Hunt List
12,844 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
77
|
CVE-2026-61439 |
8.7 | 0.0034 | NET NO AUTH LOW CX NO UI | PraisonAI versions before 4.6.78 contain a prompt injection defense misconfigura | |
|
75
|
CVE-2026-33813 |
7.5 | 0.0034 | NET NO AUTH LOW CX NO UI | Parsing a WEBP image with an invalid, large size panics on 32-bit platforms. | |
|
75
|
CVE-2026-4503 |
7.5 | 0.0034 | NET NO AUTH LOW CX NO UI | IBM Langflow Desktop 1.0.0 through 1.8.4 Langflow could allow an unauthenticated | |
|
74
|
CVE-2026-62616 |
7.2 | 0.0034 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middlewar | |
|
67
|
CVE-2026-60427 |
8.7 | 0.0034 | NET NO AUTH NO UI | Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middlewar | |
|
67
|
CVE-2026-60448 |
8.7 | 0.0034 | NET NO AUTH NO UI | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middlewar | |
|
67
|
CVE-2026-60553 |
8.7 | 0.0034 | NET NO AUTH NO UI | Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware | |
|
67
|
CVE-2026-60597 |
8.7 | 0.0034 | NET NO AUTH NO UI | Vulnerability in the PeopleSoft Enterprise FIN Cash Management product of Oracle | |
|
67
|
CVE-2026-60903 |
8.7 | 0.0034 | NET NO AUTH NO UI | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middlewar | |
|
67
|
CVE-2026-60934 |
8.7 | 0.0034 | NET NO AUTH NO UI | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middlewar | |
|
67
|
CVE-2026-60935 |
8.7 | 0.0034 | NET NO AUTH NO UI | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middlewar | |
|
67
|
CVE-2026-60954 |
8.7 | 0.0034 | NET NO AUTH NO UI | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middlewar | |
|
67
|
CVE-2026-60980 |
8.7 | 0.0034 | NET NO AUTH NO UI | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middlewar | |
|
67
|
CVE-2026-61193 |
8.7 | 0.0034 | NET NO AUTH NO UI | Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware | |
|
67
|
CVE-2026-62589 |
8.7 | 0.0034 | NET NO AUTH NO UI | Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (compon | |
|
67
|
CVE-2026-70900 |
8.7 | 0.0034 | NET NO AUTH NO UI | Vulnerability in the Oracle Hyperion Data Relationship Management product of Ora | |
|
67
|
CVE-2026-49492 |
8.6 | 0.0034 | NET NO AUTH LOW CX | Markdown Preview Enhanced before 0.8.28 opens external files and links from the | |
|
67
|
CVE-2026-66001 |
8.5 | 0.0034 | NET NO AUTH LOW CX | Frappe is a full-stack web application framework. Prior to 15.114.0 and 16.26.0, | |
|
66
|
CVE-2026-119421 |
8.2 | 0.0034 | NET NO AUTH NO UI | Juspay Hyperswitch through 1.128.0 (and builds before 2026.10.19.0) contains a m | |
|
65
|
CVE-2026-34592 |
7.7 | 0.0034 | NET LOW CX NO UI | Coolify is an open-source and self-hostable tool for managing servers, applicati | |
|
65
|
CVE-2026-46943 |
7.4 | 0.0034 | NET NO AUTH NO UI | Vulnerability in the Oracle Retail EFTLink product of Oracle Retail Applications | |
|
65
|
CVE-2026-60179 |
7.4 | 0.0034 | NET NO AUTH NO UI | Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connec | |
|
65
|
CVE-2026-60317 |
7.4 | 0.0034 | NET NO AUTH NO UI | Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connec | |
|
65
|
CVE-2026-60725 |
7.4 | 0.0034 | NET NO AUTH NO UI | Vulnerability in the MySQL Router product of Oracle MySQL (component: Router: Ge | |
|
65
|
CVE-2026-60823 |
