Hunt List
12,844 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-67688 |
9.8 | 0.0077 | NET NO AUTH LOW CX NO UI | ICS-Park Smart Park Management System v2.0 contains an unrestricted file upload | |
|
80
|
CVE-2026-67678 |
9.8 | 0.0077 | NET NO AUTH LOW CX NO UI | File Upload vulnerability in RainyGao-Hithub DocSys v.2.02.80 allows a remote at | |
|
80
|
CVE-2025-70293 |
9.8 | 0.0077 | NET NO AUTH LOW CX NO UI | An issue was discovered in Denx U-Boot before 2026.04. An integer overflow vulne | |
|
80
|
CVE-2026-78845 |
9.8 | 0.0077 | NET NO AUTH LOW CX NO UI | Aidot products Linkind Matter Smart Plug 1.01.32, OREiN Matter Smart Light Bulb | |
|
80
|
CVE-2026-17006 |
9.8 | 0.0077 | NET NO AUTH LOW CX NO UI | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to e | |
|
80
|
CVE-2026-17000 |
9.8 | 0.0077 | NET NO AUTH LOW CX NO UI | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to e | |
|
80
|
CVE-2026-65880 |
10.0 | 0.0077 | NET NO AUTH LOW CX NO UI | Joomla Extension - balbooa.com - Unauthenticated remote code execution in Balboo | |
|
80
|
CVE-2026-102785 |
10.0 | 0.0077 | NET NO AUTH LOW CX NO UI | Joomla Extension - yootheme.com - Unauthenticated remote code execution in YOOth | |
|
80
|
CVE-2026-15734 |
9.8 | 0.0077 | NET NO AUTH LOW CX NO UI | A Server-Side Template Injection (SSTI) vulnerability in WGDashboard version 4.3 | |
|
79
|
CVE-2026-34977 |
9.3 | 0.0077 | NET NO AUTH LOW CX NO UI | Aperi'Solve is an open-source steganalysis web platform. In versions 3.1.3 throu | |
|
78
|
CVE-2026-94265 |
9.1 | 0.0078 | NET NO AUTH LOW CX NO UI | When processing an HTTP redirect to a URL containing userinfo (a `username:passw | |
|
78
|
CVE-2026-56811 |
8.7 | 0.0077 | NET NO AUTH LOW CX NO UI | Allocation of Resources Without Limits or Throttling vulnerability in phoenixfra | |
|
78
|
CVE-2024-58381 |
8.7 | 0.0077 | NET NO AUTH LOW CX NO UI | PocketMine-MP before 5.11.1 contains a denial of service vulnerability in LoginP | |
|
77
|
CVE-2026-5260 |
8.2 | 0.0077 | NET NO AUTH LOW CX NO UI | A flaw was found in libgnutls. A remote attacker, by sending an extremely short | |
|
75
|
CVE-2026-66257 |
7.5 | 0.0077 | NET NO AUTH LOW CX NO UI | A pre-authentication attacker could leverage unbounded symbol value caching to c | |
|
75
|
CVE-2026-66273 |
7.5 | 0.0077 | NET NO AUTH LOW CX NO UI | A pre-authentication attacker could leverage type size/count handling to cause e | |
|
75
|
CVE-2026-67465 |
7.5 | 0.0077 | NET NO AUTH LOW CX NO UI | A pre-authentication attacker could leverage unbounded symbol value caching to c | |
|
75
|
CVE-2026-67551 |
7.5 | 0.0077 | NET NO AUTH LOW CX NO UI | pre-authentication attacker could leverage type size/count handling to cause exc | |
|
75
|
CVE-2026-67588 |
7.5 | 0.0077 | NET NO AUTH LOW CX NO UI | A pre-authentication attacker could leverage unbounded symbol value caching to c | |
|
75
|
CVE-2026-67589 |
7.5 | 0.0077 | NET NO AUTH LOW CX NO UI | A pre-authentication attacker could leverage type size/count handling to cause e | |
|
75
|
CVE-2026-68060 |
7.5 | 0.0077 | NET NO AUTH LOW CX NO UI | A pre-authentication attacker could leverage type size/count handling to cause e | |
|
75
|
CVE-2026-68074 |
7.5 | 0.0077 | NET NO AUTH LOW CX NO UI | A pre-authentication attacker could leverage unbounded symbol value caching to c | |
|
75
|
CVE-2026-66274 |
7.5 | 0.0077 | NET NO AUTH LOW CX NO UI | A pre-authentication attacker could leverage type nesting to cause a StackOverfl | |
|
75
|
CVE-2026-67552 |
7.5 | 0.0077 | NET NO AUTH LOW CX NO UI | A pre-authentication attacker could leverage type nesting to cause a StackOverfl | |
|
75
|
CVE-2026-67590 |
