Hunt List
13,805 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-11414 |
10.0 | 0.0048 | NET NO AUTH LOW CX NO UI | A hard-coded cryptographic key is used by Altium Enterprise Server to sign file | |
|
80
|
CVE-2026-40884 |
9.8 | 0.0048 | NET NO AUTH LOW CX NO UI | goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.6, goshs contains | |
|
80
|
CVE-2026-44717 |
9.8 | 0.0048 | NET NO AUTH LOW CX NO UI | MCP Calculate Server is a mathematical calculation service based on MCP protocol | |
|
80
|
CVE-2026-74345 |
9.8 | 0.0048 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: F | |
|
80
|
CVE-2026-89659 |
9.8 | 0.0048 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: NFSD: Preve | |
|
80
|
CVE-2026-49085 |
9.8 | 0.0048 | NET NO AUTH LOW CX NO UI | Unauthenticated PHP Object Injection in WP Insightly for Contact Form 7, WPForms | |
|
80
|
CVE-2026-49104 |
9.8 | 0.0048 | NET NO AUTH LOW CX NO UI | Unauthenticated PHP Object Injection in Integration for Keap/infusionsoft and Co | |
|
80
|
CVE-2026-49105 |
9.8 | 0.0048 | NET NO AUTH LOW CX NO UI | Unauthenticated PHP Object Injection in WP Zendesk for Contact Form 7, WPForms, | |
|
80
|
CVE-2026-9691 |
9.8 | 0.0048 | NET NO AUTH LOW CX NO UI | Unauthenticated PHP Object Injection in Integration for ActiveCampaign and Conta | |
|
80
|
CVE-2026-2397 |
9.8 | 0.0048 | NET NO AUTH LOW CX NO UI | Improper neutralization of special elements used in an SQL command ('SQL injecti | |
|
80
|
CVE-2026-5134 |
9.8 | 0.0048 | NET NO AUTH LOW CX NO UI | Improper neutralization of special elements used in an SQL command ('SQL injecti | |
|
80
|
CVE-2026-61998 |
9.8 | 0.0048 | NET NO AUTH LOW CX NO UI | Unauthenticated PHP Object Injection in Le Truffe <= 1.1.7 versions. | |
|
78
|
CVE-2026-18363 |
9.1 | 0.0048 | NET NO AUTH LOW CX NO UI | A logic vulnerability in the password reset token validation routine implemented | |
|
77
|
CVE-2026-112897 |
8.7 | 0.0048 | NET NO AUTH LOW CX NO UI | Pillow is a Python imaging library. From 5.3.0 until 13.0.0, Pillow can return u | |
|
77
|
CVE-2026-114052 |
8.7 | 0.0048 | NET NO AUTH LOW CX NO UI | vLLM after 0.24.0 and before 0.31.0 contains a memory exhaustion vulnerability i | |
|
77
|
CVE-2026-119760 |
8.7 | 0.0048 | NET NO AUTH LOW CX NO UI | sniproxy through 0.7.0 contains a NULL pointer dereference vulnerability in reso | |
|
76
|
CVE-2026-102555 |
8.2 | 0.0048 | NET NO AUTH LOW CX NO UI | A flaw was found in libsoup. The soup_uri_decode_data_uri() function incorrectly | |
|
75
|
CVE-2026-47247 |
7.5 | 0.0048 | NET NO AUTH LOW CX NO UI | libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.2 | |
|
75
|
CVE-2026-65644 |
7.5 | 0.0048 | NET NO AUTH LOW CX NO UI | Rocket.Chat in versions before 8.8.0, 8.7.1, 8.6.2, 8.5.3, 8.4.6, 8.3.8, 8.2.8, | |
|
75
|
CVE-2026-53229 |
7.5 | 0.0048 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: | |
|
75
|
CVE-2026-53284 |
7.5 | 0.0048 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: btrfs: only | |
|
75
|
CVE-2026-74695 |
7.5 | 0.0048 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: netfilter: | |
|
75
|
CVE-2026-80631 |
7.5 | 0.0048 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: btrfs: lzo: | |
|
75
|
CVE-2026-89561 |
7.5 | 0.0048 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: ipv6: rpl: | |
|
75
|
CVE-2026-61902 |
7.5 | 0.0048 | NET NO AUTH LOW CX NO UI | Apache bRPC versions before 1.18.0 do not consistently enforce the configured ma | |
