Hunt List
12,917 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-41507 |
9.8 | 0.0039 | NET NO AUTH LOW CX NO UI | math-codegen generates code from mathematical expressions. Prior to version 0.4. | |
|
80
|
CVE-2026-10543 |
9.8 | 0.0039 | NET NO AUTH LOW CX NO UI | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to privil | |
|
80
|
CVE-2025-52910 |
9.8 | 0.0039 | NET NO AUTH LOW CX NO UI | An issue was discovered in the GPU in Samsung Mobile Processor and Wearable Proc | |
|
80
|
CVE-2026-61620 |
9.8 | 0.0039 | NET NO AUTH LOW CX NO UI | HoneySQL turns Clojure data structures into SQL. From 2.0.0 until 2.7.1392, appl | |
|
78
|
CVE-2026-13380 |
9.0 | 0.0039 | NET NO AUTH LOW CX NO UI | VSee Clinic 7.1.26 and VSee Clinic API 1.3.0 exposes cleartext SFTP credentials | |
|
78
|
CVE-2026-3298 |
8.8 | 0.0039 | NET NO AUTH LOW CX NO UI | The method "sock_recvfrom_into()" of "asyncio.ProacterEventLoop" (Windows only) | |
|
77
|
CVE-2026-116191 |
8.7 | 0.0039 | NET NO AUTH LOW CX NO UI | Rclone before 1.75.2 contains a path traversal vulnerability in serve webdav tha | |
|
76
|
CVE-2026-109257 |
8.2 | 0.0039 | NET NO AUTH LOW CX NO UI | FreeRDP before 3.32.0 contains a double-free vulnerability in nsc_context_initia | |
|
75
|
CVE-2026-65943 |
7.5 | 0.0039 | NET NO AUTH LOW CX NO UI | Joomla Extension - rolandd.com - Unauthenticated directory creation RO CSVI < 9. | |
|
75
|
CVE-2026-71234 |
7.5 | 0.0039 | NET NO AUTH LOW CX NO UI | Documize Community's attachment download route (domain/attachment/endpoint.go, D | |
|
75
|
CVE-2026-65551 |
7.5 | 0.0039 | NET NO AUTH LOW CX NO UI | Missing Authorization vulnerability in Soflyy Breakdance allows Exploiting Incor | |
|
75
|
CVE-2026-65504 |
7.5 | 0.0039 | NET NO AUTH LOW CX NO UI | Unauthenticated Broken Access Control in BOX NOW Delivery Croatia <= 3.3.0 versi | |
|
75
|
CVE-2026-65523 |
7.5 | 0.0039 | NET NO AUTH LOW CX NO UI | Unauthenticated Insecure Direct Object References (IDOR) in Formidable Forms Sig | |
|
75
|
CVE-2026-61984 |
7.5 | 0.0039 | NET NO AUTH LOW CX NO UI | Unauthenticated Broken Access Control in WPMobile.App <= 11.77 versions. | |
|
75
|
CVE-2026-66441 |
7.5 | 0.0039 | NET NO AUTH LOW CX NO UI | Unauthenticated Broken Access Control in MultiVendorX <= 5.0.10 versions. | |
|
75
|
CVE-2026-28567 |
7.5 | 0.0039 | NET NO AUTH LOW CX NO UI | Unauthenticated Broken Access Control in WP Sort Order <= 1.3.5 versions. | |
|
75
|
CVE-2026-28571 |
7.5 | 0.0039 | NET NO AUTH LOW CX NO UI | Unauthenticated Broken Access Control in FormyChat <= 2.15.7 versions. | |
|
75
|
CVE-2026-32472 |
7.5 | 0.0039 | NET NO AUTH LOW CX NO UI | Unauthenticated Broken Access Control in Online Contact Widget <= 1.3.0 versions | |
|
75
|
CVE-2026-32549 |
7.5 | 0.0039 | NET NO AUTH LOW CX NO UI | Unauthenticated Broken Access Control in ThumbPress < 6.5 versions. | |
|
75
|
CVE-2026-33610 |
7.5 | 0.0039 | NET NO AUTH LOW CX NO UI | A rogue primary server may cause file descriptor exhaustion and eventually a den | |
|
69
|
CVE-2026-41589 |
9.6 | 0.0039 | NET LOW CX NO UI | Wish is an SSH server with defaults and a collection of middlewares. From versio | |
|
69
|
CVE-2026-17681 |
9.6 | 0.0039 | NET NO AUTH LOW CX | Insufficient validation of untrusted input in Web Authentication in Google Chrom | |
|
69
|
CVE-2026-19166 |
9.6 | 0.0039 | NET NO AUTH LOW CX | Use after free in Web Authentication in Google Chrome prior to 151.0.7922.109 al | |
|
69
|
CVE-2026-35044 |
9.6 | 0.0039 | NET NO AUTH LOW CX | BentoML is a Python library for building online serving systems optimized for AI | |
