Hunt List
13,271 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-57216 |
10.0 | 0.0050 | NET NO AUTH LOW CX NO UI | RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20, 4.1.11, | |
|
80
|
CVE-2026-26354 |
9.8 | 0.0050 | NET NO AUTH LOW CX NO UI | Dell PowerProtect Data Domain with Domain Operating System (DD OS) of Feature Re | |
|
79
|
CVE-2026-32311 |
9.3 | 0.0051 | NET NO AUTH LOW CX NO UI | Flowsint is an open-source OSINT graph exploration tool designed for cybersecuri | |
|
79
|
CVE-2026-67285 |
9.2 | 0.0051 | NET NO AUTH LOW CX NO UI | Joomla Extension - joomshaper.com - Unauthenticated arbitrary local PHP file inc | |
|
79
|
CVE-2026-41274 |
9.3 | 0.0050 | NET NO AUTH LOW CX NO UI | Flowise is a drag & drop user interface to build a customized large language mod | |
|
78
|
CVE-2026-73569 |
8.7 | 0.0051 | NET NO AUTH LOW CX NO UI | fast-xml-parser allows users to process XML from JS object without C/C++ based l | |
|
78
|
CVE-2026-119762 |
8.7 | 0.0051 | NET NO AUTH LOW CX NO UI | Axigen Mail Server before 10.5.69, 10.6.x before 10.6.40, and 10.7.x before 10.7 | |
|
78
|
CVE-2026-59084 |
9.1 | 0.0051 | NET NO AUTH LOW CX NO UI | Insufficient Technical Documentation vulnerability in Apache Tomcat since the re | |
|
78
|
CVE-2026-53727 |
8.9 | 0.0051 | NET NO AUTH LOW CX NO UI | css_parser is a Ruby CSS parser. From 2.2.0 until 3.0.0, CssParser::Parser#read_ | |
|
78
|
CVE-2026-9390 |
9.1 | 0.0050 | NET NO AUTH LOW CX NO UI | XML::Sig versions before 0.71 for Perl allow XPath injection in ID lookup. veri | |
|
78
|
CVE-2026-45177 |
9.1 | 0.0050 | NET NO AUTH LOW CX NO UI | Idira Secrets Manager SaaS Edge versions prior to 1.8 exhibit improper access co | |
|
78
|
CVE-2026-112892 |
8.7 | 0.0050 | NET NO AUTH LOW CX NO UI | Pillow is a Python imaging library. From 4.1.0 until 13.0.0, Pillow's MSP RLE de | |
|
77
|
CVE-2026-58295 |
8.3 | 0.0051 | NET NO AUTH LOW CX NO UI | Access of resource using incompatible type ('type confusion') in Microsoft Edge | |
|
77
|
CVE-2026-44981 |
8.2 | 0.0051 | NET NO AUTH LOW CX NO UI | CrowdSec offers crowdsourced protection against malicious IPs. From 1.7.0 until | |
|
77
|
CVE-2026-16686 |
8.2 | 0.0050 | NET NO AUTH LOW CX NO UI | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to a | |
|
76
|
CVE-2026-67346 |
7.7 | 0.0051 | NET NO AUTH LOW CX NO UI | Swarms through 6.8.1, fixed in commit 8b0fc9e, contains a server-side request fo | |
|
75
|
CVE-2026-50756 |
7.5 | 0.0051 | NET NO AUTH LOW CX NO UI | An issue in DayuanJiang next-ai-draw-io 0.4.13 allows a remote attacker to obtai | |
|
75
|
CVE-2026-10849 |
7.5 | 0.0051 | NET NO AUTH LOW CX NO UI | The hawkBit device management client in subsys/mgmt/hawkbit accumulates the body | |
|
75
|
CVE-2026-113728 |
7.5 | 0.0051 | NET NO AUTH LOW CX NO UI | Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server. Prior | |
|
75
|
CVE-2026-115822 |
7.5 | 0.0051 | NET NO AUTH LOW CX NO UI | Starman versions before 0.4019 for Perl allow CPU exhaustion via quadratic regex | |
|
75
|
CVE-2026-67872 |
7.5 | 0.0050 | NET NO AUTH LOW CX NO UI | An issue in Systerel S2OPC 1.7.3 allows a remote attacker to cause a denial of s | |
|
75
|
CVE-2026-28212 |
7.5 | 0.0050 | NET NO AUTH LOW CX NO UI | Firebird is an open-source relational database management system. In versions pr | |
|
75
|
CVE-2026-41642 |
7.5 | 0.0050 | NET NO AUTH LOW CX NO UI | GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go P | |
|
75
|
CVE-2026-43513 |
7.5 | 0.0050 | NET NO AUTH LOW CX NO UI | Improper Handling of Case Sensitivity vulnerability in LockOutRealm in Apache To | |
|
75
|
CVE-2026-55111 |
