Hunt List
13,776 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2025-62818 |
9.8 | 0.0046 | NET NO AUTH LOW CX NO UI | An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Mod | |
|
80
|
CVE-2026-8649 |
9.8 | 0.0046 | NET NO AUTH LOW CX NO UI | Improper Neutralization of Special Elements in Data Query Logic vulnerability in | |
|
80
|
CVE-2026-119096 |
9.8 | 0.0046 | NET NO AUTH LOW CX NO UI | The Uncanny Toolkit for LearnDash plugin for WordPress is vulnerable to Authenti | |
|
80
|
CVE-2026-83327 |
9.8 | 0.0046 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Applications Framework product of Oracle E-Business | |
|
80
|
CVE-2026-115245 |
9.8 | 0.0046 | NET NO AUTH LOW CX NO UI | The Chat AI with Dispatcher WordPress plugin before 2.4 does not properly valida | |
|
80
|
CVE-2026-42376 |
9.8 | 0.0046 | NET NO AUTH LOW CX NO UI | D-Link DIR-456U Hardware Revision A1 (End-of-Life, EOL) contains a hardcoded tel | |
|
78
|
CVE-2026-93865 |
9.2 | 0.0046 | NET NO AUTH LOW CX NO UI | A missing authentication vulnerability in the Fireware OS FireCluster synchroniz | |
|
78
|
CVE-2026-108357 |
8.8 | 0.0046 | NET NO AUTH LOW CX NO UI | PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. | |
|
78
|
CVE-2026-45034 |
9.2 | 0.0046 | NET NO AUTH LOW CX NO UI | PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. | |
|
78
|
CVE-2026-114053 |
9.2 | 0.0046 | NET NO AUTH LOW CX NO UI | vLLM from 0.7.3 before 0.31.0 forwards the request-supplied mm_processor_kwargs. | |
|
78
|
CVE-2026-7557 |
9.1 | 0.0046 | NET NO AUTH LOW CX NO UI | An improper verification of cryptographic signature vulnerability in the SAML au | |
|
78
|
CVE-2026-70452 |
9.1 | 0.0046 | NET NO AUTH LOW CX NO UI | rsync 3.1.0 before 3.5.0 contains an access control bypass vulnerability that al | |
|
77
|
CVE-2026-68494 |
8.7 | 0.0046 | NET NO AUTH LOW CX NO UI | The fix released in jackson-core 2.18.6 and 2.21.1 for CVE-2026-18401 (GHSA-72hv | |
|
77
|
CVE-2026-113582 |
8.7 | 0.0046 | NET NO AUTH LOW CX NO UI | UNSUPPORTED WHEN ASSIGNED Improper restriction of XML external entity references | |
|
77
|
CVE-2026-35064 |
8.7 | 0.0046 | NET NO AUTH LOW CX NO UI | A vulnerability in SenseLive X3050’s management ecosystem allows unauthenticated | |
|
77
|
CVE-2026-62302 |
8.7 | 0.0046 | NET NO AUTH LOW CX NO UI | MyTube is a self-hosted downloader and player for several video websites. Prior | |
|
75
|
CVE-2025-60570 |
7.5 | 0.0046 | NET NO AUTH LOW CX NO UI | D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the | |
|
75
|
CVE-2026-32605 |
7.5 | 0.0046 | NET NO AUTH LOW CX NO UI | nimiq/core-rs-albatross is a Rust implementation of the Nimiq Proof-of-Stake pro | |
|
75
|
CVE-2026-46862 |
7.5 | 0.0046 | NET NO AUTH LOW CX NO UI | Vulnerability in the MySQL Router product of Oracle MySQL (component: Router: Ge | |
|
75
|
CVE-2026-11823 |
7.5 | 0.0046 | NET NO AUTH LOW CX NO UI | The BookingPress Appointment Booking Pro plugin for WordPress is vulnerable to S | |
|
75
|
CVE-2026-8441 |
7.5 | 0.0046 | NET NO AUTH LOW CX NO UI | The WP Review Slider Pro plugin for WordPress is vulnerable to SQL Injection via | |
|
75
|
CVE-2026-51602 |
7.5 | 0.0046 | NET NO AUTH LOW CX NO UI | A stack-based buffer overflow vulnerability in the RTSP service of Tenda CP3 V3. | |
|
75
|
CVE-2026-51603 |
7.5 | 0.0046 | NET NO AUTH LOW CX NO UI | A stack-based buffer overflow vulnerability in the RTSP service of Tenda CP3 V3. | |
|
75
|
CVE-2026-56285 |
7.7 | 0.0046 | NET NO AUTH LOW CX NO UI | Nitter's /video media proxy endpoint fails to validate target URLs against Twitt | |
|
75
|
CVE-2026-54426 |