|
75
|
CVE-2026-57697 |
7.5 | 0.0048 | NET NO AUTH LOW CX NO UI | Authentication Bypass Using an Alternate Path or Channel vulnerability in Metaga | |
|
70
|
CVE-2026-105489 |
9.9 | 0.0048 | NET LOW CX NO UI | Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Specia | |
|
69
|
CVE-2026-42090 |
9.6 | 0.0048 | NET NO AUTH LOW CX | Notesnook is a note-taking app focused on user privacy & ease of use. Prior to N | |
|
68
|
CVE-2026-118938 |
8.8 | 0.0048 | NET NO AUTH LOW CX | In Trail of Bits fickling through 0.1.12, a pickle STACK_GLOBAL operand carrying | |
|
68
|
CVE-2026-109391 |
9.2 | 0.0048 | NET NO AUTH NO UI | Square Squash through commit e73f280 contains an insecure deserialization vulner | |
|
68
|
CVE-2026-74969 |
8.8 | 0.0048 | NET NO AUTH LOW CX | Race condition, use-after-free in the Layout: Text and Fonts component. This vul | |
|
67
|
CVE-2026-55193 |
8.7 | 0.0048 | NET NO AUTH LOW CX | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0 | |
|
67
|
CVE-2026-67622 |
8.5 | 0.0048 | NET LOW CX NO UI | Flowise through 3.1.4 contains an insecure direct object reference vulnerability | |
|
67
|
CVE-2026-48033 |
8.4 | 0.0048 | NET LOW CX NO UI | Hulumi is an open-source toolkit that ships secure-by-default cloud and platform | |
|
67
|
CVE-2026-34046 |
8.7 | 0.0048 | NET LOW CX NO UI | Langflow is a tool for building and deploying AI-powered agents and workflows. P | |
|
67
|
CVE-2026-120091 |
8.7 | 0.0048 | NET LOW CX NO UI | Temporal Server compiles a Worker Controller Instance module, go.temporal.io/aut | |
|
67
|
CVE-2026-75913 |
8.5 | 0.0048 | NET NO AUTH LOW CX | CodeWhale versions >= 0.3.27 and < 0.8.64 (published as deepseek-tui >= 0.3.27 a | |
|
66
|
CVE-2026-77176 |
8.1 | 0.0048 | NET LOW CX NO UI | A flaw was found in Kata Containers. In configurations utilizing genpolicy for C | |
|
66
|
CVE-2026-98405 |
8.1 | 0.0048 | NET NO AUTH LOW CX | In the Linux kernel, the following vulnerability has been resolved: smb: client | |
|
66
|
CVE-2026-117617 |
8.1 | 0.0048 | NET LOW CX NO UI | Jenkins 2.587 and earlier, LTS 2.580.1 and earlier checks for symbolic links in | |
|
65
|
CVE-2026-70474 |
7.6 | 0.0048 | NET LOW CX NO UI | Flowise is a drag-and-drop user interface for building customized large language | |
|
64
|
CVE-2026-34476 |
7.1 | 0.0048 | NET LOW CX NO UI | Server-Side Request Forgery via SW-URL Header vulnerability in Apache SkyWalking | |
|
63
|
CVE-2026-42021 |
9.1 | 0.0048 | NET LOW CX NO UI | Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Se | |
|
63
|
CVE-2026-42022 |
9.1 | 0.0048 | NET LOW CX NO UI | Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Se | |
|
57
|
CVE-2026-54661 |
8.3 | 0.0048 | NET NO AUTH | swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI | |
|
57
|
CVE-2026-54664 |
8.3 | 0.0048 | NET NO AUTH | swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI | |
|
55
|
CVE-2025-49935 |
7.5 | 0.0048 | NET NO UI | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP | |
|
55
|
CVE-2026-108448 |
7.5 | 0.0048 | NET NO AUTH | Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized at | |
|
51
|
CVE-2026-15801 |
8.0 | 0.0048 | NET NO UI | A vulnerability was found in CRI-O related to the container checkpoint and resto | |
|
49
|
CVE-2026-63397 |
7.1 | 0.0048 | NET LOW CX | remorses/genql before version 6.3.4 allows an authenticated attacker with contro |