Hunt List
12,202 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
90
|
CVE-2026-69836 |
10.0 | 0.0153 | NET NO AUTH LOW CX NO UI | 2 PoC | Deserialization of untrusted data in Microsoft Entra ID allows an unauthorized a |
|
90
|
CVE-2026-55944 |
9.8 | 0.0153 | NET NO AUTH LOW CX NO UI | 1 PoC | Deserialization of untrusted data in Microsoft Dynamics NAV allows an unauthoriz |
|
80
|
CVE-2026-8054 |
10.0 | 0.0158 | NET NO AUTH LOW CX NO UI | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti | |
|
80
|
CVE-2026-49261 |
9.8 | 0.0158 | NET NO AUTH LOW CX NO UI | MariaDB server is a community developed fork of MySQL server. Versions 10.6.1 th | |
|
80
|
CVE-2026-69084 |
9.9 | 0.0157 | NET NO AUTH LOW CX NO UI | SiYuan versions <= v3.7.2 expose the /api/search/searchEmbedBlock endpoint, whic | |
|
80
|
CVE-2026-70242 |
9.8 | 0.0157 | NET NO AUTH LOW CX NO UI | Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized at | |
|
80
|
CVE-2026-79861 |
9.8 | 0.0156 | NET NO AUTH LOW CX NO UI | There is a command injection vulnerability in AOS-10 that could lead to unauthen | |
|
80
|
CVE-2026-59124 |
9.8 | 0.0153 | NET NO AUTH LOW CX NO UI | Deserialization of untrusted data in Microsoft High Performance Computing (HPC) | |
|
80
|
CVE-2026-54117 |
9.8 | 0.0153 | NET NO AUTH LOW CX NO UI | Deserialization of untrusted data in SQL Server allows an unauthorized attacker | |
|
80
|
CVE-2026-54118 |
9.8 | 0.0153 | NET NO AUTH LOW CX NO UI | Deserialization of untrusted data in SQL Server allows an unauthorized attacker | |
|
80
|
CVE-2025-63706 |
9.8 | 0.0152 | NET NO AUTH LOW CX NO UI | NPM package next-npm-version1.0.1 is vulnerable to Command injection. | |
|
80
|
CVE-2023-31039 |
9.8 | 0.0152 | NET NO AUTH LOW CX NO UI | Security vulnerability in Apache bRPC <1.5.0 on all platforms allows attackers t | |
|
80
|
CVE-2026-48168 |
10.0 | 0.0150 | NET NO AUTH LOW CX NO UI | PraisonAI is a multi-agent teams system. In versions prior to 4.6.40, the bundle | |
|
80
|
CVE-2026-47391 |
9.8 | 0.0150 | NET NO AUTH LOW CX NO UI | PraisonAI is a multi-agent teams system. Prior to version 4.6.40, PraisonAI's fi | |
|
80
|
CVE-2021-25827 |
9.8 | 0.0150 | NET NO AUTH LOW CX NO UI | Emby Server < 4.7.12.0 is vulnerable to a login bypass attack by setting the X-F | |
|
79
|
CVE-2026-66914 |
9.2 | 0.0154 | NET NO AUTH LOW CX NO UI | Joomla Extension - seblod.com - Unauthenticated path traversal in SEBLOD < 3.30. | |
|
79
|
CVE-2026-0650 |
9.3 | 0.0152 | NET NO AUTH LOW CX NO UI | OpenFlagr versions prior to and including 1.1.18 contain an authentication bypas | |
|
79
|
CVE-2026-65700 |
9.3 | 0.0152 | NET NO AUTH LOW CX NO UI | h2oGPT through 0.2.1 contains a path traversal vulnerability in the OpenAI-compa | |
|
79
|
CVE-2026-41042 |
9.1 | 0.0151 | NET NO AUTH LOW CX NO UI | Unauthenticated callers can supply a malicious H2 JDBC URL through the testConne | |
|
79
|
CVE-2026-8398 |
9.3 | 0.0146 | NET NO AUTH LOW CX NO UI | KEV | Daemon Tools contains an unspecified vulnerability that has a high impact on con |
|
78
|
CVE-2026-41247 |
8.9 | 0.0157 | NET NO AUTH LOW CX NO UI | elFinder is an open-source file manager for web, written in JavaScript using jQu | |
|
78
|
CVE-2026-66733 |
8.7 | 0.0155 | NET NO AUTH LOW CX NO UI | Sonic 3 A.I.R. before commit 2492d18 contains an unbounded memory allocation vul | |
|
76
|
CVE-2026-60105 |
7.7 | 0.0151 | NET NO AUTH LOW CX NO UI | Monsta FTP before 2.14.5 contains a server-side request forgery vulnerability in | |
|
75
|
CVE-2026-53755 |
7.5 | 0.0158 | NET NO AUTH LOW CX NO UI | Crawl4AI is an open-source LLM friendly web crawler & scraper. Prior to 0.8.9, t | |
