Hunt List
12,333 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
79
|
CVE-2026-22093 |
9.5 | 0.0026 | NET NO AUTH LOW CX NO UI | The EVbee Service Android app uses TLS encrypted communication (HTTPS), but does | |
|
78
|
CVE-2017-20243 |
8.8 | 0.0026 | NET NO AUTH LOW CX NO UI | WordPress Car Park Booking Plugin version 13 October 17 contains a time-based SQ | |
|
78
|
CVE-2026-78334 |
9.1 | 0.0026 | NET NO AUTH LOW CX NO UI | Missing authentication in the streaming RPC path of Apache bRPC (version < 1.18. | |
|
78
|
CVE-2026-114596 |
8.8 | 0.0026 | NET NO AUTH LOW CX NO UI | In EPICS Base release 7.0.10 and prior, an improper validation of message length | |
|
78
|
CVE-2026-44699 |
9.1 | 0.0026 | NET NO AUTH LOW CX NO UI | LibJWT is a C JSON Web Token Library. From 3.0.0 to 3.3.2, libjwt accepts an RSA | |
|
77
|
CVE-2026-69249 |
8.7 | 0.0026 | NET NO AUTH LOW CX NO UI | python-cryptography is a package designed to expose cryptographic primitives and | |
|
77
|
CVE-2026-55883 |
8.3 | 0.0026 | NET NO AUTH LOW CX NO UI | Tilt defines dev environments as code for microservice apps on Kubernetes. From | |
|
77
|
CVE-2026-41039 |
8.7 | 0.0026 | NET NO AUTH LOW CX NO UI | This vulnerability exists in Quantum Networks router due to improper access cont | |
|
77
|
CVE-2026-22343 |
8.6 | 0.0026 | NET NO AUTH LOW CX NO UI | Unauthenticated Broken Access Control in WordPress Dating Theme <= 11.2.0 versio | |
|
76
|
CVE-2026-41279 |
8.2 | 0.0026 | NET NO AUTH LOW CX NO UI | Flowise is a drag & drop user interface to build a customized large language mod | |
|
76
|
CVE-2026-42260 |
8.2 | 0.0026 | NET NO AUTH LOW CX NO UI | Open-WebSearch is a multi-engine MCP server, CLI, and local daemon for agent web | |
|
76
|
CVE-2026-53712 |
8.2 | 0.0026 | NET NO AUTH LOW CX NO UI | SCRAM (Salted Challenge Response Authentication Mechanism) is part of the family | |
|
76
|
CVE-2026-91573 |
8.2 | 0.0026 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Agile Product Lifecycle Management for Process produ | |
|
75
|
CVE-2026-41712 |
7.5 | 0.0026 | NET NO AUTH LOW CX NO UI | Spring AI's chat memory component contained a problematic default that, when not | |
|
68
|
CVE-2026-43892 |
8.8 | 0.0026 | NET NO AUTH LOW CX | AntSword is a cross-platform website management toolkit. Prior to 2.1.16, incomp | |
|
67
|
CVE-2026-102786 |
8.6 | 0.0026 | NET NO AUTH LOW CX | Joomla Extension - phoca.cz - Authenticated stored cross-site scripting through | |
|
67
|
CVE-2026-42730 |
8.5 | 0.0026 | NET LOW CX NO UI | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti | |
|
67
|
CVE-2026-34291 |
8.7 | 0.0026 | NET NO AUTH NO UI | Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (com | |
|
67
|
CVE-2026-106433 |
8.7 | 0.0026 | NET LOW CX NO UI | Improper state management in MongoDB libmongocrypt can cause provider-specific d | |
|
67
|
CVE-2026-91492 |
8.7 | 0.0026 | NET NO AUTH NO UI | Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion | |
|
67
|
CVE-2026-97635 |
8.6 | 0.0026 | NET NO AUTH LOW CX | The Agent Zero Web UI before 1.15 does not correctly sanitize user-provided inpu | |
|
66
|
CVE-2026-5302 |
8.1 | 0.0026 | NET NO AUTH LOW CX | CORS misconfiguration in CoolerControl/coolercontrold <4.0.0 allows unauthentica | |
|
65
|
CVE-2026-39910 |
7.7 | 0.0026 | NET LOW CX NO UI | STACKIT IaaS API contains a missing authorization check in the PUT servers servi | |
|
65
|
CVE-2026-53855 |
7.6 | 0.0026 | NET LOW CX NO UI | OpenClaw before 2026.4.2 contains an inline-eval bypass vulnerability allowing a | |
|
64
|
CVE-2026-40832 |
