Hunt List
12,237 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-42221 |
9.8 | 0.0134 | NET NO AUTH LOW CX NO UI | Nginx UI is a web user interface for the Nginx web server. From version 2.0.0 to | |
|
80
|
CVE-2026-70291 |
9.8 | 0.0133 | NET NO AUTH LOW CX NO UI | Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized at | |
|
80
|
CVE-2026-43512 |
9.8 | 0.0133 | NET NO AUTH LOW CX NO UI | DEPRECATED: Authentication Bypass Issues vulnerability in digest authentication | |
|
80
|
CVE-2026-110264 |
10.0 | 0.0131 | NET NO AUTH LOW CX NO UI | An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 bef | |
|
80
|
CVE-2026-48277 |
10.0 | 0.0129 | NET NO AUTH LOW CX NO UI | ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Inpu | |
|
80
|
CVE-2026-42537 |
9.8 | 0.0129 | NET NO AUTH LOW CX NO UI | Remote Code Execution via JDBC URL Injection in Apache Ranger <= 2.8.0 Users are | |
|
80
|
CVE-2026-72577 |
9.8 | 0.0127 | NET NO AUTH LOW CX NO UI | Multiple vulnerabilities in NASA fprime-gds through 3.4.3 allow an unauthenticat | |
|
79
|
CVE-2026-58449 |
9.3 | 0.0135 | NET NO AUTH LOW CX NO UI | txtai through 9.10.0, fixed in commit 11b32da, exposes an API /reindex endpoint | |
|
79
|
CVE-2026-54836 |
9.3 | 0.0134 | NET NO AUTH LOW CX NO UI | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti | |
|
79
|
CVE-2026-59864 |
9.3 | 0.0133 | NET NO AUTH LOW CX NO UI | Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5 | |
|
79
|
CVE-2026-42647 |
9.3 | 0.0132 | NET NO AUTH LOW CX NO UI | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti | |
|
79
|
CVE-2026-112900 |
9.2 | 0.0130 | NET NO AUTH LOW CX NO UI | Pillow is a Python imaging library. From 2.6.0 until 13.0.0, Pillow is vulnerabl | |
|
79
|
CVE-2026-63385 |
9.2 | 0.0129 | NET NO AUTH LOW CX NO UI | Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libe | |
|
78
|
CVE-2026-39339 |
9.1 | 0.0135 | NET NO AUTH LOW CX NO UI | ChurchCRM is an open-source church management system. Prior to 7.1.0, a critica | |
|
78
|
CVE-2026-112352 |
9.1 | 0.0132 | NET NO AUTH LOW CX NO UI | Sunhillo SureLine before 9.1.5 contains an authentication bypass vulnerability t | |
|
78
|
CVE-2026-2332 |
9.1 | 0.0131 | NET NO AUTH LOW CX NO UI | In Eclipse Jetty, the HTTP/1.1 parser is vulnerable to request smuggling when ch | |
|
78
|
CVE-2026-33765 |
8.9 | 0.0130 | NET NO AUTH LOW CX NO UI | Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level | |
|
75
|
CVE-2026-42009 |
7.5 | 0.0134 | NET NO AUTH LOW CX NO UI | A flaw was found in gnutls. A remote attacker could exploit an issue in the Data | |
|
75
|
CVE-2026-70058 |
7.5 | 0.0133 | NET NO AUTH LOW CX NO UI | Out-of-bounds write in Windows DHCP Server allows an unauthorized attacker to ex | |
|
75
|
CVE-2026-70082 |
7.5 | 0.0133 | NET NO AUTH LOW CX NO UI | Uncaught exception in Windows DNS allows an unauthorized attacker to deny servic | |
|
75
|
CVE-2026-70155 |
7.5 | 0.0133 | NET NO AUTH LOW CX NO UI | Missing release of memory after effective lifetime in Windows DNS allows an unau | |
|
75
|
CVE-2026-83516 |
7.5 | 0.0133 | NET NO AUTH LOW CX NO UI | Out-of-bounds read in Windows Local Security Authority Subsystem Service (LSASS) | |
|
75
|
CVE-2026-83635 |
7.5 | 0.0133 | NET NO AUTH LOW CX NO UI | Out-of-bounds read in DNS Server allows an unauthorized attacker to deny service | |
|
75
|
CVE-2026-83655 |
7.5 | 0.0133 | NET NO AUTH LOW CX NO UI | Out-of-bounds read in Network Policy Server (NPS) allows an unauthorized attacke | |
|
75
|
CVE-2026-83665 |
7.5 | 0.0133 | NET NO AUTH LOW CX NO UI | Null pointer dereference in Windows DHCP Server allows an unauthorized attacker | |