7.5 | 0.0046 | NET NO AUTH LOW CX NO UI | Uncontrolled recursion in the Redis reply parser in Apache bRPC < 1.18.0 allows | |
|
70
|
CVE-2026-9193 |
9.9 | 0.0046 | NET LOW CX NO UI | An improper privilege management vulnerability in the Hadoop integration of Prog | |
|
69
|
CVE-2026-76035 |
9.6 | 0.0046 | NET NO AUTH LOW CX | Inappropriate implementation in Media in Google Chrome on on Mac prior to 151.0. | |
|
69
|
CVE-2026-33646 |
9.6 | 0.0046 | NET NO AUTH LOW CX | mise manages dev tools like node, python, cmake, and terraform. Prior to 2026.3. | |
|
68
|
CVE-2026-76477 |
8.8 | 0.0046 | NET LOW CX NO UI | As part of Cisco's ongoing commitment to proactive security and product quality, | |
|
67
|
CVE-2023-54366 |
8.7 | 0.0046 | NET LOW CX NO UI | SurrealDB before 1.0.1 sets default table permissions to FULL instead of NONE, a | |
|
66
|
CVE-2026-42609 |
8.1 | 0.0046 | NET LOW CX NO UI | Grav is a file-based Web platform. Prior to 2.0.0-beta.2, a business logic vulne | |
|
65
|
CVE-2026-7420 |
7.4 | 0.0046 | NET LOW CX NO UI | A security flaw has been discovered in UTT HiPER 1250GW up to 3.2.7-210907-18053 | |
|
65
|
CVE-2026-7748 |
7.4 | 0.0046 | NET LOW CX NO UI | A weakness has been identified in Totolink N300RH 3.2.4-B20220812. Affected by t | |
|
65
|
CVE-2026-7750 |
7.4 | 0.0046 | NET LOW CX NO UI | A vulnerability was detected in Totolink N300RH 3.2.4-B20220812. This vulnerabil | |
|
65
|
CVE-2026-8137 |
7.4 | 0.0046 | NET LOW CX NO UI | A vulnerability has been found in Totolink X5000R 9.1.0u.6369_B20230113. This vu | |
|
64
|
CVE-2026-72786 |
7.1 | 0.0046 | NET LOW CX NO UI | Craft CMS versions before 5.10.8 contain an authentication bypass vulnerability | |
|
64
|
CVE-2026-116233 |
9.4 | 0.0046 | NET LOW CX NO UI | A security vulnerability has been detected in Oray Pugongying X5 Pro 7.6.1. This | |
|
63
|
CVE-2026-35298 |
9.1 | 0.0046 | NET LOW CX NO UI | Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (compon | |
|
63
|
CVE-2026-46875 |
9.1 | 0.0046 | NET LOW CX NO UI | Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle E | |
|
63
|
CVE-2026-46896 |
9.1 | 0.0046 | NET LOW CX NO UI | Vulnerability in the Oracle Enterprise Command Center Framework product of Oracl | |
|
63
|
CVE-2026-46945 |
9.1 | 0.0046 | NET LOW CX NO UI | Vulnerability in the Oracle iSupport product of Oracle E-Business Suite (compone | |
|
63
|
CVE-2026-46946 |
9.1 | 0.0046 | NET LOW CX NO UI | Vulnerability in the Oracle iSupport product of Oracle E-Business Suite (compone | |
|
62
|
CVE-2026-23898 |
8.6 | 0.0046 | NET LOW CX NO UI | Lack of input validation leads to an arbitrary file deletion vulnerability in th | |
|
59
|
CVE-2026-65559 |
7.2 | 0.0046 | NET LOW CX NO UI | Shop manager Privilege Escalation in Order Delivery Date for WooCommerce <= 4.6. | |
|
59
|
CVE-2026-14237 |
7.2 | 0.0046 | NET LOW CX NO UI | The vitepos WordPress plugin before 3.6.0, Vitepos WordPress plugin before 3.5. | |
|
59
|
CVE-2026-18635 |
7.2 | 0.0046 | NET LOW CX NO UI | Velociraptor's VQL has a query() plugin which allows running a VQL query in a di | |
|
59
|
CVE-2026-70861 |
7.2 | 0.0046 | NET LOW CX NO UI | Vulnerability in the PeopleSoft Enterprise FIN Common Objects Brazil product of | |
|
59
|
CVE-2026-13174 |
7.2 | 0.0046 | NET LOW CX NO UI | The Eventin WordPress plugin before 4.1.21 does not verify ownership or capabil | |
|
58
|
CVE-2026-35035 |
9.0 | 0.0046 | NET LOW CX | CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, mo | |
|
58
|
CVE-2026-21582 |
8.8 | 0.0046 | NET NO AUTH | This High severity BASM (Broken Authentication & Session Management) vulnerabili |