Hunt List
12,867 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2025-61163 |
9.8 | 0.0036 | NET NO AUTH LOW CX NO UI | Cohere North AI v1.1.5 was discovered to contain excessively permissive cross-do | |
|
80
|
CVE-2026-110956 |
9.8 | 0.0036 | NET NO AUTH LOW CX NO UI | The asVereinbase WordPress plugin before 1.1.8 does not require a valid passwor | |
|
79
|
CVE-2025-48089 |
9.3 | 0.0036 | NET NO AUTH LOW CX NO UI | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti | |
|
78
|
CVE-2026-33896 |
9.1 | 0.0036 | NET NO AUTH LOW CX NO UI | Forge (also called `node-forge`) is a native implementation of Transport Layer S | |
|
77
|
CVE-2026-13311 |
8.7 | 0.0036 | NET NO AUTH LOW CX NO UI | shell-quote prior to 1.8.5 finalizes parsed tokens in parse() using Array.protot | |
|
77
|
CVE-2026-56339 |
8.7 | 0.0036 | NET NO AUTH LOW CX NO UI | Capgo (Cap-go/capgo) before 12.128.2 contains an information disclosure vulnerab | |
|
77
|
CVE-2026-111810 |
8.7 | 0.0036 | NET NO AUTH LOW CX NO UI | Apache Traffic Server 9.2.15, 10.1.4 and 10.2.0 write one unthrottled diagnostic | |
|
76
|
CVE-2026-10564 |
8.2 | 0.0036 | NET NO AUTH LOW CX NO UI | IBM Langflow OSS 1.0.0 through 1.9.6 contains a Server-Side Request Forgery (SSR | |
|
75
|
CVE-2026-116372 |
7.7 | 0.0036 | NET NO AUTH LOW CX NO UI | MISP mispguard is a security filtering proxy that inspects and blocks MISP feed | |
|
75
|
CVE-2025-51735 |
7.5 | 0.0036 | NET NO AUTH LOW CX NO UI | CSV formula injection vulnerability in HCL Technologies Ltd. Unica 12.0.0. | |
|
75
|
CVE-2026-1718 |
7.5 | 0.0036 | NET NO AUTH LOW CX NO UI | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to a deni | |
|
75
|
CVE-2026-44635 |
7.5 | 0.0036 | NET NO AUTH LOW CX NO UI | Kysely is a type-safe TypeScript SQL query builder. From 0.26.0 to 0.28.16, Defa | |
|
75
|
CVE-2026-49061 |
7.5 | 0.0036 | NET NO AUTH LOW CX NO UI | Unauthenticated Arbitrary File Download in WPC Product Options for WooCommerce < | |
|
75
|
CVE-2026-41205 |
7.7 | 0.0036 | NET NO AUTH LOW CX NO UI | Mako is a template library written in Python. Prior to 1.3.11, TemplateLookup.ge | |
|
75
|
CVE-2026-13189 |
7.5 | 0.0036 | NET NO AUTH LOW CX NO UI | In Progress® Telerik® UI for AJAX prior to v2026.2.708, insufficient validation | |
|
75
|
CVE-2026-1345 |
7.3 | 0.0036 | NET NO AUTH LOW CX NO UI | IBM Verify Identity Access Container 11.0 through 11.0.2 and IBM Security Verify | |
|
75
|
CVE-2026-35611 |
7.5 | 0.0036 | NET NO AUTH LOW CX NO UI | Addressable is an alternative implementation to the URI implementation that is p | |
|
75
|
CVE-2025-61162 |
7.5 | 0.0036 | NET NO AUTH LOW CX NO UI | Incorrect access control in Cohere North AI v1.1.5 allows attackers to arbitrari | |
|
75
|
CVE-2026-76491 |
7.5 | 0.0036 | NET NO AUTH LOW CX NO UI | As part of Cisco's ongoing commitment to proactive security and product quality, | |
|
75
|
CVE-2026-76492 |
7.5 | 0.0036 | NET NO AUTH LOW CX NO UI | As part of Cisco's ongoing commitment to proactive security and product quality, | |
|
75
|
CVE-2026-76493 |
7.5 | 0.0036 | NET NO AUTH LOW CX NO UI | As part of Cisco's ongoing commitment to proactive security and product quality, | |
|
74
|
CVE-2026-111812 |
7.0 | 0.0036 | NET NO AUTH LOW CX NO UI | Apache Traffic Server's origin_server_auth plugin lets a client force signing of | |
|
69
|
CVE-2026-40872 |
9.3 | 0.0036 | NET NO AUTH LOW CX | mailcow: dockerized is an open source groupware/email suite based on docker. In | |
|
68
|
CVE-2023-30901 |
