Hunt List
13,324 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-41873 |
9.8 | 0.0044 | NET NO AUTH LOW CX NO UI | ** UNSUPPORTED WHEN ASSIGNED ** Inconsistent Interpretation of HTTP Requests ('H | |
|
80
|
CVE-2026-72463 |
9.8 | 0.0044 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: xfrm: Fix d | |
|
79
|
CVE-2026-77992 |
9.5 | 0.0044 | NET NO AUTH LOW CX NO UI | Joomla Extension - fabrikar.com - heredoc terminator breakout in the calc elemen | |
|
79
|
CVE-2026-54419 |
9.3 | 0.0044 | NET NO AUTH LOW CX NO UI | claudiopizzillo PIAF-HMS (PBX-In-A-Flash Hotel Management System; no released ve | |
|
79
|
CVE-2026-61175 |
9.3 | 0.0044 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Product Lifecycle Analytics product of Oracle Supply | |
|
78
|
CVE-2026-73567 |
9.1 | 0.0044 | NET NO AUTH LOW CX NO UI | sm-crypto provides JavaScript implementations of the Chinese cryptographic algor | |
|
78
|
CVE-2026-17003 |
9.1 | 0.0044 | NET NO AUTH LOW CX NO UI | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to c | |
|
78
|
CVE-2026-112404 |
8.8 | 0.0044 | NET NO AUTH LOW CX NO UI | Pillow is a Python imaging library. From 8.1.0 until 13.0.0, Pillow's TIFF tile | |
|
77
|
CVE-2026-29036 |
8.7 | 0.0044 | NET NO AUTH LOW CX NO UI | cJSON versions 1.5.0 through 1.7.19 contain an incorrectly-resolved name or refe | |
|
77
|
CVE-2026-115775 |
8.7 | 0.0044 | NET NO AUTH LOW CX NO UI | Twisted is an event-based framework for internet applications, supporting Python | |
|
77
|
CVE-2026-58050 |
8.3 | 0.0044 | NET NO AUTH LOW CX NO UI | libssh2 through 1.11.1 reads an attacker-controlled 32-bit attribute count from | |
|
76
|
CVE-2026-72766 |
8.2 | 0.0044 | NET NO AUTH LOW CX NO UI | n8n before 1.123.67, 2.x before 2.31.5, and 2.32.x before 2.32.1 contain a type | |
|
75
|
CVE-2026-47221 |
7.5 | 0.0044 | NET NO AUTH LOW CX NO UI | Envoy is an open source edge and service proxy designed for cloud-native applica | |
|
70
|
CVE-2026-63296 |
9.9 | 0.0044 | NET LOW CX NO UI | An authorization bypass vulnerability in LXD allows an authenticated attacker to | |
|
69
|
CVE-2026-72564 |
9.6 | 0.0044 | NET LOW CX NO UI | An improper authorization vulnerability in fosrl/pangolin through v1.20.0 allows | |
|
68
|
CVE-2026-16371 |
8.8 | 0.0044 | NET NO AUTH LOW CX | Privilege escalation in the DOM: Navigation component. This vulnerability was fi | |
|
68
|
CVE-2026-60009 |
8.8 | 0.0044 | NET NO AUTH LOW CX | In Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` ba | |
|
68
|
CVE-2026-115729 |
8.9 | 0.0044 | NET NO AUTH NO UI | @pdfme/common from 5.5.10 before 6.2.6 contains a server-side request forgery vu | |
|
68
|
CVE-2026-6212 |
8.8 | 0.0044 | NET LOW CX NO UI | Authorization bypass through User-Controlled key vulnerability in Teracity Softw | |
|
68
|
CVE-2026-62869 |
8.8 | 0.0044 | NET LOW CX NO UI | Insufficient verification of data authenticity in Azure Entra ID allows an autho | |
|
68
|
CVE-2026-113018 |
8.8 | 0.0044 | NET NO AUTH LOW CX | Memory corruption in IME in Google Chrome prior to 156.0.8078.47 allowed a remot | |
|
68
|
CVE-2026-113019 |
8.8 | 0.0044 | NET NO AUTH LOW CX | Use after free in Turbolev in Google Chrome prior to 156.0.8078.47 allowed a rem | |
|
68
|
CVE-2026-113091 |
8.8 | 0.0044 | NET NO AUTH LOW CX | Use after free in PerformanceAPIs in Google Chrome on on Android prior to 156.0. | |
|
68
|
CVE-2026-113096 |
8.8 | 0.0044 | NET NO AUTH LOW CX | Memory corruption in Text in Google Chrome on on Android prior to 156.0.8078.47 | |
|
68
|
CVE-2026-113158 |