|
68
|
CVE-2026-53793 |
9.1 | 0.0039 | NET NO AUTH NO UI | rsync before 3.5.0 contains a path confinement bypass vulnerability that allows | |
|
68
|
CVE-2024-44598 |
8.8 | 0.0039 | NET LOW CX NO UI | FNT Command 13.4.0 is vulnerable to Code Execution via the C Base Module. | |
|
68
|
CVE-2026-60424 |
9.0 | 0.0039 | NET NO AUTH NO UI | Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middlewar | |
|
68
|
CVE-2026-61201 |
9.0 | 0.0039 | NET NO AUTH NO UI | Vulnerability in the PeopleSoft Enterprise CRM Common Objects product of Oracle | |
|
68
|
CVE-2026-61223 |
9.0 | 0.0039 | NET NO AUTH NO UI | Vulnerability in the Oracle Communications Converged Application Server product | |
|
68
|
CVE-2026-61029 |
9.0 | 0.0039 | NET NO AUTH NO UI | Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware | |
|
68
|
CVE-2026-70980 |
9.0 | 0.0039 | NET NO AUTH NO UI | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience | |
|
68
|
CVE-2026-5280 |
8.8 | 0.0039 | NET NO AUTH LOW CX | Use after free in WebCodecs in Google Chrome prior to 146.0.7680.178 allowed a r | |
|
68
|
CVE-2026-5286 |
8.8 | 0.0039 | NET NO AUTH LOW CX | Use after free in Dawn in Google Chrome prior to 146.0.7680.178 allowed a remote | |
|
67
|
CVE-2026-75898 |
8.4 | 0.0039 | NET LOW CX NO UI | RAGFlow before 0.26.3 contains a server-side request forgery vulnerability in th | |
|
66
|
CVE-2026-48970 |
8.1 | 0.0039 | NET NO AUTH NO UI | Unauthenticated Broken Authentication in Really Simple SSL <= 9.5.10 versions. | |
|
66
|
CVE-2026-13779 |
8.1 | 0.0039 | NET NO AUTH NO UI | Use after free in Chromoting in Google Chrome on ChromeOS prior to 150.0.7871.47 | |
|
65
|
CVE-2026-58423 |
7.7 | 0.0039 | NET LOW CX NO UI | LFS authentication bypass via malformed SSH sub-verb allows unauthorized read ac | |
|
65
|
CVE-2026-60440 |
7.7 | 0.0039 | NET LOW CX NO UI | Vulnerability in the Service Delivery Platform product of Oracle Fusion Middlewa | |
|
65
|
CVE-2026-60548 |
7.7 | 0.0039 | NET LOW CX NO UI | Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (compo | |
|
65
|
CVE-2026-60923 |
7.7 | 0.0039 | NET LOW CX NO UI | Vulnerability in the Oracle Capacity product of Oracle E-Business Suite (compone | |
|
65
|
CVE-2026-61014 |
7.7 | 0.0039 | NET LOW CX NO UI | Vulnerability in the Oracle Inventory Management product of Oracle E-Business Su | |
|
65
|
CVE-2026-61125 |
7.7 | 0.0039 | NET LOW CX NO UI | Vulnerability in the Oracle Configure to Order product of Oracle E-Business Suit | |
|
65
|
CVE-2026-91636 |
7.7 | 0.0039 | NET LOW CX NO UI | Vulnerability in Oracle Essbase (component: Security). The supported version t | |
|
65
|
CVE-2026-91639 |
7.7 | 0.0039 | NET LOW CX NO UI | Vulnerability in Oracle Essbase (component: Security). The supported version t | |
|
64
|
CVE-2026-34026 |
7.1 | 0.0039 | NET LOW CX NO UI | Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014, contains a pa | |
|
64
|
CVE-2026-46639 |
7.1 | 0.0039 | NET LOW CX NO UI | Twig is a template language for PHP. From 3.24.0 until 3.26.0, object-destructur | |
|
64
|
CVE-2026-75830 |
7.1 | 0.0039 | NET LOW CX NO UI | grav-plugin-api (getgrav/grav-plugin-api) versions >= 1.0.0-beta.10 and <= 1.0.1 | |
|
64
|
CVE-2026-44949 |
7.0 | 0.0039 | NET LOW CX NO UI | A Rancher FleetWorkspace admission path allowed side effects to occur in the Ra | |
|
59
|
CVE-2026-27407 |
7.2 | 0.0039 | NET LOW CX NO UI | Editor Privilege Escalation in AI Engine <= 3.4.9 versions. | |
|
51
|
CVE-2026-7327 |
8.1 | 0.0039 | NET LOW CX | An improper privilege management vulnerability in the REST API document processi |