Hunt List
12,844 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-41267 |
9.8 | 0.0033 | NET NO AUTH LOW CX NO UI | Flowise is a drag & drop user interface to build a customized large language mod | |
|
79
|
CVE-2026-41064 |
9.3 | 0.0034 | NET NO AUTH LOW CX NO UI | WWBN AVideo is an open source video platform. In versions up to and including 29 | |
|
79
|
CVE-2026-59507 |
9.3 | 0.0034 | NET NO AUTH LOW CX NO UI | : Use of Hard-coded Credentials : Exposure of Sensitive Information to an Unauth | |
|
79
|
CVE-2026-22097 |
9.3 | 0.0033 | NET NO AUTH LOW CX NO UI | The firmware update mechanism does not include cryptographic signature validatio | |
|
78
|
CVE-2026-55203 |
9.0 | 0.0033 | NET NO AUTH LOW CX NO UI | HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vul | |
|
77
|
CVE-2025-52547 |
8.7 | 0.0034 | NET NO AUTH LOW CX NO UI | E3 Site Supervisor Control (firmware version < 2.31F01) MGW contains an API call | |
|
77
|
CVE-2026-6903 |
8.7 | 0.0034 | NET NO AUTH LOW CX NO UI | The LabOne Web Server, backing the LabOne User Interface, contains insufficient | |
|
77
|
CVE-2026-102479 |
8.7 | 0.0034 | NET NO AUTH LOW CX NO UI | In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], th | |
|
76
|
CVE-2026-45017 |
8.2 | 0.0034 | NET NO AUTH LOW CX NO UI | Python Liquid is a Python engine for the Liquid template language. Prior to 2.2. | |
|
76
|
CVE-2026-8377 |
8.2 | 0.0034 | NET NO AUTH LOW CX NO UI | Missing Authorization vulnerability in Armiya Information Technologies Ltd. Co. | |
|
76
|
CVE-2026-14996 |
8.2 | 0.0034 | NET NO AUTH LOW CX NO UI | IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 has addressed a vulnerability related | |
|
76
|
CVE-2026-12984 |
8.2 | 0.0034 | NET NO AUTH LOW CX NO UI | Insufficiently Protected Credentials vulnerability in Zyxel Networks WAH7601 all | |
|
76
|
CVE-2026-59501 |
8.2 | 0.0034 | NET NO AUTH LOW CX NO UI | : Improper Access Control vulnerability in Priority Portal Generator addon to Pr | |
|
75
|
CVE-2026-112312 |
7.5 | 0.0034 | NET NO AUTH LOW CX NO UI | Missing Authorization vulnerability in ACF Extended ACF Extended acf-extended al | |
|
75
|
CVE-2026-114191 |
7.5 | 0.0034 | NET NO AUTH LOW CX NO UI | Missing Authorization vulnerability in Knit Pay UPI QR Code Payment Gateway for | |
|
75
|
CVE-2026-118759 |
7.5 | 0.0034 | NET NO AUTH LOW CX NO UI | Kubeflow Pipelines enables users to build and deploy portable, scalable machine | |
|
75
|
CVE-2026-43885 |
7.7 | 0.0034 | NET NO AUTH LOW CX NO UI | WWBN AVideo is an open source video platform. In versions up to and including 29 | |
|
75
|
CVE-2026-42552 |
7.5 | 0.0034 | NET NO AUTH LOW CX NO UI | Flight is an extensible micro-framework for PHP. Prior to 3.18.1, the default er | |
|
75
|
CVE-2026-115591 |
7.5 | 0.0034 | NET NO AUTH LOW CX NO UI | Insertion of Sensitive Information Into Sent Data vulnerability in Supsystic Con | |
|
75
|
CVE-2026-100353 |
7.5 | 0.0034 | NET NO AUTH LOW CX NO UI | kin-openapi is a Go project for handling OpenAPI files. From 0.136.0 until 0.149 | |
|
75
|
CVE-2026-119249 |
7.5 | 0.0034 | NET NO AUTH LOW CX NO UI | A malicious actor with access to the network could exploit a Binding to an Unres | |
|
75
|
CVE-2026-116861 |
7.5 | 0.0034 | NET NO AUTH LOW CX NO UI | Unauthenticated Sensitive Data Exposure in Flexible Chat <= 1.1.0 versions. | |
|
70
|
CVE-2026-11839 |
9.9 | 0.0034 | NET LOW CX NO UI | Unrestricted upload of file with dangerous type vulnerability in Başarsoft Infor | |
|
69
|
CVE-2026-109708 |
9.6 | 0.0033 | NET NO AUTH LOW CX | Sandbox escape due to incorrect boundary conditions in the Networking component. | |