7.5 | 0.0050 | NET NO AUTH LOW CX NO UI | A malicious actor with access to the network could exploit a Path Traversal vuln | |
|
75
|
CVE-2026-57815 |
7.5 | 0.0050 | NET NO AUTH LOW CX NO UI | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') v | |
|
75
|
CVE-2026-65754 |
7.5 | 0.0050 | NET NO AUTH LOW CX NO UI | Joomla Extension - regularlabs.com - Insecure path handling in ReReplacer Pro ex | |
|
75
|
CVE-2026-15280 |
7.5 | 0.0050 | NET NO AUTH LOW CX NO UI | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 ND Collecti | |
|
75
|
CVE-2026-61980 |
7.5 | 0.0050 | NET NO AUTH LOW CX NO UI | Unauthenticated Arbitrary File Download in OMGF Pro <= 5.2.7 versions. | |
|
75
|
CVE-2026-15585 |
7.5 | 0.0050 | NET NO AUTH LOW CX NO UI | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') v | |
|
70
|
CVE-2026-52855 |
9.9 | 0.0051 | NET LOW CX NO UI | Wings is the server control plane for Pterodactyl, a free, open-source game serv | |
|
69
|
CVE-2026-76036 |
9.6 | 0.0051 | NET NO AUTH LOW CX | Buffer overflow in Dawn in Google Chrome on on Android prior to 151.0.7922.169 a | |
|
69
|
CVE-2026-14405 |
9.6 | 0.0050 | NET NO AUTH LOW CX | Uninitialized Use in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote | |
|
68
|
CVE-2026-68561 |
8.8 | 0.0051 | NET LOW CX NO UI | Wekan is open source kanban built with Meteor. Prior to 9.89, the second Boards. | |
|
68
|
CVE-2026-61460 |
8.7 | 0.0051 | NET LOW CX NO UI | Krayin CRM through 2.2.3 contains an insecure direct object reference vulnerabil | |
|
68
|
CVE-2026-65917 |
8.7 | 0.0051 | NET LOW CX NO UI | CyberPanel through 1.9.1, fixed in commit b198460, contains an insecure direct o | |
|
68
|
CVE-2026-16617 |
8.8 | 0.0050 | NET NO AUTH LOW CX | The Simple File List WordPress plugin through 6.3.11 does not properly sanitise | |
|
68
|
CVE-2026-16856 |
8.8 | 0.0050 | NET LOW CX NO UI | IBM i 7.6, and 7.5 could allow a local attacker to gain elevated privileges due | |
|
68
|
CVE-2026-44829 |
8.8 | 0.0050 | NET NO AUTH LOW CX | Gotenberg is a Docker-powered stateless API for PDF files. In 8.32.0 and earlier | |
|
67
|
CVE-2026-18830 |
8.6 | 0.0051 | NET LOW CX NO UI | Insufficient input validation in Amazon Bedrock AgentCore harness might allow an | |
|
67
|
CVE-2026-35025 |
8.6 | 0.0050 | NET LOW CX NO UI | ProFTPD through 1.3.9b and 1.3.10rc2 contains an access control bypass vulnerabi | |
|
67
|
CVE-2026-43640 |
8.6 | 0.0050 | NET LOW CX NO UI | Bitwarden Server prior to v2026.4.1 does not require master-password re-authenti | |
|
66
|
CVE-2026-88173 |
8.1 | 0.0051 | NET NO AUTH NO UI | Use after free in Windows Background Intelligent Transfer Service (BITS) allows | |
|
66
|
CVE-2026-110205 |
7.7 | 0.0051 | NET NO AUTH LOW CX | Roo Code through 3.54.0 contains a command approval bypass vulnerability in pars | |
|
66
|
CVE-2026-99059 |
7.7 | 0.0051 | NET NO AUTH NO UI | In the Linux kernel, the following vulnerability has been resolved: wireguard: | |
|
66
|
CVE-2026-13190 |
8.1 | 0.0050 | NET NO AUTH NO UI | In Progress® Telerik® UI for AJAX prior to v2026.2.708, a deserialization vulner | |
|
66
|
CVE-2026-82891 |
8.1 | 0.0050 | NET NO AUTH NO UI | IBM Guardium Data Protection 12.1, and 12.2 could allow a remote attacker to obt | |
|
65
|
CVE-2026-98096 |
7.4 | 0.0050 | NET NO AUTH NO UI | In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: r | |
|
65
|
CVE-2026-58660 |
7.2 | 0.0050 | NET LOW CX NO UI | Kanboard before 1.2.53, fixed in commit 564cc30, BoardAjaxController save() meth | |
|
62
|
CVE-2026-62284 |
8.6 | 0.0050 | NET LOW CX NO UI | OSAC operator is a Kubernetes operator. In the affected revision identified as 8 |