Hunt List
12,821 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
90
|
CVE-2026-110063 |
10.0 | 0.0089 | NET NO AUTH LOW CX NO UI | 1 PoC | Improper link resolution before file access ('link following') in VM Inspector f |
|
80
|
CVE-2026-96219 |
9.8 | 0.0089 | NET NO AUTH LOW CX NO UI | Out-of-bounds write in Windows Local Security Authority Subsystem Service (LSASS | |
|
80
|
CVE-2023-25207 |
9.8 | 0.0089 | NET NO AUTH LOW CX NO UI | PrestaShop dpdfrance <6.1.3 is vulnerable to SQL Injection via dpdfrance/ajax.ph | |
|
80
|
CVE-2026-24254 |
9.8 | 0.0089 | NET NO AUTH LOW CX NO UI | NVIDIA Dynamo for Linux contains a vulnerability in the multimodal serving topol | |
|
80
|
CVE-2023-29129 |
9.8 | 0.0089 | NET NO AUTH LOW CX NO UI | A vulnerability has been identified in Mendix SAML (Mendix 7 compatible) (All ve | |
|
80
|
CVE-2026-84015 |
9.8 | 0.0087 | NET NO AUTH LOW CX NO UI | Heap-based buffer overflow in Remote Access Point-to-Point Protocol (PPP) EAP-TL | |
|
79
|
CVE-2026-73414 |
9.2 | 0.0089 | NET NO AUTH LOW CX NO UI | Shescape is a simple shell escape library for JavaScript. Prior to 2.1.14 and 3. | |
|
79
|
CVE-2026-75854 |
9.3 | 0.0089 | NET NO AUTH LOW CX NO UI | ArcadeDB versions before 26.8.1 contain a missing authentication vulnerability i | |
|
79
|
CVE-2026-23751 |
9.3 | 0.0088 | NET NO AUTH LOW CX NO UI | Kofax Capture, now referred to as Tungsten Capture, version 6.0.0.0 (other versi | |
|
79
|
CVE-2020-37281 |
9.2 | 0.0088 | NET NO AUTH LOW CX NO UI | Gravitee API Management through 4.12.22 contains an authentication bypass vulner | |
|
79
|
CVE-2026-6847 |
9.3 | 0.0088 | NET NO AUTH LOW CX NO UI | Remote Code Execution vulnerability exists in ThemisNETPanel due to missing auth | |
|
79
|
CVE-2026-54733 |
9.3 | 0.0088 | NET NO AUTH LOW CX NO UI | The Microsoft 365 and Microsoft Entra ID Plugins for Moodle provide Office 365 a | |
|
78
|
CVE-2026-47731 |
9.1 | 0.0089 | NET NO AUTH LOW CX NO UI | The AMMOS Instrument Toolkit (Formerly the Bespoke Links to Instruments for Surf | |
|
77
|
CVE-2026-35091 |
8.2 | 0.0088 | NET NO AUTH LOW CX NO UI | A flaw was found in Corosync. A remote unauthenticated attacker can exploit a wr | |
|
75
|
CVE-2026-89059 |
7.5 | 0.0089 | NET NO AUTH LOW CX NO UI | A flaw was found in RESTEasy's IIOImageProvider, which decodes attacker-supplied | |
|
75
|
CVE-2026-115497 |
7.5 | 0.0089 | NET NO AUTH LOW CX NO UI | The Music Store – WordPress eCommerce plugin for WordPress is vulnerable to Dire | |
|
75
|
CVE-2026-48068 |
7.5 | 0.0088 | NET NO AUTH LOW CX NO UI | @grpc/grps-js implements the core functionality of gRPC purely in JavaScript, wi | |
|
75
|
CVE-2026-48069 |
7.5 | 0.0088 | NET NO AUTH LOW CX NO UI | @grpc/grps-js implements the core functionality of gRPC purely in JavaScript, wi | |
|
75
|
CVE-2022-31810 |
7.5 | 0.0088 | NET NO AUTH LOW CX NO UI | A vulnerability has been identified in SiPass integrated (All versions < V2.90.3 | |
|
75
|
CVE-2026-97788 |
7.5 | 0.0088 | NET NO AUTH LOW CX NO UI | Observable discrepancy in Active Directory Federation Services (AD FS) allows an | |
|
75
|
CVE-2026-33811 |
7.5 | 0.0088 | NET NO AUTH LOW CX NO UI | When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can | |
|
75
|
CVE-2026-48399 |
7.5 | 0.0087 | NET NO AUTH LOW CX NO UI | Adobe Campaign Classic (ACC) is affected by a Violation of Secure Design Princip | |
|
70
|
CVE-2026-63294 |
9.9 | 0.0088 | NET LOW CX NO UI | A link following vulnerability in LXD allows an attacker to achieve root command | |
|
70
|
CVE-2026-8481 |
9.9 | 0.0088 | NET LOW CX NO UI | IBM Langflow OSS 1.0.0 through 1.10.0 contain a critical remote code execution v | |
