Hunt List
12,202 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
78
|
CVE-2026-75625 |
9.1 | 0.0024 | NET NO AUTH LOW CX NO UI | Kraken agents fail to verify peer-to-peer downloaded blobs against their request | |
|
78
|
CVE-2023-24215 |
9.1 | 0.0024 | NET NO AUTH LOW CX NO UI | Incorrect access control in the /uci/get/ endpoint of NOVUS AirGate 4G firmware | |
|
78
|
CVE-2026-7428 |
9.2 | 0.0024 | NET NO AUTH LOW CX NO UI | Prior to 2025-11-03, well-intended users of Terraform or REST API for Google Clo | |
|
77
|
CVE-2026-116183 |
8.7 | 0.0024 | NET NO AUTH LOW CX NO UI | phpMyFAQ before 4.1.10 contains an object-level authorization bypass vulnerabili | |
|
77
|
CVE-2026-33362 |
8.6 | 0.0024 | NET NO AUTH LOW CX NO UI | In Meari IoT SDK builds embedded in CloudEdge 5.5.0 (build 220), Arenti 1.8.1 (b | |
|
77
|
CVE-2026-100725 |
8.3 | 0.0024 | NET NO AUTH LOW CX NO UI | http4k (Maven artifact org.http4k:http4k-core) before 6.48.0.0, 5.42.0.0, and 4. | |
|
76
|
CVE-2026-44971 |
8.2 | 0.0024 | NET NO AUTH LOW CX NO UI | GuardDog is a CLI tool to identify malicious PyPI packages. From 1.0.0 to 2.9.0, | |
|
75
|
CVE-2026-33357 |
7.5 | 0.0024 | NET NO AUTH LOW CX NO UI | In Meari client applications embedding "com.meari.sdk" (including CloudEdge 5.5. | |
|
75
|
CVE-2026-108088 |
7.5 | 0.0024 | NET NO AUTH LOW CX NO UI | ** UNSUPPORTED WHEN ASSIGNED ** Use of cache containing sensitive information vu | |
|
75
|
CVE-2026-49064 |
7.5 | 0.0024 | NET NO AUTH LOW CX NO UI | Insertion of Sensitive Information Into Sent Data vulnerability in Stiofan GetPa | |
|
75
|
CVE-2026-40774 |
7.5 | 0.0024 | NET NO AUTH LOW CX NO UI | Unauthenticated Broken Access Control in Booking Package <= 1.7.06 versions. | |
|
75
|
CVE-2026-48873 |
7.5 | 0.0024 | NET NO AUTH LOW CX NO UI | Unauthenticated Broken Access Control in Montonio for WooCommerce <= 10.1.2 vers | |
|
75
|
CVE-2026-48883 |
7.5 | 0.0024 | NET NO AUTH LOW CX NO UI | Unauthenticated Broken Access Control in WPC Product Bundles for WooCommerce <= | |
|
75
|
CVE-2026-52692 |
7.5 | 0.0024 | NET NO AUTH LOW CX NO UI | Unauthenticated Sensitive Data Exposure in Affiliates Manager <= 2.9.50 versions | |
|
75
|
CVE-2026-52694 |
7.5 | 0.0024 | NET NO AUTH LOW CX NO UI | Unauthenticated Sensitive Data Exposure in Signature Add-On for WooCommerce <= 2 | |
|
75
|
CVE-2026-52696 |
7.5 | 0.0024 | NET NO AUTH LOW CX NO UI | Unauthenticated Sensitive Data Exposure in JetBlog <= 2.4.8 versions. | |
|
74
|
CVE-2026-111314 |
7.2 | 0.0024 | NET NO AUTH LOW CX NO UI | The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin | |
|
74
|
CVE-2026-111111 |
7.2 | 0.0024 | NET NO AUTH LOW CX NO UI | The Prime Slider – Hero Slider, Carousel, WooCommerce & Post Slider Elementor Ad | |
|
68
|
CVE-2026-52784 |
8.8 | 0.0024 | NET LOW CX NO UI | OpenProject is open-source, web-based project management software. Prior to 17.3 | |
|
68
|
CVE-2026-31940 |
8.8 | 0.0024 | NET NO AUTH LOW CX | Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, in | |
|
68
|
CVE-2026-49111 |
8.8 | 0.0024 | NET LOW CX NO UI | Incorrect Privilege Assignment vulnerability in ThemeGrill Masteriyo - LMS allow | |
|
67
|
CVE-2026-113870 |
8.6 | 0.0024 | NET NO AUTH LOW CX | MongoDB Compass improperly escapes certain BSON values when converting a stored | |
|
66
|
CVE-2026-22747 |
8.1 | 0.0024 | NET LOW CX NO UI | Vulnerability in Spring Spring Security. SubjectX500PrincipalExtractor does not | |
|
65
|
CVE-2026-55524 |
7.5 | 0.0024 | NET NO AUTH NO UI | PraisonAI is a multi-agent teams system. In versions prior to 1.6.58, the web_cr | |
|
64
|
CVE-2026-116208 |
7.2 | 0.0024 | NET NO AUTH LOW CX | YesWiki from 4.6.2 before 4.7.0 contains a missing authorization vulnerability i | |
|
64
|
CVE-2026-47015 |
7.1 | 0.0024 | NET NO AUTH LOW CX | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleS | |
|
64
|
CVE-2026-70858 |
7.1 | 0.0024 | NET NO AUTH LOW CX | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middlewar | |
|
64
|
CVE-2026-33783 |
7.1 | 0.0024 | NET LOW CX NO UI | A Function Call With Incorrect Argument Type vulnerability in the sensor interfa | |
|
64
|
CVE-2026-8843 |
7.1 | 0.0024 | NET LOW CX NO UI | Creating a "2dsphere_bucket" index on a non-timeseries bucket collection will su | |
|
64
|
CVE-2026-10825 |
7.1 | 0.0024 | NET LOW CX NO UI | A denial-of-service vulnerability exists in the WebSocket API due to insufficien | |
|
64
|
CVE-2026-56244 |
7.1 | 0.0024 | NET LOW CX NO UI | Capgo before 12.128.2 allows non-admin API keys to read webhook signing secrets | |
|
64
|
CVE-2026-91415 |
7.0 | 0.0024 | NET NO AUTH NO UI | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Ente | |
|
61
|
CVE-2026-116826 |
8.2 | 0.0024 | NET LOW CX NO UI | YesWiki before 4.7.0 contains a server-side request forgery vulnerability in Dup | |
|
59
|
CVE-2026-40823 |
7.0 | 0.0024 | NET LOW CX NO UI | A high privileged remote attacker can exploit an unauthenticated SQL Injection v | |
|
59
|
CVE-2026-40824 |
7.0 | 0.0024 | NET LOW CX NO UI | A high privileged remote attacker can exploit an unauthenticated SQL Injection v | |
|
59
|
CVE-2026-40825 |
7.0 | 0.0024 | NET LOW CX NO UI | A high privileged remote attacker can exploit an unauthenticated SQL Injection v | |
|
57
|
CVE-2026-12465 |
8.3 | 0.0024 | NET NO AUTH | Object lifecycle issue in Metrics in Google Chrome prior to 149.0.7827.155 allow | |
|
57
|
CVE-2026-15119 |
8.3 | 0.0024 | NET NO AUTH | Race in GetUserMedia in Google Chrome prior to 150.0.7871.115 allowed a remote a | |
|
57
|
CVE-2026-14429 |
8.3 | 0.0024 | NET NO AUTH | Insufficient validation of untrusted input in Skia in Google Chrome prior to 150 | |
|
57
|
CVE-2026-7900 |
8.3 | 0.0024 | NET NO AUTH | Heap buffer overflow in ANGLE in Google Chrome prior to 148.0.7778.96 allowed a | |
|
55
|
CVE-2026-19418 |
7.3 | 0.0024 | NET LOW CX | The referrer enforcement introduced with TYPO3-CORE-SA-2020-006 (CVE-2020-11069) | |
|
54
|
CVE-2026-60834 |
7.1 | 0.0024 | NET NO UI | Vulnerability in the Oracle Solaris product of Oracle Systems (component: Utilit | |
|
54
|
CVE-2026-60868 |
7.1 | 0.0024 | NET NO UI | Vulnerability in the Oracle Advanced Pricing product of Oracle E-Business Suite | |
|
54
|
CVE-2026-60949 |
7.1 | 0.0024 | NET NO UI | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middlewar | |
|
54
|
CVE-2026-62522 |
7.1 | 0.0024 | NET NO UI | Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle | |
|
54
|
CVE-2026-62627 |
7.1 | 0.0024 | NET NO UI | Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middlewar | |
|
54
|
CVE-2026-70760 |
7.1 | 0.0024 | NET NO UI | Vulnerability in the Oracle Order Management product of Oracle E-Business Suite | |
|
54
|
CVE-2026-46445 |
7.1 | 0.0024 | NET NO UI | SOGo before 5.12.7, when PostgreSQL is used, allows SQL injection. | |
|
54
|
CVE-2026-46446 |
7.1 | 0.0024 | NET NO UI | SOGo before 5.12.7, when PostgreSQL or MariaDB is used, and cleartext passwords | |
|
44
|
CVE-2026-114510 |
7.1 | 0.0024 | NET | Flexible GraphRAG is a Python framework for building graph and retrieval-augment |