Hunt List
12,833 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-5734 |
9.8 | 0.0033 | NET NO AUTH LOW CX NO UI | Memory safety bugs present in Firefox ESR 140.9.0, Thunderbird ESR 140.9.0, Fire | |
|
79
|
CVE-2026-68582 |
9.3 | 0.0033 | NET NO AUTH LOW CX NO UI | Vikunja versions >= 0.24.0 and <= 2.3.0 contain a broken object level authorizat | |
|
79
|
CVE-2026-112327 |
9.3 | 0.0033 | NET NO AUTH LOW CX NO UI | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti | |
|
79
|
CVE-2026-76935 |
9.4 | 0.0033 | NET NO AUTH LOW CX NO UI | Stack-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System | |
|
78
|
CVE-2026-63160 |
9.1 | 0.0033 | NET NO AUTH LOW CX NO UI | Omnispace Agora Project before 26.10.0 contains a vulnerability where the persis | |
|
77
|
CVE-2026-65007 |
8.7 | 0.0033 | NET NO AUTH LOW CX NO UI | The Grav api plugin (grav-plugin-api) before 1.0.8 fails to properly authorize A | |
|
77
|
CVE-2026-116877 |
8.7 | 0.0033 | NET NO AUTH LOW CX NO UI | Semantic MediaWiki from 2.5.0 before 7.3.1 contains an uncontrolled resource con | |
|
76
|
CVE-2026-67213 |
8.2 | 0.0033 | NET NO AUTH LOW CX NO UI | nanoid (Nano ID) before 5.1.6 contains an infinite loop in the customAlphabet an | |
|
76
|
CVE-2026-93905 |
8.2 | 0.0033 | NET NO AUTH LOW CX NO UI | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 could allo | |
|
76
|
CVE-2026-48764 |
8.2 | 0.0033 | NET NO AUTH LOW CX NO UI | TypeBot is a chatbot builder tool. In versions prior to 3.17.2, SSRF validation | |
|
76
|
CVE-2026-67214 |
8.2 | 0.0033 | NET NO AUTH LOW CX NO UI | nanoid (Nano ID) before 3.3.16 and 5.1.16 contains an infinite loop in the custo | |
|
76
|
CVE-2026-17543 |
8.1 | 0.0033 | NET NO AUTH LOW CX NO UI | Improper escaping of backslashes in attacker-provided parameters would allow for | |
|
76
|
CVE-2026-56836 |
8.2 | 0.0033 | NET NO AUTH LOW CX NO UI | PraisonAI is a multi-agent teams system. From version 4.5.112 to before version | |
|
75
|
CVE-2026-34305 |
7.5 | 0.0033 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware | |
|
75
|
CVE-2026-95696 |
7.5 | 0.0033 | NET NO AUTH LOW CX NO UI | IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could all | |
|
75
|
CVE-2026-44602 |
7.5 | 0.0033 | NET NO AUTH LOW CX NO UI | Tor before 0.4.9.7 has a NULL pointer dereference when a CERT cell is received o | |
|
75
|
CVE-2026-15163 |
7.5 | 0.0033 | NET NO AUTH LOW CX NO UI | Multiple protocol dissector infinite loops in Wireshark 4.6.0 to 4.6.6 and 4.4.0 | |
|
75
|
CVE-2026-40879 |
7.5 | 0.0033 | NET NO AUTH LOW CX NO UI | Nest is a framework for building scalable Node.js server-side applications. Prio | |
|
75
|
CVE-2026-23824 |
7.5 | 0.0033 | NET NO AUTH LOW CX NO UI | Vulnerabilities exist in a protocol-handling component of AOS-8 and AOS-10 Opera | |
|
75
|
CVE-2026-23825 |
7.5 | 0.0033 | NET NO AUTH LOW CX NO UI | Vulnerabilities exist in a protocol-handling component of AOS-8 and AOS-10 Opera | |
|
75
|
CVE-2025-28344 |
7.5 | 0.0033 | NET NO AUTH LOW CX NO UI | striso-control-firmware 54c9722 is vulnerable to Buffer Overflow in function Aux | |
|
70
|
CVE-2026-76299 |
9.9 | 0.0033 | NET LOW CX NO UI | As part of Cisco's ongoing commitment to proactive security and product quality, | |
|
68
|
CVE-2026-12439 |
8.8 | 0.0033 | NET NO AUTH LOW CX | Use after free in Digital Credentials in Google Chrome prior to 149.0.7827.155 a | |
|
68
|
CVE-2026-118307 |
8.8 | 0.0033 | NET NO AUTH LOW CX | Use after free in Paint in Google Chrome prior to 156.0.8078.73 allowed a remote | |
|
68
|
CVE-2026-2449 |