7.1 | 0.0026 | NET LOW CX NO UI | An low privileged remote attacker can exploit an unauthenticated SQL Injection v | |
|
64
|
CVE-2026-40835 |
7.1 | 0.0026 | NET LOW CX NO UI | An low privileged remote attacker can exploit an unauthenticated SQL Injection v | |
|
64
|
CVE-2026-40837 |
7.1 | 0.0026 | NET LOW CX NO UI | An low privileged remote attacker can exploit an unauthenticated SQL Injection v | |
|
64
|
CVE-2026-40838 |
7.1 | 0.0026 | NET LOW CX NO UI | An low privileged remote attacker can exploit an unauthenticated SQL Injection v | |
|
64
|
CVE-2026-40839 |
7.1 | 0.0026 | NET LOW CX NO UI | An low privileged remote attacker can exploit an unauthenticated SQL Injection v | |
|
64
|
CVE-2026-40840 |
7.1 | 0.0026 | NET LOW CX NO UI | An low privileged remote attacker can exploit an unauthenticated SQL Injection v | |
|
64
|
CVE-2026-40841 |
7.1 | 0.0026 | NET LOW CX NO UI | An low privileged remote attacker can exploit an unauthenticated SQL Injection v | |
|
64
|
CVE-2026-40842 |
7.1 | 0.0026 | NET LOW CX NO UI | An low privileged remote attacker can exploit an unauthenticated SQL Injection v | |
|
64
|
CVE-2026-40843 |
7.1 | 0.0026 | NET LOW CX NO UI | An low privileged remote attacker can exploit an unauthenticated SQL Injection v | |
|
64
|
CVE-2026-40844 |
7.1 | 0.0026 | NET LOW CX NO UI | An low privileged remote attacker can exploit an unauthenticated SQL Injection v | |
|
64
|
CVE-2026-40845 |
7.1 | 0.0026 | NET LOW CX NO UI | An low privileged remote attacker can exploit an unauthenticated SQL Injection v | |
|
64
|
CVE-2026-40846 |
7.1 | 0.0026 | NET LOW CX NO UI | An low privileged remote attacker can exploit an unauthenticated SQL Injection v | |
|
64
|
CVE-2026-40847 |
7.1 | 0.0026 | NET LOW CX NO UI | An low privileged remote attacker can exploit an unauthenticated SQL Injection v | |
|
64
|
CVE-2026-40848 |
7.1 | 0.0026 | NET LOW CX NO UI | An low privileged remote attacker can exploit an unauthenticated SQL Injection v | |
|
64
|
CVE-2026-40849 |
7.1 | 0.0026 | NET LOW CX NO UI | An low privileged remote attacker can exploit an unauthenticated SQL Injection v | |
|
64
|
CVE-2026-40880 |
7.2 | 0.0026 | NET LOW CX NO UI | ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.3.1 an | |
|
64
|
CVE-2026-75146 |
7.2 | 0.0026 | NET NO AUTH LOW CX | FFmpeg before commit 65b0dab contains an out-of-bounds read in the DASH demuxer | |
|
64
|
CVE-2026-32960 |
7.1 | 0.0026 | NET NO AUTH LOW CX | SD-330AC and AMC Manager provided by silex technology, Inc. contain an issue wit | |
|
57
|
CVE-2026-45270 |
8.7 | 0.0026 | NET LOW CX | CI4MS is a CodeIgniter 4-based content management system skeleton. Prior to vers | |
|
57
|
CVE-2026-12010 |
8.3 | 0.0026 | NET NO AUTH | Heap buffer overflow in GPU in Google Chrome on Android prior to 149.0.7827.115 | |
|
57
|
CVE-2026-35576 |
8.7 | 0.0026 | NET LOW CX | ChurchCRM is an open-source church management system. Prior to 7.0.0, a stored c | |
|
57
|
CVE-2026-41524 |
8.7 | 0.0026 | NET LOW CX | Brave CMS is an open-source CMS. Prior to commit 6c56603, page and article body | |
|
57
|
CVE-2026-13281 |
8.3 | 0.0026 | NET NO AUTH | Integer overflow in Mojo in Google Chrome prior to 149.0.7827.201 allowed a remo | |
|
56
|
CVE-2026-101841 |
8.2 | 0.0026 | NET NO UI | Vulnerability in the Global Order Promising product of Oracle E-Business Suite ( | |
|
45
|
CVE-2026-60657 |
7.7 | 0.0026 | NET | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middlewar | |
|
45
|
CVE-2026-70857 |
7.7 | 0.0026 | NET | Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component |