Hunt List
13,294 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
90
|
CVE-2026-81648 |
10.0 | 0.0050 | NET NO AUTH LOW CX NO UI | 1 PoC | The CryptoPayment Gateway WordPress plugin from 1.2.1 to 1.2.2 does not apply an |
|
80
|
CVE-2026-9202 |
9.8 | 0.0050 | NET NO AUTH LOW CX NO UI | IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to create | |
|
80
|
CVE-2025-70520 |
9.8 | 0.0050 | NET NO AUTH LOW CX NO UI | The websocket handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce | |
|
80
|
CVE-2026-89702 |
9.8 | 0.0050 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: nfsd: size | |
|
80
|
CVE-2026-49781 |
9.8 | 0.0050 | NET NO AUTH LOW CX NO UI | Unauthenticated PHP Object Injection in OttoKit <= 1.1.27 versions. | |
|
80
|
CVE-2025-65656 |
9.8 | 0.0050 | NET NO AUTH LOW CX NO UI | dcat-admin v2.2.3-beta and before is vulnerable to file inclusion in admin/src/E | |
|
79
|
CVE-2026-114595 |
9.3 | 0.0050 | NET NO AUTH LOW CX NO UI | In EPICS Base release 7.0.10 and prior, an integer overflow in network request p | |
|
79
|
CVE-2026-114358 |
9.3 | 0.0050 | NET NO AUTH LOW CX NO UI | This vulnerability exists in the Radius Xenia M2M Platform due to insufficient v | |
|
79
|
CVE-2026-65890 |
9.2 | 0.0050 | NET NO AUTH LOW CX NO UI | Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20 | |
|
78
|
CVE-2026-40582 |
9.1 | 0.0050 | NET NO AUTH LOW CX NO UI | ChurchCRM is an open-source church management system. In versions prior to 7.2.0 | |
|
78
|
CVE-2026-103090 |
8.8 | 0.0050 | NET NO AUTH LOW CX NO UI | Missing Authentication for Critical Function (CWE-306) and Insufficiently Protec | |
|
78
|
CVE-2025-40796 |
8.7 | 0.0050 | NET NO AUTH LOW CX NO UI | A vulnerability has been identified in SIMATIC PCS neo V4.1 (All versions), SIMA | |
|
78
|
CVE-2026-71263 |
9.1 | 0.0050 | NET NO AUTH LOW CX NO UI | The LINUXTCP port of FreeModbus contains an off-by-one bounds check in xMBPortTC | |
|
78
|
CVE-2026-53791 |
9.1 | 0.0050 | NET NO AUTH LOW CX NO UI | rsync daemon before 3.5.0 contains an IP address spoofing vulnerability that all | |
|
78
|
CVE-2026-93228 |
9.1 | 0.0050 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: svcrdma: Re | |
|
78
|
CVE-2026-34543 |
8.7 | 0.0050 | NET NO AUTH LOW CX NO UI | OpenEXR provides the specification and reference implementation of the EXR file | |
|
78
|
CVE-2026-25199 |
9.1 | 0.0050 | NET NO AUTH LOW CX NO UI | Instances deployed via the Proxmox extension allow unauthorized access to instan | |
|
77
|
CVE-2026-56675 |
8.3 | 0.0050 | NET NO AUTH LOW CX NO UI | 9Router is an AI router & token saver. Prior to 0.5.2, 9router treats loopback r | |
|
77
|
CVE-2026-58013 |
8.2 | 0.0050 | NET NO AUTH LOW CX NO UI | A flaw was found in GLib. A buffer over-read can occur in g_io_channel_read_line | |
|
75
|
CVE-2026-61980 |
7.5 | 0.0050 | NET NO AUTH LOW CX NO UI | Unauthenticated Arbitrary File Download in OMGF Pro <= 5.2.7 versions. | |
|
75
|
CVE-2026-15585 |
7.5 | 0.0050 | NET NO AUTH LOW CX NO UI | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') v | |
|
75
|
CVE-2026-73181 |
7.5 | 0.0050 | NET NO AUTH LOW CX NO UI | Unauthenticated Arbitrary File Download in Extra Product Options & Add-Ons for W | |
|
75
|
CVE-2026-28167 |
7.5 | 0.0050 | NET NO AUTH LOW CX NO UI | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') v | |
|
75
|
CVE-2026-102834 |
7.5 | 0.0050 | NET NO AUTH LOW CX NO UI | JavaCV provides Java interfaces to OpenCV, FFmpeg, and other multimedia librarie | |
|
75
|
CVE-2026-114136 |
