Hunt List
12,831 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-6213 |
10.0 | 0.0033 | NET NO AUTH LOW CX NO UI | A vulnerability in Remote Spark SparkView before build 1122 allows an attacker t | |
|
80
|
CVE-2026-30496 |
9.8 | 0.0033 | NET NO AUTH LOW CX NO UI | The Optoma CinemaX P2 projector (firmware TVOS-04.24.010.04.01, Android 8.0.0) e | |
|
79
|
CVE-2026-48768 |
9.3 | 0.0033 | NET NO AUTH LOW CX NO UI | TypeBot is a chatbot builder tool. In versions 3.16.1 and earlier, POST /api/blo | |
|
78
|
CVE-2026-11832 |
9.1 | 0.0033 | NET NO AUTH LOW CX NO UI | Dancer2::Plugin::Auth::OAuth versions before 0.22 for Perl default to a predicta | |
|
78
|
CVE-2025-70516 |
9.1 | 0.0033 | NET NO AUTH LOW CX NO UI | The websocket handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce | |
|
78
|
CVE-2026-56324 |
8.8 | 0.0033 | NET NO AUTH LOW CX NO UI | Capgo before 12.128.2 contains a rate limit bypass vulnerability in the channel_ | |
|
78
|
CVE-2026-45091 |
9.1 | 0.0033 | NET NO AUTH LOW CX NO UI | sealed-env is a cross-stack, zero-trust secret management library for Node.js an | |
|
78
|
CVE-2026-63569 |
9.1 | 0.0033 | NET NO AUTH LOW CX NO UI | Improper input validation in DHAgreement.CalculateAgreement (MTI/A0 two-pass Dif | |
|
77
|
CVE-2026-67322 |
8.7 | 0.0033 | NET NO AUTH LOW CX NO UI | GitPython before 3.1.52 is vulnerable to environment-variable exfiltration in Re | |
|
77
|
CVE-2026-41683 |
8.6 | 0.0033 | NET NO AUTH LOW CX NO UI | i18next-http-middleware is a middleware to be used with Node.js web frameworks l | |
|
77
|
CVE-2026-93441 |
8.6 | 0.0033 | NET NO AUTH LOW CX NO UI | IBM QRadar SIEM could allow a remote attacker to cause a denial of service due t | |
|
76
|
CVE-2026-8827 |
8.2 | 0.0033 | NET NO AUTH LOW CX NO UI | The AddressRepository::getSqlQuery() method constructs a database query without | |
|
76
|
CVE-2026-61205 |
8.2 | 0.0033 | NET NO AUTH LOW CX NO UI | Vulnerability in the PeopleSoft Enterprise SCM Purchasing product of Oracle Peop | |
|
76
|
CVE-2026-73925 |
8.2 | 0.0033 | NET NO AUTH LOW CX NO UI | Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imp | |
|
76
|
CVE-2026-116589 |
8.2 | 0.0033 | NET NO AUTH LOW CX NO UI | Datadog dd-trace-py is the Datadog Python APM client. From 3.13.0 until 4.15.5, | |
|
76
|
CVE-2026-100635 |
8.2 | 0.0033 | NET NO AUTH LOW CX NO UI | SiYuan before v3.8.4 contains an authentication bypass vulnerability in the publ | |
|
75
|
CVE-2026-33666 |
7.5 | 0.0033 | NET NO AUTH LOW CX NO UI | Zserio is a framework for serializing structured data with a compact and efficie | |
|
75
|
CVE-2026-54592 |
7.5 | 0.0033 | NET NO AUTH LOW CX NO UI | Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby ge | |
|
75
|
CVE-2026-35036 |
7.5 | 0.0033 | NET NO AUTH LOW CX NO UI | Ech0 is an open-source, self-hosted publishing platform for personal idea sharin | |
|
75
|
CVE-2026-70378 |
7.5 | 0.0033 | NET NO AUTH LOW CX NO UI | imagecli's pipeline operation (Carve::apply in src/image_ops.rs) only asserts , | |
|
74
|
CVE-2026-92210 |
7.2 | 0.0033 | NET NO AUTH LOW CX NO UI | NoMachine nxhtd Server-Side Request Forgery Information Disclosure Vulnerability | |
|
69
|
CVE-2026-14038 |
9.3 | 0.0033 | NET NO AUTH LOW CX | Insufficient validation of untrusted input in New Tab Page in Google Chrome prio | |
|
69
|
CVE-2026-5166 |
9.6 | 0.0033 | NET NO AUTH LOW CX | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') v | |
|
69
|
CVE-2026-91243 |
9.6 | 0.0033 | NET LOW CX NO UI | Vulnerability in the Oracle Business Process Management Suite product of Oracle | |
|
69
|
CVE-2026-76475 |
