Hunt List
13,773 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-64391 |
9.8 | 0.0049 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: ksmbd: use | |
|
80
|
CVE-2026-68381 |
9.8 | 0.0049 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: ksmbd: pin | |
|
80
|
CVE-2026-74611 |
9.8 | 0.0049 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: tls: rx: re | |
|
80
|
CVE-2026-74723 |
9.8 | 0.0049 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: btrfs: lzo: | |
|
80
|
CVE-2026-80694 |
9.8 | 0.0049 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: net: ethern | |
|
80
|
CVE-2026-89530 |
9.8 | 0.0049 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: svcrdma: Re | |
|
80
|
CVE-2026-89550 |
9.8 | 0.0049 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: SUNRPC: svc | |
|
80
|
CVE-2026-89676 |
9.8 | 0.0049 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: nfsd: fix s | |
|
80
|
CVE-2026-76473 |
9.8 | 0.0049 | NET NO AUTH LOW CX NO UI | As part of Cisco's ongoing commitment to proactive security and product quality, | |
|
80
|
CVE-2026-54856 |
9.8 | 0.0049 | NET NO AUTH LOW CX NO UI | Unauthenticated PHP Object Injection in RexCoin <= 1.2.6 versions. | |
|
80
|
CVE-2026-54857 |
9.8 | 0.0049 | NET NO AUTH LOW CX NO UI | Unauthenticated PHP Object Injection in Quirky <= 1.23 versions. | |
|
80
|
CVE-2026-54858 |
9.8 | 0.0049 | NET NO AUTH LOW CX NO UI | Unauthenticated PHP Object Injection in Printy <= 1.13.0 versions. | |
|
80
|
CVE-2026-54860 |
9.8 | 0.0049 | NET NO AUTH LOW CX NO UI | Unauthenticated PHP Object Injection in Ozisti <= 1.1.10 versions. | |
|
79
|
CVE-2026-40621 |
9.3 | 0.0049 | NET NO AUTH LOW CX NO UI | ELECOM wireless LAN access point devices do not require authentication to access | |
|
78
|
CVE-2026-45688 |
9.1 | 0.0049 | NET NO AUTH LOW CX NO UI | Rocket.Chat is an open-source, secure, fully customizable communications platfor | |
|
78
|
CVE-2026-48713 |
9.1 | 0.0049 | NET NO AUTH LOW CX NO UI | Versions prior to 2.6.6 are vulnerable to prototype pollution via crafted missin | |
|
78
|
CVE-2026-48714 |
9.1 | 0.0049 | NET NO AUTH LOW CX NO UI | i18next-http-middleware is a middleware to be used with Node.js web frameworks l | |
|
78
|
CVE-2026-52868 |
8.8 | 0.0049 | NET NO AUTH LOW CX NO UI | An unauthenticated attacker can read worklist records from a directory outside t | |
|
78
|
CVE-2017-20266 |
8.8 | 0.0049 | NET NO AUTH LOW CX NO UI | Joomla SP Movie Database 1.3 contains an SQL injection vulnerability that allows | |
|
78
|
CVE-2026-89631 |
9.1 | 0.0049 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: smb: client | |
|
77
|
CVE-2026-58469 |
8.7 | 0.0049 | NET NO AUTH LOW CX NO UI | GNU Wget through 1.25.0, fixed in commit 37a40fc, contains a heap buffer underre | |
|
77
|
CVE-2026-59644 |
8.7 | 0.0049 | NET NO AUTH LOW CX NO UI | In Bouncy Castle for Java before 1.85, MLS hash-ratchet honours arbitrary 32-bit | |
|
77
|
CVE-2026-12852 |
8.7 | 0.0049 | NET NO AUTH LOW CX NO UI | In Bouncy Castle for Java before 1.85, MLS wire decoder allocates attacker-decla | |
|
77
|
CVE-2026-116078 |
8.7 | 0.0049 | NET NO AUTH LOW CX NO UI | Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 | |
|
77
|
CVE-2026-88893 |
8.7 | 0.0049 | NET NO AUTH LOW CX NO UI | OpenPanel through 2.3.0 share lookup procedures fail to validate access controls | |
|
76
|
CVE-2026-116541 |
8.2 | 0.0049 | NET NO AUTH LOW CX NO UI | Netty netty-tcnative before 2.0.84.Final contains a denial of service vulnerabil | |
