Hunt List
12,179 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
78
|
CVE-2026-87095 |
9.1 | 0.0024 | NET NO AUTH LOW CX NO UI | Sensitive information disclosure and manipulation due to improper authorization | |
|
78
|
CVE-2026-75625 |
9.1 | 0.0024 | NET NO AUTH LOW CX NO UI | Kraken agents fail to verify peer-to-peer downloaded blobs against their request | |
|
78
|
CVE-2023-24215 |
9.1 | 0.0024 | NET NO AUTH LOW CX NO UI | Incorrect access control in the /uci/get/ endpoint of NOVUS AirGate 4G firmware | |
|
78
|
CVE-2026-7428 |
9.2 | 0.0024 | NET NO AUTH LOW CX NO UI | Prior to 2025-11-03, well-intended users of Terraform or REST API for Google Clo | |
|
77
|
CVE-2026-116183 |
8.7 | 0.0024 | NET NO AUTH LOW CX NO UI | phpMyFAQ before 4.1.10 contains an object-level authorization bypass vulnerabili | |
|
77
|
CVE-2026-33362 |
8.6 | 0.0024 | NET NO AUTH LOW CX NO UI | In Meari IoT SDK builds embedded in CloudEdge 5.5.0 (build 220), Arenti 1.8.1 (b | |
|
77
|
CVE-2026-100725 |
8.3 | 0.0024 | NET NO AUTH LOW CX NO UI | http4k (Maven artifact org.http4k:http4k-core) before 6.48.0.0, 5.42.0.0, and 4. | |
|
76
|
CVE-2026-45089 |
8.2 | 0.0024 | NET NO AUTH LOW CX NO UI | Dalfox is a powerful open-source XSS scanner and utility focused on automation. | |
|
76
|
CVE-2026-44971 |
8.2 | 0.0024 | NET NO AUTH LOW CX NO UI | GuardDog is a CLI tool to identify malicious PyPI packages. From 1.0.0 to 2.9.0, | |
|
75
|
CVE-2026-52695 |
7.5 | 0.0024 | NET NO AUTH LOW CX NO UI | Unauthenticated Sensitive Data Exposure in ABC Crypto Checkout <= 1.8.2 versions | |
|
75
|
CVE-2026-33357 |
7.5 | 0.0024 | NET NO AUTH LOW CX NO UI | In Meari client applications embedding "com.meari.sdk" (including CloudEdge 5.5. | |
|
75
|
CVE-2026-108088 |
7.5 | 0.0024 | NET NO AUTH LOW CX NO UI | ** UNSUPPORTED WHEN ASSIGNED ** Use of cache containing sensitive information vu | |
|
74
|
CVE-2026-114636 |
7.0 | 0.0024 | NET NO AUTH LOW CX NO UI | Traefik v3.7.13 before v3.7.14 contains an access-control bypass in the Kubernet | |
|
74
|
CVE-2026-111314 |
7.2 | 0.0024 | NET NO AUTH LOW CX NO UI | The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin | |
|
74
|
CVE-2026-111111 |
7.2 | 0.0024 | NET NO AUTH LOW CX NO UI | The Prime Slider – Hero Slider, Carousel, WooCommerce & Post Slider Elementor Ad | |
|
68
|
CVE-2026-8002 |
8.8 | 0.0024 | NET NO AUTH LOW CX | Use after free in Audio in Google Chrome on Mac prior to 148.0.7778.96 allowed a | |
|
68
|
CVE-2026-6001 |
8.8 | 0.0024 | NET NO AUTH LOW CX | Authorization bypass through User-Controlled key vulnerability in ABIS Technolog | |
|
68
|
CVE-2026-44988 |
8.8 | 0.0024 | NET NO AUTH LOW CX | LibVNCClient is a library for easy implementation of a VNC client. In 0.9.15 and | |
|
68
|
CVE-2026-52784 |
8.8 | 0.0024 | NET LOW CX NO UI | OpenProject is open-source, web-based project management software. Prior to 17.3 | |
|
68
|
CVE-2026-31940 |
8.8 | 0.0024 | NET NO AUTH LOW CX | Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, in | |
|
66
|
CVE-2026-22747 |
8.1 | 0.0024 | NET LOW CX NO UI | Vulnerability in Spring Spring Security. SubjectX500PrincipalExtractor does not | |
|
65
|
CVE-2026-83366 |
7.4 | 0.0024 | NET NO AUTH NO UI | Vulnerability in the Oracle Shipping Execution product of Oracle E-Business Suit | |
|
65
|
CVE-2026-91288 |
7.4 | 0.0024 | NET NO AUTH NO UI | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards | |
|
65
|
CVE-2026-91337 |
7.4 | 0.0024 | NET NO AUTH NO UI | Vulnerability in the iProcurement product of Oracle E-Business Suite (component: | |
