Hunt List
12,844 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-42222 |
9.8 | 0.0034 | NET NO AUTH LOW CX NO UI | Nginx UI is a web user interface for the Nginx web server. In version 2.3.5, an | |
|
80
|
CVE-2026-54807 |
9.8 | 0.0034 | NET NO AUTH LOW CX NO UI | Unauthenticated Privilege Escalation in Registration Form for WooCommerce <= 1.0 | |
|
79
|
CVE-2026-105215 |
9.3 | 0.0034 | NET NO AUTH LOW CX NO UI | ZITADEL before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in | |
|
79
|
CVE-2026-35305 |
9.3 | 0.0034 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (compo | |
|
79
|
CVE-2026-91230 |
9.3 | 0.0034 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (compo | |
|
78
|
CVE-2026-5085 |
9.1 | 0.0034 | NET NO AUTH LOW CX NO UI | Solstice::Session versions through 1440 for Perl generates session ids insecurel | |
|
78
|
CVE-2026-113812 |
9.1 | 0.0034 | NET NO AUTH LOW CX NO UI | Mozilla::CA versions before 20261020 for Perl provide a CA certificate bundle co | |
|
78
|
CVE-2015-20128 |
8.8 | 0.0034 | NET NO AUTH LOW CX NO UI | FooSun DotNetCMS 1.0 and 2.0 contains an SQL injection vulnerability that allows | |
|
77
|
CVE-2025-71437 |
8.7 | 0.0034 | NET NO AUTH LOW CX NO UI | Astral uv before 0.8.22 contains a path traversal vulnerability in source distri | |
|
77
|
CVE-2026-33778 |
8.7 | 0.0034 | NET NO AUTH LOW CX NO UI | An Improper Validation of Syntactic Correctness of Input vulnerability in the I | |
|
75
|
CVE-2025-66969 |
7.5 | 0.0034 | NET NO AUTH LOW CX NO UI | Integer overflow in OpenModSim (<=1.11.0), leading to denial of service | |
|
75
|
CVE-2026-18449 |
7.5 | 0.0034 | NET NO AUTH LOW CX NO UI | The BMC does not correctly enforce integrity and encryption requirements for IPM | |
|
75
|
CVE-2026-106972 |
7.5 | 0.0034 | NET NO AUTH LOW CX NO UI | Uncontrolled recursion in MessagePack\BufferUnpacker::unpack() in rybakit/msgpac | |
|
75
|
CVE-2026-103963 |
7.5 | 0.0034 | NET NO AUTH LOW CX NO UI | A flaw was found in glib-networking. When establishing connections using Transpo | |
|
75
|
CVE-2026-62864 |
7.5 | 0.0034 | NET NO AUTH LOW CX NO UI | Ring is a Clojure web applications library inspired by Python's WSGI and Ruby's | |
|
75
|
CVE-2026-62297 |
7.5 | 0.0034 | NET NO AUTH LOW CX NO UI | ag-psd is a JavaScript library for reading and writing Photoshop Document files. | |
|
75
|
CVE-2026-40117 |
7.5 | 0.0034 | NET NO AUTH LOW CX NO UI | PraisonAIAgents is a multi-agent teams system. Prior to 1.5.128, read_skill_file | |
|
68
|
CVE-2025-10537 |
8.8 | 0.0034 | NET NO AUTH LOW CX | Memory safety bugs present in Firefox ESR 140.2, Thunderbird ESR 140.2, Firefox | |
|
68
|
CVE-2026-3953 |
8.8 | 0.0034 | NET NO AUTH LOW CX | Improper neutralization of input during web page generation ('cross-site scripti | |
|
68
|
CVE-2026-40978 |
8.8 | 0.0034 | NET LOW CX NO UI | SQL injection vulnerability in Spring AI's `CosmosDBVectorStore` allows attacker | |
|
68
|
CVE-2026-7928 |
8.8 | 0.0034 | NET NO AUTH LOW CX | Use after free in WebRTC in Google Chrome on Windows prior to 148.0.7778.96 allo | |
|
68
|
CVE-2026-7980 |
8.8 | 0.0034 | NET NO AUTH LOW CX | Use after free in WebAudio in Google Chrome prior to 148.0.7778.96 allowed a rem | |
|
68
|
CVE-2026-7987 |
8.8 | 0.0034 | NET NO AUTH LOW CX | Use after free in WebRTC in Google Chrome prior to 148.0.7778.96 allowed a remot | |
|
68
|
CVE-2026-91610 |
8.8 | 0.0034 | NET LOW CX NO UI | Vulnerability in Oracle REST Data Services (component: General). Supported vers | |
|
67
|
CVE-2026-81726 |