8.8 | 0.0044 | NET NO AUTH LOW CX | Use after free in Streaming in Google Chrome prior to 156.0.8078.47 allowed a re | |
|
68
|
CVE-2026-113160 |
8.8 | 0.0044 | NET NO AUTH LOW CX | Use after free in Turbolev in Google Chrome prior to 156.0.8078.47 allowed a rem | |
|
68
|
CVE-2026-113162 |
8.8 | 0.0044 | NET NO AUTH LOW CX | Improper input validation in Actor in Google Chrome prior to 156.0.8078.47 allow | |
|
68
|
CVE-2026-113165 |
8.8 | 0.0044 | NET NO AUTH LOW CX | Use after free in Core in Google Chrome on on Mac prior to 156.0.8078.47 allowed | |
|
68
|
CVE-2026-113167 |
8.8 | 0.0044 | NET NO AUTH LOW CX | Memory corruption in Network in Google Chrome prior to 156.0.8078.47 allowed a r | |
|
68
|
CVE-2026-113168 |
8.8 | 0.0044 | NET NO AUTH LOW CX | Use after free in Permissions in Google Chrome prior to 156.0.8078.47 allowed a | |
|
68
|
CVE-2026-113172 |
8.8 | 0.0044 | NET NO AUTH LOW CX | Memory corruption in ServiceWorker in Google Chrome prior to 156.0.8078.47 allow | |
|
68
|
CVE-2026-113174 |
8.8 | 0.0044 | NET NO AUTH LOW CX | Use after free in Extensions in Google Chrome prior to 156.0.8078.47 allowed a r | |
|
68
|
CVE-2026-113179 |
8.8 | 0.0044 | NET NO AUTH LOW CX | Use after free in Paint in Google Chrome prior to 156.0.8078.47 allowed a remote | |
|
68
|
CVE-2026-113181 |
8.8 | 0.0044 | NET NO AUTH LOW CX | Use after free in Navigation in Google Chrome prior to 156.0.8078.47 allowed a r | |
|
68
|
CVE-2026-113182 |
8.8 | 0.0044 | NET NO AUTH LOW CX | Memory corruption in Passwords in Google Chrome prior to 156.0.8078.47 allowed a | |
|
68
|
CVE-2026-113183 |
8.8 | 0.0044 | NET NO AUTH LOW CX | Memory corruption in FedCM in Google Chrome prior to 156.0.8078.47 allowed a rem | |
|
67
|
CVE-2026-16881 |
8.7 | 0.0044 | NET NO AUTH LOW CX | A code injection vulnerability exists in the LINE Android app prior to version 2 | |
|
65
|
CVE-2026-6581 |
7.4 | 0.0044 | NET LOW CX NO UI | A vulnerability was detected in H3C Magic B1 up to 100R004. Affected by this vul | |
|
65
|
CVE-2026-8776 |
7.4 | 0.0044 | NET LOW CX NO UI | A vulnerability has been found in Edimax BR-6428NS 1.10. This vulnerability affe | |
|
65
|
CVE-2026-95619 |
7.7 | 0.0044 | NET NO AUTH NO UI | A flaw was found in libstdc++. An integer overflow can occur when processing lar | |
|
64
|
CVE-2026-65918 |
7.1 | 0.0044 | NET NO AUTH LOW CX | PyTorch torchvision through 0.28.0, fixed in commit 4e05dc2, contains an out-of- | |
|
64
|
CVE-2026-54715 |
7.1 | 0.0044 | NET NO AUTH LOW CX | GoAccess is a real-time web log analyzer and interactive viewer that runs in a t | |
|
64
|
CVE-2026-12246 |
7.2 | 0.0044 | NET LOW CX NO UI | NSD version 4.14.0 introduced a bug where a specially crafted APL RR, with an ad | |
|
64
|
CVE-2026-70635 |
7.1 | 0.0044 | NET LOW CX NO UI | TimescaleDB through 2.29.1, fixed in commit 517c13e, contains an out-of-bounds r | |
|
62
|
CVE-2026-63725 |
8.6 | 0.0044 | NET LOW CX NO UI | sysPass's FileBackupService::doBackupFiles() in lib/SP/Services/Backup/FileBacku | |
|
55
|
CVE-2025-67525 |
7.5 | 0.0044 | NET NO UI | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP | |
|
55
|
CVE-2025-67526 |
7.5 | 0.0044 | NET NO UI | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP | |
|
55
|
CVE-2025-67527 |
7.5 | 0.0044 | NET NO UI | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP | |
|
55
|
CVE-2025-67529 |
7.5 | 0.0044 | NET NO UI | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP | |
|
55
|
CVE-2025-67531 |
7.5 | 0.0044 | NET NO UI | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP |