Hunt List
12,927 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-68426 |
9.8 | 0.0040 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: xfrm: fix s | |
|
80
|
CVE-2026-63377 |
9.8 | 0.0040 | NET NO AUTH LOW CX NO UI | TAKO AI Agent for Okta is a local-first AI agent that helps Okta administrators | |
|
80
|
CVE-2026-12341 |
9.8 | 0.0040 | NET NO AUTH LOW CX NO UI | This vulnerability impacts all versions of IdentityIQ and allows an unauthentica | |
|
80
|
CVE-2026-62003 |
9.8 | 0.0040 | NET NO AUTH LOW CX NO UI | Unauthenticated PHP Object Injection in Mission <= 1.22 versions. | |
|
80
|
CVE-2026-62004 |
9.8 | 0.0040 | NET NO AUTH LOW CX NO UI | Unauthenticated PHP Object Injection in Motorix <= 1.11 versions. | |
|
80
|
CVE-2026-62005 |
9.8 | 0.0040 | NET NO AUTH LOW CX NO UI | Unauthenticated PHP Object Injection in Muzicon <= 1.15 versions. | |
|
80
|
CVE-2026-62010 |
9.8 | 0.0040 | NET NO AUTH LOW CX NO UI | Unauthenticated PHP Object Injection in Avventure <= 1.1.12 versions. | |
|
78
|
CVE-2016-20101 |
9.2 | 0.0040 | NET NO AUTH LOW CX NO UI | Issuu Panel plugin for WordPress before 1.6.6 contains a PHP file inclusion vuln | |
|
78
|
CVE-2026-64940 |
8.8 | 0.0040 | NET NO AUTH LOW CX NO UI | Tegalog -Fumy Otegaru Memo Logger- provided by Nishishi Factory contains a vulne | |
|
78
|
CVE-2026-7182 |
9.2 | 0.0040 | NET NO AUTH LOW CX NO UI | Diagram's export module is vulnerable to Path Traversal in src attribute due to | |
|
78
|
CVE-2026-48989 |
8.9 | 0.0040 | NET NO AUTH LOW CX NO UI | Windows-MCP is an open-source project that integrates AI agents with Windows. In | |
|
77
|
CVE-2026-91353 |
8.6 | 0.0040 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middl | |
|
77
|
CVE-2026-102558 |
8.6 | 0.0040 | NET NO AUTH LOW CX NO UI | A flaw was found in libsoup. When max-incoming-payload-size is unlimited (0), So | |
|
75
|
CVE-2026-42893 |
7.5 | 0.0040 | NET NO AUTH LOW CX NO UI | Improper neutralization of special elements used in a command ('command injectio | |
|
75
|
CVE-2026-59203 |
7.5 | 0.0040 | NET NO AUTH LOW CX NO UI | Pillow is a Python imaging library. From 12.0.0 through 12.2.0, Pillow's EPS par | |
|
75
|
CVE-2026-91325 |
7.5 | 0.0040 | NET NO AUTH LOW CX NO UI | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards | |
|
75
|
CVE-2026-91448 |
7.5 | 0.0040 | NET NO AUTH LOW CX NO UI | Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (compone | |
|
75
|
CVE-2026-28944 |
7.5 | 0.0040 | NET NO AUTH LOW CX NO UI | The issue was addressed with improved memory handling. This issue is fixed in Sa | |
|
75
|
CVE-2026-28962 |
7.5 | 0.0040 | NET NO AUTH LOW CX NO UI | This issue was addressed with improved access restrictions. This issue is fixed | |
|
75
|
CVE-2026-8609 |
7.5 | 0.0040 | NET NO AUTH LOW CX NO UI | An unauthenticated attacker can repeatedly call Grafana's OAuth login route with | |
|
75
|
CVE-2026-72754 |
7.5 | 0.0040 | NET NO AUTH LOW CX NO UI | When Routinator encounters a CRL with many entries, it may hang or run out of me | |
|
75
|
CVE-2026-72756 |
7.5 | 0.0040 | NET NO AUTH LOW CX NO UI | Routinator exits when an rsync URI for a file obtained over RRDP contains a path | |
|
75
|
CVE-2026-72758 |
7.5 | 0.0040 | NET NO AUTH LOW CX NO UI | When parsing an AS range in Routinator, if the maximum value of the range is sma | |
|
69
|
CVE-2026-33102 |
9.3 | 0.0040 | NET NO AUTH LOW CX | Url redirection to untrusted site ('open redirect') in M365 Copilot allows an un | |
|
68
|
CVE-2026-15125 |
8.8 | 0.0040 | NET NO AUTH LOW CX | Inappropriate implementation in Forms in Google Chrome prior to 150.0.7871.115 a | |
