Hunt List
12,779 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-50086 |
9.8 | 0.0029 | NET NO AUTH LOW CX NO UI | The Aqara IAM/SSO gateway (gw-builder.aqara.com) exposes bidirectional AES round | |
|
80
|
CVE-2026-43914 |
9.8 | 0.0029 | NET NO AUTH LOW CX NO UI | Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.35.4, t | |
|
79
|
CVE-2026-49067 |
9.3 | 0.0029 | NET NO AUTH LOW CX NO UI | Unauthenticated SQL Injection in Advanced 301 and 302 Redirect <= 1.6.9 versions | |
|
79
|
CVE-2026-49776 |
9.3 | 0.0029 | NET NO AUTH LOW CX NO UI | Unauthenticated SQL Injection in GPTranslate – Multilingual AI Translation for W | |
|
79
|
CVE-2026-52693 |
9.3 | 0.0029 | NET NO AUTH LOW CX NO UI | Unauthenticated SQL Injection in eCommerce Product Catalog <= 3.5.5 versions. | |
|
79
|
CVE-2026-54186 |
9.3 | 0.0029 | NET NO AUTH LOW CX NO UI | Unauthenticated SQL Injection in JobSearch <= 3.2.9 versions. | |
|
78
|
CVE-2026-12205 |
9.1 | 0.0029 | NET NO AUTH LOW CX NO UI | Crypt::DSA versions before 1.21 for Perl reused the nonce across signatures, lea | |
|
78
|
CVE-2026-56388 |
9.1 | 0.0029 | NET NO AUTH LOW CX NO UI | The Redis server command parser in Apache bRPC accepts an empty RESP array as a | |
|
75
|
CVE-2026-43977 |
7.5 | 0.0029 | NET NO AUTH LOW CX NO UI | wger is a free, open-source workout and fitness manager. In versions prior to 2. | |
|
74
|
CVE-2026-44246 |
7.2 | 0.0029 | NET NO AUTH LOW CX NO UI | nnU-Net is a semantic segmentation framework that automatically adapts its pipel | |
|
68
|
CVE-2026-6363 |
8.8 | 0.0029 | NET NO AUTH LOW CX | Type Confusion in V8 in Google Chrome prior to 147.0.7727.101 allowed a remote a | |
|
68
|
CVE-2026-6506 |
8.8 | 0.0029 | NET LOW CX NO UI | The InfusedWoo Pro plugin for WordPress is vulnerable to privilege escalation in | |
|
68
|
CVE-2026-76530 |
8.8 | 0.0029 | NET LOW CX NO UI | As part of Cisco's ongoing commitment to proactive security and product quality, | |
|
67
|
CVE-2026-34185 |
8.7 | 0.0029 | NET LOW CX NO UI | AlanWeb SCADA is vulnerable to SQL Injection across most scripts and input param | |
|
67
|
CVE-2026-115328 |
8.7 | 0.0029 | NET LOW CX NO UI | JSON-SCADA before 0.65-alpha contains an sql injection vulnerability in opcApi() | |
|
67
|
CVE-2026-35595 |
8.3 | 0.0029 | NET LOW CX NO UI | Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, | |
|
67
|
CVE-2026-45227 |
8.7 | 0.0029 | NET LOW CX NO UI | Heym before 0.0.21 contains a sandbox escape vulnerability in the custom Python | |
|
67
|
CVE-2026-112822 |
8.5 | 0.0029 | NET LOW CX NO UI | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti | |
|
67
|
CVE-2026-115608 |
8.5 | 0.0029 | NET LOW CX NO UI | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti | |
|
67
|
CVE-2026-115948 |
8.5 | 0.0029 | NET LOW CX NO UI | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti | |
|
67
|
CVE-2026-115965 |
8.5 | 0.0029 | NET LOW CX NO UI | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti | |
|
66
|
CVE-2026-13974 |
8.1 | 0.0029 | NET NO AUTH LOW CX | Integer overflow in Safe Browsing in Google Chrome on Mac prior to 150.0.7871.47 | |
|
66
|
CVE-2026-14122 |
8.1 | 0.0029 | NET NO AUTH LOW CX | Insufficient validation of untrusted input in WebAppInstalls in Google Chrome on | |
|
65
|
CVE-2026-100105 |
7.7 | 0.0029 | NET LOW CX NO UI | A user with permission to edit contact points but not their protected fields can | |
|
65
|