|
65
|
CVE-2026-55524 |
7.5 | 0.0024 | NET NO AUTH NO UI | PraisonAI is a multi-agent teams system. In versions prior to 1.6.58, the web_cr | |
|
64
|
CVE-2025-58966 |
7.1 | 0.0024 | NET NO AUTH LOW CX | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti | |
|
64
|
CVE-2026-116647 |
7.1 | 0.0024 | NET NO AUTH LOW CX | Tanium addressed an improper output sanitization vulnerability in Comply. | |
|
64
|
CVE-2026-116208 |
7.2 | 0.0024 | NET NO AUTH LOW CX | YesWiki from 4.6.2 before 4.7.0 contains a missing authorization vulnerability i | |
|
64
|
CVE-2026-47015 |
7.1 | 0.0024 | NET NO AUTH LOW CX | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleS | |
|
64
|
CVE-2026-70858 |
7.1 | 0.0024 | NET NO AUTH LOW CX | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middlewar | |
|
64
|
CVE-2026-33783 |
7.1 | 0.0024 | NET LOW CX NO UI | A Function Call With Incorrect Argument Type vulnerability in the sensor interfa | |
|
64
|
CVE-2026-8843 |
7.1 | 0.0024 | NET LOW CX NO UI | Creating a "2dsphere_bucket" index on a non-timeseries bucket collection will su | |
|
64
|
CVE-2026-10825 |
7.1 | 0.0024 | NET LOW CX NO UI | A denial-of-service vulnerability exists in the WebSocket API due to insufficien | |
|
61
|
CVE-2026-116826 |
8.2 | 0.0024 | NET LOW CX NO UI | YesWiki before 4.7.0 contains a server-side request forgery vulnerability in Dup | |
|
58
|
CVE-2026-115392 |
8.8 | 0.0024 | NET LOW CX | Wasmtime before 24.0.13, 25.0.0 before 36.0.14, 37.0.0 before 46.0.3, and 47.0.0 | |
|
58
|
CVE-2026-118688 |
8.8 | 0.0024 | NET LOW CX | wasmtime-wasi in Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 befor | |
|
57
|
CVE-2026-12465 |
8.3 | 0.0024 | NET NO AUTH | Object lifecycle issue in Metrics in Google Chrome prior to 149.0.7827.155 allow | |
|
57
|
CVE-2026-15119 |
8.3 | 0.0024 | NET NO AUTH | Race in GetUserMedia in Google Chrome prior to 150.0.7871.115 allowed a remote a | |
|
57
|
CVE-2026-14429 |
8.3 | 0.0024 | NET NO AUTH | Insufficient validation of untrusted input in Skia in Google Chrome prior to 150 | |
|
57
|
CVE-2026-7900 |
8.3 | 0.0024 | NET NO AUTH | Heap buffer overflow in ANGLE in Google Chrome prior to 148.0.7778.96 allowed a | |
|
56
|
CVE-2026-35575 |
8.0 | 0.0024 | NET LOW CX | ChurchCRM is an open-source church management system. Prior to 6.5.3, a Stored C | |
|
55
|
CVE-2025-13012 |
7.5 | 0.0024 | NET NO AUTH | Race condition in the Graphics component. This vulnerability was fixed in Firefo | |
|
55
|
CVE-2026-19418 |
7.3 | 0.0024 | NET LOW CX | The referrer enforcement introduced with TYPO3-CORE-SA-2020-006 (CVE-2020-11069) | |
|
54
|
CVE-2026-60834 |
7.1 | 0.0024 | NET NO UI | Vulnerability in the Oracle Solaris product of Oracle Systems (component: Utilit | |
|
54
|
CVE-2026-60868 |
7.1 | 0.0024 | NET NO UI | Vulnerability in the Oracle Advanced Pricing product of Oracle E-Business Suite | |
|
54
|
CVE-2026-60949 |
7.1 | 0.0024 | NET NO UI | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middlewar | |
|
54
|
CVE-2026-62522 |
7.1 | 0.0024 | NET NO UI | Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle | |
|
54
|
CVE-2026-62627 |
7.1 | 0.0024 | NET NO UI | Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middlewar | |
|
54
|
CVE-2026-70760 |
7.1 | 0.0024 | NET NO UI | Vulnerability in the Oracle Order Management product of Oracle E-Business Suite | |
|
44
|
CVE-2026-114510 |
7.1 | 0.0024 | NET | Flexible GraphRAG is a Python framework for building graph and retrieval-augment |