Hunt List
13,108 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2023-29131 |
10.0 | 0.0042 | NET NO AUTH LOW CX NO UI | A vulnerability has been identified in SIMATIC CN 4100 (All versions < V2.5). Af | |
|
80
|
CVE-2025-11709 |
9.8 | 0.0042 | NET NO AUTH LOW CX NO UI | A compromised web process was able to trigger out of bounds reads and writes in | |
|
80
|
CVE-2025-11710 |
9.8 | 0.0042 | NET NO AUTH LOW CX NO UI | A compromised web process using malicious IPC messages could have caused the pri | |
|
79
|
CVE-2026-10539 |
9.5 | 0.0042 | NET NO AUTH LOW CX NO UI | A Control-M/Server communication command does not sufficiently filter or sanitiz | |
|
79
|
CVE-2026-48875 |
9.3 | 0.0042 | NET NO AUTH LOW CX NO UI | Unauthenticated SQL Injection in JetSmartFilters <= 3.8.1 versions. | |
|
78
|
CVE-2026-64863 |
9.1 | 0.0042 | NET NO AUTH LOW CX NO UI | goshs is a feature-rich single-binary file server for red teamers and developers | |
|
78
|
CVE-2026-33615 |
9.1 | 0.0042 | NET NO AUTH LOW CX NO UI | An unauthenticated remote attacker can exploit an unauthenticated SQL Injection | |
|
78
|
CVE-2024-58400 |
8.8 | 0.0042 | NET NO AUTH LOW CX NO UI | llama.cpp before b3701 contains an out-of-bounds read vulnerability in llama_dec | |
|
77
|
CVE-2019-25781 |
8.7 | 0.0042 | NET NO AUTH LOW CX NO UI | Python-Markdown 3.0 through 3.11.2 contains an algorithmic complexity vulnerabil | |
|
76
|
CVE-2026-42013 |
8.2 | 0.0042 | NET NO AUTH LOW CX NO UI | A flaw was found in gnutls. When validating certificates, an oversized Subject A | |
|
75
|
CVE-2026-119197 |
7.5 | 0.0043 | NET NO AUTH LOW CX NO UI | pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, binary REAL decodi | |
|
75
|
CVE-2026-119196 |
7.5 | 0.0043 | NET NO AUTH LOW CX NO UI | pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, constructed BIT ST | |
|
75
|
CVE-2026-119194 |
7.5 | 0.0043 | NET NO AUTH LOW CX NO UI | pyasn1 is a generic ASN.1 library for Python. From 0.3.3 until 0.6.5, schemaless | |
|
75
|
CVE-2026-89480 |
7.5 | 0.0043 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: r | |
|
75
|
CVE-2026-110184 |
7.5 | 0.0042 | NET NO AUTH LOW CX NO UI | The Newsmatic theme for WordPress is vulnerable to blind SQL Injection via the ' | |
|
75
|
CVE-2026-64792 |
7.5 | 0.0042 | NET NO AUTH LOW CX NO UI | Joomla Extension - regularlabs.com - disclosure of restricted content via search | |
|
75
|
CVE-2026-114123 |
7.5 | 0.0042 | NET NO AUTH LOW CX NO UI | D365 F&O MCP Server is a Model Context Protocol server for querying Dynamics 365 | |
|
75
|
CVE-2026-110682 |
7.5 | 0.0042 | NET NO AUTH LOW CX NO UI | Cpanel::JSON::XS versions from 4.42 before 4.80 for Perl let input chunking chan | |
|
70
|
CVE-2026-20304 |
9.9 | 0.0042 | NET LOW CX NO UI | As part of Cisco's ongoing commitment to proactive security and product quality, | |
|
69
|
CVE-2026-113078 |
9.6 | 0.0042 | NET NO AUTH LOW CX | Improper input validation in Compositing in Google Chrome prior to 156.0.8078.47 | |
|
69
|
CVE-2026-113084 |
9.6 | 0.0042 | NET NO AUTH LOW CX | Improper input validation in Permissions in Google Chrome prior to 156.0.8078.47 | |
|
68
|
CVE-2026-5921 |
8.9 | 0.0042 | NET NO AUTH NO UI | A server-side request forgery (SSRF) vulnerability was identified in GitHub Ente | |
|
68
|
CVE-2026-20150 |
8.8 | 0.0042 | NET LOW CX NO UI | As part of Cisco's ongoing commitment to proactive security and product quality, | |
|
68
|
CVE-2026-21824 |
8.8 | 0.0042 | NET LOW CX NO UI | HCL Commerce contains an privilege escalation vulnerability that could allow den | |
|
68
|