7.4 | 0.0034 | NET NO AUTH NO UI | Vulnerability in the Oracle iSupport product of Oracle E-Business Suite (compone | |
|
65
|
CVE-2026-61113 |
7.4 | 0.0034 | NET NO AUTH NO UI | Vulnerability in the Oracle Application Object Library product of Oracle E-Busin | |
|
65
|
CVE-2026-61135 |
7.4 | 0.0034 | NET NO AUTH NO UI | Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (compon | |
|
65
|
CVE-2026-61164 |
7.4 | 0.0034 | NET NO AUTH NO UI | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience | |
|
65
|
CVE-2026-61173 |
7.4 | 0.0034 | NET NO AUTH NO UI | Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: | |
|
65
|
CVE-2026-61210 |
7.4 | 0.0034 | NET NO AUTH NO UI | Vulnerability in the PeopleSoft Enterprise SCM Manufacturing product of Oracle P | |
|
65
|
CVE-2026-61234 |
7.4 | 0.0034 | NET NO AUTH NO UI | Vulnerability in the PeopleSoft Enterprise FIN Common Objects Brazil product of | |
|
65
|
CVE-2026-60759 |
7.4 | 0.0034 | NET NO AUTH NO UI | Vulnerability in the Oracle Internet Procurement Connector product of Oracle E-B | |
|
65
|
CVE-2026-60766 |
7.4 | 0.0034 | NET NO AUTH NO UI | Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (compon | |
|
65
|
CVE-2026-60792 |
7.4 | 0.0034 | NET NO AUTH NO UI | Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (compone | |
|
65
|
CVE-2026-60797 |
7.4 | 0.0034 | NET NO AUTH NO UI | Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (compon | |
|
65
|
CVE-2026-60803 |
7.4 | 0.0034 | NET NO AUTH NO UI | Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (compo | |
|
65
|
CVE-2026-60915 |
7.4 | 0.0034 | NET NO AUTH NO UI | Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imp | |
|
65
|
CVE-2026-60933 |
7.4 | 0.0034 | NET NO AUTH NO UI | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middlewar | |
|
65
|
CVE-2026-62492 |
7.4 | 0.0034 | NET NO AUTH NO UI | Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle | |
|
65
|
CVE-2026-62538 |
7.4 | 0.0034 | NET NO AUTH NO UI | Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle | |
|
65
|
CVE-2026-70672 |
7.4 | 0.0034 | NET NO AUTH NO UI | Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middlewar | |
|
65
|
CVE-2026-70699 |
7.4 | 0.0034 | NET NO AUTH NO UI | Vulnerability in the Oracle Payments product of Oracle E-Business Suite (compone | |
|
65
|
CVE-2026-70779 |
7.4 | 0.0034 | NET NO AUTH NO UI | Vulnerability in the Oracle iSupplier Portal product of Oracle E-Business Suite | |
|
65
|
CVE-2026-70783 |
7.4 | 0.0034 | NET NO AUTH NO UI | Vulnerability in the Oracle Service Contracts product of Oracle E-Business Suite | |
|
65
|
CVE-2026-70823 |
7.4 | 0.0034 | NET NO AUTH NO UI | Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hype | |
|
65
|
CVE-2026-70898 |
7.4 | 0.0034 | NET NO AUTH NO UI | Vulnerability in the Oracle Hyperion Data Relationship Management product of Ora | |
|
65
|
CVE-2026-71009 |
7.4 | 0.0034 | NET NO AUTH NO UI | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience | |
|
65
|
CVE-2026-71143 |
7.4 | 0.0034 | NET NO AUTH NO UI | Vulnerability in the Oracle Communications Unified Inventory Management product | |
|
64
|
CVE-2026-18693 |
7.2 | 0.0034 | NET LOW CX NO UI | An issue in MongoDB Server's handling of timeseries collections could allow an a | |
|
56
|
CVE-2024-43384 |
8.0 | 0.0034 | NET LOW CX | A low privileged remote attacker can gain the root password due to improper remo |