8.3 | 0.0034 | NET NO AUTH NO UI | NLTK through 3.10.3 contains a path traversal vulnerability in model-artifact AP | |
|
67
|
CVE-2026-8629 |
8.6 | 0.0034 | NET LOW CX NO UI | Crabbox prior to v0.12.0 contains a privilege escalation vulnerability that allo | |
|
66
|
CVE-2026-116172 |
8.2 | 0.0034 | NET NO AUTH NO UI | vLLM from 0.22.0 before 0.24.0 contains an improper input validation vulnerabili | |
|
66
|
CVE-2026-116173 |
8.2 | 0.0034 | NET NO AUTH NO UI | vLLM from 0.22.0 before 0.24.0 contains a denial of service vulnerability that a | |
|
66
|
CVE-2026-22326 |
8.1 | 0.0034 | NET NO AUTH NO UI | Unauthenticated Local File Inclusion in Reprizo <= 1.0.8 versions. | |
|
66
|
CVE-2026-22338 |
8.1 | 0.0034 | NET NO AUTH NO UI | Unauthenticated Local File Inclusion in EcoBlue <= 1.15 versions. | |
|
66
|
CVE-2026-34893 |
8.1 | 0.0034 | NET NO AUTH NO UI | Unauthenticated Local File Inclusion in Thegov Core < 2.0.23 versions. | |
|
66
|
CVE-2026-34895 |
8.1 | 0.0034 | NET NO AUTH NO UI | Unauthenticated Local File Inclusion in Softlab Core < 1.2.11 versions. | |
|
66
|
CVE-2026-39547 |
8.1 | 0.0034 | NET NO AUTH NO UI | Unauthenticated Local File Inclusion in Getaway < 1.8 versions. | |
|
66
|
CVE-2026-39558 |
8.1 | 0.0034 | NET NO AUTH NO UI | Unauthenticated Local File Inclusion in Malmö <= 2.2 versions. | |
|
66
|
CVE-2026-39582 |
8.1 | 0.0034 | NET NO AUTH NO UI | Unauthenticated Local File Inclusion in Hitek < 1.8.3 versions. | |
|
66
|
CVE-2026-39523 |
8.1 | 0.0034 | NET NO AUTH NO UI | Unauthenticated Local File Inclusion in Solene Core <= 2.3.2 versions. | |
|
66
|
CVE-2026-39559 |
8.1 | 0.0034 | NET NO AUTH NO UI | Unauthenticated Local File Inclusion in Uppercase < 1.2.2 versions. | |
|
66
|
CVE-2026-39590 |
8.1 | 0.0034 | NET NO AUTH NO UI | Unauthenticated Local File Inclusion in Atomlab <= 2.4.5 versions. | |
|
65
|
CVE-2026-48599 |
7.6 | 0.0034 | NET LOW CX NO UI | Authorization Bypass Through User-Controlled Key vulnerability in elixir-grpc gr | |
|
65
|
CVE-2026-18534 |
7.4 | 0.0034 | NET NO AUTH LOW CX | ArcSearch for iOS versions prior to 1.48.0 could keep the address bar hidden aft | |
|
64
|
CVE-2026-60985 |
7.1 | 0.0034 | NET LOW CX NO UI | Vulnerability in the Oracle Project Portfolio Analysis product of Oracle E-Busin | |
|
64
|
CVE-2026-61012 |
7.1 | 0.0034 | NET LOW CX NO UI | Vulnerability in the Oracle Time and Labor product of Oracle E-Business Suite (c | |
|
64
|
CVE-2026-61119 |
7.1 | 0.0034 | NET LOW CX NO UI | Vulnerability in the Oracle HRMS (UK) product of Oracle E-Business Suite (compon | |
|
64
|
CVE-2026-70774 |
7.1 | 0.0034 | NET LOW CX NO UI | Vulnerability in the Oracle Warehouse Management product of Oracle E-Business Su | |
|
64
|
CVE-2026-70845 |
7.1 | 0.0034 | NET LOW CX NO UI | Vulnerability in the Oracle Loans product of Oracle E-Business Suite (component: | |
|
64
|
CVE-2026-102010 |
7.0 | 0.0034 | NET NO AUTH NO UI | A flaw was found in GCC. When an application calls the erase_if function on a bi | |
|
59
|
CVE-2026-111577 |
7.2 | 0.0034 | NET LOW CX NO UI | The GoSMTP WordPress plugin before 1.2.5 does not perform a settings-management | |
|
59
|
CVE-2026-46953 |
7.2 | 0.0034 | NET LOW CX NO UI | Vulnerability in the Oracle HRMS (UK) product of Oracle E-Business Suite (compon | |
|
59
|
CVE-2026-46976 |
7.2 | 0.0034 | NET LOW CX NO UI | Vulnerability in the Oracle Public Sector Payroll product of Oracle E-Business S | |
|
58
|
CVE-2026-44221 |
9.0 | 0.0034 | NET LOW CX | ArcadeDB is a Multi-Model DBMS. Starting in version 21.10.1 and prior to version |