Hunt List
11,817 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
81
|
CVE-2026-13773 |
10.0 | 0.0610 | NET NO AUTH LOW CX NO UI | IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 Approximately 50 generated C | |
|
81
|
CVE-2026-4670 |
9.8 | 0.0504 | NET NO AUTH LOW CX NO UI | Authentication bypass by primary weakness vulnerability in Progress Software MOV | |
|
81
|
CVE-2026-6516 |
10.0 | 0.0473 | NET NO AUTH LOW CX NO UI | Zohocorp ManageEngine ADAudit Plus versions before 8606 are affected by Unauthen | |
|
81
|
CVE-2026-104286 |
9.8 | 0.0457 | NET NO AUTH LOW CX NO UI | KEV | Fortinet FortiMail contains a path traversal and an improper neutralization of N |
|
81
|
CVE-2026-7411 |
10.0 | 0.0368 | NET NO AUTH LOW CX NO UI | In Eclipse BaSyx Java Server SDK versions prior to 2.0.0-milestone-10, inadequat | |
|
80
|
CVE-2026-62327 |
9.3 | 0.0627 | NET NO AUTH LOW CX NO UI | 9Router through version 0.4.41 contains an unauthenticated information disclosur | |
|
80
|
CVE-2026-44262 |
9.4 | 0.0586 | NET NO AUTH LOW CX NO UI | Scramble generates API documentation for Laravel project. From 0.13.2 to before | |
|
80
|
CVE-2026-19586 |
9.3 | 0.0572 | NET NO AUTH LOW CX NO UI | A pre-authentication OS command injection vulnerability has been identified in O | |
|
80
|
CVE-2026-73034 |
9.3 | 0.0570 | NET NO AUTH LOW CX NO UI | DB-GPT v0.8.1 contains an unauthenticated path traversal vulnerability that allo | |
|
80
|
CVE-2026-53787 |
9.3 | 0.0564 | NET NO AUTH LOW CX NO UI | Amasty Order Attributes for Magento 2 before version 4.0.0 contains an unauthent | |
|
80
|
CVE-2026-41922 |
9.3 | 0.0498 | NET NO AUTH LOW CX NO UI | WDR201A WiFi Extender (HW V2.1, FW LFMZX28040922V1.02) contains an OS command in | |
|
80
|
CVE-2026-48909 |
9.5 | 0.0494 | NET NO AUTH LOW CX NO UI | SP LMS (com_splms) < 4.1.4 by JoomShaper deserializes user-controlled cookie dat | |
|
80
|
CVE-2026-49952 |
9.3 | 0.0472 | NET NO AUTH LOW CX NO UI | Discuz! X5.0 releases 20260320 through 20260501 contains an authentication bypas | |
|
80
|
CVE-2026-58123 |
9.3 | 0.0465 | NET NO AUTH LOW CX NO UI | Hermes WebUI before 0.51.788 contains an unauthenticated remote code execution v | |
|
80
|
CVE-2026-15748 |
9.8 | 0.0409 | NET NO AUTH LOW CX NO UI | The Forminator Forms plugin for WordPress is vulnerable to Arbitrary File Upload | |
|
79
|
CVE-2026-41103 |
9.1 | 0.0538 | NET NO AUTH LOW CX NO UI | Incorrect implementation of authentication algorithm in Microsoft SSO Plugin for | |
|
79
|
CVE-2026-15511 |
8.9 | 0.0473 | NET NO AUTH LOW CX NO UI | A vulnerability was determined in Comfast CF-WR631AX V3 up to 2.7.0.8. Affected | |
|
79
|
CVE-2026-18686 |
8.9 | 0.0473 | NET NO AUTH LOW CX NO UI | A vulnerability was detected in GL.iNet GL-MT3000 up to 4.4.5. The affected elem | |
|
79
|
CVE-2026-18963 |
9.1 | 0.0468 | NET NO AUTH LOW CX NO UI | A flaw was found in the reset-credentials flow of the keycloak-services componen | |
|
79
|
CVE-2026-58479 |
9.2 | 0.0440 | NET NO AUTH LOW CX NO UI | Sustainable Irrigation Platform (SIP) through version 5.2.16 contains a command | |
|
79
|
CVE-2026-59865 |
9.3 | 0.0436 | NET NO AUTH LOW CX NO UI | Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5 | |
|
79
|
CVE-2026-61498 |
9.3 | 0.0401 | NET NO AUTH LOW CX NO UI | Vitec Flamingo 4.12.2 contains an unauthenticated OS command injection vulnerabi | |
|
79
|
CVE-2026-41925 |
9.3 | 0.0400 | NET NO AUTH LOW CX NO UI | WDR201A WiFi Extender (HW V2.1, FW LFMZX28040922V1.02) contains an OS command in | |
|
79
|
CVE-2026-18612 |
8.9 | 0.0397 | NET NO AUTH LOW CX NO UI | A flaw has been found in GL-iNet GL-MT3000 up to 4.4.5. This vulnerability affec | |
|
79
|
CVE-2026-55200 |
