Hunt List
12,881 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-4101 |
9.8 | 0.0037 | NET NO AUTH LOW CX NO UI | IBM Verify Identity Access Container 11.0 through 11.0.2 and IBM Security Verify | |
|
80
|
CVE-2026-11714 |
9.8 | 0.0037 | NET NO AUTH LOW CX NO UI | IBM WebSphere Application Server Liberty is affected by a server-side request fo | |
|
79
|
CVE-2026-5963 |
9.3 | 0.0037 | NET NO AUTH LOW CX NO UI | EasyFlow .NET developed by Digiwin has a SQL Injection vulnerability, allowing u | |
|
79
|
CVE-2026-5964 |
9.3 | 0.0037 | NET NO AUTH LOW CX NO UI | EasyFlow .NET developed by Digiwin has a SQL Injection vulnerability, allowing u | |
|
79
|
CVE-2026-42155 |
9.3 | 0.0037 | NET NO AUTH LOW CX NO UI | Magento Long Term Support (LTS) is an unofficial, community-driven project provi | |
|
78
|
CVE-2026-42889 |
9.1 | 0.0037 | NET NO AUTH LOW CX NO UI | Relay adds real-time collaboration to Obsidian. Relay Server versions 0.9.0 thro | |
|
78
|
CVE-2026-107034 |
9.1 | 0.0037 | NET NO AUTH LOW CX NO UI | Insecure permissions in LeafPad / Leaf Note v1.21 (versionCode 21) allows unauth | |
|
78
|
CVE-2026-118769 |
9.2 | 0.0037 | NET NO AUTH LOW CX NO UI | Botan is a C++ cryptography library. From 2.1.0 until 3.13.0, the Botan C API fu | |
|
78
|
CVE-2026-112362 |
9.1 | 0.0037 | NET NO AUTH LOW CX NO UI | @fastify/express is a Fastify plugin that runs Express middleware inside Fastify | |
|
78
|
CVE-2026-63149 |
9.1 | 0.0037 | NET NO AUTH LOW CX NO UI | Omnispace Agora Project before 26.10.0 contains an insecure randomness vulnerabi | |
|
77
|
CVE-2026-116871 |
8.7 | 0.0037 | NET NO AUTH LOW CX NO UI | Semantic MediaWiki 3.0.0 before 7.3.1 contains an uncontrolled recursion vulnera | |
|
77
|
CVE-2026-41146 |
8.7 | 0.0037 | NET NO AUTH LOW CX NO UI | facil.io is a C micro-framework for web applications. Prior to commit 5128747363 | |
|
77
|
CVE-2026-116878 |
8.7 | 0.0037 | NET NO AUTH LOW CX NO UI | Semantic MediaWiki from 2.5.0 before 7.3.1 contains an uncontrolled resource con | |
|
76
|
CVE-2026-79886 |
8.2 | 0.0037 | NET NO AUTH LOW CX NO UI | An unauthenticated buffer overflow vulnerability exists in the PAPI protocol of | |
|
76
|
CVE-2026-62162 |
8.2 | 0.0037 | NET NO AUTH LOW CX NO UI | Hydra is a layer-two scalability solution for Cardano. Prior to 2.1.0, the `Clai | |
|
76
|
CVE-2026-70637 |
8.2 | 0.0037 | NET NO AUTH LOW CX NO UI | LightFTP through 2.4 contains multiple data race vulnerabilities in ftpserv.c th | |
|
75
|
CVE-2026-40586 |
7.5 | 0.0037 | NET NO AUTH LOW CX NO UI | blueprintUE is a tool to help Unreal Engine developers. Prior to 4.2.0, the logi | |
|
75
|
CVE-2026-8651 |
7.5 | 0.0037 | NET NO AUTH LOW CX NO UI | Limited authentication bypass by spoofing vulnerability in Progress MOVEit Trans | |
|
75
|
CVE-2026-51105 |
7.5 | 0.0037 | NET NO AUTH LOW CX NO UI | Buffer Overflow vulnerability in aMULE-Project aMule v.2.3.3 allows a remote att | |
|
75
|
CVE-2026-59532 |
7.5 | 0.0037 | NET NO AUTH LOW CX NO UI | Unauthenticated Other Vulnerability Type in Booking and Rental Manager <= 2.7.2 | |
|
75
|
CVE-2026-116587 |
7.5 | 0.0037 | NET NO AUTH LOW CX NO UI | Go JOSE provides an implementation of the Javascript Object Signing and Encrypti | |
|
75
|
CVE-2025-50950 |
7.5 | 0.0037 | NET NO AUTH LOW CX NO UI | Audiofile v0.3.7 was discovered to contain a NULL pointer dereference via the Mo | |
|
75
|
CVE-2026-31931 |
7.5 | 0.0037 | NET NO AUTH LOW CX NO UI | Suricata is a network IDS, IPS and NSM engine. From version 8.0.0 to before vers | |
|
75
|
CVE-2026-31933 |
7.5 | 0.0037 | NET NO AUTH LOW CX NO UI | Suricata is a network IDS, IPS and NSM engine. Prior to versions 7.0.15 and 8.0. | |
|
75
|
CVE-2026-49056 |
7.5 | 0.0037 | NET NO AUTH LOW CX NO UI | Unauthenticated Sensitive Data Exposure in WooCommerce PDF Invoices, Packing Sli | |
|
75
|
CVE-2026-8050 |
7.5 | 0.0037 | NET NO AUTH LOW CX NO UI | In SignalRGB versions prior to 1.3.7.0, seven of the thirteen IOCTL handlers der | |
|
75
|
CVE-2026-59877 |
7.5 | 0.0037 | NET NO AUTH LOW CX NO UI | protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior t | |
|
75
|
CVE-2026-116584 |
7.5 | 0.0037 | NET NO AUTH LOW CX NO UI | Seroval facilitates JavaScript value stringification, including complex structur | |
|
75
|
CVE-2026-110245 |
7.5 | 0.0037 | NET NO AUTH LOW CX NO UI | IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote attacker to obtain se | |
|
75
|
CVE-2026-63341 |
7.5 | 0.0037 | NET NO AUTH LOW CX NO UI | Aedes is an MQTT broker that can run on any stream server. Prior to 1.1.1, the M | |
|
75
|
CVE-2026-43655 |
7.3 | 0.0037 | NET NO AUTH LOW CX NO UI | An out-of-bounds read was addressed with improved bounds checking. This issue is | |
|
70
|
CVE-2026-110720 |
9.9 | 0.0037 | NET LOW CX NO UI | Consul-k8s versions 0.42.0 and later are vulnerable to a cross-namespace authori | |
|
69
|
CVE-2026-42812 |
9.4 | 0.0037 | NET LOW CX NO UI | In Apache Iceberg, the table's metadata files are control files: they tell reade | |
|
68
|
CVE-2026-6307 |
8.8 | 0.0037 | NET NO AUTH LOW CX | Type Confusion in Turbofan in Google Chrome prior to 147.0.7727.101 allowed a re | |
|
67
|
CVE-2026-62187 |
8.6 | 0.0037 | NET LOW CX NO UI | OpenClaw Feishu tools (npm package @openclaw/feishu) in versions <= 2026.6.6 cou | |
|
67
|
CVE-2026-62188 |
8.6 | 0.0037 | NET LOW CX NO UI | OpenClaw @openclaw/feishu versions 2026.6.6 and earlier contain an incorrect aut | |
|
67
|
CVE-2026-55118 |
8.3 | 0.0037 | NET LOW CX NO UI | A malicious actor with access to the network,low privileges and under certain co | |
|
67
|
CVE-2026-53871 |
8.6 | 0.0037 | NET LOW CX NO UI | Hermes WebUI before 0.51.368 contains an authorization bypass vulnerability in t | |
|
66
|
CVE-2026-87306 |
8.1 | 0.0037 | NET LOW CX NO UI | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards | |
|
65
|
CVE-2026-120208 |
7.7 | 0.0037 | NET NO AUTH LOW CX | libheif 1.18.0 before 1.23.3 contains a heap-based buffer overflow vulnerability | |
|
64
|
CVE-2026-48807 |
7.1 | 0.0037 | NET LOW CX NO UI | Twig is a template language for PHP. Prior to 3.27.0, the sandbox __toString() c | |
|
64
|
CVE-2026-20916 |
7.2 | 0.0037 | NET LOW CX NO UI | An authenticated iControl REST user with low privileges can create or modify arb | |
|
64
|
CVE-2026-114068 |
7.2 | 0.0037 | NET LOW CX NO UI | Trigger.dev before 4.6.0 contains a missing authorization vulnerability in the w | |
|
64
|
CVE-2026-12895 |
7.1 | 0.0037 | NET LOW CX NO UI | SQL injection in Frappe's ERPNext, versions ERPNext 15.107.0 and Frappe 15.107.2 | |
|
64
|
CVE-2026-116469 |
7.1 | 0.0037 | NET LOW CX NO UI | MISP Guard, a proxy-based security filter for MISP feed distribution, contains a | |
|
64
|
CVE-2026-91256 |
7.1 | 0.0037 | NET LOW CX NO UI | Vulnerability in the Oracle Solaris product of Oracle Systems (component: Servic | |
|
62
|
CVE-2025-8574 |
8.7 | 0.0037 | NET LOW CX NO UI | The Database Cleaner plugin for WordPress is vulnerable to arbitrary table delet | |
|
59
|
CVE-2026-110744 |
7.2 | 0.0037 | NET LOW CX NO UI | A flaw was found in multicluster-global-hub-operator-bundle. The operator is con | |
|
57
|
CVE-2026-76046 |
8.3 | 0.0037 | NET NO AUTH | Buffer overflow in ANGLE in Google Chrome on on Android prior to 151.0.7922.169 | |
|
44
|
CVE-2026-114510 |
7.1 | 0.0037 | NET | Flexible GraphRAG is a Python framework for building graph and retrieval-augment |