9.3 | 0.0033 | NET NO AUTH LOW CX | As part of Cisco's ongoing commitment to proactive security and product quality, | |
|
68
|
CVE-2026-14385 |
8.8 | 0.0033 | NET NO AUTH LOW CX | Heap buffer overflow in ANGLE in Google Chrome on Mac prior to 150.0.7871.46 all | |
|
68
|
CVE-2026-55598 |
9.1 | 0.0033 | NET LOW CX NO UI | PinePods is a complete, self-hosted podcast management system written in Rust. P | |
|
68
|
CVE-2026-5161 |
8.8 | 0.0033 | NET NO AUTH LOW CX | Improper link resolution before file access ('link following') vulnerability in | |
|
68
|
CVE-2026-112242 |
8.8 | 0.0033 | NET LOW CX NO UI | Incorrect Privilege Assignment vulnerability in Cozmoslabs Profile Builder profi | |
|
67
|
CVE-2026-71271 |
8.5 | 0.0033 | NET LOW CX NO UI | Memos' webhook URL validation, isReservedIP (internal/webhook/validate.go), chec | |
|
67
|
CVE-2026-87346 |
8.7 | 0.0033 | NET NO AUTH NO UI | Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (com | |
|
67
|
CVE-2026-49493 |
8.6 | 0.0033 | NET NO AUTH LOW CX | Markdown Preview Enhanced before 0.8.28 parses Bitfield fenced code blocks with | |
|
67
|
CVE-2026-114727 |
8.3 | 0.0033 | NET LOW CX NO UI | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 passes potentially unsafe | |
|
66
|
CVE-2026-35167 |
8.1 | 0.0033 | NET LOW CX NO UI | Kedro is a toolbox for production-ready data science. Prior to 1.3.0, the _get_v | |
|
66
|
CVE-2026-7399 |
8.1 | 0.0033 | NET LOW CX NO UI | Authorization bypass through User-Controlled key vulnerability in MeWare Softwar | |
|
66
|
CVE-2026-54814 |
8.1 | 0.0033 | NET NO AUTH NO UI | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP | |
|
66
|
CVE-2026-14011 |
8.1 | 0.0033 | NET NO AUTH LOW CX | Out of bounds read in SurfaceCapture in Google Chrome prior to 150.0.7871.47 all | |
|
66
|
CVE-2026-17869 |
8.1 | 0.0033 | NET NO AUTH LOW CX | Out of bounds read in WebXR in Google Chrome prior to 151.0.7922.72 allowed a re | |
|
66
|
CVE-2026-17995 |
8.1 | 0.0033 | NET NO AUTH LOW CX | Out of bounds read in Dawn in Google Chrome prior to 151.0.7922.72 allowed a rem | |
|
65
|
CVE-2026-40779 |
7.7 | 0.0033 | NET LOW CX NO UI | Contributor Arbitrary File Deletion in Link Library <= 7.8.8 versions. | |
|
65
|
CVE-2026-54193 |
7.7 | 0.0033 | NET LOW CX NO UI | Contributor Arbitrary File Deletion in Fusion Builder <= 3.15.4 versions. | |
|
64
|
CVE-2026-62186 |
7.2 | 0.0033 | NET LOW CX NO UI | OpenClaw versions before 2026.6.8 contain an authorization bypass vulnerability | |
|
64
|
CVE-2026-54290 |
7.1 | 0.0033 | NET NO AUTH LOW CX | Hono is a Web application framework that provides support for any JavaScript run | |
|
64
|
CVE-2026-55564 |
7.1 | 0.0033 | NET NO AUTH LOW CX | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0 | |
|
64
|
CVE-2026-116740 |
7.1 | 0.0033 | NET NO AUTH LOW CX | libcss through 0.9.2 contains a NULL pointer dereference vulnerability in mq_par | |
|
59
|
CVE-2026-10843 |
7.2 | 0.0033 | NET LOW CX NO UI | A flaw was found in the OpenShift Cloud Credential Operator Mint-mode IAM polici | |
|
57
|
CVE-2026-19138 |
8.3 | 0.0033 | NET NO AUTH | Heap buffer overflow in CrashReporting in Google Chrome prior to 151.0.7922.109 | |
|
56
|
CVE-2026-13752 |
8.0 | 0.0033 | NET LOW CX | Improper neutralization of parameters in Snowflake CLI versions prior to 3.19 al | |
|
55
|
CVE-2026-87853 |
7.5 | 0.0033 | NET NO UI | A flaw was found in SSSD's IdP authentication provider. The eval_access_token_bu | |
|
55
|
CVE-2026-54816 |
7.5 | 0.0033 | NET NO UI | Improper Control of Generation of Code ('Code Injection') vulnerability in Monet |