Hunt List
12,907 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
79
|
CVE-2026-47174 |
9.5 | 0.0039 | NET NO AUTH LOW CX NO UI | In Duck Site before version 1.0.1, the repository has a deploy workflow that run | |
|
77
|
CVE-2026-8686 |
8.7 | 0.0039 | NET NO AUTH LOW CX NO UI | Missing bounds validation in the MQTT v5.0 property parser in coreMQTT before 5. | |
|
77
|
CVE-2026-47189 |
8.3 | 0.0039 | NET NO AUTH LOW CX NO UI | Quest Bot is an opensource modern Discord Bot built for moderation, utilities an | |
|
77
|
CVE-2026-58227 |
8.7 | 0.0039 | NET NO AUTH LOW CX NO UI | The Erlang/OTP ssl application does not detect cycles when reconstructing an inc | |
|
77
|
CVE-2026-116543 |
8.7 | 0.0039 | NET NO AUTH LOW CX NO UI | Open5GS 1.3.0 through 2.8.0 contains a heap out-of-bounds write vulnerability in | |
|
76
|
CVE-2026-79885 |
8.2 | 0.0039 | NET NO AUTH LOW CX NO UI | An unauthenticated file write vulnerability exists in the PAPI protocol in AOS-8 | |
|
76
|
CVE-2023-53711 |
8.2 | 0.0039 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: NFS: Fix a | |
|
76
|
CVE-2026-42353 |
8.2 | 0.0039 | NET NO AUTH LOW CX NO UI | i18next-http-middleware is a middleware to be used with Node.js web frameworks l | |
|
75
|
CVE-2026-33382 |
7.5 | 0.0039 | NET NO AUTH LOW CX NO UI | Several Grafana API endpoints, some of them unauthenticated, do not limit the si | |
|
75
|
CVE-2026-83404 |
7.5 | 0.0039 | NET NO AUTH LOW CX NO UI | Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connec | |
|
75
|
CVE-2026-111181 |
7.5 | 0.0039 | NET NO AUTH LOW CX NO UI | body-parser is body parsing middleware for Node.js and Express. In versions befo | |
|
75
|
CVE-2026-40180 |
7.7 | 0.0039 | NET NO AUTH LOW CX NO UI | Quarkus OpenAPI Generator is Quarkus' extensions for generation of Rest Clients | |
|
70
|
CVE-2026-60377 |
9.9 | 0.0039 | NET LOW CX NO UI | Vulnerability in the Service Delivery Platform product of Oracle Fusion Middlewa | |
|
70
|
CVE-2026-60422 |
9.9 | 0.0039 | NET LOW CX NO UI | Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middlewar | |
|
70
|
CVE-2026-60719 |
9.9 | 0.0039 | NET LOW CX NO UI | Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: | |
|
69
|
CVE-2026-45374 |
9.6 | 0.0039 | NET NO AUTH LOW CX | CodeWhale is a DeepSeek + MiMo coding agent in terminal. Prior to 0.8.26, the ta | |
|
68
|
CVE-2026-113253 |
8.8 | 0.0039 | NET NO AUTH LOW CX | Use after free in Canvas in Google Chrome prior to 156.0.8078.47 allowed a remot | |
|
68
|
CVE-2026-118329 |
8.8 | 0.0039 | NET NO AUTH LOW CX | Improper input validation in ANGLE in Google Chrome on on Mac prior to 156.0.807 | |
|
68
|
CVE-2026-44792 |
8.9 | 0.0039 | NET NO AUTH LOW CX | n8n is an open source workflow automation platform. Prior to 1.123.43, 2.22.1, a | |
|
68
|
CVE-2026-110018 |
8.8 | 0.0039 | NET LOW CX NO UI | The aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Buil | |
|
67
|
CVE-2026-65709 |
8.7 | 0.0039 | NET LOW CX NO UI | sysPass through version 3.2.11 contains a missing object-level authorization vul | |
|
67
|
CVE-2026-67331 |
8.7 | 0.0039 | NET LOW CX NO UI | better-auth SCIM versions from 1.5.0 before 1.7.0-beta.4 fail to bind non-organi | |
|
67
|
CVE-2026-102800 |
8.7 | 0.0039 | NET NO AUTH LOW CX | Joomla Extension - dj-extensions.com - Unauthenticated Stored XSS in DJ-HelpfulA | |
|
67
|
CVE-2026-73079 |
8.5 | 0.0039 | NET LOW CX NO UI | Sub2API is an AI API gateway platform designed to distribute and manage API quot | |
|
67
|
CVE-2026-68558 |
