Hunt List
12,825 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-42160 |
10.0 | 0.0032 | NET NO AUTH LOW CX NO UI | Data Space Portal is an open-source Software as a Service (SaaS) solution design | |
|
80
|
CVE-2026-48930 |
9.8 | 0.0032 | NET NO AUTH LOW CX NO UI | A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lea | |
|
80
|
CVE-2026-12665 |
9.8 | 0.0032 | NET NO AUTH LOW CX NO UI | IBM MQ could allow a remote attacker to execute arbitrary code due to a stack bu | |
|
80
|
CVE-2026-40190 |
9.8 | 0.0031 | NET NO AUTH LOW CX NO UI | LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. | |
|
80
|
CVE-2026-112846 |
9.8 | 0.0031 | NET NO AUTH LOW CX NO UI | Deserialization of Untrusted Data vulnerability in ThemeREX Group Save Life save | |
|
80
|
CVE-2026-112847 |
9.8 | 0.0031 | NET NO AUTH LOW CX NO UI | Deserialization of Untrusted Data vulnerability in ThemeREX ZenSoul zensoul allo | |
|
79
|
CVE-2026-102789 |
9.3 | 0.0032 | NET NO AUTH LOW CX NO UI | Joomla Extension - balbooa.com - Missing Authorization Check on Editor Controlle | |
|
78
|
CVE-2026-116199 |
9.2 | 0.0032 | NET NO AUTH LOW CX NO UI | Snipe-IT before 8.6.3 contains an authentication bypass in GoogleAuthController: | |
|
78
|
CVE-2026-65057 |
9.2 | 0.0031 | NET NO AUTH LOW CX NO UI | Keep (commit 91c75e0) contains a server-side request forgery vulnerability that | |
|
78
|
CVE-2026-112712 |
9.1 | 0.0031 | NET NO AUTH LOW CX NO UI | @fastify/middie is the Express-style middleware engine for Fastify. In versions | |
|
75
|
CVE-2025-63248 |
7.5 | 0.0032 | NET NO AUTH LOW CX NO UI | DWSurvey 6.14.0 is vulnerable to Incorrect Access Control. When deleting a quest | |
|
75
|
CVE-2026-44302 |
7.5 | 0.0032 | NET NO AUTH LOW CX NO UI | Snappier is a high performance C# implementation of the Snappy compression algor | |
|
75
|
CVE-2026-46474 |
7.5 | 0.0032 | NET NO AUTH LOW CX NO UI | Trog::TOTP versions before 1.006 for Perl generate secrets using rand. Secrets | |
|
75
|
CVE-2026-67978 |
7.5 | 0.0032 | NET NO AUTH LOW CX NO UI | An issue in the SBN UDP interface of NASA cFS v7.0.1 allows attackers to cause a | |
|
75
|
CVE-2026-28930 |
7.5 | 0.0032 | NET NO AUTH LOW CX NO UI | A permissions issue was addressed with additional restrictions. This issue is fi | |
|
75
|
CVE-2026-35229 |
7.5 | 0.0031 | NET NO AUTH LOW CX NO UI | Vulnerability in the Java VM component of Oracle Database Server. Supported ver | |
|
75
|
CVE-2026-35231 |
7.5 | 0.0031 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Financial Services Transaction Filtering product of | |
|
75
|
CVE-2026-47193 |
7.5 | 0.0031 | NET NO AUTH LOW CX NO UI | OpenProject is open-source, web-based project management software. Prior to 17.3 | |
|
69
|
CVE-2026-57498 |
9.6 | 0.0032 | NET LOW CX NO UI | Coolify is an open-source and self-hostable tool for managing servers, applicati | |
|
68
|
CVE-2026-91550 |
8.8 | 0.0032 | NET LOW CX NO UI | Vulnerability in the Oracle Agile Product Lifecycle Management for Process produ | |
|
68
|
CVE-2026-111120 |
8.8 | 0.0032 | NET NO AUTH LOW CX | The VikRentCar Car Rental Management System plugin for WordPress is vulnerable t | |
|
68
|
CVE-2026-15183 |
9.2 | 0.0031 | NET NO AUTH NO UI | Multiple input validation vulnerabilities in the Snowflake Spark Connector (spar | |
|
67
|
CVE-2026-6272 |
8.5 | 0.0032 | NET LOW CX NO UI | A client holding only a read JWT scope can still register itself as a signal pro | |
|
67
|
CVE-2026-91347 |
8.5 | 0.0032 | NET LOW CX NO UI | Vulnerability in the iSupport product of Oracle E-Business Suite (component: Ser | |
|
67
|
CVE-2026-8077 |
