Hunt List
13,779 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
86
|
CVE-2026-80344 |
8.2 | 0.0049 | NET NO AUTH LOW CX NO UI | 1 PoC | Server-Side Request Forgery (SSRF) vulnerability in Apache Camel AS2 component. |
|
80
|
CVE-2025-58963 |
10.0 | 0.0049 | NET NO AUTH LOW CX NO UI | Unrestricted Upload of File with Dangerous Type vulnerability in 7oroof Medcity | |
|
80
|
CVE-2026-111813 |
10.0 | 0.0049 | NET NO AUTH LOW CX NO UI | Apache Traffic Server's experimental magick plugin lets an unauthenticated clien | |
|
80
|
CVE-2026-113399 |
9.8 | 0.0049 | NET NO AUTH LOW CX NO UI | Incorrect boundary conditions in the SVG component. This vulnerability was fixed | |
|
79
|
CVE-2026-80098 |
9.3 | 0.0049 | NET NO AUTH LOW CX NO UI | Improper verification of cryptographic signature in Copilot Studio allows an una | |
|
78
|
CVE-2026-34000 |
9.1 | 0.0049 | NET NO AUTH LOW CX NO UI | A flaw was found in the X.Org X server. This out-of-bounds read vulnerability in | |
|
78
|
CVE-2026-34002 |
9.1 | 0.0049 | NET NO AUTH LOW CX NO UI | A flaw was found in the X.Org X server. This vulnerability, an out-of-bounds rea | |
|
78
|
CVE-2026-61435 |
8.8 | 0.0049 | NET NO AUTH LOW CX NO UI | PraisonAI before 4.6.78 contains an authentication bypass in the Call API agent | |
|
77
|
CVE-2026-66360 |
8.7 | 0.0049 | NET NO AUTH LOW CX NO UI | The ISO Presentation layer contains a flaw in the handling of specific paramete | |
|
77
|
CVE-2026-63383 |
8.7 | 0.0049 | NET NO AUTH LOW CX NO UI | Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libe | |
|
77
|
CVE-2024-58382 |
8.7 | 0.0049 | NET NO AUTH LOW CX NO UI | league/commonmark versions before 2.6.0 contain polynomial time complexity vulne | |
|
76
|
CVE-2026-55575 |
8.2 | 0.0049 | NET NO AUTH LOW CX NO UI | LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScri | |
|
75
|
CVE-2026-101572 |
7.5 | 0.0049 | NET NO AUTH LOW CX NO UI | Vulnerability in the Helidon product of Oracle Fusion Middleware (component: hel | |
|
75
|
CVE-2026-87398 |
7.5 | 0.0049 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middl | |
|
75
|
CVE-2026-57146 |
7.5 | 0.0049 | NET NO AUTH LOW CX NO UI | PraisonAI is a multi-agent teams system. From version 4.5.115 to before version | |
|
75
|
CVE-2026-50787 |
7.5 | 0.0049 | NET NO AUTH LOW CX NO UI | e-SIC Livre (esiclivre) v0.2.2 and earlier contains an uncontrolled resource con | |
|
75
|
CVE-2026-8446 |
7.5 | 0.0049 | NET NO AUTH LOW CX NO UI | IBM Langflow OSS 1.0.0 through 1.10.3 contain an authentication bypass vulnerabi | |
|
75
|
CVE-2026-56017 |
7.5 | 0.0049 | NET NO AUTH LOW CX NO UI | JavaScript::Minifier::XS versions before 0.16 for Perl crash with a NULL pointer | |
|
75
|
CVE-2026-57080 |
7.5 | 0.0049 | NET NO AUTH LOW CX NO UI | Net::BitTorrent versions through 2.1.0 for Perl allow remote memory exhaustion v | |
|
75
|
CVE-2026-57081 |
7.5 | 0.0049 | NET NO AUTH LOW CX NO UI | Net::BitTorrent versions through 2.1.0 for Perl allow remote memory exhaustion v | |
|
75
|
CVE-2026-57585 |
7.5 | 0.0049 | NET NO AUTH LOW CX NO UI | MessagePack is the serializer implementation for Python msgpack.org. Prior to 1. | |
|
75
|
CVE-2026-52197 |
7.5 | 0.0049 | NET NO AUTH LOW CX NO UI | An issue in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to | |
|
75
|
CVE-2026-49145 |
7.5 | 0.0049 | NET NO AUTH LOW CX NO UI | App::Ack versions through 3.10.0 for Perl read arbitrary files via --files-from | |
|
75
|
CVE-2026-49147 |
7.5 | 0.0049 | NET NO AUTH LOW CX NO UI | App::Ack versions through 3.10.0 for Perl print unsanitised terminal escape sequ | |
|
75
|
CVE-2026-40007 |