8.5 | 0.0039 | NET LOW CX NO UI | Wekan is open source kanban built with Meteor. From 8.36 until 9.74, the outgoin | |
|
67
|
CVE-2026-34914 |
8.3 | 0.0039 | NET LOW CX NO UI | A missing sanitisation of user input in the zone-include.php script of Revive Ad | |
|
67
|
CVE-2026-12473 |
8.3 | 0.0039 | NET NO AUTH LOW CX | Two data sources (DICOMWebProxy and DICOMJSON) shipped in the default configurat | |
|
67
|
CVE-2026-47415 |
8.3 | 0.0039 | NET LOW CX NO UI | PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams sys | |
|
67
|
CVE-2026-59855 |
8.6 | 0.0039 | NET NO AUTH LOW CX | SiYuan is an open-source personal knowledge management system. Prior to 3.7.1, A | |
|
67
|
CVE-2026-48113 |
8.5 | 0.0039 | NET LOW CX NO UI | Chisel is a TCP/UDP tunnel, transported over HTTP and secured via SSH. In versio | |
|
67
|
CVE-2026-35262 |
8.3 | 0.0039 | NET LOW CX NO UI | Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware | |
|
67
|
CVE-2026-60788 |
8.3 | 0.0039 | NET LOW CX NO UI | Vulnerability in the Oracle Sales Offline product of Oracle E-Business Suite (co | |
|
67
|
CVE-2026-62473 |
8.3 | 0.0039 | NET LOW CX NO UI | Vulnerability in the Oracle Installed Base product of Oracle E-Business Suite (c | |
|
67
|
CVE-2026-61305 |
8.3 | 0.0039 | NET LOW CX NO UI | Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: | |
|
67
|
CVE-2026-70770 |
8.3 | 0.0039 | NET LOW CX NO UI | Vulnerability in the Oracle Warehouse Management product of Oracle E-Business Su | |
|
67
|
CVE-2026-71095 |
8.3 | 0.0039 | NET LOW CX NO UI | Vulnerability in the Oracle Business Intelligence Enterprise Edition product of | |
|
66
|
CVE-2026-54690 |
8.2 | 0.0039 | NET NO AUTH LOW CX | datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, a | |
|
66
|
CVE-2026-118665 |
8.2 | 0.0039 | NET NO AUTH NO UI | GraphQL Tools provides utilities for building, stitching, and mocking GraphQL sc | |
|
66
|
CVE-2026-22555 |
8.1 | 0.0039 | NET LOW CX NO UI | Gitea versions before 1.26.0 allow API users to fork a repository into an organi | |
|
66
|
CVE-2026-98454 |
8.1 | 0.0039 | NET NO AUTH LOW CX | In the Linux kernel, the following vulnerability has been resolved: smb: client | |
|
65
|
CVE-2026-52870 |
7.6 | 0.0039 | NET LOW CX NO UI | The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model | |
|
65
|
CVE-2026-48084 |
7.4 | 0.0039 | NET NO AUTH NO UI | OpenReception's appointment booking software provides an end-to-end encrypted ap | |
|
64
|
CVE-2025-40831 |
7.1 | 0.0039 | NET LOW CX NO UI | A vulnerability has been identified in SINEC Security Monitor (All versions < V4 | |
|
64
|
CVE-2026-119645 |
7.1 | 0.0039 | NET LOW CX NO UI | ZenTao PMS through 22.6 contains a missing authorization vulnerability in doc::a | |
|
62
|
CVE-2026-56414 |
8.6 | 0.0039 | NET LOW CX NO UI | A vulnerability exists in H.View IP cameras certificate-related upload interface | |
|
59
|
CVE-2026-21653 |
7.2 | 0.0039 | NET LOW CX NO UI | Victor SSRF vulnerability in Johnson Controls CCure 9000 and victor application | |
|
58
|
CVE-2026-34560 |
9.0 | 0.0039 | NET LOW CX | CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, mo | |
|
58
|
CVE-2026-45746 |
9.0 | 0.0039 | NET LOW CX | Termix is a web-based server management platform with SSH terminal, tunneling, a | |
|
57
|
CVE-2026-13841 |
8.3 | 0.0039 | NET NO AUTH | Integer overflow in Skia in Google Chrome prior to 150.0.7871.47 allowed a remot | |
|
55
|
CVE-2026-41180 |
7.5 | 0.0039 | NET NO AUTH | PsiTransfer is an open source, self-hosted file sharing solution. Prior to versi |