9.2 | 0.0388 | NET NO AUTH LOW CX NO UI | libssh2 1.11.1, fixed in commit 97acf3d, contains an out-of-bounds write vulnera | |
|
79
|
CVE-2026-41452 |
9.3 | 0.0374 | NET NO AUTH LOW CX NO UI | Krayin CRM 2.2.4 contains a missing authentication vulnerability in the installe | |
|
78
|
CVE-2026-73522 |
8.7 | 0.0395 | NET NO AUTH LOW CX NO UI | COVESA Open1722 through 0.9.2 contains a stack buffer overflow vulnerability tha | |
|
76
|
CVE-2026-41266 |
7.7 | 0.0406 | NET NO AUTH LOW CX NO UI | Flowise is a drag & drop user interface to build a customized large language mod | |
|
76
|
CVE-2026-48933 |
7.5 | 0.0371 | NET NO AUTH LOW CX NO UI | A flaw in Node.js WebCrypto implementation can crash the process if the input of | |
|
76
|
CVE-2023-2828 |
7.5 | 0.0370 | NET NO AUTH LOW CX NO UI | Every `named` instance configured to run as a recursive resolver maintains a cac | |
|
75
|
CVE-2024-46507 |
7.3 | 0.0392 | NET NO AUTH LOW CX NO UI | A SSTI (server side template injection) vulnerability in the custom template exp | |
|
75
|
CVE-2024-45257 |
7.3 | 0.0389 | NET NO AUTH LOW CX NO UI | A Command Injection issue in the payload build page in BYOB (Build Your Own Botn | |
|
71
|
CVE-2026-20180 |
9.9 | 0.0602 | NET LOW CX NO UI | A vulnerability in Cisco Identity Services Engine (ISE) could allow an authentic | |
|
71
|
CVE-2026-20186 |
9.9 | 0.0560 | NET LOW CX NO UI | A vulnerability in Cisco Identity Services Engine (ISE) could allow an authentic | |
|
70
|
CVE-2025-64393 |
9.4 | 0.0520 | NET LOW CX NO UI | This vulnerability in Veeam Backup & Replication allows a Backup Viewer to execu | |
|
69
|
CVE-2026-8111 |
8.8 | 0.0631 | NET LOW CX NO UI | SQL injection in the web console of Ivanti Endpoint Manager before version 2024 | |
|
69
|
CVE-2026-9787 |
8.8 | 0.0549 | NET LOW CX NO UI | Quest NetVault Backup NVBULogDaemon Command Injection Remote Code Execution Vuln | |
|
69
|
CVE-2026-50741 |
8.8 | 0.0494 | NET LOW CX NO UI | Bypass to the fix for CVE-2026-34916. Variants of such vectors have been also re | |
|
68
|
CVE-2023-43000 |
8.8 | 0.0404 | NET NO AUTH LOW CX | KEV | Apple macOS, iOS, iPadOS, and Safari 16.6 contain a use-after-free vulnerability |
|
66
|
CVE-2026-13545 |
7.4 | 0.0554 | NET LOW CX NO UI | A vulnerability has been found in D-Link DCS-935L 1.10.01. This affects the func | |
|
66
|
CVE-2026-7096 |
7.4 | 0.0408 | NET LOW CX NO UI | A security flaw has been discovered in Tenda HG3 2.0 300003070. This vulnerabili | |
|
65
|
CVE-2026-61450 |
7.1 | 0.0542 | NET LOW CX NO UI | Grav before 2.0.2 contains a Twig sandbox bypass that allows a page author (any | |
|
64
|
CVE-2026-44194 |
9.1 | 0.0567 | NET LOW CX NO UI | OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.8, an a | |
|
64
|
CVE-2026-50627 |
9.1 | 0.0452 | NET LOW CX NO UI | The JwtAccessTokenValidator class in Apache CXF fails to validate the 'aud' (Aud | |
|
64
|
CVE-2026-42607 |
9.1 | 0.0438 | NET LOW CX NO UI | Grav is a file-based Web platform. Prior to 2.0.0-beta.2, an authenticated user | |
|
63
|
CVE-2026-111216 |
8.6 | 0.0472 | NET LOW CX NO UI | Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability | |
|
61
|
CVE-2026-5844 |
7.3 | 0.0508 | NET LOW CX NO UI | A vulnerability was found in D-Link DIR-882 1.01B02. Impacted is the function sp | |
|
60
|
CVE-2026-18900 |
7.3 | 0.0382 | NET LOW CX NO UI | A weakness has been identified in H3C NX15 V100R017. This impacts the function f | |
|
60
|
CVE-2026-18902 |
7.3 | 0.0382 | NET LOW CX NO UI | A vulnerability was detected in H3C NX15 V100R017. Affected by this vulnerabilit | |
|
47
|
CVE-2026-40321 |
8.0 | 0.0641 | NET | DNN (formerly DotNetNuke) is an open-source web content management platform (CMS |