CVE-2026-88967 |
7.7 | 0.0029 | NET LOW CX NO UI | A user with query access to an Azure Monitor data source in Grafana can cause se | |
|
64
|
CVE-2026-61441 |
7.1 | 0.0029 | NET LOW CX NO UI | PraisonAI Platform (praisonai-platform) before 0.1.9 improperly authorizes delet | |
|
64
|
CVE-2026-13069 |
7.1 | 0.0029 | NET LOW CX NO UI | An authenticated user can cause excessive CPU consumption or out-of-memory condi | |
|
64
|
CVE-2026-60705 |
7.0 | 0.0029 | NET NO AUTH NO UI | Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM | |
|
64
|
CVE-2025-10527 |
7.1 | 0.0029 | NET NO AUTH LOW CX | Sandbox escape due to use-after-free in the Graphics: Canvas2D component. This v | |
|
64
|
CVE-2026-57746 |
7.1 | 0.0029 | NET LOW CX NO UI | Subscriber Broken Access Control in Booked <= 3.0.0 versions. | |
|
64
|
CVE-2026-47197 |
7.2 | 0.0029 | NET LOW CX NO UI | Quest Bot is an opensource Discord Bot. Prior to version 1.1.6, a moderator with | |
|
64
|
CVE-2026-112000 |
7.2 | 0.0029 | NET LOW CX NO UI | Vanus 0.8.0 through 0.9.0 contains a missing authorization vulnerability in the | |
|
62
|
CVE-2026-43912 |
8.7 | 0.0029 | NET LOW CX NO UI | Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.35.5, V | |
|
56
|
CVE-2026-46993 |
8.2 | 0.0029 | NET NO UI | Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle E | |
|
56
|
CVE-2026-60421 |
8.2 | 0.0029 | NET NO UI | Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middlewar | |
|
56
|
CVE-2026-60525 |
8.2 | 0.0029 | NET NO UI | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middlewar | |
|
56
|
CVE-2026-60665 |
8.2 | 0.0029 | NET NO UI | Vulnerability in the PeopleSoft Enterprise HCM Global Payroll Switzerland produc | |
|
56
|
CVE-2026-62456 |
8.2 | 0.0029 | NET NO UI | Vulnerability in the Oracle HRMS (UK) product of Oracle E-Business Suite (compon | |
|
56
|
CVE-2026-62598 |
8.2 | 0.0029 | NET NO UI | Vulnerability in the Oracle Hyperion Calculation Manager product of Oracle Hyper | |
|
56
|
CVE-2026-70703 |
8.2 | 0.0029 | NET NO UI | Vulnerability in the Oracle Agile Engineering Data Management product of Oracle | |
|
56
|
CVE-2026-70892 |
8.2 | 0.0029 | NET NO UI | Vulnerability in the Oracle Hyperion Data Relationship Management product of Ora | |
|
56
|
CVE-2026-70893 |
8.2 | 0.0029 | NET NO UI | Vulnerability in the Oracle Hyperion Data Relationship Management product of Ora | |
|
56
|
CVE-2026-70964 |
8.2 | 0.0029 | NET NO UI | Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle | |
|
56
|
CVE-2026-71096 |
8.2 | 0.0029 | NET NO UI | Vulnerability in the Oracle Business Intelligence Enterprise Edition product of | |
|
55
|
CVE-2026-39306 |
7.3 | 0.0029 | NET LOW CX | PraisonAI is a multi-agent teams system. Prior to 1.5.113, PraisonAI's recipe re | |
|
55
|
CVE-2026-56624 |
7.3 | 0.0029 | NET LOW CX | Improper certificate validation in Apache MINA SSHD (server-side). Apache MINA S | |
|
55
|
CVE-2026-17979 |
7.5 | 0.0029 | NET NO AUTH | Race in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to | |
|
54
|
CVE-2026-61306 |
7.1 | 0.0029 | NET NO UI | Vulnerability in the Oracle Complex Maintenance, Repair and Overhaul product of | |
|
54
|
CVE-2026-39976 |
7.1 | 0.0029 | NET NO UI | Laravel Passport provides OAuth2 server support to Laravel. From 13.0.0 to befor | |
|
51
|
CVE-2026-46361 |
8.2 | 0.0029 | NET LOW CX | phpMyFAQ before 4.1.2 contains a stored cross-site scripting vulnerability in se |