Hunt List
12,830 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-9192 |
9.8 | 0.0083 | NET NO AUTH LOW CX NO UI | An authentication bypass vulnerability in the ODBC App Server of Progress MarkLo | |
|
80
|
CVE-2026-57308 |
9.8 | 0.0083 | NET NO AUTH LOW CX NO UI | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti | |
|
80
|
CVE-2026-103780 |
9.8 | 0.0083 | NET NO AUTH LOW CX NO UI | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS | |
|
80
|
CVE-2026-46454 |
9.8 | 0.0083 | NET NO AUTH LOW CX NO UI | Improper Input Validation vulnerability in Apache Camel Cometd Component. The c | |
|
80
|
CVE-2026-43185 |
9.8 | 0.0083 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix | |
|
80
|
CVE-2026-90532 |
10.0 | 0.0083 | NET NO AUTH LOW CX NO UI | Adobe Experience Manager is affected by an Incorrect Authorization vulnerability | |
|
80
|
CVE-2026-16634 |
9.8 | 0.0082 | NET NO AUTH LOW CX NO UI | TOML::XS versions before 0.06 for Perl bundle an unsupported and vulnerable vers | |
|
80
|
CVE-2026-3490 |
10.0 | 0.0082 | NET NO AUTH LOW CX NO UI | picklescan before 1.0.4 fails to block pkgutil.resolve_name, allowing attackers | |
|
80
|
CVE-2026-66915 |
10.0 | 0.0082 | NET NO AUTH LOW CX NO UI | Joomla Extension - fabrikar.com - Remote code execution in Fabrik < 4.7.2 - An u | |
|
79
|
CVE-2026-60113 |
9.3 | 0.0083 | NET NO AUTH LOW CX NO UI | AMMOS Instrument Toolkit (AIT) Deep Space Network (DSN) Interface before 2.2.2 c | |
|
79
|
CVE-2026-50516 |
9.4 | 0.0083 | NET NO AUTH LOW CX NO UI | Incorrect authorization in Microsoft Azure Kubernetes Service allows an authoriz | |
|
79
|
CVE-2026-64827 |
9.3 | 0.0083 | NET NO AUTH LOW CX NO UI | Telenia Software TVox 26.5.3 and prior 26.x versions, and 24.9.21 and prior 24.x | |
|
79
|
CVE-2026-61514 |
9.3 | 0.0083 | NET NO AUTH LOW CX NO UI | Puwell IP Camera firmware versions 2.x through 4.x contains an authentication by | |
|
79
|
CVE-2026-70552 |
9.3 | 0.0083 | NET NO AUTH LOW CX NO UI | MaxSite CMS 109.5 and earlier contains an authentication bypass vulnerability in | |
|
78
|
CVE-2026-43945 |
8.9 | 0.0084 | NET NO AUTH LOW CX NO UI | FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Versio | |
|
78
|
CVE-2026-42584 |
9.1 | 0.0084 | NET NO AUTH LOW CX NO UI | Netty is an asynchronous, event-driven network application framework. Prior to 4 | |
|
78
|
CVE-2026-59822 |
8.8 | 0.0084 | NET NO AUTH LOW CX NO UI | KEV | BerriAI LiteLLM contains an improper authentication vulnerability in the MCP Str |
|
78
|
CVE-2026-71190 |
8.7 | 0.0084 | NET NO AUTH LOW CX NO UI | In OpenStack Swift through 2.38.0, the proxy server Accept header parser contain | |
|
78
|
CVE-2026-72713 |
8.7 | 0.0083 | NET NO AUTH LOW CX NO UI | XAgent contains a path traversal vulnerability in the workspace file endpoint th | |
|
78
|
CVE-2025-49794 |
9.1 | 0.0083 | NET NO AUTH LOW CX NO UI | A use-after-free vulnerability was found in libxml2. This issue occurs when pars | |
|
78
|
CVE-2026-107328 |
8.8 | 0.0082 | NET LOW CX NO UI | 1 PoC | IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacke |
|
77
|
CVE-2026-48285 |
8.6 | 0.0083 | NET NO AUTH LOW CX NO UI | ColdFusion versions 2025.9, 2023.20 and earlier are affected by a Server-Side Re | |
|
76
|
CVE-2026-85168 |
7.7 | 0.0083 | NET LOW CX NO UI | 1 PoC | n8n versions before 1.123.73, 2.35.4, and 2.36.2 contain a remote code execution |
|
76
|
CVE-2026-14637 |
7.8 | 0.0083 | NET NO AUTH LOW CX NO UI | A security vulnerability has been detected in kirilkirkov Ecommerce-CodeIgniter- | |
|
75
|
CVE-2026-41284 |
7.5 | 0.0084 | NET NO AUTH LOW CX NO UI | Allocation of Resources Without Limits or Throttling vulnerability in Apache Tom | |
|
75
|
CVE-2026-71467 |
7.5 | 0.0083 | NET NO AUTH LOW CX NO UI | A flaw was found in search-v2-api. The authentication middleware in the affected | |
|
75
|
CVE-2026-69793 |
7.5 | 0.0083 | NET NO AUTH LOW CX NO UI | Improper validation of consistency within input in Windows TCP/IP allows an unau | |
|
74
|
CVE-2026-66723 |
7.0 | 0.0083 | NET NO AUTH LOW CX NO UI | MWDB Core versions >=2.2.0 and <2.19.0 contain a missing authorization vulnerabi | |
|
70
|
CVE-2026-113672 |
9.9 | 0.0084 | NET LOW CX NO UI | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 0 | |
|
70
|
CVE-2026-47367 |
9.9 | 0.0083 | NET LOW CX NO UI | A malicious actor with access to the network and low privileges could exploit an | |
|
69
|
CVE-2026-14453 |
9.6 | 0.0084 | NET LOW CX NO UI | This vulnerability is a critical Server-Side Template Injection (SSTI) in Centre | |
|
68
|
CVE-2026-46590 |
8.8 | 0.0084 | NET LOW CX NO UI | Deserialization of Untrusted Data vulnerability in Apache Camel PQC component. | |
|
68
|
CVE-2026-88164 |
8.8 | 0.0084 | NET LOW CX NO UI | Missing authorization in Microsoft Office SharePoint allows an authorized attack | |
|
68
|
CVE-2026-102869 |
8.8 | 0.0084 | NET NO AUTH LOW CX | Access of resource using incompatible type ('type confusion') in .NET and Visual | |
|
68
|
CVE-2026-69522 |
8.8 | 0.0084 | NET NO AUTH LOW CX | Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to e | |
|
68
|
CVE-2026-81955 |
8.8 | 0.0084 | NET NO AUTH LOW CX | Heap-based buffer overflow in Microsoft Graphics Component allows an unauthorize | |
|
68
|
CVE-2026-78439 |
8.8 | 0.0084 | NET NO AUTH LOW CX | Stack-based buffer overflow in Microsoft Graphics Component allows an unauthoriz | |
|
68
|
CVE-2026-57296 |
8.8 | 0.0083 | NET LOW CX NO UI | Jenkins External Workspace Manager Plugin 1.3.2 and earlier does not reject path | |
|
68
|
CVE-2026-88075 |
8.8 | 0.0083 | NET LOW CX NO UI | Improper neutralization of special elements used in an sql command ('sql injecti | |
|
68
|
CVE-2026-73602 |
9.0 | 0.0083 | NET LOW CX NO UI | Flowise before 3.1.3 contains a sandbox escape vulnerability in the vm2 JavaScri | |
|
66
|
CVE-2026-58454 |
7.7 | 0.0083 | NET LOW CX NO UI | JAIOTlink C492A-W6 Wi-Fi IP cameras running firmware 4.8.30.57701411 contain a r | |
|
66
|
CVE-2026-86412 |
8.1 | 0.0083 | NET NO AUTH NO UI | A remote HTTP server can set a cookie that curl accepts and writes to a Netscape | |
|
66
|
CVE-2026-92386 |
8.1 | 0.0083 | NET NO AUTH NO UI | When writing a long cookie name and value to a Netscape cookie jar, a remote HTT | |
|
66
|
CVE-2026-41105 |
8.1 | 0.0083 | NET LOW CX NO UI | Server-side request forgery (ssrf) in Azure Notification Service allows an autho | |
|
65
|
CVE-2026-6016 |
7.4 | 0.0084 | NET LOW CX NO UI | A vulnerability was found in Tenda AC9 15.03.02.13. The affected element is the | |
|
64
|
CVE-2026-26151 |
7.1 | 0.0083 | NET NO AUTH LOW CX | Insufficient ui warning of dangerous operations in Windows Remote Desktop allows | |
|
62
|
CVE-2026-15427 |
8.6 | 0.0084 | NET LOW CX NO UI | An OS command injection vulnerability exists in the TR-069 / CWMP management int | |
|
62
|
CVE-2026-74036 |
8.6 | 0.0083 | NET LOW CX NO UI | Wazuh from 4.3.0 before 4.14.8 contains a remote code execution vulnerability wh | |
|
60
|
CVE-2026-49290 |
7.6 | 0.0083 | NET LOW CX NO UI | Slopsmith is a self-contained web application for browsing, playing, and practic | |
|
56
|
CVE-2026-73623 |
7.7 | 0.0083 | NET NO UI | GitPython before 3.1.54 contains an incomplete denylist in unsafe_git_clone_opti |