Hunt List
12,881 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-89111 |
10.0 | 0.0037 | NET NO AUTH LOW CX NO UI | The SAP Cloud SDK for Python contains an OAuth2 SSRF vulnerability affecting mul | |
|
80
|
CVE-2026-61239 |
9.9 | 0.0037 | NET NO AUTH LOW CX NO UI | Vulnerability in the PeopleSoft Enterprise FIN Common Objects Argentina product | |
|
80
|
CVE-2026-60916 |
9.9 | 0.0037 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusio | |
|
80
|
CVE-2026-73930 |
9.9 | 0.0037 | NET NO AUTH LOW CX NO UI | Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imp | |
|
79
|
CVE-2026-22340 |
9.3 | 0.0037 | NET NO AUTH LOW CX NO UI | Unauthenticated SQL Injection in WPJobster <= 6.3.5 versions. | |
|
79
|
CVE-2026-39438 |
9.3 | 0.0037 | NET NO AUTH LOW CX NO UI | Unauthenticated SQL Injection in ListingPro <= 2.9.10 versions. | |
|
79
|
CVE-2026-39596 |
9.3 | 0.0037 | NET NO AUTH LOW CX NO UI | Unauthenticated SQL Injection in Blocksy Companion Pro < 2.1.29 versions. | |
|
79
|
CVE-2026-49076 |
9.3 | 0.0037 | NET NO AUTH LOW CX NO UI | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti | |
|
79
|
CVE-2026-39746 |
9.3 | 0.0037 | NET NO AUTH LOW CX NO UI | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti | |
|
79
|
CVE-2026-32557 |
9.3 | 0.0037 | NET NO AUTH LOW CX NO UI | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti | |
|
79
|
CVE-2026-119597 |
9.3 | 0.0037 | NET NO AUTH LOW CX NO UI | OpenDeepWiki through 2.0.6 contains a hard-coded JWT signing key vulnerability t | |
|
77
|
CVE-2026-26062 |
8.7 | 0.0037 | NET NO AUTH LOW CX NO UI | Fleet is open source device management software. Prior to version 4.81.0, Fleet | |
|
77
|
CVE-2026-56082 |
8.7 | 0.0037 | NET NO AUTH LOW CX NO UI | Capgo (Cap-go/capgo) before 12.128.2 contains an improper access control vulnera | |
|
77
|
CVE-2026-54365 |
8.7 | 0.0037 | NET NO AUTH LOW CX NO UI | CentreStack before 17.3 contains an unauthenticated deserialization vulnerabilit | |
|
77
|
CVE-2026-111075 |
8.7 | 0.0037 | NET NO AUTH LOW CX NO UI | In Eclipse OpenJ9 versions prior to 0.63.0, the JITServer component fails to per | |
|
77
|
CVE-2026-55604 |
8.6 | 0.0037 | NET NO AUTH LOW CX NO UI | DeepSeek MCP Server is an MCP server for DeepSeek V4. Starting in version 1.4.2 | |
|
76
|
CVE-2026-14504 |
8.2 | 0.0037 | NET NO AUTH LOW CX NO UI | An authorization bypass in Nexus Repository 3's component upload API allowed a u | |
|
76
|
CVE-2026-101690 |
8.2 | 0.0037 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle E-Business Suite Integrated SOA Gateway product of O | |
|
76
|
CVE-2026-118260 |
8.2 | 0.0037 | NET NO AUTH LOW CX NO UI | Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in BodyDump m | |
|
76
|
CVE-2026-118261 |
8.2 | 0.0037 | NET NO AUTH LOW CX NO UI | Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in Decompress | |
|
75
|
CVE-2025-60549 |
7.5 | 0.0037 | NET NO AUTH LOW CX NO UI | D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the | |
|
75
|
CVE-2025-60550 |
7.5 | 0.0037 | NET NO AUTH LOW CX NO UI | D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the | |
|
75
|
CVE-2025-60552 |
7.5 | 0.0037 | NET NO AUTH LOW CX NO UI | D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the | |
|
75
|
CVE-2026-16373 |
7.5 | 0.0037 | NET NO AUTH LOW CX NO UI | Information disclosure in the Privacy component in Firefox for Android. This vul | |
|
75
|
CVE-2026-60075 |
7.5 | 0.0037 | NET NO AUTH LOW CX NO UI | Date::Manip versions through 7.00 for Perl allow CPU exhaustion via quadratic ba | |
|
75
|
CVE-2026-56834 |
