Hunt List
12,896 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2025-51511 |
9.8 | 0.0038 | NET NO AUTH LOW CX NO UI | Cadmium CMS v.0.4.9 has a background arbitrary file upload vulnerability in /adm | |
|
80
|
CVE-2026-13446 |
9.8 | 0.0038 | NET NO AUTH LOW CX NO UI | IBM Langflow OSS 1.0.0 through 1.10.1 contains hard-coded credentials, such as a | |
|
80
|
CVE-2026-10094 |
9.8 | 0.0038 | NET NO AUTH LOW CX NO UI | A Path Traversal vulnerability affecting SOLIDWORKS Visualize from SOLIDWORKS De | |
|
80
|
CVE-2026-8364 |
9.8 | 0.0038 | NET NO AUTH LOW CX NO UI | Gladinet Triofox Cloud Server Agent Access Service (GladServerAgentService.exe) | |
|
78
|
CVE-2026-55202 |
8.8 | 0.0038 | NET NO AUTH LOW CX NO UI | Tinyproxy through 1.11.3, fixed in commit 09312a1, fails to properly validate th | |
|
78
|
CVE-2026-54466 |
9.2 | 0.0038 | NET NO AUTH LOW CX NO UI | websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0. | |
|
78
|
CVE-2026-114493 |
9.2 | 0.0038 | NET NO AUTH LOW CX NO UI | LocalAI v4.6.0 through v4.11.0 contains a server-side request forgery vulnerabil | |
|
78
|
CVE-2026-40010 |
9.1 | 0.0038 | NET NO AUTH LOW CX NO UI | Missing invocation of Servlet http web request method changeSessionId after sess | |
|
77
|
CVE-2026-62230 |
8.7 | 0.0038 | NET NO AUTH LOW CX NO UI | Grav before 2.0.4 ships a default .htaccess (and reference webserver-configs/hta | |
|
77
|
CVE-2026-61654 |
8.3 | 0.0038 | NET NO AUTH LOW CX NO UI | Lightdash is an open source business intelligence platform. In affected versions | |
|
77
|
CVE-2026-55950 |
8.7 | 0.0038 | NET NO AUTH LOW CX NO UI | Time-of-check Time-of-use (TOCTOU) race condition vulnerability in Erlang/OTP ss | |
|
76
|
CVE-2026-57030 |
8.2 | 0.0038 | NET NO AUTH LOW CX NO UI | A Concurrent Execution using Shared Resource with Improper Synchronization ('Rac | |
|
76
|
CVE-2026-60255 |
8.2 | 0.0038 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (compo | |
|
76
|
CVE-2026-60592 |
8.2 | 0.0038 | NET NO AUTH LOW CX NO UI | Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: | |
|
76
|
CVE-2026-70993 |
8.2 | 0.0038 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience | |
|
75
|
CVE-2026-33593 |
7.5 | 0.0038 | NET NO AUTH LOW CX NO UI | A client can trigger a divide by zero error leading to crash by sending a crafte | |
|
75
|
CVE-2026-13463 |
7.5 | 0.0038 | NET NO AUTH LOW CX NO UI | IBM Cloud Pak System 2.3.5.0 could allow a local attacker to obtain sensitive in | |
|
75
|
CVE-2026-28860 |
7.5 | 0.0038 | NET NO AUTH LOW CX NO UI | The issue was addressed with improved input validation. This issue is fixed in i | |
|
75
|
CVE-2026-104895 |
7.5 | 0.0038 | NET NO AUTH LOW CX NO UI | The asynchronous Smile parser (NonBlockingByteArrayParser) uses a raw-binary len | |
|
75
|
CVE-2026-44335 |
7.7 | 0.0038 | NET NO AUTH LOW CX NO UI | PraisonAI is a multi-agent teams system. Prior to version 1.6.32, the URL checki | |
|
69
|
CVE-2026-45035 |
9.4 | 0.0038 | NET NO AUTH LOW CX | Tabby (formerly Terminus) is a highly configurable terminal emulator. Prior to 1 | |
|
69
|
CVE-2026-13859 |
9.6 | 0.0038 | NET NO AUTH LOW CX | Inappropriate implementation in ANGLE in Google Chrome prior to 150.0.7871.47 al | |
|
69
|
CVE-2026-40157 |
9.4 | 0.0038 | NET NO AUTH LOW CX | PraisonAI is a multi-agent teams system. Prior to 4.5.128, cmd_unpack in the rec | |
|
69
|
CVE-2026-112197 |
9.4 | 0.0038 | NET LOW CX NO UI | Vulnerability due to a lack of authentication in critical functions of the NoviG | |
|
68