|
70
|
CVE-2026-73268 |
9.9 | 0.0088 | NET LOW CX NO UI | A flaw was found in the cluster-curator-controller component of multicluster eng | |
|
68
|
CVE-2023-22640 |
8.8 | 0.0089 | NET LOW CX NO UI | A out-of-bounds write vulnerability in Fortinet FortiOS 7.2.0 through 7.2.3, For | |
|
68
|
CVE-2026-63639 |
8.8 | 0.0089 | NET LOW CX NO UI | Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0. | |
|
68
|
CVE-2026-102856 |
8.8 | 0.0089 | NET NO AUTH LOW CX | Heap-based buffer overflow in Microsoft Office Visio allows an unauthorized atta | |
|
68
|
CVE-2026-102225 |
8.8 | 0.0089 | NET NO AUTH LOW CX | Out-of-bounds read in Windows Text Shaping allows an unauthorized attacker to ex | |
|
68
|
CVE-2026-83934 |
8.8 | 0.0089 | NET NO AUTH LOW CX | Stack-based buffer overflow in Windows GDI+ allows an unauthorized attacker to e | |
|
68
|
CVE-2026-44178 |
8.8 | 0.0088 | NET LOW CX NO UI | xrdp is an open source RDP server. Versions 0.10.6 and prior contain a heap-base | |
|
68
|
CVE-2026-97781 |
8.8 | 0.0088 | NET NO AUTH LOW CX | Improper neutralization of special elements used in a command ('command injectio | |
|
68
|
CVE-2026-72767 |
8.7 | 0.0088 | NET LOW CX NO UI | n8n before 1.123.67, 2.x before 2.31.5, and 2.32.x before 2.32.1 contain a remot | |
|
68
|
CVE-2026-85169 |
8.7 | 0.0088 | NET LOW CX NO UI | n8n versions before 1.123.73, 2.35.4, and 2.36.2 contain an expression sandbox e | |
|
68
|
CVE-2026-105717 |
8.8 | 0.0088 | NET NO AUTH LOW CX | Heap-based buffer overflow in Microsoft Office Access allows an unauthorized att | |
|
68
|
CVE-2026-69370 |
8.8 | 0.0088 | NET NO AUTH LOW CX | Improper neutralization of special elements used in a command ('command injectio | |
|
68
|
CVE-2026-17632 |
8.8 | 0.0088 | NET LOW CX NO UI | IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote authenticated attacke | |
|
68
|
CVE-2026-59260 |
8.7 | 0.0088 | NET LOW CX NO UI | OpenWrt luci-app-samba4 read ACL grants file.exec permission on /usr/sbin/smbd, | |
|
66
|
CVE-2026-40859 |
8.1 | 0.0089 | NET NO AUTH NO UI | Deserialization of Untrusted Data vulnerability in Apache Camel. The camel-vert | |
|
65
|
CVE-2026-57993 |
7.4 | 0.0088 | NET NO AUTH LOW CX | Server-side request forgery (ssrf) in Microsoft Edge (Chromium-based) allows an | |
|
65
|
CVE-2026-58612 |
7.4 | 0.0087 | NET NO AUTH LOW CX | Server-side request forgery (ssrf) in Microsoft PowerShell Core allows an unauth | |
|
60
|
CVE-2026-114624 |
7.2 | 0.0089 | NET LOW CX NO UI | baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and | |
|
60
|
CVE-2023-45581 |
7.2 | 0.0088 | NET LOW CX NO UI | An improper privilege management vulnerability [CWE-269] vulnerability in Fortin | |
|
60
|
CVE-2026-26942 |
7.2 | 0.0088 | NET LOW CX NO UI | Dell PowerProtect Data Domain, versions 8.5 through 8.6 contain(s) an Improper N | |
|
60
|
CVE-2026-16521 |
7.2 | 0.0088 | NET LOW CX NO UI | An OS command injection vulnerability exists because of insufficient input filte | |
|
57
|
CVE-2026-55255 |
8.4 | 0.0089 | NET NO UI | KEV | Langflow contains an authorization bypass through user-controlled key vulnerabil |
|
57
|
CVE-2023-3932 |
8.2 | 0.0088 | NET NO UI | An issue has been discovered in GitLab EE affecting all versions starting from 1 | |
|
55
|
CVE-2026-12398 |
7.5 | 0.0089 | NET NO UI | A command injection vulnerability was found in galaxy_ng. The do_git_checkout() | |
|
55
|
CVE-2026-57200 |
7.5 | 0.0088 | NET NO UI | Asterisk is an open source private branch exchange and telephony toolkit. Prior | |
|
49
|
CVE-2026-4622 |
7.1 | 0.0088 | NET LOW CX | OS Command Injection vulnerability in NEC Platforms, Ltd. Aterm Series allows a |