7.5 | 0.0037 | NET NO AUTH LOW CX NO UI | PraisonAI is a multi-agent teams system. From version 3.8.1 to before version 4. | |
|
75
|
CVE-2026-40116 |
7.5 | 0.0037 | NET NO AUTH LOW CX NO UI | PraisonAI is a multi-agent teams system. Prior to 4.5.128, the /media-stream Web | |
|
75
|
CVE-2026-34065 |
7.5 | 0.0037 | NET NO AUTH LOW CX NO UI | nimiq-primitives contains primitives (e.g., block, account, transaction) to be u | |
|
75
|
CVE-2026-25425 |
7.5 | 0.0037 | NET NO AUTH LOW CX NO UI | Unauthenticated Broken Access Control in User Registration <= 5.1.2 versions. | |
|
74
|
CVE-2026-0263 |
7.2 | 0.0037 | NET NO AUTH LOW CX NO UI | A buffer overflow vulnerability in the IKEv2 processing of Palo Alto Networks PA | |
|
74
|
CVE-2026-114730 |
7.2 | 0.0037 | NET NO AUTH LOW CX NO UI | Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a s | |
|
74
|
CVE-2026-44982 |
7.2 | 0.0037 | NET NO AUTH LOW CX NO UI | CrowdSec offers crowdsourced protection against malicious IPs. From 1.5.0 until | |
|
69
|
CVE-2026-12686 |
9.3 | 0.0037 | NET LOW CX NO UI | An authenticated user could manipulate a company ID parameter in a POST request | |
|
68
|
CVE-2026-77903 |
9.0 | 0.0037 | NET NO AUTH NO UI | Authentication bypass by spoofing in Microsoft Dataverse allows an unauthorized | |
|
68
|
CVE-2026-6301 |
8.8 | 0.0037 | NET NO AUTH LOW CX | Type Confusion in Turbofan in Google Chrome prior to 147.0.7727.101 allowed a re | |
|
68
|
CVE-2026-119716 |
9.2 | 0.0037 | NET NO AUTH NO UI | pybars3 through 0.9.7 contains a code injection vulnerability in pybars/_compile | |
|
68
|
CVE-2026-43908 |
8.8 | 0.0037 | NET NO AUTH LOW CX | OpenImageIO is a toolset for reading, writing, and manipulating image files of a | |
|
67
|
CVE-2026-5967 |
8.7 | 0.0037 | NET LOW CX NO UI | ThreatSonar Anti-Ransomware developed by TeamT5 has an Privilege Escalation vuln | |
|
66
|
CVE-2026-27543 |
8.1 | 0.0037 | NET NO AUTH NO UI | Unauthenticated Privilege Escalation in MStore API <= 4.20.0 versions. | |
|
65
|
CVE-2026-56689 |
7.7 | 0.0037 | NET LOW CX NO UI | Dell PowerFlex Manager, Version prior to 5.1.0.1, contain(s) an Improper Neutral | |
|
65
|
CVE-2026-39924 |
7.6 | 0.0037 | NET LOW CX NO UI | Flarum before 1.8.16 contains an improper session invalidation vulnerability tha | |
|
65
|
CVE-2026-47026 |
7.4 | 0.0037 | NET NO AUTH LOW CX | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleS | |
|
65
|
CVE-2026-45741 |
7.5 | 0.0037 | NET NO AUTH NO UI | Gotenberg is a Docker-powered stateless API for PDF files. In 8.32.0 and earlier | |
|
64
|
CVE-2026-47214 |
7.1 | 0.0037 | NET NO AUTH LOW CX | Docling simplifies document processing by parsing diverse formats and providing | |
|
64
|
CVE-2026-33443 |
7.1 | 0.0037 | NET LOW CX NO UI | CVE-2026-33443 is a memory management error in Secure Access servers prior to 14 | |
|
64
|
CVE-2026-96637 |
7.1 | 0.0037 | NET NO AUTH LOW CX | Pillow is a Python imaging library. Prior to 13.0.0, SpiderImageFile.seek() in s | |
|
64
|
CVE-2026-96643 |
7.1 | 0.0037 | NET NO AUTH LOW CX | Pillow is a Python imaging library. From 11.0.0 until 13.0.0, Exif.load() in src | |
|
64
|
CVE-2026-39385 |
7.1 | 0.0037 | NET LOW CX NO UI | Frappe LMS is an open source learning management system. In version 2.51.0 and e | |
|
64
|
CVE-2026-8431 |
9.4 | 0.0037 | NET LOW CX NO UI | An administrative user with access to configure webhooks can execute arbitrary c | |
|
59
|
CVE-2026-60104 |
9.3 | 0.0037 | NET LOW CX | Bitwarden Server before 2026.6.0 does not verify that the email in a POST /auth- |