|
75
|
CVE-2026-83855 |
7.5 | 0.0133 | NET NO AUTH LOW CX NO UI | Integer underflow (wrap or wraparound) in Windows WLAN Service allows an unautho | |
|
75
|
CVE-2026-105723 |
7.5 | 0.0132 | NET NO AUTH LOW CX NO UI | Untrusted pointer dereference in Windows Distributed File System (DFS) allows an | |
|
75
|
CVE-2026-2100 |
7.5 | 0.0131 | NET NO AUTH LOW CX NO UI | A flaw was found in p11-kit. A remote attacker could exploit this vulnerability | |
|
75
|
CVE-2026-53598 |
7.5 | 0.0129 | NET NO AUTH LOW CX NO UI | Prompty is a markdown file format (.prompty) for LLM prompts. Prior to 2.0.0-bet | |
|
70
|
CVE-2026-104353 |
9.9 | 0.0130 | NET LOW CX NO UI | Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Specia | |
|
70
|
CVE-2023-27407 |
9.9 | 0.0130 | NET LOW CX NO UI | A vulnerability has been identified in SCALANCE LPE9403 (All versions < V2.1). T | |
|
69
|
CVE-2026-21571 |
9.4 | 0.0135 | NET LOW CX NO UI | This Critical severity OS Command Injection vulnerability was introduced in vers | |
|
69
|
CVE-2026-70279 |
9.3 | 0.0129 | NET NO AUTH LOW CX | Improper neutralization of input during web page generation ('cross-site scripti | |
|
69
|
CVE-2026-44939 |
9.4 | 0.0128 | NET NO AUTH LOW CX | A command injection vulnerability in the Rancher Manager cluster before 2.14.2 i | |
|
68
|
CVE-2026-41880 |
9.0 | 0.0133 | NET LOW CX NO UI | R-SOFT DMS is vulnerable to OS Command Injection in the Optical Character Recogn | |
|
68
|
CVE-2026-63722 |
8.7 | 0.0133 | NET LOW CX NO UI | ICEcoder 8.1 contains an unauthenticated remote code execution vulnerability tha | |
|
68
|
CVE-2026-33277 |
8.7 | 0.0132 | NET LOW CX NO UI | An OS command Injection issue exists in LogonTracer prior to v2.0.0. An arbitrar | |
|
68
|
CVE-2026-39981 |
8.8 | 0.0132 | NET LOW CX NO UI | AGiXT is a dynamic AI Agent Automation Platform. Prior to 1.9.2, the safe_join() | |
|
68
|
CVE-2026-34791 |
8.7 | 0.0129 | NET LOW CX NO UI | Endian Firewall version 3.3.25 and prior allow authenticated users to execute ar | |
|
68
|
CVE-2026-8659 |
8.8 | 0.0129 | NET LOW CX NO UI | OS Command Injection vulnerability in Rapid7 InsightConnect SQLmap Plugin on Lin | |
|
68
|
CVE-2026-8663 |
8.8 | 0.0129 | NET LOW CX NO UI | OS Command Injection vulnerability in Rapid7 InsightConnect RPM Plugin on Linux | |
|
68
|
CVE-2026-8664 |
8.8 | 0.0129 | NET LOW CX NO UI | OS Command Injection vulnerability in Rapid7 InsightConnect Finger Plugin on Lin | |
|
68
|
CVE-2026-8658 |
8.8 | 0.0129 | NET LOW CX NO UI | OS Command Injection vulnerability in Rapid7 InsightConnect Tcpdump Plugin on Li | |
|
68
|
CVE-2026-97380 |
8.8 | 0.0128 | NET LOW CX NO UI | MariaDB server is a community developed fork of MySQL server. From 10.6.1 until | |
|
63
|
CVE-2026-35499 |
9.1 | 0.0129 | NET LOW CX NO UI | An os command injection vulnerability exists in the boa formWsc peerRptPin funct | |
|
62
|
CVE-2026-12104 |
8.6 | 0.0132 | NET LOW CX NO UI | OS command injection in the environment and tunnel configuration functionality i | |
|
62
|
CVE-2026-35506 |
8.6 | 0.0131 | NET LOW CX NO UI | ELECOM wireless LAN access point devices contain an OS command injection vulnera | |
|
57
|
CVE-2024-3727 |
8.3 | 0.0128 | NET NO AUTH | A flaw was found in the github.com/containers/image library. This flaw allows at | |
|
56
|
CVE-2026-48719 |
8.0 | 0.0132 | NET LOW CX | Warp is an agentic development environment. From 0.2025.08.06.08.12.stable_00 un | |
|
51
|
CVE-2026-40711 |
8.0 | 0.0135 | NET NO UI | Dell Dell Container Storage Modules, version(s) csi-powerstore v2.16.0, csi-unit |