Hunt List
12,697 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-3325 |
10.0 | 0.0027 | NET NO AUTH LOW CX NO UI | SQL injection (SQLi) in MegaCMS v12.0.0, specifically in the “id_territorio” par | |
|
80
|
CVE-2026-81212 |
10.0 | 0.0027 | NET NO AUTH LOW CX NO UI | IBM DataStage on Cloud Pak for Data 5.4.0.0 allows an unauthenticated user to pe | |
|
79
|
CVE-2026-46912 |
9.3 | 0.0027 | NET NO AUTH LOW CX NO UI | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards | |
|
79
|
CVE-2026-72785 |
9.3 | 0.0027 | NET NO AUTH LOW CX NO UI | Craft CMS 5.0.0-RC1 through 5.10.5 contains an incorrect authorization vulnerabi | |
|
78
|
CVE-2026-40910 |
9.1 | 0.0027 | NET NO AUTH LOW CX NO UI | frp is a fast reverse proxy. From 0.43.0 to 0.68.0, frp contains an authenticati | |
|
78
|
CVE-2026-94423 |
9.1 | 0.0027 | NET NO AUTH LOW CX NO UI | Net::LibSSH versions before 0.004 for Perl authenticate to an unverified server | |
|
78
|
CVE-2026-12681 |
8.9 | 0.0027 | NET NO AUTH LOW CX NO UI | Improper Validation of Specified Index, Position, or Offset in Input vulnerabili | |
|
77
|
CVE-2026-112355 |
8.7 | 0.0027 | NET NO AUTH LOW CX NO UI | The MembershipWorks plugin for WordPress before 6.17 contains an information dis | |
|
76
|
CVE-2026-43929 |
8.2 | 0.0027 | NET NO AUTH LOW CX NO UI | ssrfcheck is a library that checks if a string contains a potential SSRF attack. | |
|
76
|
CVE-2026-41879 |
8.2 | 0.0027 | NET NO AUTH LOW CX NO UI | R-SOFT DMS stores superadmin credentials using a non-salted nested MD5 hash. Thi | |
|
75
|
CVE-2026-43660 |
7.5 | 0.0027 | NET NO AUTH LOW CX NO UI | A validation issue was addressed with improved logic. This issue is fixed in Saf | |
|
75
|
CVE-2026-17698 |
7.5 | 0.0027 | NET NO AUTH LOW CX NO UI | Insufficient validation of untrusted input in UI in Google Chrome on Android pri | |
|
75
|
CVE-2026-10696 |
7.5 | 0.0027 | NET NO AUTH LOW CX NO UI | Use of an incorrectly resolved name or reference in the pinget backend in Devol | |
|
75
|
CVE-2026-44413 |
7.5 | 0.0027 | NET NO AUTH LOW CX NO UI | In JetBrains TeamCity before 2026.1 2025.11.5 authenticated users could expose s | |
|
75
|
CVE-2026-4870 |
7.5 | 0.0027 | NET NO AUTH LOW CX NO UI | IBM Qiskit SDK 0.43.0 through 2.5.0 could allow an attacker to trigger a segment | |
|
75
|
CVE-2026-0136 |
7.5 | 0.0027 | NET NO AUTH LOW CX NO UI | In Modem, there is a possible out of bounds read due to a missing bounds check. | |
|
75
|
CVE-2026-0144 |
7.5 | 0.0027 | NET NO AUTH LOW CX NO UI | In writeAocCommand of AocAudioCodec.cpp, there is a possible memory safety issue | |
|
75
|
CVE-2026-118039 |
7.5 | 0.0027 | NET NO AUTH LOW CX NO UI | In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027 | |
|
69
|
CVE-2026-33875 |
9.3 | 0.0027 | NET NO AUTH LOW CX | Gematik Authenticator securely authenticates users for login to digital health a | |
|
69
|
CVE-2026-12048 |
9.3 | 0.0027 | NET NO AUTH LOW CX | Stored cross-site scripting in pgAdmin 4's error-rendering and plan-node-renderi | |
|
69
|
CVE-2026-46911 |
9.6 | 0.0027 | NET LOW CX NO UI | Vulnerability in the JD Edwards EnterpriseOne Project Costing product of Oracle | |
|
69
|
CVE-2026-14411 |
9.6 | 0.0027 | NET NO AUTH LOW CX | Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 15 | |
|
68
|
CVE-2026-103506 |
8.9 | 0.0027 | NET LOW CX NO UI | An authenticated user in Grafana can read SSO client secrets and modify instance | |
|
68
|
CVE-2026-42559 |
8.8 | 0.0027 | NET NO AUTH LOW CX | RMCP is an official Rust SDK for the Model Context Protocol. Prior to version 1. | |
