Hunt List
12,005 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-16812 |
10.0 | 0.0176 | NET NO AUTH LOW CX NO UI | KEV | Arista VeloCloud Orchestrator On-Prem contains an OS command injection vulnerabi |
|
80
|
CVE-2026-45748 |
9.8 | 0.0173 | NET NO AUTH LOW CX NO UI | Termix is a web-based server management platform with SSH terminal, tunneling, a | |
|
80
|
CVE-2026-65400 |
9.8 | 0.0172 | NET NO AUTH LOW CX NO UI | KEV | Apple macOS contains an improper authentication vulnerability that could allow a |
|
80
|
CVE-2026-66713 |
9.8 | 0.0172 | NET NO AUTH LOW CX NO UI | Deserialization of Untrusted Data (CWE-502) in the Tribes-based clustering compo | |
|
80
|
CVE-2026-47210 |
9.8 | 0.0172 | NET NO AUTH LOW CX NO UI | vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, a sandbox | |
|
80
|
CVE-2026-42076 |
9.8 | 0.0170 | NET NO AUTH LOW CX NO UI | Evolver is a GEP-powered self-evolving engine for AI agents. Prior to version 1. | |
|
80
|
CVE-2026-41293 |
9.8 | 0.0170 | NET NO AUTH LOW CX NO UI | Improper Input Validation vulnerability in Apache Tomcat. This issue affects Ap | |
|
80
|
CVE-2026-50746 |
10.0 | 0.0169 | NET NO AUTH LOW CX NO UI | A malicious actor with access to the network could exploit an Improper Access Co | |
|
80
|
CVE-2026-105016 |
9.8 | 0.0166 | NET NO AUTH LOW CX NO UI | Heap-based buffer overflow in Microsoft QUIC allows an unauthorized attacker to | |
|
80
|
CVE-2026-72580 |
9.8 | 0.0165 | NET NO AUTH LOW CX NO UI | An OS command injection vulnerability in duhow/xiaoai-patch through commit fb070 | |
|
80
|
CVE-2026-8500 |
9.8 | 0.0165 | NET NO AUTH LOW CX NO UI | Web::Passwd versions through 0.03 for Perl is vulnerable to RCE. Web::Passwd is | |
|
80
|
CVE-2026-33264 |
9.8 | 0.0165 | NET NO AUTH LOW CX NO UI | A bug in `BaseSerialization.deserialize()` allowed unrestricted `import_string() | |
|
80
|
CVE-2026-34159 |
9.8 | 0.0162 | NET NO AUTH LOW CX NO UI | llama.cpp is an inference of several LLM models in C/C++. Prior to version b8492 | |
|
80
|
CVE-2026-8054 |
10.0 | 0.0158 | NET NO AUTH LOW CX NO UI | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti | |
|
79
|
CVE-2026-40887 |
9.1 | 0.0176 | NET NO AUTH LOW CX NO UI | Vendure is an open-source headless commerce platform. Starting in version 1.7.4 | |
|
79
|
CVE-2026-46364 |
9.3 | 0.0171 | NET NO AUTH LOW CX NO UI | phpMyFAQ before 4.1.2 contains an unauthenticated SQL injection vulnerability in | |
|
79
|
CVE-2026-53975 |
9.3 | 0.0168 | NET NO AUTH LOW CX NO UI | OpenChamber 1.11.7 contains an unauthenticated remote code execution vulnerabili | |
|
79
|
CVE-2026-5965 |
9.3 | 0.0164 | NET NO AUTH LOW CX NO UI | NewSoftOA developed by NewSoft has an OS Command Injection vulnerability, allowi | |
|
79
|
CVE-2026-42062 |
9.3 | 0.0163 | NET NO AUTH LOW CX NO UI | ELECOM wireless LAN access point devices contain an OS command injection in proc | |
|
79
|
CVE-2026-42281 |
9.2 | 0.0162 | NET NO AUTH LOW CX NO UI | MagicMirror² is an open source modular smart mirror platform. Prior to 2.36.0, a | |
|
78
|
CVE-2026-116067 |
8.8 | 0.0169 | NET NO AUTH LOW CX NO UI | Paisa before 0.7.8 contains a path traversal vulnerability in the GetFile, GetSh | |
|
77
|
CVE-2026-58467 |
8.2 | 0.0173 | NET NO AUTH LOW CX NO UI | Cockpit CMS through 2.14.0 contains a path traversal and local file inclusion vu | |
|
75
|
CVE-2025-57231 |
7.5 | 0.0173 | NET NO AUTH LOW CX NO UI | Path Traversal in avatar attachments in Docmost v0.21.0 allows an unauthenticate | |
|
75
|
CVE-2026-50652 |
7.5 | 0.0173 | NET NO AUTH LOW CX NO UI | Deserialization of untrusted data in Azure Active Directory allows an unauthoriz | |
|
75
|
CVE-2023-22796 |