7.5 | 0.0050 | NET NO AUTH LOW CX NO UI | Django REST framework is a toolkit for building Web APIs. From 3.6.4 until 3.18. | |
|
75
|
CVE-2026-59158 |
7.5 | 0.0050 | NET NO AUTH LOW CX NO UI | Nuxt Ollama integrates the official Ollama JavaScript library into Nuxt applicat | |
|
75
|
CVE-2026-64312 |
7.5 | 0.0050 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: crypto: pcr | |
|
75
|
CVE-2026-115776 |
7.5 | 0.0050 | NET NO AUTH LOW CX NO UI | Twisted is an event-based framework for internet applications, supporting Python | |
|
75
|
CVE-2026-55727 |
7.5 | 0.0050 | NET NO AUTH LOW CX NO UI | A flaw in the authentication mechanism for video stream requests in Genetec Secu | |
|
75
|
CVE-2026-56846 |
7.5 | 0.0050 | NET NO AUTH LOW CX NO UI | A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blocks evade | |
|
75
|
CVE-2026-72438 |
7.5 | 0.0050 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: md/raid10: | |
|
70
|
CVE-2026-27681 |
9.9 | 0.0050 | NET LOW CX NO UI | Due to insufficient authorization checks in SAP Business Planning and Consolidat | |
|
69
|
CVE-2026-8338 |
9.2 | 0.0050 | NET NO AUTH NO UI | A Spring Security authentication and authorization bypass exists in Coverity Con | |
|
68
|
CVE-2026-83596 |
8.8 | 0.0050 | NET NO AUTH LOW CX | A flaw was found in WebKitGTK. Processing malicious web content can cause memory | |
|
68
|
CVE-2026-41453 |
8.7 | 0.0050 | NET LOW CX NO UI | Krayin CRM before 2.2.4 contains a blind SQL injection vulnerability in the lead | |
|
66
|
CVE-2026-20124 |
7.7 | 0.0050 | NET LOW CX NO UI | A vulnerability in the Simple Network Management Protocol (SNMP) subsystem of Ci | |
|
66
|
CVE-2026-71845 |
7.7 | 0.0050 | NET LOW CX NO UI | A flaw was found in insights-client. The setDefault() function logs the value of | |
|
66
|
CVE-2026-47398 |
8.1 | 0.0050 | NET NO AUTH NO UI | PraisonAI is a multi-agent teams system. The v4.6.32 chokepoint refactor (which | |
|
65
|
CVE-2026-56313 |
7.2 | 0.0050 | NET LOW CX NO UI | Capgo before 12.128.2 contains a cross-organization account disruption vulnerabi | |
|
65
|
CVE-2026-48079 |
7.4 | 0.0050 | NET NO AUTH NO UI | OpenReception's appointment booking software provides an end-to-end encrypted ap | |
|
65
|
CVE-2026-62669 |
7.4 | 0.0050 | NET NO AUTH NO UI | Grav Login Plugin adds login, basic ACL, and session wide messages to Grav. Prio | |
|
64
|
CVE-2026-114396 |
7.1 | 0.0050 | NET LOW CX NO UI | Trudesk through 1.2.11 contains a server-side JavaScript injection vulnerability | |
|
64
|
CVE-2026-9177 |
9.4 | 0.0050 | NET LOW CX NO UI | A Server-Side Template Injection (SSTI) vulnerability was identified in the mai | |
|
64
|
CVE-2026-52865 |
7.1 | 0.0050 | NET LOW CX NO UI | When NGINX Ingress Controller processes Ingress or TransportServer resources, an | |
|
64
|
CVE-2026-33770 |
7.1 | 0.0050 | NET LOW CX NO UI | WWBN AVideo is an open source video platform. In versions up to and including 26 | |
|
62
|
CVE-2026-53455 |
8.6 | 0.0050 | NET LOW CX NO UI | Blueprint Studio is a VS Code-like file editor for Home Assistant configuration | |
|
62
|
CVE-2026-79880 |
8.7 | 0.0050 | NET LOW CX NO UI | A vulnerability in the command line interface of AOS-8 could allow an authentica | |
|
58
|
CVE-2026-19004 |
8.8 | 0.0050 | NET NO AUTH | An application using the MongoDB BI Connector ODBC Driver may experience a memor | |
|
57
|
CVE-2026-55765 |
8.5 | 0.0050 | NET NO UI | CloudNativePG is a platform designed to manage PostgreSQL databases within Kuber | |
|
50
|
CVE-2026-53987 |
7.3 | 0.0050 | NET LOW CX | The Tag plugin for GLPI 11 before 2.14.4 stores the tag name without HTML saniti |