|
75
|
CVE-2026-23870 |
7.5 | 0.0153 | NET NO AUTH LOW CX NO UI | A denial of service vulnerability could be triggered by sending specially crafte | |
|
75
|
CVE-2024-1394 |
7.5 | 0.0153 | NET NO AUTH LOW CX NO UI | A memory leak flaw was found in Golang in the RSA encrypting/decrypting code, wh | |
|
75
|
CVE-2026-19446 |
7.5 | 0.0146 | NET NO AUTH LOW CX NO UI | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 allows a remote unauthenticated at | |
|
75
|
CVE-2026-57872 |
7.5 | 0.0145 | NET NO AUTH LOW CX NO UI | An unauthenticated directory traversal vulnerability exists in get_fcont.cgi in | |
|
70
|
CVE-2026-7873 |
9.9 | 0.0155 | NET LOW CX NO UI | IBM Langflow OSS 1.0.0 through 1.10.0 allows authenticated attackers to execute | |
|
69
|
CVE-2026-44225 |
9.3 | 0.0154 | NET NO AUTH LOW CX | Pulpy is a lightweight, cross-platform desktop application packager for web apps | |
|
69
|
CVE-2026-49481 |
9.6 | 0.0148 | NET LOW CX NO UI | UpSnap is a wake on lan web app. Versions prior to 5.4.0 have an OS command inje | |
|
68
|
CVE-2026-72573 |
8.8 | 0.0157 | NET LOW CX NO UI | An OS command injection vulnerability in 4xmen/pm2panel (all versions) allows an | |
|
68
|
CVE-2026-116504 |
8.6 | 0.0155 | NET LOW CX NO UI | A vulnerability has been found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. This a | |
|
68
|
CVE-2026-32892 |
8.8 | 0.0153 | NET LOW CX NO UI | Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, Ch | |
|
68
|
CVE-2026-85900 |
8.8 | 0.0152 | NET LOW CX NO UI | Deserialization of untrusted data in Microsoft Office SharePoint allows an autho | |
|
67
|
CVE-2025-34108 |
8.6 | 0.0149 | NET NO AUTH LOW CX | A stack-based buffer overflow vulnerability exists in the login functionality of | |
|
66
|
CVE-2026-57999 |
7.7 | 0.0147 | NET LOW CX NO UI | luci-app-tailscale-community contains a command injection vulnerability in the t | |
|
66
|
CVE-2026-18129 |
8.1 | 0.0146 | NET NO AUTH NO UI | Cleartext transmission of sensitive information in the Core of Ivanti Endpoint M | |
|
65
|
CVE-2026-7548 |
7.4 | 0.0149 | NET LOW CX NO UI | A vulnerability was detected in Totolink NR1800X 9.1.0u.6279_B20210910. This aff | |
|
60
|
CVE-2026-14959 |
7.2 | 0.0155 | NET LOW CX NO UI | IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 could allow a remote authenticated at | |
|
60
|
CVE-2023-36750 |
7.2 | 0.0154 | NET LOW CX NO UI | A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.1 | |
|
60
|
CVE-2023-36751 |
7.2 | 0.0154 | NET LOW CX NO UI | A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.1 | |
|
60
|
CVE-2023-36752 |
7.2 | 0.0154 | NET LOW CX NO UI | A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.1 | |
|
60
|
CVE-2023-36753 |
7.2 | 0.0154 | NET LOW CX NO UI | A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.1 | |
|
60
|
CVE-2023-36754 |
7.2 | 0.0154 | NET LOW CX NO UI | A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.1 | |
|
60
|
CVE-2026-6952 |
7.2 | 0.0152 | NET LOW CX NO UI | A post-authentication command injection vulnerability in the "LogServer" field o | |
|
60
|
CVE-2026-6837 |
7.2 | 0.0152 | NET LOW CX NO UI | A post-authentication command injection vulnerability in the "export-cgi" CGI pr | |
|
60
|
CVE-2026-48165 |
7.2 | 0.0151 | NET LOW CX NO UI | MariaDB server is a community developed fork of MySQL server. From versions 10.6 | |
|
60
|
CVE-2026-23774 |
7.2 | 0.0147 | NET LOW CX NO UI | Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Featu | |
|
60
|
CVE-2026-44879 |
7.2 | 0.0145 | NET LOW CX NO UI | A vulnerability in the command line interface of ECOS devices could allow a high |