7.5 | 0.0077 | NET NO AUTH LOW CX NO UI | A pre-authentication attacker could leverage type nesting to cause a StackOverfl | |
|
75
|
CVE-2026-68073 |
7.5 | 0.0077 | NET NO AUTH LOW CX NO UI | A pre-authentication attacker could leverage type nesting to cause a StackOverfl | |
|
75
|
CVE-2026-56452 |
7.5 | 0.0077 | NET NO AUTH LOW CX NO UI | Path traversal in the sshd-scp component of Apache MINA SSHD. Apache MINA SSHD i | |
|
75
|
CVE-2026-47427 |
7.5 | 0.0077 | NET NO AUTH LOW CX NO UI | GitHub MCP Server is GitHub's official MCP Server. Prior to 1.1.0, the Completio | |
|
75
|
CVE-2026-33034 |
7.5 | 0.0077 | NET NO AUTH LOW CX NO UI | An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4 | |
|
69
|
CVE-2026-55769 |
9.4 | 0.0077 | NET LOW CX NO UI | CloudNativePG is a platform designed to manage PostgreSQL databases within Kuber | |
|
68
|
CVE-2026-2052 |
8.8 | 0.0077 | NET LOW CX NO UI | The Widget Options – Advanced Conditional Visibility for Gutenberg Blocks & Clas | |
|
68
|
CVE-2026-30898 |
8.8 | 0.0077 | NET LOW CX NO UI | An example of BashOperator in Airflow documentation suggested a way of passing d | |
|
68
|
CVE-2026-102849 |
8.8 | 0.0077 | NET NO AUTH LOW CX | Heap-based buffer overflow in Microsoft Office Access allows an unauthorized att | |
|
68
|
CVE-2026-102850 |
8.8 | 0.0077 | NET NO AUTH LOW CX | Heap-based buffer overflow in Microsoft Office Access allows an unauthorized att | |
|
68
|
CVE-2026-69326 |
8.8 | 0.0077 | NET NO AUTH LOW CX | Heap-based buffer overflow in Graphic Fonts allows an unauthorized attacker to e | |
|
68
|
CVE-2026-83725 |
8.8 | 0.0077 | NET NO AUTH LOW CX | Heap-based buffer overflow in Microsoft Windows Search Component allows an unaut | |
|
68
|
CVE-2026-83851 |
8.8 | 0.0077 | NET NO AUTH LOW CX | Heap-based buffer overflow in Windows Partition Management Driver allows an unau | |
|
67
|
CVE-2026-10754 |
8.6 | 0.0078 | NET LOW CX NO UI | Pega Platform versions 8.5.0 through 25.1.2 are affected by an improper validati | |
|
66
|
CVE-2023-25734 |
8.1 | 0.0077 | NET NO AUTH LOW CX | After downloading a Windows <code>.url</code> shortcut from the local filesystem | |
|
66
|
CVE-2026-47619 |
8.1 | 0.0077 | NET NO AUTH NO UI | NVIDIA Dynamo for Linux examples and recipes contain a vulnerability where an at | |
|
66
|
CVE-2026-70062 |
8.1 | 0.0077 | NET NO AUTH NO UI | Double free in Windows Libarchive allows an unauthorized attacker to execute cod | |
|
63
|
CVE-2026-49441 |
9.1 | 0.0077 | NET LOW CX NO UI | Wazuh is a free and open source platform used for threat prevention, detection, | |
|
63
|
CVE-2026-44758 |
9.1 | 0.0077 | NET LOW CX NO UI | SAP Manufacturing Integration and Intelligence (MII) allows an attacker with hig | |
|
63
|
CVE-2025-13590 |
9.1 | 0.0077 | NET LOW CX NO UI | A malicious actor with administrative privileges can upload an arbitrary file to | |
|
60
|
CVE-2026-73660 |
7.5 | 0.0077 | NET LOW CX NO UI | FreePBX is an open source IP PBX. Prior to 16.0.6 and 17.0.5.4, the FreePBX Text | |
|
60
|
CVE-2026-18255 |
7.2 | 0.0077 | NET LOW CX NO UI | A flaw was found in Quay. A user configured in GLOBAL_READONLY_SUPER_USERS is ab | |
|
56
|
CVE-2026-69322 |
8.0 | 0.0077 | NET LOW CX | Double free in Microsoft Windows Search Component allows an authorized attacker | |
|
56
|
CVE-2026-69332 |
8.0 | 0.0077 | NET LOW CX | Out-of-bounds read in Windows NTFS allows an authorized attacker to elevate priv | |
|
56
|
CVE-2026-69346 |
8.0 | 0.0077 | NET LOW CX | Heap-based buffer overflow in Windows Print Spooler Components allows an authori | |
|
56
|
CVE-2026-69365 |
8.0 | 0.0077 | NET LOW CX | Out-of-bounds read in Microsoft Local Security Authority Server (lsasrv) allows |