Hunt List
13,086 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2025-60553 |
9.8 | 0.0041 | NET NO AUTH LOW CX NO UI | D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the | |
|
80
|
CVE-2026-50085 |
9.8 | 0.0041 | NET NO AUTH LOW CX NO UI | The Aqara Board service (op-test.aqara.com) accepts arbitrary MQTT command paylo | |
|
80
|
CVE-2026-3144 |
9.8 | 0.0041 | NET NO AUTH LOW CX NO UI | IBM API Connect 12.1.0.0 through 12.1.0.3 uses default credentials which could a | |
|
80
|
CVE-2026-80587 |
9.8 | 0.0041 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: mptcp: avoi | |
|
78
|
CVE-2026-9222 |
9.2 | 0.0041 | NET NO AUTH LOW CX NO UI | Setracker2 Android Companion App com.tgelec.setracker versions 3.1.5 and prior o | |
|
77
|
CVE-2026-110825 |
8.7 | 0.0041 | NET NO AUTH LOW CX NO UI | The ONVIF device service on affected Kiloview E3 NDI encoder firmware accepts ho | |
|
77
|
CVE-2024-58300 |
8.7 | 0.0041 | NET NO AUTH LOW CX NO UI | Siklu MultiHaul TG series devices through version 2.0.0 contain an unauthenticat | |
|
77
|
CVE-2026-35225 |
8.7 | 0.0041 | NET NO AUTH LOW CX NO UI | An unauthenticated remote attacker is able to exhaust all available TCP connecti | |
|
77
|
CVE-2026-15957 |
8.7 | 0.0041 | NET NO AUTH LOW CX NO UI | Smithy-RS is a Rust code generation and runtime framework that generates HTTP cl | |
|
77
|
CVE-2015-20123 |
8.7 | 0.0041 | NET NO AUTH LOW CX NO UI | Aspose Doc Exporter plugin for WordPress before 2.0 contains a path traversal vu | |
|
77
|
CVE-2015-20125 |
8.7 | 0.0041 | NET NO AUTH LOW CX NO UI | Aspose PDF Exporter plugin for WordPress before 2.0 contains a path traversal vu | |
|
77
|
CVE-2026-43760 |
8.6 | 0.0041 | NET NO AUTH LOW CX NO UI | An access issue was addressed with improved access restrictions. This issue is f | |
|
76
|
CVE-2026-73350 |
8.2 | 0.0041 | NET NO AUTH LOW CX NO UI | Unauthenticated Broken Authentication in SupportCandy <= 3.5.1 versions. | |
|
76
|
CVE-2014-125136 |
8.2 | 0.0041 | NET NO AUTH LOW CX NO UI | C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engin | |
|
75
|
CVE-2025-63462 |
7.5 | 0.0041 | NET NO AUTH LOW CX NO UI | Totolink A7000R v9.1.0u.6115_B20201022 was discovered to contain a stack overflo | |
|
75
|
CVE-2025-63464 |
7.5 | 0.0041 | NET NO AUTH LOW CX NO UI | Totolink LR350 v9.3.5u.6369_B20220309 was discovered to contain a stack overflow | |
|
75
|
CVE-2025-63465 |
7.5 | 0.0041 | NET NO AUTH LOW CX NO UI | Totolink LR350 v9.3.5u.6369_B20220309 was discovered to contain a stack overflow | |
|
75
|
CVE-2026-28986 |
7.5 | 0.0041 | NET NO AUTH LOW CX NO UI | A race condition was addressed with additional validation. This issue is fixed i | |
|
75
|
CVE-2024-6832 |
7.5 | 0.0041 | NET NO AUTH LOW CX NO UI | The account locking mechanism fails to trigger when secondary user stores are in | |
|
75
|
CVE-2026-111805 |
7.7 | 0.0041 | NET NO AUTH LOW CX NO UI | Apache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool vi | |
|
75
|
CVE-2026-111808 |
7.7 | 0.0041 | NET NO AUTH LOW CX NO UI | Apache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool vi | |
|
74
|
CVE-2026-58298 |
7.2 | 0.0041 | NET NO AUTH LOW CX NO UI | Improper neutralization of input during web page generation ('cross-site scripti | |
|
68
|
CVE-2026-17705 |
8.8 | 0.0041 | NET NO AUTH LOW CX | Integer overflow in libxml in Google Chrome prior to 151.0.7922.72 allowed a rem | |
|
68
|
CVE-2026-17719 |
8.8 | 0.0041 | NET NO AUTH LOW CX | Use after free in Input in Google Chrome prior to 151.0.7922.72 allowed a remote | |
|
68
|
CVE-2026-17807 |
