Hunt List
12,841 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-24270 |
9.8 | 0.0081 | NET NO AUTH LOW CX NO UI | NVIDIA AIStore framework contains a vulnerability where an attacker could bypass | |
|
80
|
CVE-2023-24482 |
9.8 | 0.0081 | NET NO AUTH LOW CX NO UI | A vulnerability has been identified in COMOS V10.2 (All versions), COMOS V10.3.3 | |
|
80
|
CVE-2024-11080 |
9.8 | 0.0081 | NET NO AUTH LOW CX NO UI | The Post Grid and Gutenberg Blocks – ComboBlocks plugin for WordPress is vulnera | |
|
80
|
CVE-2026-11756 |
10.0 | 0.0081 | NET NO AUTH LOW CX NO UI | A Deserialization of Untrusted Data vulnerability affecting Station Launcher App | |
|
80
|
CVE-2026-65883 |
10.0 | 0.0081 | NET NO AUTH LOW CX NO UI | Joomla Extension - aimy-extensions.com - RCE via PHP object injection in Aimy Ca | |
|
80
|
CVE-2026-17061 |
10.0 | 0.0081 | NET NO AUTH LOW CX NO UI | A Deserialization of Untrusted Data vulnerability affecting SIMULIA Execution En | |
|
80
|
CVE-2026-59940 |
9.8 | 0.0081 | NET NO AUTH LOW CX NO UI | Seroval facilitates JS value stringification, including complex structures beyon | |
|
80
|
CVE-2026-61486 |
9.8 | 0.0081 | NET NO AUTH LOW CX NO UI | ** UNSUPPORTED WHEN ASSIGNED ** Stack-based Buffer Overflow vulnerability in Apa | |
|
80
|
CVE-2026-64608 |
9.8 | 0.0081 | NET NO AUTH LOW CX NO UI | Heap type confusion and out-of-bounds read/write in the Apache Fory C++ implemen | |
|
80
|
CVE-2026-61484 |
9.8 | 0.0081 | NET NO AUTH LOW CX NO UI | ** UNSUPPORTED WHEN ASSIGNED ** Deserialization of Untrusted Data vulnerability | |
|
79
|
CVE-2026-35019 |
9.2 | 0.0081 | NET NO AUTH LOW CX NO UI | NetComm NF20MESH routers running firmware R6B031 and earlier contain an authenti | |
|
78
|
CVE-2014-125134 |
8.7 | 0.0082 | NET NO AUTH LOW CX NO UI | ChurcHope theme for WordPress before 2.2 contains a path traversal vulnerability | |
|
78
|
CVE-2026-47896 |
8.9 | 0.0081 | NET NO AUTH LOW CX NO UI | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') v | |
|
78
|
CVE-2026-65315 |
8.7 | 0.0081 | NET NO AUTH LOW CX NO UI | Ollama (HEAD f0078ae) contains an uncontrolled memory allocation vulnerability i | |
|
78
|
CVE-2026-17556 |
8.8 | 0.0080 | NET NO AUTH LOW CX NO UI | A path traversal vulnerability was identified in GitHub Enterprise Server that a | |
|
75
|
CVE-2026-17615 |
7.5 | 0.0082 | NET NO AUTH LOW CX NO UI | A flaw was found in RESTEasy's SourceProvider. This vulnerability allows an unau | |
|
75
|
CVE-2026-78058 |
7.5 | 0.0081 | NET NO AUTH LOW CX NO UI | Uncontrolled resource consumption in the HTTP/2 (h2) receive path of Apache bRPC | |
|
75
|
CVE-2026-6758 |
7.5 | 0.0081 | NET NO AUTH LOW CX NO UI | Use-after-free in the JavaScript: WebAssembly component. This vulnerability was | |
|
75
|
CVE-2026-28983 |
7.5 | 0.0081 | NET NO AUTH LOW CX NO UI | A type confusion issue was addressed with improved checks. This issue is fixed i | |
|
75
|
CVE-2026-61372 |
7.5 | 0.0081 | NET NO AUTH LOW CX NO UI | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') v | |
|
75
|
CVE-2026-66907 |
7.5 | 0.0081 | NET NO AUTH LOW CX NO UI | Relative path traversal vulnerability in Apache Camel Google Storage component. | |
|
75
|
CVE-2026-110354 |
7.5 | 0.0081 | NET NO AUTH LOW CX NO UI | HAProxy 3 before 3.4.6 allows a remote unauthenticated attacker to cause a denia | |
|
70
|
CVE-2026-72508 |
9.9 | 0.0081 | NET LOW CX NO UI | A flaw was found in the multicloud-operators-subscription component of Red Hat A | |
|
69
|
CVE-2026-102238 |
9.6 | 0.0082 | NET NO AUTH LOW CX | Improper limitation of a pathname to a restricted directory ('path traversal') i | |
|
69
|
CVE-2026-70477 |
9.5 | 0.0081 | NET NO AUTH NO UI | Flowise is a drag & drop user interface to build a customized large language mod | |
|
69
|
CVE-2026-57571 |
9.6 | 0.0081 | NET NO AUTH LOW CX | Crawl4AI is an open-source LLM-friendly web crawler and scraper. Prior to 0.9.0, | |
|
68
|
CVE-2023-0767 |
8.8 | 0.0082 | NET NO AUTH LOW CX | An attacker could construct a PKCS 12 cert bundle in such a way that could allow | |
|
68
|
CVE-2026-70336 |
8.8 | 0.0082 | NET NO AUTH LOW CX | Improper control of generation of code ('code injection') in Visual Studio Code | |
|
68
|
CVE-2026-59734 |
8.8 | 0.0081 | NET LOW CX NO UI | Coolify is an open-source and self-hostable tool for managing servers, applicati | |
|
68
|
CVE-2026-27957 |
8.8 | 0.0081 | NET LOW CX NO UI | Coolify is an open-source and self-hostable tool for managing servers, applicati | |
|
68
|
CVE-2026-88200 |
8.8 | 0.0081 | NET LOW CX NO UI | Privilege context switching error in Microsoft Office SharePoint allows an autho | |
|
68
|
CVE-2026-102860 |
8.8 | 0.0081 | NET LOW CX NO UI | Improper access control in Microsoft Office SharePoint allows an authorized atta | |
|
68
|
CVE-2026-102861 |
8.8 | 0.0081 | NET LOW CX NO UI | Missing authorization in Microsoft Office SharePoint allows an authorized attack | |
|
68
|
CVE-2023-27463 |
8.8 | 0.0080 | NET LOW CX NO UI | A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.3). | |
|
68
|
CVE-2026-69118 |
8.7 | 0.0080 | NET LOW CX NO UI | Cachet through 2.4.1 contains a server-side template injection vulnerability in | |
|
67
|
CVE-2026-40501 |
8.6 | 0.0080 | NET NO AUTH LOW CX | Cherry Studio versions 1.2.2 through 1.9.12, fixed in commit 1518530, contain a | |
|
66
|
CVE-2026-100218 |
8.1 | 0.0082 | NET NO AUTH NO UI | Use after free in Remote Desktop Gateway Service allows an unauthorized attacker | |
|
66
|
CVE-2026-70127 |
8.1 | 0.0082 | NET NO AUTH NO UI | Use after free in DNS Server allows an unauthorized attacker to execute code ove | |
|
65
|
CVE-2026-7097 |
7.4 | 0.0081 | NET LOW CX NO UI | A weakness has been identified in Tenda F456 1.0.0.5. This issue affects the fun | |
|
65
|
CVE-2026-6015 |
7.4 | 0.0081 | NET LOW CX NO UI | A vulnerability has been found in Tenda AC9 15.03.02.13. Impacted is the functio | |
|
65
|
CVE-2026-12806 |
7.4 | 0.0080 | NET LOW CX NO UI | A vulnerability has been found in Edimax BR-6478AC V2 1.23. The impacted element | |
|
65
|
CVE-2026-13562 |
7.4 | 0.0080 | NET LOW CX NO UI | A flaw has been found in Edimax EW-7478APC 1.04. This affects the function formi | |
|
65
|
CVE-2026-13563 |
7.4 | 0.0080 | NET LOW CX NO UI | A vulnerability has been found in Edimax EW-7478APC 1.04. This impacts the funct | |
|
65
|
CVE-2026-13564 |
7.4 | 0.0080 | NET LOW CX NO UI | A vulnerability was found in Edimax EW-7478APC 1.04. Affected is the function fo | |
|
65
|
CVE-2026-13580 |
7.4 | 0.0080 | NET LOW CX NO UI | A security vulnerability has been detected in Edimax EW-7478APC 1.04. This affec | |
|
65
|
CVE-2026-13582 |
7.4 | 0.0080 | NET LOW CX NO UI | A flaw has been found in Edimax EW-7478APC 1.04. This issue affects the function | |
|
65
|
CVE-2026-13583 |
7.4 | 0.0080 | NET LOW CX NO UI | A vulnerability has been found in Edimax EW-7478APC 1.04. Impacted is the functi | |
|
64
|
CVE-2023-53907 |
7.1 | 0.0081 | NET LOW CX NO UI | Bludit versions before 3.13.0 contain an authenticated file download vulnerabili | |
|
60
|
CVE-2026-44872 |
7.2 | 0.0081 | NET LOW CX NO UI | A command injection vulnerability exists in the web-based management interface o | |
|
60
|
CVE-2026-5627 |
7.2 | 0.0081 | NET LOW CX NO UI | A path traversal vulnerability exists in mintplex-labs/anything-llm versions up |