7.5 | 0.0171 | NET NO AUTH LOW CX NO UI | A regular expression based DoS vulnerability in Active Support <6.1.7.1 and <7.0 | |
|
75
|
CVE-2023-22792 |
7.5 | 0.0169 | NET NO AUTH LOW CX NO UI | A regular expression based DoS vulnerability in Action Dispatch <6.0.6.1,< 6.1.7 | |
|
75
|
CVE-2026-12609 |
7.5 | 0.0164 | NET NO AUTH LOW CX NO UI | In Eclipse Theia versions 1.66.0 and up until including 1.73.1, the `@theia/plug | |
|
75
|
CVE-2026-11801 |
7.5 | 0.0164 | NET NO AUTH LOW CX NO UI | The WPAdverts – Classifieds Plugin plugin for WordPress is vulnerable to authori | |
|
75
|
CVE-2026-18125 |
7.5 | 0.0159 | NET NO AUTH LOW CX NO UI | An out-of-bounds read in the Agent of Ivanti Endpoint Manager before version 202 | |
|
70
|
CVE-2026-50517 |
9.9 | 0.0169 | NET LOW CX NO UI | Deserialization of untrusted data in M365 Copilot allows an authorized attacker | |
|
70
|
CVE-2026-50515 |
9.9 | 0.0169 | NET LOW CX NO UI | Deserialization of untrusted data in Azure Service Bus allows an authorized atta | |
|
70
|
CVE-2026-50748 |
9.9 | 0.0163 | NET LOW CX NO UI | A malicious actor with access to the network and low privileges could exploit an | |
|
69
|
CVE-2026-63304 |
9.2 | 0.0173 | NET NO AUTH NO UI | AVideo through 29.0 contains an OS command injection vulnerability in plugin/API | |
|
69
|
CVE-2026-56379 |
9.2 | 0.0164 | NET NO AUTH NO UI | ImageMagick before 7.1.2-15 and 6.9.13-40 contains a command injection vulnerabi | |
|
68
|
CVE-2026-58000 |
8.7 | 0.0172 | NET LOW CX NO UI | luci-proto-openvpn through 0.11.1, fixed in commit e4ff45e, contains a command i | |
|
68
|
CVE-2026-40357 |
8.8 | 0.0170 | NET LOW CX NO UI | Deserialization of untrusted data in Microsoft Office SharePoint allows an autho | |
|
68
|
CVE-2026-65815 |
8.8 | 0.0169 | NET LOW CX NO UI | Deserialization of untrusted data in Microsoft Dynamics 365 (on-premises) allows | |
|
68
|
CVE-2026-70321 |
8.8 | 0.0169 | NET LOW CX NO UI | Deserialization of untrusted data in Microsoft Office SharePoint allows an autho | |
|
68
|
CVE-2026-65665 |
8.8 | 0.0169 | NET LOW CX NO UI | Deserialization of untrusted data in Microsoft Office SharePoint allows an autho | |
|
68
|
CVE-2026-40502 |
8.7 | 0.0169 | NET LOW CX NO UI | OpenHarness prior to commit dd1d235 contains a command injection vulnerability t | |
|
68
|
CVE-2026-42364 |
8.8 | 0.0168 | NET LOW CX NO UI | An os command injection vulnerability exists in the DdnsSetting.cgi functionalit | |
|
68
|
CVE-2026-65674 |
8.8 | 0.0162 | NET LOW CX NO UI | Deserialization of untrusted data in SQL Server allows an authorized attacker to | |
|
68
|
CVE-2023-22789 |
8.8 | 0.0160 | NET LOW CX NO UI | Multiple authenticated command injection vulnerabilities exist in the Aruba Inst | |
|
68
|
CVE-2026-9155 |
8.8 | 0.0160 | NET LOW CX NO UI | OS Command Injection vulnerability in Rapid7 InsightConnect Sed Plugin on Linux | |
|
67
|
CVE-2026-34885 |
8.5 | 0.0167 | NET LOW CX NO UI | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti | |
|
67
|
CVE-2025-34023 |
8.5 | 0.0160 | NET LOW CX NO UI | A path traversal vulnerability exists in the Karel IP1211 IP Phone's web managem | |
|
64
|
CVE-2026-9814 |
9.1 | 0.0160 | NET LOW CX NO UI | An OS command injection vulnerability exists in the boa formWizard newPass funct | |
|
63
|
CVE-2026-9717 |
8.6 | 0.0173 | NET LOW CX NO UI | CWE-78 Neutralization of Special Elements used in an OS Command ('OS Command Inj | |
|
63
|
CVE-2026-50043 |
8.6 | 0.0171 | NET LOW CX NO UI | Improper neutralization of special elements used in an OS command ('OS Command I | |
|
60
|
CVE-2026-49815 |
7.2 | 0.0171 | NET LOW CX NO UI | Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release ver |