8.8 | 0.0041 | NET NO AUTH LOW CX | Use after free in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote at | |
|
68
|
CVE-2026-17836 |
8.8 | 0.0041 | NET NO AUTH LOW CX | Use after free in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote at | |
|
68
|
CVE-2026-17918 |
8.8 | 0.0041 | NET NO AUTH LOW CX | Use after free in Sync in Google Chrome prior to 151.0.7922.72 allowed a remote | |
|
68
|
CVE-2026-18017 |
8.8 | 0.0041 | NET NO AUTH LOW CX | Use after free in Dawn in Google Chrome prior to 151.0.7922.72 allowed a remote | |
|
68
|
CVE-2026-19145 |
8.8 | 0.0041 | NET NO AUTH LOW CX | Use after free in Translate in Google Chrome prior to 151.0.7922.109 allowed a r | |
|
68
|
CVE-2026-19150 |
8.8 | 0.0041 | NET NO AUTH LOW CX | Inappropriate implementation in V8 in Google Chrome prior to 151.0.7922.109 allo | |
|
68
|
CVE-2026-19151 |
8.8 | 0.0041 | NET NO AUTH LOW CX | Use after free in V8 in Google Chrome prior to 151.0.7922.109 allowed a remote a | |
|
68
|
CVE-2026-19162 |
8.8 | 0.0041 | NET NO AUTH LOW CX | Out of bounds write in V8 in Google Chrome prior to 151.0.7922.109 allowed a rem | |
|
68
|
CVE-2026-19168 |
8.8 | 0.0041 | NET NO AUTH LOW CX | Inappropriate implementation in V8 in Google Chrome prior to 151.0.7922.109 allo | |
|
68
|
CVE-2026-19174 |
8.8 | 0.0041 | NET NO AUTH LOW CX | Integer overflow in V8 in Google Chrome prior to 151.0.7922.109 allowed a remote | |
|
68
|
CVE-2026-19556 |
8.8 | 0.0041 | NET NO AUTH LOW CX | Use after free in V8 in Google Chrome prior to 151.0.7922.137 allowed a remote a | |
|
68
|
CVE-2026-19559 |
8.8 | 0.0041 | NET NO AUTH LOW CX | Use after free in HTML in Google Chrome prior to 151.0.7922.137 allowed a remote | |
|
68
|
CVE-2026-19560 |
8.8 | 0.0041 | NET NO AUTH LOW CX | Use after free in Blink in Google Chrome prior to 151.0.7922.137 allowed a remot | |
|
68
|
CVE-2026-76043 |
8.8 | 0.0041 | NET NO AUTH LOW CX | Incorrect calculation in V8 in Google Chrome prior to 151.0.7922.169 allowed a r | |
|
68
|
CVE-2026-5278 |
8.8 | 0.0041 | NET NO AUTH LOW CX | Use after free in Web MIDI in Google Chrome on Android prior to 146.0.7680.178 a | |
|
68
|
CVE-2026-48889 |
8.8 | 0.0041 | NET LOW CX NO UI | Subscriber Privilege Escalation in Amelia <= 2.3 versions. | |
|
68
|
CVE-2026-113083 |
8.8 | 0.0041 | NET NO AUTH LOW CX | Memory corruption in Actor in Google Chrome on on Android prior to 156.0.8078.47 | |
|
68
|
CVE-2026-113121 |
8.8 | 0.0041 | NET NO AUTH LOW CX | Memory corruption in ContextMenu in Google Chrome on on Android prior to 156.0.8 | |
|
67
|
CVE-2026-55794 |
8.7 | 0.0041 | NET LOW CX NO UI | Craft CMS is a content management system (CMS). In versions 5.9.0 and above prio | |
|
66
|
CVE-2026-47406 |
8.1 | 0.0041 | NET LOW CX NO UI | PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams sys | |
|
66
|
CVE-2026-47418 |
8.1 | 0.0041 | NET LOW CX NO UI | PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams sys | |
|
65
|
CVE-2026-58168 |
7.7 | 0.0041 | NET LOW CX NO UI | DeepTutor before version 1.4.10 contains an authorization bypass vulnerability t | |
|
64
|
CVE-2026-44010 |
7.1 | 0.0041 | NET LOW CX NO UI | Craft CMS is a content management system (CMS). From 4.0.0 to before 4.17.12 and | |
|
64
|
CVE-2026-70471 |
7.1 | 0.0041 | NET LOW CX NO UI | Flowise is a drag-and-drop user interface for building customized large language | |
|
59
|
CVE-2026-114704 |
7.2 | 0.0041 | NET LOW CX NO UI | Deserialization of Untrusted Data vulnerability in Christoph Vielgrader Relevans | |
|
57
|
CVE-2026-28737 |
8.7 | 0.0041 | NET LOW CX | Gitea versions from 1.25.0 before 1.26.0 allow stored cross-site scripting throu |