Hunt List
12,179 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-64193 |
9.8 | 0.0144 | NET NO AUTH LOW CX NO UI | Net::DNS versions through 1.55 for Perl allow remote execution injection via EDN | |
|
80
|
CVE-2026-48281 |
10.0 | 0.0142 | NET NO AUTH LOW CX NO UI | ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Inpu | |
|
80
|
CVE-2026-79857 |
9.8 | 0.0141 | NET NO AUTH LOW CX NO UI | There is a command injection vulnerability in the PAPI protocol (Aruba's access | |
|
80
|
CVE-2026-69085 |
9.9 | 0.0139 | NET NO AUTH LOW CX NO UI | SiYuan before v3.7.3 contains a SQL injection vulnerability in the /api/filetree | |
|
80
|
CVE-2026-31843 |
10.0 | 0.0138 | NET NO AUTH LOW CX NO UI | The goodoneuz/pay-uz Laravel package (<= 2.2.24) contains a critical vulnerabili | |
|
80
|
CVE-2026-79846 |
10.0 | 0.0137 | NET NO AUTH LOW CX NO UI | Command injection vulnerabilities exist in the affected interface of AOS-8 that | |
|
80
|
CVE-2026-48323 |
10.0 | 0.0137 | NET NO AUTH LOW CX NO UI | Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Specia | |
|
79
|
CVE-2026-56062 |
9.3 | 0.0144 | NET NO AUTH LOW CX NO UI | Unauthenticated SQL Injection in Quotes llama <= 3.1.5 versions. | |
|
79
|
CVE-2026-56070 |
9.3 | 0.0144 | NET NO AUTH LOW CX NO UI | Unauthenticated SQL Injection in Advance Product Search <= 1.4.4 versions. | |
|
79
|
CVE-2026-6875 |
9.5 | 0.0143 | NET NO AUTH LOW CX NO UI | ServiceNow has addressed a remote code execution vulnerability that was identifi | |
|
79
|
CVE-2026-59866 |
9.3 | 0.0141 | NET NO AUTH LOW CX NO UI | Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5 | |
|
79
|
CVE-2026-56121 |
9.3 | 0.0141 | NET NO AUTH LOW CX NO UI | Feast before 0.63.0 contains an unsafe deserialization vulnerability that allows | |
|
79
|
CVE-2026-22095 |
9.3 | 0.0139 | NET NO AUTH LOW CX NO UI | The network diagnosis endpoint on the web server at port 8090 is vulnerable to c | |
|
79
|
CVE-2026-22103 |
9.3 | 0.0139 | NET NO AUTH LOW CX NO UI | The NPC start endpoint on the web server at port 8090 is vulnerable to command i | |
|
79
|
CVE-2026-59707 |
9.2 | 0.0138 | NET NO AUTH LOW CX NO UI | LocalAI contains an unauthenticated server-side request forgery vulnerability in | |
|
79
|
CVE-2026-56292 |
9.2 | 0.0138 | NET NO AUTH LOW CX NO UI | Joomla Extension - acymailing.com - SQL Injection in AcyMailing extension < 10.1 | |
|
79
|
CVE-2026-47103 |
9.3 | 0.0136 | NET NO AUTH LOW CX NO UI | Python StateMachine versions 3.0.0 before 3.2.0 contains a remote code execution | |
|
79
|
CVE-2026-58449 |
9.3 | 0.0135 | NET NO AUTH LOW CX NO UI | txtai through 9.10.0, fixed in commit 11b32da, exposes an API /reindex endpoint | |
|
77
|
CVE-2026-27771 |
8.2 | 0.0139 | NET NO AUTH LOW CX NO UI | Gitea versions up to and including 1.26.1 have insufficient permission checks fo | |
|
75
|
CVE-2026-36045 |
7.3 | 0.0144 | NET NO AUTH LOW CX NO UI | picoclaw <=v0.1.2 and earlier is vulnerable to OS command injection via the Exec | |
|
75
|
CVE-2026-45332 |
7.5 | 0.0142 | NET NO AUTH LOW CX NO UI | Automad is a flat-file content management system and template engine. From 2.0.0 | |
|
75
|
CVE-2026-59862 |
7.5 | 0.0138 | NET NO AUTH LOW CX NO UI | Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.0 | |
|
75
|
CVE-2026-47717 |
7.5 | 0.0138 | NET NO AUTH LOW CX NO UI | FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. In fux | |
|
75
|
CVE-2026-67918 |
7.5 | 0.0136 | NET NO AUTH LOW CX NO UI | Directory Traversal vulnerability in hermes-studio v.0.6.26 allows a remote atta | |
|
75
|
CVE-2026-83516 |