|
76
|
CVE-2026-58010 |
8.2 | 0.0049 | NET NO AUTH LOW CX NO UI | A flaw was found in GLib. An off-by-one error can occur in the gvs_tuple_is_norm | |
|
76
|
CVE-2026-58012 |
8.2 | 0.0049 | NET NO AUTH LOW CX NO UI | A flaw was found in GLib. A buffer over-read can occur in the g_regex_replace fu | |
|
75
|
CVE-2026-44436 |
7.5 | 0.0049 | NET NO AUTH LOW CX NO UI | Quicly is an IETF QUIC protocol implementation intended primarily for use within | |
|
75
|
CVE-2026-39769 |
7.5 | 0.0049 | NET NO AUTH LOW CX NO UI | Authentication Bypass Using an Alternate Path or Channel vulnerability in Iqonic | |
|
75
|
CVE-2026-6656 |
7.5 | 0.0049 | NET NO AUTH LOW CX NO UI | Crypt::Password versions through 0.28 for Perl are susceptible to timing attacks | |
|
70
|
CVE-2026-50747 |
9.9 | 0.0049 | NET LOW CX NO UI | A malicious actor with access to the network and low privileges could exploit a | |
|
70
|
CVE-2026-5483 |
9.9 | 0.0049 | NET LOW CX NO UI | A flaw was found in odh-dashboard in Red Hat Openshift AI. This vulnerability in | |
|
70
|
CVE-2026-46386 |
9.9 | 0.0049 | NET LOW CX NO UI | OpenProject is open-source, web-based project management software. Prior to , th | |
|
70
|
CVE-2026-44935 |
9.9 | 0.0049 | NET LOW CX NO UI | Missing validation of "valuesFrom" references in Helm Deployer of SUSE Rancher F | |
|
70
|
CVE-2026-105780 |
9.9 | 0.0049 | NET LOW CX NO UI | Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerabi | |
|
68
|
CVE-2026-56841 |
8.8 | 0.0049 | NET LOW CX NO UI | A malicious actor with access to the network and low privileges could exploit an | |
|
68
|
CVE-2026-31706 |
8.8 | 0.0049 | NET LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: ksmbd: vali | |
|
68
|
CVE-2026-59793 |
8.8 | 0.0049 | NET LOW CX NO UI | In JetBrains TeamCity before 2026.1.2 arbitrary file access was possible via the | |
|
67
|
CVE-2026-59833 |
8.6 | 0.0049 | NET NO AUTH LOW CX | SiYuan is an open-source personal knowledge management system. Prior to 3.7.1, S | |
|
67
|
CVE-2026-50107 |
8.6 | 0.0049 | NET LOW CX NO UI | When NGINX Plus or NGINX Open Source is configured as the data plane for NGINX G | |
|
67
|
CVE-2026-67328 |
8.6 | 0.0049 | NET LOW CX NO UI | @better-auth/sso versions before 1.6.21 contain multiple authentication bypass v | |
|
66
|
CVE-2026-54591 |
8.1 | 0.0049 | NET NO AUTH LOW CX | AsyncSSH is a Python package which provides an asynchronous client and server im | |
|
66
|
CVE-2026-72903 |
8.1 | 0.0049 | NET NO AUTH LOW CX | Tabby (formerly Terminus) is a highly configurable terminal emulator. Prior to 1 | |
|
66
|
CVE-2025-40075 |
8.1 | 0.0049 | NET NO AUTH NO UI | In the Linux kernel, the following vulnerability has been resolved: tcp_metrics | |
|
66
|
CVE-2025-42953 |
8.1 | 0.0049 | NET LOW CX NO UI | SAP Netweaver System Configuration does not perform necessary authorization chec | |
|
66
|
CVE-2026-119557 |
8.2 | 0.0049 | NET NO AUTH NO UI | n8n from 2.14.0 through 2.46.3 contains a path traversal vulnerability in the Da | |
|
64
|
CVE-2026-56394 |
7.1 | 0.0049 | NET LOW CX NO UI | Craft CMS from 4.0.0-RC1 contains an authenticated path traversal vulnerability | |
|
64
|
CVE-2026-20779 |
7.1 | 0.0049 | NET NO AUTH LOW CX | Gitea versions from 1.5.0 before 1.26.3 have a TOTP single-use enforcement defec | |
|
62
|
CVE-2026-74037 |
8.6 | 0.0049 | NET LOW CX NO UI | Wazuh 4.0.0 before 4.14.8 fails to invalidate issued tokens for run_as users wit |