Hunt List
13,760 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-66587 |
9.8 | 0.0050 | NET NO AUTH LOW CX NO UI | Unauthenticated Local File Inclusion in WP Cafe Pro < 3.0.15 versions. | |
|
80
|
CVE-2026-76606 |
10.0 | 0.0050 | NET NO AUTH LOW CX NO UI | Joomla Extension - fabrikar.com - Path Traversal via image element in Fabrik < 4 | |
|
80
|
CVE-2026-91323 |
9.8 | 0.0050 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware | |
|
79
|
CVE-2026-6885 |
9.3 | 0.0050 | NET NO AUTH LOW CX NO UI | Borg SPM 2007 (Sales Ended in 2008) developed by BorG Technology Corporation has | |
|
79
|
CVE-2026-63106 |
9.3 | 0.0050 | NET NO AUTH LOW CX NO UI | ReadyEcommerce before 4.5.2 contains an unauthenticated SQL injection vulnerabil | |
|
78
|
CVE-2026-41552 |
9.2 | 0.0050 | NET NO AUTH LOW CX NO UI | PDF Export Module used in DHTMLX's products Gantt and Scheduler is vulnerable to | |
|
78
|
CVE-2026-62849 |
9.1 | 0.0050 | NET NO AUTH LOW CX NO UI | ThingLinks is an enterprise IoT platform. Prior to 1.4.0, an unauthenticated SQL | |
|
78
|
CVE-2026-49759 |
8.8 | 0.0050 | NET NO AUTH LOW CX NO UI | Stack-based Buffer Overflow vulnerability in Erlang OTP erts (inet_drv) allows a | |
|
78
|
CVE-2026-55884 |
9.2 | 0.0050 | NET NO AUTH LOW CX NO UI | Tilt defines dev environments as code for microservice apps on Kubernetes. From | |
|
78
|
CVE-2026-57830 |
8.8 | 0.0050 | NET NO AUTH LOW CX NO UI | Joomla Extension - joomshaper.com - Unauthenticated arbitrary file deletion in H | |
|
77
|
CVE-2015-20124 |
8.7 | 0.0050 | NET NO AUTH LOW CX NO UI | Aspose Importer & Exporter plugin for WordPress before 3.0 contains a path trave | |
|
77
|
CVE-2024-58396 |
8.7 | 0.0050 | NET NO AUTH LOW CX NO UI | YouDataSum CPAS Audit Management System V4 contains a path traversal vulnerabili | |
|
77
|
CVE-2026-72581 |
8.6 | 0.0050 | NET NO AUTH LOW CX NO UI | A server-side request forgery (SSRF) vulnerability in duhow/xiaoai-patch through | |
|
77
|
CVE-2026-6376 |
8.7 | 0.0050 | NET NO AUTH LOW CX NO UI | A weakness in SpiceJet’s public booking retrieval page permits full passenger bo | |
|
76
|
CVE-2026-49982 |
8.2 | 0.0050 | NET NO AUTH LOW CX NO UI | tmp is a temporary file and directory creator for node.js. In version 0.2.6, the | |
|
75
|
CVE-2026-13182 |
7.5 | 0.0050 | NET NO AUTH LOW CX NO UI | In Progress® Telerik® UI for AJAX prior to v2026.2.708, RadAsyncUpload client-st | |
|
75
|
CVE-2026-13183 |
7.5 | 0.0050 | NET NO AUTH LOW CX NO UI | In Progress® Telerik® UI for AJAX prior to v2026.2.708, RadAsyncUpload upload me | |
|
75
|
CVE-2026-61609 |
7.5 | 0.0050 | NET NO AUTH LOW CX NO UI | Pterodactyl is a free, open-source game server management panel. From 1.7.0 unti | |
|
75
|
CVE-2026-82210 |
7.5 | 0.0050 | NET NO AUTH LOW CX NO UI | Enforceable assertion in the streaming feature of Apache bRPC (version < 1.18.0) | |
|
75
|
CVE-2026-76290 |
7.5 | 0.0050 | NET NO AUTH LOW CX NO UI | In Splunk Enterprise versions below 10.4.4, 10.2.8, and 10.0.11, an unauthentica | |
|
74
|
CVE-2026-42404 |
7.2 | 0.0050 | NET NO AUTH LOW CX NO UI | Apache Neethi does not impose any restrictions on URIs when manually fetching re | |
|
68
|
CVE-2026-8517 |
8.8 | 0.0050 | NET NO AUTH LOW CX | Object lifecycle issue in WebShare in Google Chrome on Mac prior to 148.0.7778.1 | |
|
68
|
CVE-2026-17082 |
8.8 | 0.0050 | NET LOW CX NO UI | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to gain | |
|
68
|
CVE-2026-71281 |
8.8 | 0.0050 | NET NO AUTH LOW CX | Hugging Face peft's LoRA-GA and CorDA initialization modules (src/peft/tuners/lo | |
|
68