|
68
|
CVE-2026-115693 |
9.1 | 0.0027 | NET NO AUTH NO UI | Improper Certificate Validation vulnerability in hackney_ssl in benoitc hackney | |
|
68
|
CVE-2026-7901 |
8.8 | 0.0027 | NET NO AUTH LOW CX | Use after free in ANGLE in Google Chrome on Mac prior to 148.0.7778.96 allowed a | |
|
68
|
CVE-2026-7906 |
8.8 | 0.0027 | NET NO AUTH LOW CX | Use after free in SVG in Google Chrome prior to 148.0.7778.96 allowed a remote a | |
|
68
|
CVE-2026-7907 |
8.8 | 0.0027 | NET NO AUTH LOW CX | Use after free in DOM in Google Chrome prior to 148.0.7778.96 allowed a remote a | |
|
68
|
CVE-2026-7921 |
8.8 | 0.0027 | NET NO AUTH LOW CX | Use after free in Passwords in Google Chrome prior to 148.0.7778.96 allowed a re | |
|
68
|
CVE-2026-7926 |
8.8 | 0.0027 | NET NO AUTH LOW CX | Use after free in PresentationAPI in Google Chrome prior to 148.0.7778.96 allowe | |
|
68
|
CVE-2026-7938 |
8.8 | 0.0027 | NET NO AUTH LOW CX | Use after free in CSS in Google Chrome prior to 148.0.7778.96 allowed a remote a | |
|
68
|
CVE-2026-7974 |
8.8 | 0.0027 | NET NO AUTH LOW CX | Use after free in Blink in Google Chrome prior to 148.0.7778.96 allowed a remote | |
|
67
|
CVE-2026-61429 |
8.4 | 0.0027 | NET LOW CX NO UI | PraisonAI versions before 1.6.78 contain a server-side request forgery vulnerabi | |
|
66
|
CVE-2026-47129 |
8.1 | 0.0027 | NET LOW CX NO UI | NextCRM is open-source customer relationship management (CRM) software. Versions | |
|
64
|
CVE-2026-66090 |
7.1 | 0.0027 | NET LOW CX NO UI | In openEQUELLA before 2026.1, the XML parser used for item metadata does not dis | |
|
64
|
CVE-2026-103094 |
7.1 | 0.0027 | NET LOW CX NO UI | ServiceNow has remediated an information disclosure vulnerability that was ident | |
|
64
|
CVE-2026-54056 |
7.1 | 0.0027 | NET NO AUTH LOW CX | Kitty is a cross-platform GPU based terminal. In versions 0.47.0 and 0.47.1, `ki | |
|
64
|
CVE-2026-112342 |
7.1 | 0.0027 | NET LOW CX NO UI | Tandoor Recipes before 2.7.0 contains an improper cache-key design in cookbook/h | |
|
57
|
CVE-2026-6314 |
8.3 | 0.0027 | NET NO AUTH | Out of bounds write in GPU in Google Chrome prior to 147.0.7727.101 allowed a re | |
|
55
|
CVE-2026-70678 |
7.6 | 0.0027 | NET LOW CX | Vulnerability in the Oracle Hyperion Calculation Manager product of Oracle Hyper | |
|
55
|
CVE-2026-70786 |
7.6 | 0.0027 | NET LOW CX | Vulnerability in the Oracle Service Fulfillment Manager product of Oracle E-Busi | |
|
55
|
CVE-2026-70864 |
7.6 | 0.0027 | NET LOW CX | Vulnerability in Oracle Application Testing Suite. The supported version that | |
|
55
|
CVE-2026-70960 |
7.6 | 0.0027 | NET LOW CX | Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hype | |
|
55
|
CVE-2026-71020 |
7.6 | 0.0027 | NET LOW CX | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience | |
|
55
|
CVE-2026-71021 |
7.6 | 0.0027 | NET LOW CX | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience | |
|
55
|
CVE-2026-71022 |
7.6 | 0.0027 | NET LOW CX | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience | |
|
55
|
CVE-2026-71027 |
7.6 | 0.0027 | NET LOW CX | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience | |
|
55
|
CVE-2026-101849 |
7.6 | 0.0027 | NET LOW CX | Vulnerability in the Installed Base product of Oracle E-Business Suite (componen | |
|
54
|
CVE-2026-101827 |
7.1 | 0.0027 | NET NO UI | Vulnerability in the Oracle HCM Common Architecture product of Oracle E-Business | |
|
52
|
CVE-2026-4857 |
8.4 | 0.0027 | NET LOW CX | IdentityIQ 8.5, all IdentityIQ 8.5 patch levels prior to 8.5p2, IdentityIQ 8.4, |