8.6 | 0.0031 | NET LOW CX NO UI | Lack of proper authorization implementation in the CashDro 3 web administration | |
|
67
|
CVE-2026-10129 |
8.5 | 0.0031 | NET LOW CX NO UI | IBM Langflow OSS 1.0.0 through 1.9.3 contains a Server-Side Request Forgery (SSR | |
|
66
|
CVE-2026-65758 |
8.2 | 0.0031 | NET NO AUTH NO UI | Joomla Extension - tassos.gr - Sensitive data exposure in Convert Forms extensio | |
|
66
|
CVE-2026-39307 |
8.1 | 0.0031 | NET NO AUTH LOW CX | PraisonAI is a multi-agent teams system. Prior to 1.5.113, The PraisonAI templat | |
|
66
|
CVE-2026-40093 |
8.1 | 0.0031 | NET LOW CX NO UI | nimiq-blockchain provides persistent block storage for Nimiq's Rust implementati | |
|
66
|
CVE-2026-49340 |
8.1 | 0.0031 | NET LOW CX NO UI | gonic is a music streaming server / free-software subsonic server API implementa | |
|
66
|
CVE-2026-87862 |
8.1 | 0.0031 | NET NO AUTH NO UI | Importing a `includeSubDomains` parent HSTS entry before a longer-lived child en | |
|
65
|
CVE-2026-12348 |
7.4 | 0.0032 | NET NO AUTH LOW CX | Address bar spoofing in Arc Search for Android allows a remote attacker to displ | |
|
65
|
CVE-2026-71307 |
7.7 | 0.0031 | NET LOW CX NO UI | Lemur manages TLS certificate creation. Prior to 1.9.3, GET /api/1/destinations | |
|
65
|
CVE-2026-85297 |
7.7 | 0.0031 | NET NO AUTH LOW CX | Bucket Squatting in Google Cloud Run MCP versions prior to 1.11.0 on Google Clou | |
|
64
|
CVE-2026-56280 |
7.1 | 0.0032 | NET LOW CX NO UI | Cap-go before 12.128.2 contains a privilege inversion vulnerability in GET /buil | |
|
64
|
CVE-2026-64880 |
7.1 | 0.0032 | NET LOW CX NO UI | Unsanitized user-supplied input in report filtering parameters is concatenated d | |
|
64
|
CVE-2026-110540 |
7.1 | 0.0032 | NET LOW CX NO UI | Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1. | |
|
64
|
CVE-2026-47120 |
7.1 | 0.0031 | NET LOW CX NO UI | Nezha Monitoring is a self-hostable, lightweight, servers and websites monitorin | |
|
64
|
CVE-2026-48119 |
7.1 | 0.0031 | NET LOW CX NO UI | Nezha Monitoring is a self-hostable, lightweight, servers and websites monitorin | |
|
64
|
CVE-2026-110832 |
7.1 | 0.0031 | NET LOW CX NO UI | FreeRDP from 2.0.0 before 3.32.0 contains a memory exhaustion vulnerability in w | |
|
64
|
CVE-2026-116175 |
7.1 | 0.0031 | NET LOW CX NO UI | vLLM from 0.19.0 before 0.24.0 contains a decompression bomb vulnerability becau | |
|
64
|
CVE-2026-58230 |
7.0 | 0.0031 | NET NO AUTH NO UI | SAP Approuter does not sufficiently validate certain token content under specifi | |
|
60
|
CVE-2026-60528 |
7.6 | 0.0031 | NET LOW CX NO UI | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware | |
|
59
|
CVE-2026-91260 |
7.2 | 0.0032 | NET LOW CX NO UI | Vulnerability in the iProcurement product of Oracle E-Business Suite (component: | |
|
59
|
CVE-2026-65211 |
7.2 | 0.0032 | NET LOW CX NO UI | This issue may allow an authenticated IPMI Administrator to read and write arbit | |
|
59
|
CVE-2026-44860 |
7.2 | 0.0032 | NET LOW CX NO UI | SQL injection vulnerabilities exist in several underlying service components acc | |
|
59
|
CVE-2026-44861 |
7.2 | 0.0032 | NET LOW CX NO UI | SQL injection vulnerabilities exist in several underlying service components acc | |
|
59
|
CVE-2026-44862 |
7.2 | 0.0032 | NET LOW CX NO UI | SQL injection vulnerabilities exist in several underlying service components acc | |
|
59
|
CVE-2026-44863 |
7.2 | 0.0032 | NET LOW CX NO UI | SQL injection vulnerabilities exist in several underlying service components acc | |
|
59
|
CVE-2026-44864 |
7.2 | 0.0032 | NET LOW CX NO UI | SQL injection vulnerabilities exist in several underlying service components acc |