Hunt List
12,824 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-8505 |
9.8 | 0.0087 | NET NO AUTH LOW CX NO UI | IBM Langflow OSS 1.0.0 through 1.10.0 has a vulnerability in Langflow's webhook | |
|
80
|
CVE-2026-96113 |
9.8 | 0.0087 | NET NO AUTH LOW CX NO UI | Heap-based buffer overflow in DNS Server allows an unauthorized attacker to exec | |
|
80
|
CVE-2026-97815 |
9.8 | 0.0087 | NET NO AUTH LOW CX NO UI | Heap-based buffer overflow in Windows Error Reporting allows an unauthorized att | |
|
80
|
CVE-2026-38165 |
9.8 | 0.0087 | NET NO AUTH LOW CX NO UI | A Server-Side Template Injection (SSTI) vulnerability in the Velocity template e | |
|
80
|
CVE-2026-58630 |
10.0 | 0.0086 | NET NO AUTH LOW CX NO UI | Improper access control in Azure App Service allows an unauthorized attacker to | |
|
80
|
CVE-2026-49827 |
9.8 | 0.0086 | NET NO AUTH LOW CX NO UI | WebErpMesv2 is a Resource Management and Manufacturing execution system Web for | |
|
80
|
CVE-2026-57624 |
10.0 | 0.0086 | NET NO AUTH LOW CX NO UI | Unauthenticated Remote Code Execution (RCE) in Blocksy Companion Pro <= 2.1.46 v | |
|
80
|
CVE-2026-65553 |
10.0 | 0.0086 | NET NO AUTH LOW CX NO UI | Unauthenticated Remote Code Execution (RCE) in Spider Analyser – WordPress | |
|
80
|
CVE-2026-27544 |
10.0 | 0.0086 | NET NO AUTH LOW CX NO UI | Unauthenticated Remote Code Execution (RCE) in QA Analytics <= 5.2.0.0 versions. | |
|
80
|
CVE-2026-73343 |
10.0 | 0.0086 | NET NO AUTH LOW CX NO UI | Unauthenticated Remote Code Execution (RCE) in WP Compress < 7.20.01 versions. | |
|
80
|
CVE-2026-10109 |
9.8 | 0.0086 | NET NO AUTH LOW CX NO UI | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to remote | |
|
80
|
CVE-2026-16956 |
9.8 | 0.0086 | NET NO AUTH LOW CX NO UI | IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to execute | |
|
79
|
CVE-2026-53805 |
9.3 | 0.0087 | NET NO AUTH LOW CX NO UI | NVIDIA Spatial Intelligence Lab's (SIL) GEN3C contains an unauthenticated remote | |
|
79
|
CVE-2026-65687 |
9.3 | 0.0087 | NET NO AUTH LOW CX NO UI | Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepa | |
|
79
|
CVE-2026-65688 |
9.3 | 0.0087 | NET NO AUTH LOW CX NO UI | Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepa | |
|
79
|
CVE-2026-65689 |
9.3 | 0.0087 | NET NO AUTH LOW CX NO UI | Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepa | |
|
78
|
CVE-2026-62916 |
9.1 | 0.0086 | NET NO AUTH LOW CX NO UI | Authentication bypass using an alternate path or channel in Microsoft Entra ID a | |
|
78
|
CVE-2026-49179 |
8.8 | 0.0086 | NET NO AUTH LOW CX | 1 PoC | Improper neutralization of special elements used in a command ('command injectio |
|
75
|
CVE-2026-54428 |
7.5 | 0.0087 | NET NO AUTH LOW CX NO UI | Allocation of resources without limits or throttling in the HTTP/2 HPACK decoder | |
|
75
|
CVE-2026-8023 |
7.5 | 0.0087 | NET NO AUTH LOW CX NO UI | Zephyr's HTTP server (subsys/net/lib/http) provides a static-filesystem resource | |
|
75
|
CVE-2023-2829 |
7.5 | 0.0087 | NET NO AUTH LOW CX NO UI | A `named` instance configured to run as a DNSSEC-validating recursive resolver w | |
|
75
|
CVE-2023-35920 |
7.5 | 0.0087 | NET NO AUTH LOW CX NO UI | A vulnerability has been identified in SIMATIC MV540 H (All versions < V3.3.4), | |
|
75
|
CVE-2023-35921 |
7.5 | 0.0087 | NET NO AUTH LOW CX NO UI | A vulnerability has been identified in SIMATIC MV540 H (All versions < V3.3.4), | |
|
75
|
CVE-2026-108131 |
7.5 | 0.0086 | NET NO AUTH LOW CX NO UI | No cwe for this issue in Active Directory Federation Services (AD FS) allows an | |
|
75
|
CVE-2026-15323 |
7.5 | 0.0086 | NET NO AUTH LOW CX NO UI | The Product Designer for WooCommerce WordPress | Lumise plugin for WordPress is | |
|
69
|
CVE-2026-106629 |
9.3 | 0.0087 | NET NO AUTH LOW CX | Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vuln | |
|
69
|
CVE-2026-106630 |
9.3 | 0.0087 | NET NO AUTH LOW CX | Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vuln | |
|
69
|
CVE-2026-8043 |
9.6 | 0.0087 | NET LOW CX NO UI | External control of a file name in Ivanti Xtraction before version 2026.2 allows | |
|
69
|
CVE-2026-70332 |
9.6 | 0.0086 | NET NO AUTH LOW CX | Improper neutralization of input during web page generation ('cross-site scripti | |
|
69
|
CVE-2026-48561 |
9.6 | 0.0086 | NET NO AUTH LOW CX | Improper neutralization of special elements used in a command ('command injectio | |
|
69
|
CVE-2026-55008 |
9.6 | 0.0086 | NET NO AUTH LOW CX | Improper neutralization of input during web page generation ('cross-site scripti | |
|
69
|
CVE-2026-65669 |
9.6 | 0.0086 | NET NO AUTH LOW CX | Improper neutralization of special elements in output used by a downstream compo | |
|
68
|
CVE-2026-17603 |
8.7 | 0.0087 | NET LOW CX NO UI | Nexus Repository 3 did not sufficiently restrict which HikariCP connection-pool | |
|
68
|
CVE-2026-77910 |
8.8 | 0.0087 | NET LOW CX NO UI | Incorrect authorization in Microsoft Exchange Server allows an authorized attack | |
|
68
|
CVE-2026-70246 |
8.8 | 0.0086 | NET LOW CX NO UI | Incorrect authorization in Microsoft Office SharePoint allows an authorized atta | |
|
68
|
CVE-2026-71476 |
8.7 | 0.0086 | NET NO AUTH LOW CX | Nx is a monorepo solution for TypeScript and polyglot codebases. From version 20 | |
|
68
|
CVE-2026-57104 |
8.8 | 0.0086 | NET NO AUTH LOW CX | Improper neutralization of input during web page generation ('cross-site scripti | |
|
68
|
CVE-2026-69320 |
8.8 | 0.0086 | NET NO AUTH LOW CX | Improper neutralization of special elements used in an os command ('os command i | |
|
68
|
CVE-2026-78463 |
8.8 | 0.0086 | NET NO AUTH LOW CX | Improper control of generation of code ('code injection') in Remote Desktop Clie | |
|
68
|
CVE-2026-41109 |
8.8 | 0.0086 | NET NO AUTH LOW CX | Improper neutralization of special elements in output used by a downstream compo | |
|
68
|
CVE-2026-72765 |
8.7 | 0.0086 | NET LOW CX NO UI | n8n before 2.31.5 and before 2.32.1 contain a sandbox escape vulnerability in ex | |
|
64
|
CVE-2026-56623 |
7.1 | 0.0087 | NET LOW CX NO UI | Path traversal on Windows in Apache MINA SSHD component sshd-git. Apache MINA SS | |
|
63
|
CVE-2026-40484 |
9.1 | 0.0087 | NET LOW CX NO UI | ChurchCRM is an open-source church management system. In versions prior to 7.2.0 | |
|
63
|
CVE-2026-66309 |
9.1 | 0.0086 | NET LOW CX NO UI | Improper access control in Azure SQL Database allows an authorized attacker to e | |
|
63
|
CVE-2026-69641 |
9.1 | 0.0086 | NET LOW CX NO UI | Missing authorization in Microsoft Exchange Server allows an authorized attacker | |
|
62
|
CVE-2026-104082 |
8.6 | 0.0087 | NET LOW CX NO UI | SmarterMail before build 9777 contains a remote code execution vulnerability tha | |
|
60
|
CVE-2026-49506 |
7.2 | 0.0087 | NET LOW CX NO UI | Dell Wyse Management Suite, versions prior to WMS 5.5 HF1, contain an Improper L | |
|
60
|
CVE-2026-63454 |
7.2 | 0.0087 | NET LOW CX NO UI | An authenticated path traversal vulnerability exists in AOS-CX. Successful explo | |
|
60
|
CVE-2026-85798 |
7.2 | 0.0087 | NET LOW CX NO UI | Heap-based buffer overflow in Windows Distributed File System (DFS) allows an au | |
|
56
|
CVE-2026-69807 |
8.0 | 0.0087 | NET LOW CX | Improper limitation of a pathname to a restricted directory ('path traversal') i |