9.0 | 0.0033 | NET LOW CX NO UI | Improper neutralization of argument delimiters in a command ('argument injection | |
|
68
|
CVE-2026-42999 |
8.8 | 0.0033 | NET LOW CX NO UI | An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone RBAC p | |
|
68
|
CVE-2026-48508 |
8.8 | 0.0033 | NET LOW CX NO UI | Lemur manages TLS certificate creation. Prior to 1.9.1, StrictRolePermission and | |
|
68
|
CVE-2025-11715 |
8.8 | 0.0033 | NET NO AUTH LOW CX | Memory safety bugs present in Firefox ESR 140.3, Thunderbird ESR 140.3, Firefox | |
|
68
|
CVE-2026-43000 |
8.8 | 0.0033 | NET LOW CX NO UI | An issue was discovered in OpenStack Keystone before 29.0.2. When combined with | |
|
67
|
CVE-2026-42275 |
8.7 | 0.0033 | NET NO AUTH NO UI | zrok is software for sharing web services, files, and network resources. Prior t | |
|
66
|
CVE-2026-114104 |
8.2 | 0.0033 | NET NO AUTH NO UI | adm-zip before 0.6.1 contains an inconsistent entry resolution vulnerability tha | |
|
66
|
CVE-2026-116178 |
8.2 | 0.0033 | NET NO AUTH NO UI | vLLM from 0.20.0 before 0.30.0 contains a denial of service vulnerability that a | |
|
66
|
CVE-2026-13806 |
8.1 | 0.0033 | NET NO AUTH LOW CX | Insufficient validation of untrusted input in Accessibility in Google Chrome pri | |
|
66
|
CVE-2026-17686 |
8.1 | 0.0033 | NET NO AUTH LOW CX | Insufficient validation of untrusted input in Passwords in Google Chrome prior t | |
|
66
|
CVE-2026-19153 |
8.1 | 0.0033 | NET NO AUTH LOW CX | Insufficient validation of untrusted input in Workers in Google Chrome prior to | |
|
66
|
CVE-2026-15556 |
8.1 | 0.0033 | NET LOW CX NO UI | A flaw was found in Picketlink's SP signature validation; a SAML response contai | |
|
66
|
CVE-2026-91647 |
8.1 | 0.0033 | NET NO AUTH NO UI | Vulnerability in Oracle Essbase (component: Security). The supported version t | |
|
66
|
CVE-2026-57121 |
8.1 | 0.0033 | NET LOW CX NO UI | PraisonAI is a multi-agent teams system. From version 0.1.4 to before version 0. | |
|
65
|
CVE-2026-46699 |
7.6 | 0.0033 | NET NO AUTH LOW CX | conda-smithy is a tool for combining a conda recipe with configurations to build | |
|
65
|
CVE-2026-101398 |
7.6 | 0.0033 | NET LOW CX NO UI | Vulnerability in the Oracle Capacity product of Oracle E-Business Suite (compone | |
|
65
|
CVE-2026-44460 |
7.4 | 0.0033 | NET NO AUTH NO UI | FileRise is a self-hosted web-based file manager with multi-file upload, editing | |
|
64
|
CVE-2026-53982 |
7.1 | 0.0033 | NET LOW CX NO UI | Cap-go Console < 12.28.2 contains a denial-of-service vulnerability in its accou | |
|
59
|
CVE-2026-68759 |
7.2 | 0.0033 | NET LOW CX NO UI | A holder of a valid integration credential may impersonate other users under spe | |
|
59
|
CVE-2026-67245 |
7.0 | 0.0033 | NET LOW CX NO UI | A path traversal vulnerability was found in the VPN Clients on the ADM. The vuln | |
|
58
|
CVE-2026-34559 |
9.0 | 0.0033 | NET LOW CX | CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, mo | |
|
58
|
CVE-2026-34569 |
9.0 | 0.0033 | NET LOW CX | CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, mo | |
|
56
|
CVE-2026-14886 |
8.2 | 0.0033 | NET NO UI | Vault Enterprise's identity entity batch-delete endpoint is vulnerable to a cros | |
|
55
|
CVE-2026-60467 |
7.5 | 0.0033 | NET NO AUTH | Vulnerability in the WebCenter Content: Imaging product of Oracle Fusion Middlew | |
|
55
|
CVE-2026-70681 |
7.5 | 0.0033 | NET NO AUTH | Vulnerability in the Oracle Applications DBA product of Oracle E-Business Suite | |
|
55
|
CVE-2026-70856 |
7.5 | 0.0033 | NET NO AUTH | Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (compone |