Hunt List
12,891 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-10534 |
9.8 | 0.0038 | NET NO AUTH LOW CX NO UI | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to buffer | |
|
80
|
CVE-2026-39529 |
9.8 | 0.0037 | NET NO AUTH LOW CX NO UI | Unauthenticated PHP Object Injection in Elementra <= 1.0.9 versions. | |
|
80
|
CVE-2026-40725 |
9.8 | 0.0037 | NET NO AUTH LOW CX NO UI | Unauthenticated PHP Object Injection in WooCommerce Product Filters < 2.0.6 vers | |
|
80
|
CVE-2026-49075 |
9.8 | 0.0037 | NET NO AUTH LOW CX NO UI | Contributor PHP Object Injection in JetEngine <= 3.8.9.1 versions. | |
|
80
|
CVE-2026-49107 |
9.8 | 0.0037 | NET NO AUTH LOW CX NO UI | Unauthenticated PHP Object Injection in Thrive Apprentice < 10.8.10.2 versions. | |
|
80
|
CVE-2026-54194 |
9.8 | 0.0037 | NET NO AUTH LOW CX NO UI | Contributor PHP Object Injection in Fusion Builder <= 3.15.4 versions. | |
|
79
|
CVE-2026-61729 |
9.4 | 0.0038 | NET NO AUTH LOW CX NO UI | SOCFortress CoPilot focuses on providing a single pane of glass for all your sec | |
|
79
|
CVE-2026-44666 |
9.3 | 0.0038 | NET NO AUTH LOW CX NO UI | HRConvert2 is a self-hosted, drag-and-drop & nosql file conversion server & shar | |
|
78
|
CVE-2026-40583 |
8.8 | 0.0038 | NET NO AUTH LOW CX NO UI | UltraDAG is a minimal DAG-BFT blockchain in Rust. In version 0.1, a non-council | |
|
78
|
CVE-2026-91403 |
9.1 | 0.0037 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Ente | |
|
77
|
CVE-2026-32847 |
8.7 | 0.0038 | NET NO AUTH LOW CX NO UI | DeepCode through commit c991dc2 contains a path traversal vulnerability in the S | |
|
77
|
CVE-2026-72779 |
8.7 | 0.0038 | NET NO AUTH LOW CX NO UI | Craft CMS 5.0.0-RC1 before 5.10.6 and 4.0.0-RC1 before 4.18.2 contain an arbitra | |
|
77
|
CVE-2026-10848 |
8.6 | 0.0038 | NET NO AUTH LOW CX NO UI | The OCPP 1.6 client in subsys/net/lib/ocpp parsed inbound WAMP RPC frames in par | |
|
77
|
CVE-2026-92450 |
8.7 | 0.0037 | NET NO AUTH LOW CX NO UI | The authentication framework used by affected Kiloview E3 NDI encoder firmware s | |
|
77
|
CVE-2026-56677 |
8.6 | 0.0037 | NET NO AUTH LOW CX NO UI | 9Router is an AI router & token saver. In 0.5.4 and earlier, the POST /api/auth/ | |
|
75
|
CVE-2026-39480 |
7.5 | 0.0038 | NET NO AUTH LOW CX NO UI | Unauthenticated Sensitive Data Exposure in Backup Migration <= 2.1.1 versions. | |
|
69
|
CVE-2026-14423 |
9.6 | 0.0038 | NET NO AUTH LOW CX | Type Confusion in Tint in Google Chrome prior to 150.0.7871.46 allowed a remote | |
|
69
|
CVE-2026-87347 |
9.6 | 0.0038 | NET LOW CX NO UI | Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (com | |
|
69
|
CVE-2026-101420 |
9.6 | 0.0037 | NET LOW CX NO UI | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleS | |
|
68
|
CVE-2026-9201 |
8.8 | 0.0037 | NET LOW CX NO UI | IBM Langflow OSS 1.0.0 through 1.10.3 could allow an authenticated attacker to e | |
|
68
|
CVE-2026-56840 |
8.8 | 0.0037 | NET NO AUTH LOW CX | PraisonAI is a multi-agent teams system. From version 4.5.2 to before version 4. | |
|
67
|
CVE-2026-41200 |
8.5 | 0.0038 | NET NO AUTH LOW CX | STIG Manager is an API and web client for managing Security Technical Implement | |
|
67
|
CVE-2026-71057 |
8.5 | 0.0038 | NET LOW CX NO UI | Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: | |
|
66
|
CVE-2026-46849 |
8.1 | 0.0037 | NET LOW CX NO UI | Vulnerability in the PeopleSoft Enterprise CS Student Financials product of Orac | |
|
65
|