|
68
|
CVE-2026-6305 |
8.8 | 0.0034 | NET NO AUTH LOW CX | Heap buffer overflow in PDFium in Google Chrome prior to 147.0.7727.101 allowed | |
|
68
|
CVE-2026-6306 |
8.8 | 0.0034 | NET NO AUTH LOW CX | Heap buffer overflow in PDFium in Google Chrome prior to 147.0.7727.101 allowed | |
|
68
|
CVE-2025-11714 |
8.8 | 0.0034 | NET NO AUTH LOW CX | Memory safety bugs present in Firefox ESR 115.28, Firefox ESR 140.3, Thunderbird | |
|
68
|
CVE-2026-8443 |
8.8 | 0.0034 | NET LOW CX NO UI | The WP Review Slider Pro plugin for WordPress is vulnerable to SQL Injection via | |
|
68
|
CVE-2026-6302 |
8.8 | 0.0033 | NET NO AUTH LOW CX | Use after free in Video in Google Chrome prior to 147.0.7727.101 allowed a remot | |
|
67
|
CVE-2026-42844 |
8.7 | 0.0034 | NET LOW CX NO UI | Grav is a file-based Web platform. In Grav 2.0.0-beta.2, a low-privileged authen | |
|
67
|
CVE-2026-101785 |
8.3 | 0.0034 | NET LOW CX NO UI | Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (compon | |
|
67
|
CVE-2026-64832 |
8.7 | 0.0034 | NET NO AUTH LOW CX | FFmpeg versions 4.4 through 8.1.2 contain a double-free vulnerability in the NVI | |
|
66
|
CVE-2026-91635 |
8.1 | 0.0034 | NET NO AUTH NO UI | Vulnerability in Oracle Essbase (component: Security). The supported version t | |
|
66
|
CVE-2026-41056 |
8.1 | 0.0034 | NET NO AUTH LOW CX | WWBN AVideo is an open source video platform. In versions 29.0 and below, the `a | |
|
65
|
CVE-2026-110845 |
7.7 | 0.0034 | NET LOW CX NO UI | n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains a code | |
|
65
|
CVE-2026-15081 |
7.4 | 0.0034 | NET NO AUTH NO UI | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti | |
|
65
|
CVE-2026-46717 |
7.7 | 0.0034 | NET LOW CX NO UI | Nezha Monitoring is a self-hostable, lightweight, servers and websites monitorin | |
|
65
|
CVE-2026-85197 |
7.6 | 0.0034 | NET NO AUTH LOW CX | A flaw was found in libsoup. A malicious HTTP/2 server or a Man-in-the-Middle (M | |
|
65
|
CVE-2026-49353 |
7.5 | 0.0034 | NET NO AUTH NO UI | 9Router is an AI router & token saver. In 0.4.45 and earlier, 9Router's src/dash | |
|
64
|
CVE-2026-114082 |
7.2 | 0.0034 | NET LOW CX NO UI | Trigger.dev before 4.6.2 contains an authorization vulnerability that allows pub | |
|
64
|
CVE-2026-48856 |
7.1 | 0.0034 | NET NO AUTH LOW CX | Sensitive Data Exposure vulnerability in Erlang OTP inets (httpc_response module | |
|
64
|
CVE-2026-34023 |
7.1 | 0.0034 | NET LOW CX NO UI | The Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014, contains | |
|
64
|
CVE-2026-16480 |
7.1 | 0.0034 | NET LOW CX NO UI | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is affected by an impro | |
|
64
|
CVE-2026-119337 |
7.1 | 0.0034 | NET LOW CX NO UI | RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. From 0.25 | |
|
59
|
CVE-2026-62965 |
7.0 | 0.0034 | NET LOW CX NO UI | SABnzbd is an open source automated Usenet download tool. Prior to 5.1.0Beta3, o | |
|
58
|
CVE-2026-65598 |
8.9 | 0.0034 | NET NO UI | n8n before 1.123.64, 2.29.8, and 2.30.1 contains a TOCTOU race condition in the | |
|
56
|
CVE-2026-32172 |
8.0 | 0.0034 | NET NO AUTH | Uncontrolled search path element in Microsoft Power Apps allows an unauthorized | |
|
55
|
CVE-2026-101410 |
7.5 | 0.0034 | NET NO UI | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleS | |
|
55
|
CVE-2026-101698 |
7.5 | 0.0034 | NET NO UI | Vulnerability in the Oracle One-to-One Fulfillment product of Oracle E-Business | |
|
55
|
CVE-2026-101703 |
7.5 | 0.0034 | NET NO UI | Vulnerability in the Pasta product of Oracle E-Business Suite (component: Intern |