|
CVE-2026-65542 |
8.8 | 0.0050 | NET NO AUTH LOW CX | Unauthenticated Broken Authentication in Super Socializer <= 7.14.5 versions. | |
|
68
|
CVE-2026-108329 |
8.8 | 0.0050 | NET LOW CX NO UI | Tanium addressed an unauthorized code execution vulnerability in Threat Response | |
|
67
|
CVE-2026-54281 |
8.7 | 0.0050 | NET LOW CX NO UI | Nest is a framework for building scalable Node.js server-side applications. Prio | |
|
67
|
CVE-2026-66494 |
8.7 | 0.0050 | NET NO AUTH LOW CX | Joomla Extension - joomshaper.com - Unauthenticated stored XSS in Shapes API end | |
|
67
|
CVE-2026-62349 |
8.3 | 0.0050 | NET LOW CX NO UI | TDengine is an open source, time-series database optimized for Internet of Thing | |
|
67
|
CVE-2026-61461 |
8.7 | 0.0050 | NET LOW CX NO UI | Dify before 1.16.0-rc1 contains a SQL injection vulnerability in the MyScale vec | |
|
67
|
CVE-2026-94422 |
8.7 | 0.0050 | NET NO AUTH LOW CX | An incorrect implementation of message filtering in xdg-dbus-proxy versions befo | |
|
67
|
CVE-2026-64835 |
8.7 | 0.0050 | NET NO AUTH LOW CX | FFmpeg versions 4.4 through 8.1.2 contain an out-of-bounds memory access vulnera | |
|
67
|
CVE-2026-45576 |
8.3 | 0.0050 | NET NO AUTH LOW CX | zrok is software for sharing web services, files, and network resources. From 0. | |
|
66
|
CVE-2026-33833 |
8.2 | 0.0050 | NET NO AUTH LOW CX | Improper neutralization of special elements in output used by a downstream compo | |
|
66
|
CVE-2026-116688 |
8.1 | 0.0050 | NET LOW CX NO UI | CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. Fro | |
|
66
|
CVE-2026-97783 |
8.1 | 0.0050 | NET NO AUTH LOW CX | Improper neutralization of input during web page generation ('cross-site scripti | |
|
66
|
CVE-2026-19594 |
8.1 | 0.0050 | NET LOW CX NO UI | Insufficient input sanitization in Snowflake Python API (`snowflake.core`) versi | |
|
64
|
CVE-2026-62238 |
7.2 | 0.0050 | NET LOW CX NO UI | OpenRemote before 1.26.0 contain an authenticated SQL injection vulnerability in | |
|
64
|
CVE-2026-72440 |
7.1 | 0.0050 | NET LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: md/raid1: f | |
|
64
|
CVE-2026-13065 |
7.1 | 0.0050 | NET LOW CX NO UI | A user with read-only privileges is able to craft an aggregation pipeline using | |
|
64
|
CVE-2026-72910 |
7.1 | 0.0050 | NET LOW CX NO UI | ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15 | |
|
64
|
CVE-2026-61444 |
9.4 | 0.0050 | NET LOW CX NO UI | PraisonAI versions before 4.6.78 contain a code injection vulnerability in deplo | |
|
64
|
CVE-2025-71436 |
7.1 | 0.0050 | NET NO AUTH LOW CX | Raptor RDF Syntax Library from 2.0.15 through 2.0.16 contains a heap-based buffe | |
|
63
|
CVE-2026-35270 |
9.1 | 0.0050 | NET LOW CX NO UI | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middlewar | |
|
63
|
CVE-2026-104354 |
9.1 | 0.0050 | NET LOW CX NO UI | Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Specia | |
|
57
|
CVE-2026-11400 |
8.6 | 0.0050 | NET LOW CX | An untrusted search path issue in the GlobalDatabasePlugin in the AWS Advanced J | |
|
56
|
CVE-2026-23879 |
8.0 | 0.0050 | NET LOW CX | py7zr is a Python-based library and utility to support 7zip archive compression, | |
|
56
|
CVE-2025-2241 |
8.2 | 0.0050 | NET NO UI | A flaw was found in Hive, a component of Multicluster Engine (MCE) and Advanced | |
|
55
|
CVE-2026-116489 |
7.7 | 0.0050 | NET NO UI | Timescale pgvectorscale before 0.9.1 contains a type confusion vulnerability tha | |
|
55
|
CVE-2026-69805 |
7.5 | 0.0050 | NET NO AUTH | External control of file name or path in .NET allows an unauthorized attacker to |