CVE-2026-113022 |
8.8 | 0.0042 | NET NO AUTH LOW CX | Memory corruption in PDFium in Google Chrome prior to 156.0.8078.47 allowed a re | |
|
68
|
CVE-2026-113076 |
8.8 | 0.0042 | NET NO AUTH LOW CX | Use after free in Toolbar in Google Chrome on on Android prior to 156.0.8078.47 | |
|
68
|
CVE-2026-113092 |
8.8 | 0.0042 | NET NO AUTH LOW CX | Use after free in Passwords in Google Chrome on on Android prior to 156.0.8078.4 | |
|
68
|
CVE-2026-113099 |
8.8 | 0.0042 | NET NO AUTH LOW CX | Improper input validation in Omnibox in Google Chrome on on Android prior to 156 | |
|
67
|
CVE-2026-44937 |
8.3 | 0.0042 | NET NO AUTH NO UI | Potential forgery of webhook requests when using a unauthenticated webhook in SU | |
|
67
|
CVE-2014-125138 |
8.7 | 0.0042 | NET LOW CX NO UI | C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engin | |
|
67
|
CVE-2026-119028 |
8.7 | 0.0042 | NET NO AUTH LOW CX | oapi-codegen 2.0.0 before 2.8.1 contains a code injection vulnerability that all | |
|
66
|
CVE-2026-61979 |
8.1 | 0.0042 | NET NO AUTH NO UI | Unauthenticated Privilege Escalation in SAML SP Single Sign On <= 5.4.3 versions | |
|
66
|
CVE-2026-60415 |
8.1 | 0.0042 | NET NO AUTH NO UI | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware | |
|
66
|
CVE-2026-34894 |
8.1 | 0.0042 | NET NO AUTH NO UI | Unauthenticated Local File Inclusion in Integrio Core < 1.2.8 versions. | |
|
66
|
CVE-2026-39522 |
8.1 | 0.0042 | NET NO AUTH NO UI | Unauthenticated Local File Inclusion in Solene <= 3.4 versions. | |
|
66
|
CVE-2026-39537 |
8.1 | 0.0042 | NET NO AUTH NO UI | Unauthenticated Local File Inclusion in Mikado Core <= 1.6 versions. | |
|
66
|
CVE-2026-39549 |
8.1 | 0.0042 | NET NO AUTH NO UI | Unauthenticated Local File Inclusion in Aperitif <= 1.5 versions. | |
|
66
|
CVE-2026-39568 |
8.1 | 0.0042 | NET NO AUTH NO UI | Unauthenticated Local File Inclusion in Mr. SEO <= 2.0 versions. | |
|
66
|
CVE-2026-40731 |
8.1 | 0.0042 | NET NO AUTH NO UI | Unauthenticated Local File Inclusion in ChapterOne <= 1.7 versions. | |
|
66
|
CVE-2026-88174 |
8.1 | 0.0042 | NET NO AUTH NO UI | Concurrent execution using shared resource with improper synchronization ('race | |
|
64
|
CVE-2026-119710 |
7.1 | 0.0042 | NET LOW CX NO UI | PipesHub 0.3.0 before 0.10.0 contains an event type injection vulnerability that | |
|
64
|
CVE-2026-41052 |
9.4 | 0.0042 | NET LOW CX NO UI | Improper privilege handling could be used by users with Project Owner role to es | |
|
64
|
CVE-2026-18655 |
7.1 | 0.0042 | NET NO AUTH LOW CX | Improper restriction of intended endpoints in the RabbitMQ broker connection too | |
|
63
|
CVE-2026-34178 |
9.1 | 0.0042 | NET LOW CX NO UI | In Canonical LXD before 6.8, the backup import path validates project restrictio | |
|
60
|
CVE-2026-46343 |
7.5 | 0.0042 | NET LOW CX NO UI | Wazuh is a free and open source platform used for threat prevention, detection, | |
|
58
|
CVE-2026-62378 |
9.0 | 0.0042 | NET LOW CX | RustFS Console is a web management console for the RustFS distributed file syste | |
|
55
|
CVE-2026-93757 |
7.5 | 0.0043 | NET NO UI | The Wild Apricot Login plugin for WordPress is vulnerable to Authentication Bypa | |
|
55
|
CVE-2026-67357 |
7.7 | 0.0042 | NET NO UI | ArcadeDB versions before 26.7.3 contain an information disclosure vulnerability | |
|
55
|
CVE-2026-114145 |
7.5 | 0.0042 | NET NO AUTH | GitPython is a python library used to interact with Git repositories. Prior to 3 | |
|
49
|
CVE-2026-11321 |
7.1 | 0.0042 | NET LOW CX | The DataInjection plugin for GLPI 2.15.6 (GLPI 11 builds) concatenates user-supp |