Hunt List
11,651 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
98
|
CVE-2026-55040 |
9.1 | 0.6954 | NET NO AUTH LOW CX NO UI | KEV 5 PoC | Microsoft SharePoint contains a weak authentication vulnerability which allows a |
|
90
|
CVE-2026-63077 |
9.8 | 0.9356 | NET NO AUTH LOW CX NO UI | KEV RW | JetBrains TeamCity contains a deserialization of untrusted data vulnerability th |
|
90
|
CVE-2026-39808 |
9.8 | 0.9319 | NET NO AUTH LOW CX NO UI | KEV | Fortinet FortiSandbox contains an OS command injection vulnerability that could |
|
90
|
CVE-2026-20182 |
10.0 | 0.9182 | NET NO AUTH LOW CX NO UI | KEV | Cisco Catalyst SD-WAN Controller & Manager contain an authentication bypass vuln |
|
90
|
CVE-2026-48908 |
10.0 | 0.8851 | NET NO AUTH LOW CX NO UI | KEV | JoomShaper SP Page Builder contains an unrestricted upload of file with dangerou |
|
90
|
CVE-2024-21762 |
9.8 | 0.8459 | NET NO AUTH LOW CX NO UI | KEV RW | Fortinet FortiOS contains an out-of-bound write vulnerability that allows a remo |
|
90
|
CVE-2026-105134 |
10.0 | 0.8176 | NET NO AUTH LOW CX NO UI | KEV | Ahsay AhsayCBS contains a command injection vulnerability that could allow a rem |
|
90
|
CVE-2026-41089 |
9.8 | 0.7962 | NET NO AUTH LOW CX NO UI | Stack-based buffer overflow in Windows Netlogon allows an unauthorized attacker | |
|
90
|
CVE-2026-0740 |
9.8 | 0.6290 | NET NO AUTH LOW CX NO UI | The Ninja Forms - File Uploads plugin for WordPress is vulnerable to arbitrary f | |
|
90
|
CVE-2026-2699 |
9.8 | 0.5839 | NET NO AUTH LOW CX NO UI | Customer Managed ShareFile Storage Zones Controller (SZC) allows an unauthentica | |
|
89
|
CVE-2026-21589 |
9.3 | 0.9948 | NET NO AUTH LOW CX NO UI | KEV | Multiple Atlassian products (Bitbucket Data Center ,Confluence Data Center, Jira |
|
89
|
CVE-2026-41940 |
9.3 | 0.9853 | NET NO AUTH LOW CX NO UI | KEV RW | WebPros cPanel & WHM (WebHost Manager) and WP2 (WordPress Squared) contain an au |
|
89
|
CVE-2026-42208 |
9.3 | 0.8942 | NET NO AUTH LOW CX NO UI | KEV | BerriAI LiteLLM contains a SQL injection vulnerability that allows an attacker t |
|
88
|
CVE-2026-109618 |
9.2 | 1.0000 | NET NO AUTH NO UI | KEV 710 PoC | PHP contains an out-of-memory corruption vulnerability that allows for unauthent |
|
88
|
CVE-2026-71362 |
9.1 | 0.9049 | NET NO AUTH LOW CX NO UI | KEV | Adobe Commerce and Magento contains an incorrect authorization vulnerability tha |
|
88
|
CVE-2026-111497 |
9.2 | 0.8799 | NET NO AUTH LOW CX NO UI | KEV | Google Brotli contains an unchecked return value vulnerability that allows a rem |
|
88
|
CVE-2026-42945 |
9.2 | 0.6805 | NET NO AUTH LOW CX NO UI | NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_mo | |
|
88
|
CVE-2026-48282 |
10.0 | 0.4239 | NET NO AUTH LOW CX NO UI | KEV | Adobe ColdFusion contains a path traversal vulnerability that could lead to arbi |
|
87
|
CVE-2026-0300 |
9.3 | 0.4171 | NET NO AUTH LOW CX NO UI | KEV | Palo Alto Networks PAN-OS contains an out-of-bounds write vulnerability in the U |
|
86
|
CVE-2026-0257 |
7.8 | 0.9501 | NET NO AUTH LOW CX NO UI | KEV RW | Palo Alto Networks PAN-OS contains an authentication bypass vulnerability that a |
|
86
|
CVE-2026-41679 |
10.0 | 0.3167 | NET NO AUTH LOW CX NO UI | Paperclip is a Node.js server and React UI that orchestrates a team of AI agents | |
|
86
|
CVE-2026-56290 |
10.0 | 0.3087 | NET NO AUTH LOW CX NO UI | KEV | Joomlack Page Builder contains an improper access control vulnerability that cou |
|
85
|
CVE-2026-19490 |
9.3 | 0.3265 | NET NO AUTH LOW CX NO UI | KEV | Citrix NetScaler ADC and NetScaler Gateway contain an authentication-bypass vuln |
|
85
|
CVE-2026-9198 |
9.8 | 0.2866 | NET NO AUTH LOW CX NO UI | KEV | Langflow contains a code injection vulnerability that allows unauthenticated att |