7.5 | 0.0136 | NET NO AUTH LOW CX NO UI | Out-of-bounds read in Windows Local Security Authority Subsystem Service (LSASS) | |
|
75
|
CVE-2026-83655 |
7.5 | 0.0136 | NET NO AUTH LOW CX NO UI | Out-of-bounds read in Network Policy Server (NPS) allows an unauthorized attacke | |
|
75
|
CVE-2026-83665 |
7.5 | 0.0136 | NET NO AUTH LOW CX NO UI | Null pointer dereference in Windows DHCP Server allows an unauthorized attacker | |
|
69
|
CVE-2026-41137 |
9.4 | 0.0145 | NET LOW CX NO UI | Flowise is a drag & drop user interface to build a customized large language mod | |
|
69
|
CVE-2026-61736 |
9.3 | 0.0142 | NET NO AUTH LOW CX | LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.4 | |
|
69
|
CVE-2026-90531 |
9.6 | 0.0140 | NET LOW CX NO UI | Adobe Experience Manager is affected by an Improper Restriction of XML External | |
|
69
|
CVE-2026-115995 |
9.4 | 0.0138 | NET NO AUTH LOW CX | A security vulnerability has been detected in Unitree Robotics Unitree Go2 up to | |
|
68
|
CVE-2026-7816 |
8.7 | 0.0144 | NET LOW CX NO UI | OS command injection (CWE-78) vulnerability in pgAdmin 4 Import/Export query exp | |
|
68
|
CVE-2026-70035 |
8.8 | 0.0143 | NET NO AUTH LOW CX | Deserialization of untrusted data in .NET Framework allows an unauthorized attac | |
|
68
|
CVE-2026-83520 |
8.8 | 0.0143 | NET NO AUTH LOW CX | Deserialization of untrusted data in .NET allows an unauthorized attacker to exe | |
|
68
|
CVE-2026-88159 |
8.8 | 0.0142 | NET LOW CX NO UI | Use after free in Windows Background Intelligent Transfer Service (BITS) allows | |
|
68
|
CVE-2026-58655 |
8.7 | 0.0142 | NET LOW CX NO UI | The bundled Grav Flex Objects plugin (getgrav/grav-plugin-flex-objects) before 1 | |
|
68
|
CVE-2026-48732 |
8.8 | 0.0140 | NET NO AUTH LOW CX | Warp is an agentic development environment. From 0.2023.03.21.08.02.stable_00 un | |
|
68
|
CVE-2026-59859 |
8.7 | 0.0138 | NET NO AUTH LOW CX | Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.4 | |
|
68
|
CVE-2026-59860 |
8.7 | 0.0138 | NET NO AUTH LOW CX | Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.3 | |
|
68
|
CVE-2026-34594 |
8.8 | 0.0138 | NET LOW CX NO UI | Coolify is an open-source and self-hostable tool for managing servers, applicati | |
|
66
|
CVE-2026-5785 |
8.1 | 0.0139 | NET LOW CX NO UI | Zohocorp ManageEngine PAM360 versions before 8531 and ManageEngine Password Mana | |
|
66
|
CVE-2026-70571 |
8.1 | 0.0139 | NET NO AUTH NO UI | Stack-based buffer overflow in Microsoft Exchange Server allows an unauthorized | |
|
64
|
CVE-2026-59863 |
7.0 | 0.0137 | NET NO AUTH LOW CX | Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5 | |
|
63
|
CVE-2026-10138 |
9.1 | 0.0145 | NET LOW CX NO UI | A OS command injection vulnerability exists in the boa formUpload() functionalit | |
|
63
|
CVE-2026-10131 |
9.1 | 0.0139 | NET LOW CX NO UI | An OS command injection vulnerability exists in the boa formPasswordSetup functi | |
|
63
|
CVE-2026-10135 |
9.1 | 0.0139 | NET LOW CX NO UI | A OS command injection vulnerability exists in the batchupg functionality of X20 | |
|
62
|
CVE-2026-118755 |
8.6 | 0.0140 | NET LOW CX NO UI | Volmarg Personal Management System through 2.1.0 contains an OS command injectio | |
|
62
|
CVE-2026-40520 |
8.6 | 0.0138 | NET LOW CX NO UI | FreePBX api module version 17.0.8 and prior contain a command injection vulnerab | |
|
60
|
CVE-2026-84387 |
7.2 | 0.0140 | NET LOW CX NO UI | An Improper Neutralization of Special Elements used in a Command ('Command Injec | |
|
60
|
CVE-2026-111461 |
7.5 | 0.0137 | NET LOW CX NO UI | An OS command injection vulnerability exists in OnCell G3150A-LTE Series. When t |