8.8 | 0.0036 | NET NO AUTH LOW CX | A vulnerability has been identified in SICAM P850 (7KG8500-0AA00-0AA0) (All vers | |
|
68
|
CVE-2026-47399 |
8.8 | 0.0036 | NET LOW CX NO UI | PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams sys | |
|
68
|
CVE-2026-63378 |
8.8 | 0.0036 | NET LOW CX NO UI | TAKO AI Agent for Okta is a local-first AI agent that helps Okta administrators | |
|
68
|
CVE-2026-47405 |
8.8 | 0.0036 | NET LOW CX NO UI | PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams sys | |
|
68
|
CVE-2026-118082 |
8.8 | 0.0036 | NET LOW CX NO UI | Subscriber Privilege Escalation in Buddyboss Platform <= 3.5.0 versions. | |
|
68
|
CVE-2026-118086 |
8.8 | 0.0036 | NET LOW CX NO UI | Subscriber Privilege Escalation in WP BASE Booking <= 6.5.2 versions. | |
|
67
|
CVE-2026-8621 |
8.7 | 0.0036 | NET LOW CX NO UI | Crabbox prior to v0.12.0 contains an authentication bypass vulnerability that al | |
|
67
|
CVE-2026-45178 |
8.4 | 0.0036 | NET LOW CX NO UI | Idira Secrets Manager Self-Hosted versions 13.8.0 and lower exhibit improper acc | |
|
67
|
CVE-2026-75481 |
8.7 | 0.0036 | NET LOW CX NO UI | SkyPilot fails to validate that authenticated users are entitled to grant admini | |
|
67
|
CVE-2026-26231 |
8.5 | 0.0036 | NET LOW CX NO UI | Gitea versions up to and including 1.26.1 allow the Allow edits from maintainers | |
|
66
|
CVE-2026-70881 |
8.1 | 0.0036 | NET LOW CX NO UI | Vulnerability in the Oracle Hyperion Data Relationship Management product of Ora | |
|
66
|
CVE-2026-70925 |
8.1 | 0.0036 | NET LOW CX NO UI | Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hype | |
|
66
|
CVE-2026-70929 |
8.1 | 0.0036 | NET LOW CX NO UI | Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hype | |
|
66
|
CVE-2026-70957 |
8.1 | 0.0036 | NET LOW CX NO UI | Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle | |
|
66
|
CVE-2026-70999 |
8.1 | 0.0036 | NET LOW CX NO UI | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience | |
|
66
|
CVE-2026-71110 |
8.1 | 0.0036 | NET LOW CX NO UI | Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imp | |
|
66
|
CVE-2026-44752 |
8.2 | 0.0036 | NET NO AUTH LOW CX | SAP NetWeaver Application Server Java allows an unauthenticated attacker to inje | |
|
66
|
CVE-2026-66318 |
8.1 | 0.0036 | NET NO AUTH LOW CX | Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorize | |
|
62
|
CVE-2026-91437 |
8.7 | 0.0036 | NET LOW CX NO UI | Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (compone | |
|
61
|
CVE-2026-60854 |
8.2 | 0.0036 | NET LOW CX NO UI | Vulnerability in the Oracle Quality product of Oracle E-Business Suite (componen | |
|
55
|
CVE-2026-13802 |
7.5 | 0.0036 | NET NO AUTH | Use after free in Views in Google Chrome prior to 150.0.7871.47 allowed a remote | |
|
55
|
CVE-2026-14064 |
7.5 | 0.0036 | NET NO AUTH | Use after free in PageInfo in Google Chrome on Android prior to 150.0.7871.47 al | |
|
55
|
CVE-2026-14409 |
7.5 | 0.0036 | NET NO AUTH | Inappropriate implementation in V8 in Google Chrome prior to 150.0.7871.46 allow | |
|
55
|
CVE-2026-14426 |
7.5 | 0.0036 | NET NO AUTH | Use after free in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote at | |
|
55
|
CVE-2026-56842 |
7.5 | 0.0036 | NET NO UI | A malicious actor with access to the network and under certain conditions could | |
|
55
|
CVE-2026-17896 |
7.5 | 0.0036 | NET NO AUTH | Use after free in DevTools in Google Chrome prior to 151.0.7922.72 allowed a rem | |
|
55
|
CVE-2026-91406 |
7.5 | 0.0036 | NET NO AUTH | Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middl |