|
CVE-2026-51905 |
8.8 | 0.0038 | NET LOW CX NO UI | TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in | |
|
68
|
CVE-2026-40352 |
8.8 | 0.0038 | NET LOW CX NO UI | FastGPT is an AI Agent building platform. In versions prior to 4.14.9.5, the pas | |
|
68
|
CVE-2026-13125 |
8.8 | 0.0038 | NET NO AUTH LOW CX | GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Playe | |
|
68
|
CVE-2026-113081 |
8.8 | 0.0038 | NET NO AUTH LOW CX | Use after free in Compositing in Google Chrome prior to 156.0.8078.47 allowed a | |
|
68
|
CVE-2026-113087 |
8.8 | 0.0038 | NET NO AUTH LOW CX | Use after free in Actor in Google Chrome prior to 156.0.8078.47 allowed a remote | |
|
68
|
CVE-2026-113231 |
8.8 | 0.0038 | NET NO AUTH LOW CX | Improper input validation in Extensions in Google Chrome prior to 156.0.8078.47 | |
|
68
|
CVE-2026-116838 |
8.8 | 0.0038 | NET NO AUTH LOW CX | A malicious actor who lures an authenticated user to a malicious page could expl | |
|
67
|
CVE-2026-61996 |
8.5 | 0.0038 | NET LOW CX NO UI | Subscriber SQL Injection in MLS On The Fly <= 1.8.1.5 versions. | |
|
67
|
CVE-2026-60582 |
8.3 | 0.0038 | NET LOW CX NO UI | Vulnerability in the Oracle Enterprise Command Center Framework product of Oracl | |
|
67
|
CVE-2026-63161 |
8.6 | 0.0038 | NET NO AUTH LOW CX | Omnispace Agora Project before 26.10.0 contains a session fixation vulnerability | |
|
66
|
CVE-2026-24899 |
8.2 | 0.0038 | NET NO AUTH NO UI | Fleet is open source device management software. Prior to version 4.82.0, a vuln | |
|
66
|
CVE-2026-35194 |
8.1 | 0.0038 | NET LOW CX NO UI | Code injection in SQL code generation in Apache Flink 1.15.0 through 1.20.x and | |
|
66
|
CVE-2026-50138 |
8.1 | 0.0038 | NET LOW CX NO UI | goshs is a SimpleHTTPServer written in Go. Prior to version 2.1.0, when `goshs` | |
|
66
|
CVE-2026-60680 |
8.1 | 0.0038 | NET LOW CX NO UI | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware | |
|
66
|
CVE-2026-60779 |
8.1 | 0.0038 | NET LOW CX NO UI | Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (compo | |
|
66
|
CVE-2026-70959 |
8.1 | 0.0038 | NET LOW CX NO UI | Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle | |
|
66
|
CVE-2026-71042 |
8.1 | 0.0038 | NET LOW CX NO UI | Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: | |
|
65
|
CVE-2026-40348 |
7.7 | 0.0038 | NET LOW CX NO UI | Movary is a self hosted web app to track and rate a user's watched movies. Prior | |
|
64
|
CVE-2026-113912 |
7.1 | 0.0038 | NET NO AUTH LOW CX | An out-of-bounds access issue was addressed with improved bounds checking. This | |
|
64
|
CVE-2026-47150 |
7.1 | 0.0038 | NET LOW CX NO UI | In EmberZNet v9.0.2 and earlier, malformed IAS Zone enrollment messages can trig | |
|
64
|
CVE-2026-47151 |
7.1 | 0.0038 | NET LOW CX NO UI | In EmberZNet v9.0.2 and earlier, malformed ClearWeekdaySchedule messages can tri | |
|
64
|
CVE-2026-87307 |
7.1 | 0.0038 | NET LOW CX NO UI | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards | |
|
62
|
CVE-2026-91211 |
8.7 | 0.0038 | NET LOW CX NO UI | Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion | |
|
62
|
CVE-2026-44224 |
8.6 | 0.0038 | NET LOW CX NO UI | Wiki.js is an open source wiki app built on Node.js. Prior to 2.5.313, the users | |
|
62
|
CVE-2023-7357 |
8.6 | 0.0038 | NET LOW CX NO UI | A remote code execution (RCE) vulnerability was identified in the FlexNet Publis | |
|
59
|
CVE-2026-118984 |
7.0 | 0.0038 | NET LOW CX NO UI | OmniRoute 3.8.0 before 3.8.52 contains an unverified password change vulnerabili |