7.5 | 0.0049 | NET NO AUTH LOW CX NO UI | Uncontrolled Recursion, Uncontrolled Resource Consumption vulnerability in Apach | |
|
75
|
CVE-2026-40454 |
7.5 | 0.0049 | NET NO AUTH LOW CX NO UI | Out-of-bounds Read, Improper Input Validation vulnerability in Apache IoTDB C++ | |
|
75
|
CVE-2026-47479 |
7.5 | 0.0049 | NET NO AUTH LOW CX NO UI | NVIDIA Triton Inference Server for Linux contains a vulnerability where an attac | |
|
75
|
CVE-2026-47480 |
7.5 | 0.0049 | NET NO AUTH LOW CX NO UI | NVIDIA Triton Inference Server for Linux contains a vulnerability where an attac | |
|
75
|
CVE-2026-47482 |
7.5 | 0.0049 | NET NO AUTH LOW CX NO UI | NVIDIA Triton Inference Server for Linux contains a vulnerability where an attac | |
|
75
|
CVE-2026-44433 |
7.5 | 0.0049 | NET NO AUTH LOW CX NO UI | Quicly is an IETF QUIC protocol implementation intended primarily for use within | |
|
75
|
CVE-2026-44435 |
7.5 | 0.0049 | NET NO AUTH LOW CX NO UI | Quicly is an IETF QUIC protocol implementation intended primarily for use within | |
|
75
|
CVE-2026-42566 |
7.5 | 0.0049 | NET NO AUTH LOW CX NO UI | Meshtastic is an open source mesh networking solution. Prior to version 2.7.23.b | |
|
75
|
CVE-2026-47249 |
7.5 | 0.0049 | NET NO AUTH LOW CX NO UI | Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1 | |
|
75
|
CVE-2026-52878 |
7.5 | 0.0049 | NET NO AUTH LOW CX NO UI | Klever-Go is the Go implementation of the Klever blockchain protocol. Versions 1 | |
|
75
|
CVE-2026-52879 |
7.5 | 0.0049 | NET NO AUTH LOW CX NO UI | Klever-Go is the Go implementation of the Klever blockchain protocol. In version | |
|
75
|
CVE-2026-52880 |
7.5 | 0.0049 | NET NO AUTH LOW CX NO UI | Klever-Go is the Go implementation of the Klever blockchain protocol. Versions f | |
|
75
|
CVE-2026-73568 |
7.5 | 0.0049 | NET NO AUTH LOW CX NO UI | py-libp2p is the Python implementation of the libp2p networking stack. In 0.7.0 | |
|
75
|
CVE-2026-73643 |
7.5 | 0.0049 | NET NO AUTH LOW CX NO UI | js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 until 5.2.2, parsing | |
|
69
|
CVE-2026-17676 |
9.6 | 0.0049 | NET NO AUTH LOW CX | Inappropriate implementation in ANGLE in Google Chrome on Android prior to 151.0 | |
|
69
|
CVE-2026-71424 |
9.6 | 0.0049 | NET LOW CX NO UI | Onyx is an open-source AI platform. Prior to 3.1.10, 3.2.14, and 4.0.0, Onyx's G | |
|
68
|
CVE-2026-13361 |
8.8 | 0.0049 | NET LOW CX NO UI | IBM Informix oninit sq_sgkprepare RCE via unchecked SQL Interface length field. | |
|
68
|
CVE-2026-49298 |
8.8 | 0.0049 | NET LOW CX NO UI | A bug in Apache Airflow's KubernetesExecutor caused JWT tokens used by worker po | |
|
66
|
CVE-2026-49291 |
8.1 | 0.0049 | NET LOW CX NO UI | mcp-memory-service is a semantic memory layer for AI applications. Prior to vers | |
|
66
|
CVE-2026-50143 |
8.1 | 0.0049 | NET NO AUTH LOW CX | The Apify MCP server enables AI agents to extract data from websites using ready | |
|
65
|
CVE-2026-19869 |
7.6 | 0.0049 | NET LOW CX NO UI | @neo4j/graphql from 5.2.0 until the patched versions fails to enforce field-leve | |
|
59
|
CVE-2026-68752 |
7.2 | 0.0049 | NET LOW CX NO UI | A Project Resource Manager may gain broader administrative privileges under spec | |
|
56
|
CVE-2026-71312 |
8.0 | 0.0049 | NET LOW CX | rclone is a command-line program to sync files and directories to and from diffe | |
|
55
|
CVE-2026-13794 |
7.5 | 0.0049 | NET NO AUTH | Insufficient validation of untrusted input in WebAppInstalls in Google Chrome on | |
|
55
|
CVE-2026-55415 |
7.5 | 0.0049 | NET NO AUTH | datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, a | |
|
51
|
CVE-2026-115190 |
8.0 | 0.0049 | NET NO UI | An insecure deserialization (PHP object injection) vulnerability exists in Mauti |