|
68
|
CVE-2026-17751 |
8.8 | 0.0040 | NET NO AUTH LOW CX | Inappropriate implementation in AdFilter in Google Chrome prior to 151.0.7922.72 | |
|
68
|
CVE-2026-17956 |
8.8 | 0.0040 | NET NO AUTH LOW CX | Inappropriate implementation in Scheduling in Google Chrome prior to 151.0.7922. | |
|
68
|
CVE-2026-17969 |
8.8 | 0.0040 | NET NO AUTH LOW CX | Inappropriate implementation in Passwords in Google Chrome prior to 151.0.7922.7 | |
|
68
|
CVE-2026-98451 |
8.8 | 0.0040 | NET NO AUTH LOW CX | In the Linux kernel, the following vulnerability has been resolved: smb: client | |
|
68
|
CVE-2026-8509 |
8.8 | 0.0040 | NET NO AUTH LOW CX | Heap buffer overflow in WebML in Google Chrome prior to 148.0.7778.168 allowed a | |
|
67
|
CVE-2026-55738 |
8.7 | 0.0040 | NET NO AUTH LOW CX | A stack-based buffer overflow exists in the raw_to_header function in src/microt | |
|
67
|
CVE-2026-119979 |
8.7 | 0.0040 | NET NO AUTH LOW CX | LM Studio before 0.4.22+1 contains a path traversal vulnerability in the model d | |
|
67
|
CVE-2026-61708 |
8.5 | 0.0040 | NET LOW CX NO UI | SOCFortress CoPilot focuses on providing a single pane of glass for all your sec | |
|
67
|
CVE-2026-12070 |
8.4 | 0.0040 | NET LOW CX NO UI | Tobit Laboratories AG TeamDavid's Webbox is vulnerable to an arbitrary file del | |
|
67
|
CVE-2026-111638 |
8.3 | 0.0040 | NET LOW CX NO UI | sshportal through 1.19.5 contains a missing authorization vulnerability in the m | |
|
66
|
CVE-2026-13819 |
8.1 | 0.0040 | NET NO AUTH LOW CX | Out of bounds read in ANGLE in Google Chrome on Mac prior to 150.0.7871.47 allow | |
|
66
|
CVE-2026-33437 |
8.1 | 0.0040 | NET NO AUTH LOW CX | Stirling-PDF is a locally hosted web application that facilitates various operat | |
|
66
|
CVE-2026-56670 |
8.2 | 0.0040 | NET NO AUTH LOW CX | ComfyUI is a modular diffusion model GUI, api and backend with a graph/nodes int | |
|
66
|
CVE-2026-56672 |
8.2 | 0.0040 | NET NO AUTH LOW CX | ComfyUI is a node-based diffusion model GUI, API, and backend. Prior to 0.28.0, | |
|
64
|
CVE-2026-42212 |
7.1 | 0.0040 | NET NO AUTH LOW CX | SolidCAM-GPPL-IDE is an unofficial, independently developed extension, Postproce | |
|
64
|
CVE-2026-18737 |
7.1 | 0.0040 | NET LOW CX NO UI | Shlink contains a blind SQL injection vulnerability that allows any authenticate | |
|
64
|
CVE-2026-18688 |
7.1 | 0.0040 | NET LOW CX NO UI | An issue in MongoDB Server's aggregation framework could allow an authenticated | |
|
64
|
CVE-2026-18694 |
7.1 | 0.0040 | NET LOW CX NO UI | An issue in MongoDB Server's geospatial query processing could allow an authenti | |
|
64
|
CVE-2026-85170 |
7.1 | 0.0040 | NET LOW CX NO UI | n8n versions before 1.123.73, 2.35.4, and 2.36.2 pass message content in the Gma | |
|
64
|
CVE-2026-40195 |
7.1 | 0.0040 | NET LOW CX NO UI | Incus is a system container and virtual machine manager. In versions before 7.0. | |
|
64
|
CVE-2026-54321 |
7.0 | 0.0040 | NET NO AUTH NO UI | Daytona is a secure and elastic infrastructure runtime for AI-generated code exe | |
|
62
|
CVE-2026-66397 |
8.6 | 0.0040 | NET LOW CX NO UI | phpMyFAQ before 4.1.6 fails to validate path traversal sequences in the existing | |
|
59
|
CVE-2026-76307 |
7.2 | 0.0040 | NET LOW CX NO UI | In Splunk SOAR versions below 8.7.0, a user that holds a role with the Users and | |
|
58
|
CVE-2026-50737 |
9.0 | 0.0040 | NET NO UI | When applying replicated changes for a row that is missing one or more columns, | |
|
52
|
CVE-2026-46788 |
8.4 | 0.0040 | NET LOW CX | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middlewar |