CVE-2026-55516 |
7.7 | 0.0038 | NET LOW CX NO UI | Snipe-IT is an IT asset/license management system. Prior to 8.6.2, PATCH or PUT | |
|
65
|
CVE-2026-33235 |
7.7 | 0.0037 | NET LOW CX NO UI | AutoGPT is a workflow automation platform for creating, deploying, and managing | |
|
65
|
CVE-2026-62189 |
7.6 | 0.0037 | NET LOW CX NO UI | OpenClaw versions before 2026.6.9 contain a symlink following vulnerability in t | |
|
64
|
CVE-2026-56402 |
7.1 | 0.0038 | NET LOW CX NO UI | NanoClaw before 2.1.17 contains a privilege escalation vulnerability in the hand | |
|
64
|
CVE-2026-60647 |
7.1 | 0.0038 | NET LOW CX NO UI | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middlewar | |
|
64
|
CVE-2026-60752 |
7.1 | 0.0038 | NET LOW CX NO UI | Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (compo | |
|
64
|
CVE-2026-61259 |
7.1 | 0.0038 | NET LOW CX NO UI | Vulnerability in the Oracle Hyperion Calculation Manager product of Oracle Hyper | |
|
64
|
CVE-2026-70680 |
7.1 | 0.0038 | NET LOW CX NO UI | Vulnerability in the Oracle Applications DBA product of Oracle E-Business Suite | |
|
64
|
CVE-2026-70933 |
7.1 | 0.0038 | NET LOW CX NO UI | Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hype | |
|
64
|
CVE-2026-70934 |
7.1 | 0.0038 | NET LOW CX NO UI | Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hype | |
|
64
|
CVE-2026-70935 |
7.1 | 0.0038 | NET LOW CX NO UI | Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hype | |
|
64
|
CVE-2026-71003 |
7.1 | 0.0038 | NET LOW CX NO UI | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience | |
|
64
|
CVE-2026-71012 |
7.1 | 0.0038 | NET LOW CX NO UI | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience | |
|
64
|
CVE-2026-63572 |
7.1 | 0.0038 | NET NO AUTH LOW CX | Allocation of resources without limits in PKCS#12 keystore loading (Pkcs12Store. | |
|
64
|
CVE-2026-63578 |
7.1 | 0.0038 | NET NO AUTH LOW CX | Allocation of resources without limits in password-based private-key decryption | |
|
64
|
CVE-2026-109299 |
7.1 | 0.0038 | NET LOW CX NO UI | Open WebUI from 0.9.0 before 0.11.4 contains a denial of service vulnerability t | |
|
57
|
CVE-2026-93639 |
8.7 | 0.0037 | NET LOW CX | A missing authorization vulnerability in Zimbra Collaboration Suite (ZCS) allows | |
|
55
|
CVE-2026-107161 |
7.5 | 0.0038 | NET NO AUTH | A heap-based buffer overflow flaw was found in Cyrus SASL. The add_to_challenge( | |
|
51
|
CVE-2026-46923 |
8.0 | 0.0037 | NET NO UI | Vulnerability in the Oracle Public Sector Financials (International) product of | |
|
51
|
CVE-2026-60790 |
8.0 | 0.0037 | NET NO UI | Vulnerability in the Oracle Sales Offline product of Oracle E-Business Suite (co | |
|
51
|
CVE-2026-61009 |
8.0 | 0.0037 | NET NO UI | Vulnerability in the Oracle Process Manufacturing Logistics product of Oracle E- | |
|
51
|
CVE-2026-61224 |
8.0 | 0.0037 | NET NO UI | Vulnerability in the Oracle Communications Converged Application Server product | |
|
51
|
CVE-2026-60998 |
8.0 | 0.0037 | NET NO UI | Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion | |
|
51
|
CVE-2026-70690 |
8.0 | 0.0037 | NET NO UI | Vulnerability in the Oracle HRMS (US) product of Oracle E-Business Suite (compon | |
|
51
|
CVE-2026-70802 |
8.0 | 0.0037 | NET NO UI | Vulnerability in the Oracle Public Sector Human Resources product of Oracle E-Bu | |
|
51
|
CVE-2026-71122 |
8.0 | 0.0037 | NET NO UI | Vulnerability in the Oracle Business Intelligence Enterprise Edition product of |