|
84
|
CVE-2026-33626 |
7.5 | 0.4525 | NET NO AUTH LOW CX NO UI | LMDeploy is a toolkit for compressing, deploying, and serving large language mod | |
|
84
|
CVE-2026-39813 |
9.8 | 0.2222 | NET NO AUTH LOW CX NO UI | A path traversal: '../filedir' vulnerability in Fortinet FortiSandbox 5.0.0 thro | |
|
84
|
CVE-2026-48939 |
10.0 | 0.2007 | NET NO AUTH LOW CX NO UI | KEV | iCagenda contains an unrestricted upload of file with dangerous type vulnerabili |
|
83
|
CVE-2026-22679 |
9.3 | 0.2036 | NET NO AUTH LOW CX NO UI | Weaver (Fanwei) E-cology 10.0 versions prior to 20260312 contain an unauthentica | |
|
83
|
CVE-2026-41268 |
9.8 | 0.1744 | NET NO AUTH LOW CX NO UI | Flowise is a drag & drop user interface to build a customized large language mod | |
|
83
|
CVE-2026-58644 |
9.8 | 0.1587 | NET NO AUTH LOW CX NO UI | KEV | Microsoft SharePoint contains a deserialization of untrusted data vulnerability |
|
82
|
CVE-2026-9586 |
9.3 | 0.1898 | NET NO AUTH LOW CX NO UI | KEV | Sangoma Switchvox contains a SQL injection vulnerability which allows an unauthe |
|
82
|
CVE-2026-25874 |
9.3 | 0.1555 | NET NO AUTH LOW CX NO UI | LeRobot through 0.5.1 contains an unsafe deserialization vulnerability in the as | |
|
81
|
CVE-2026-5854 |
8.9 | 0.1661 | NET NO AUTH LOW CX NO UI | A vulnerability was detected in Totolink A7100RU 7.4cu.2313_b20191024. Affected | |
|
79
|
CVE-2026-48356 |
9.3 | 0.5908 | NET NO AUTH LOW CX | KEV | Adobe Commerce and Magento contain an unrestricted upload of file with dangerous |
|
79
|
CVE-2026-34648 |
7.5 | 0.2138 | NET NO AUTH LOW CX NO UI | Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2 | |
|
78
|
CVE-2026-109619 |
9.2 | 1.0000 | NET NO AUTH NO UI | KEV | PHP contains a stale internal request-state vulnerability that allows for unauth |
|
78
|
CVE-2023-29525 |
8.8 | 0.7775 | NET LOW CX NO UI | XWiki Platform is a generic wiki platform offering runtime services for applicat | |
|
78
|
CVE-2026-2701 |
8.8 | 0.5454 | NET LOW CX NO UI | Authenticated user can upload a malicious file to the server and execute it, whi | |
|
77
|
CVE-2026-42271 |
8.7 | 0.9144 | NET LOW CX NO UI | KEV | BerriAI LiteLLM contains a command injection vulnerability that could allow any |
|
75
|
CVE-2026-35029 |
8.7 | 0.3861 | NET LOW CX NO UI | LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) fo | |
|
74
|
CVE-2026-33112 |
8.8 | 0.3112 | NET LOW CX NO UI | Deserialization of untrusted data in Microsoft Office SharePoint allows an autho | |
|
73
|
CVE-2025-11700 |
8.4 | 0.3168 | NET LOW CX NO UI | N-central versions < 2025.4 are vulnerable to multiple XML External Entities inj | |
|
73
|
CVE-2026-86950 |
8.8 | 0.2617 | NET NO AUTH LOW CX | KEV | Apple iOS, macOS, and iPadOS contain an out-of-bounds write vulnerability in Cor |
|
72
|
CVE-2026-0628 |
8.8 | 0.2095 | NET NO AUTH LOW CX | Insufficient policy enforcement in WebView tag in Google Chrome prior to 143.0.7 | |
|
71
|
CVE-2023-2288 |
8.8 | 0.1797 | NET LOW CX NO UI | The Otter WordPress plugin before 2.2.6 does not sanitize some user-controlled f | |
|
68
|
CVE-2023-29154 |
7.2 | 0.4144 | NET LOW CX NO UI | SQL injection vulnerability exists in the CONPROSYS HMI System (CHS) versions pr | |
|
66
|
CVE-2026-6973 |
7.2 | 0.3445 | NET LOW CX NO UI | KEV | Ivanti Endpoint Manager Mobile (EPMM) contains an improper input validation vuln |
|
65
|
CVE-2026-22666 |
8.6 | 0.1553 | NET LOW CX NO UI | Dolibarr ERP/CRM versions prior to 23.0.2 contain an authenticated remote code e | |
|
63
|
CVE-2026-3518 |
7.2 | 0.1688 | NET LOW CX NO UI | OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC | |
|
62
|
CVE-2026-3517 |
7.2 | 0.1549 | NET LOW CX NO UI | OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC |