Hunt List
12,843 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-63455 |
9.8 | 0.0080 | NET NO AUTH LOW CX NO UI | Multiple vulnerabilities in the REST API interface of HPE Networking SD-WAN Orch | |
|
80
|
CVE-2026-63456 |
9.8 | 0.0080 | NET NO AUTH LOW CX NO UI | Multiple vulnerabilities in the REST API interface of HPE Networking SD-WAN Orch | |
|
80
|
CVE-2026-17218 |
9.8 | 0.0080 | NET NO AUTH LOW CX NO UI | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to execute arbitrary | |
|
80
|
CVE-2026-16840 |
9.8 | 0.0080 | NET NO AUTH LOW CX NO UI | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to e | |
|
80
|
CVE-2026-16917 |
9.8 | 0.0080 | NET NO AUTH LOW CX NO UI | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to e | |
|
80
|
CVE-2026-16919 |
9.8 | 0.0080 | NET NO AUTH LOW CX NO UI | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to e | |
|
80
|
CVE-2026-17118 |
9.8 | 0.0080 | NET NO AUTH LOW CX NO UI | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to e | |
|
80
|
CVE-2026-17136 |
9.8 | 0.0080 | NET NO AUTH LOW CX NO UI | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to e | |
|
80
|
CVE-2026-17160 |
9.8 | 0.0080 | NET NO AUTH LOW CX NO UI | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to e | |
|
80
|
CVE-2026-46456 |
9.8 | 0.0079 | NET NO AUTH LOW CX NO UI | Improper Input Validation vulnerability in Apache Camel AWS2-SQS Component. Th | |
|
80
|
CVE-2026-72593 |
9.8 | 0.0079 | NET NO AUTH LOW CX NO UI | A missing authentication vulnerability in dulldusk/phpfm through 1.8.0 allows an | |
|
78
|
CVE-2022-51022 |
8.8 | 0.0079 | NET NO AUTH LOW CX NO UI | YiShaAdmin 2.2 through 3.1, fixed in commit 025b062, contains an unauthenticated | |
|
78
|
CVE-2026-41473 |
8.8 | 0.0079 | NET NO AUTH LOW CX NO UI | CyberPanel versions prior to 2.4.5 contain an authentication bypass vulnerabilit | |
|
78
|
CVE-2026-59094 |
8.7 | 0.0079 | NET NO AUTH LOW CX NO UI | Pathway through 0.31.1, fixed in commit d09722e, document store applies a caller | |
|
78
|
CVE-2026-60108 |
8.7 | 0.0079 | NET NO AUTH LOW CX NO UI | Zeek before 8.0.9 contains an uncontrolled memory consumption vulnerability in t | |
|
75
|
CVE-2026-50273 |
7.5 | 0.0079 | NET NO AUTH LOW CX NO UI | Datadog .NET Tracer is a client library for Datadog APM for .NET applications. P | |
|
75
|
CVE-2026-50271 |
7.5 | 0.0079 | NET NO AUTH LOW CX NO UI | Datadog dd-trace-py is the Datadog Python APM client. Prior to 4.8.2, Datadog tr | |
|
75
|
CVE-2026-50272 |
7.5 | 0.0079 | NET NO AUTH LOW CX NO UI | dd-trace is the Datadog APM client for Node.js. Prior to 5.100.0, W3C baggage pr | |
|
75
|
CVE-2026-50274 |
7.5 | 0.0079 | NET NO AUTH LOW CX NO UI | Datadog dd-trace-go is a Go client library for Datadog application performance m | |
|
75
|
CVE-2026-14164 |
7.5 | 0.0079 | NET NO AUTH LOW CX NO UI | A double free issue has been identified in libarchive's RAR5 reader. During pars | |
|
75
|
CVE-2026-32316 |
7.5 | 0.0079 | NET NO AUTH LOW CX NO UI | jq is a command-line JSON processor. An integer overflow vulnerability exists th | |
|
70
|
CVE-2026-15068 |
9.9 | 0.0079 | NET LOW CX NO UI | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 NIM could allow a remote authentic | |
|
70
|
CVE-2026-16816 |
9.9 | 0.0079 | NET LOW CX NO UI | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote authenticated | |
|
70
|
CVE-2026-18835 |
9.9 | 0.0079 | NET LOW CX NO UI | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote authenticated | |
|
69
|
CVE-2026-65605 |
9.4 | 0.0079 | NET NO AUTH LOW CX | SiYuan before v3.7.2 contains a stored cross-site scripting vulnerability in Att | |
|
68
|
CVE-2026-62895 |
8.8 | 0.0080 | NET NO AUTH LOW CX | Permissive cross-domain policy with untrusted domains in Azure Arc allows an una | |
|
68
|
CVE-2026-119713 |
8.7 | 0.0080 | NET LOW CX NO UI | Paperclip 2026.403.0 before 2026.416.0 contains a remote code execution vulnerab | |
|
68
|
CVE-2026-17623 |
8.8 | 0.0079 | NET LOW CX NO UI | IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote authenticated attacke | |
|
68
|
CVE-2026-16906 |
8.8 | 0.0079 | NET LOW CX NO UI | IBM i 7.6, and 7.5 could allow a remote authenticated attacker to execute arbitr | |
|
68
|
CVE-2026-17417 |
8.8 | 0.0079 | NET LOW CX NO UI | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to exec | |
|
68
|
CVE-2026-17642 |
8.8 | 0.0079 | NET LOW CX NO UI | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to exec | |
|
68
|
CVE-2026-57087 |
8.8 | 0.0079 | NET NO AUTH LOW CX | Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unaut | |
|
68
|
CVE-2026-15484 |
8.7 | 0.0079 | NET LOW CX NO UI | A vulnerability was detected in TRENDnet TEW-821DAP 1.12B01. The affected elemen | |
|
68
|
CVE-2026-16097 |
8.7 | 0.0079 | NET LOW CX NO UI | A vulnerability was found in Shibby Tomato 1.28. This vulnerability affects the | |
|
67
|
CVE-2026-76003 |
8.6 | 0.0079 | NET LOW CX NO UI | A weakness has been identified in UTT HiPER 1200GW up to 2.5.3-170306. Affected | |
|
67
|
CVE-2026-76004 |
8.6 | 0.0079 | NET LOW CX NO UI | A security vulnerability has been detected in UTT HiPER 1250GW up to 3.2.7-21090 | |
|
66
|
CVE-2026-70340 |
8.1 | 0.0080 | NET LOW CX NO UI | Missing authorization in Azure CycleCloud allows an authorized attacker to eleva | |
|
66
|
CVE-2026-85888 |
7.7 | 0.0080 | NET LOW CX NO UI | Out-of-bounds read in SQL Server allows an authorized attacker to disclose infor | |
|
66
|
CVE-2026-88081 |
7.7 | 0.0080 | NET LOW CX NO UI | Out-of-bounds read in SQL Server allows an authorized attacker to disclose infor | |
|
66
|
CVE-2026-49164 |
8.1 | 0.0079 | NET NO AUTH NO UI | Heap-based buffer overflow in Active Directory Domain Services allows an unautho | |
|
66
|
CVE-2026-50439 |
8.1 | 0.0079 | NET NO AUTH NO UI | Use after free in Microsoft Message Queuing Queue Manager allows an unauthorized | |
|
66
|
CVE-2026-50487 |
8.1 | 0.0079 | NET NO AUTH NO UI | Use after free in Microsoft Windows DNS allows an unauthorized attacker to eleva | |
|
66
|
CVE-2026-50694 |
8.1 | 0.0079 | NET NO AUTH NO UI | Use after free in Windows Secure Socket Tunneling Protocol (SSTP) allows an unau | |
|
66
|
CVE-2026-54995 |
8.1 | 0.0079 | NET NO AUTH NO UI | Use after free in Reliable Multicast Transport Driver (RMCAST) allows an unautho | |
|
65
|
CVE-2026-14721 |
7.4 | 0.0079 | NET LOW CX NO UI | A vulnerability has been found in UTT HiPER 1250GW up to 3.2.7-210907-180535. Th | |
|
65
|
CVE-2026-15480 |
7.4 | 0.0079 | NET LOW CX NO UI | A vulnerability was identified in Trendnet TEW-635BRM up to 1.00.03. This affect | |
|
65
|
CVE-2026-15544 |
7.4 | 0.0079 | NET LOW CX NO UI | A vulnerability was determined in Shibby Tomato up to 1.28.0000. Affected is the | |
|
65
|
CVE-2026-15548 |
7.4 | 0.0079 | NET LOW CX NO UI | A security vulnerability has been detected in Shibby Tomato up to 1.28.0000. Thi | |
|
64
|
CVE-2026-114720 |
7.1 | 0.0079 | NET LOW CX NO UI | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an IMAP co | |
|
63
|
CVE-2026-9659 |
9.1 | 0.0079 | NET LOW CX NO UI | Multiple exploitable stack-based buffer overflow vulnerabilities exist in the bo |