Hunt List
12,859 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-54159 |
10.0 | 0.0075 | NET NO AUTH LOW CX NO UI | PrestaShop ps_facetedsearch is a module that adds layered navigation filters. Fr | |
|
80
|
CVE-2026-26035 |
9.8 | 0.0075 | NET NO AUTH LOW CX NO UI | An Improper Authentication vulnerability [CWE-287] vulnerability in Fortinet For | |
|
80
|
CVE-2024-31026 |
9.8 | 0.0075 | NET NO AUTH LOW CX NO UI | An issue in Greek Universities Network (GUnet) Open eClass Platform v.3.15 allow | |
|
80
|
CVE-2026-61991 |
10.0 | 0.0075 | NET NO AUTH LOW CX NO UI | Unauthenticated Remote Code Execution (RCE) in AjaxLoadMore Cache <= 3.1.1 versi | |
|
80
|
CVE-2026-104339 |
9.8 | 0.0075 | NET NO AUTH LOW CX NO UI | IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote attacker to execute a | |
|
80
|
CVE-2026-53405 |
9.8 | 0.0075 | NET NO AUTH LOW CX NO UI | Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An | |
|
80
|
CVE-2025-49710 |
9.8 | 0.0074 | NET NO AUTH LOW CX NO UI | An integer overflow was present in `OrderedHashTable` used by the JavaScript eng | |
|
80
|
CVE-2026-79860 |
9.8 | 0.0074 | NET NO AUTH LOW CX NO UI | Buffer overflow vulnerabilities exist in an underlying service of AOS-8 that cou | |
|
79
|
CVE-2026-63359 |
9.3 | 0.0075 | NET NO AUTH LOW CX NO UI | The Appriss Insights (Equifax) Victim Information Notification Exchange (VINE) a | |
|
79
|
CVE-2026-112408 |
9.4 | 0.0074 | NET NO AUTH LOW CX NO UI | Missing verification of source of a communication channel in the default_bucket( | |
|
78
|
CVE-2026-16756 |
8.7 | 0.0075 | NET NO AUTH LOW CX NO UI | Missing connection and header-read timeouts and the absence of a concurrent-conn | |
|
78
|
CVE-2026-53486 |
9.1 | 0.0075 | NET NO AUTH LOW CX NO UI | The decompress package for Node.js extracts archives. Prior to 10.2.1 and 11.1.3 | |
|
78
|
CVE-2026-58319 |
9.1 | 0.0075 | NET NO AUTH LOW CX NO UI | Certain Apache Doris FE HTTP REST administrative APIs were accessible without pr | |
|
78
|
CVE-2026-54003 |
9.1 | 0.0074 | NET NO AUTH LOW CX NO UI | Kirby is an open-source content management system. Prior to 4.9.4 and from 5.4.4 | |
|
78
|
CVE-2026-44307 |
8.7 | 0.0074 | NET NO AUTH LOW CX NO UI | Mako is a template library written in Python. Prior to 1.3.12, on Windows, a URI | |
|
78
|
CVE-2026-59803 |
8.7 | 0.0074 | NET NO AUTH LOW CX NO UI | rpcx through 1.9.3, fixed in commit 047aec1, contains a denial-of-service vulner | |
|
76
|
CVE-2026-11940 |
7.8 | 0.0075 | NET NO AUTH LOW CX NO UI | tarfile.extractall() with the 'data' or 'tar' filter could be bypassed by a cra | |
|
75
|
CVE-2026-85324 |
7.5 | 0.0075 | NET NO AUTH LOW CX NO UI | Memory allocation with excessive size value in Active Directory Federation Servi | |
|
75
|
CVE-2026-49451 |
7.5 | 0.0075 | NET NO AUTH LOW CX NO UI | The OpenAPI.NET SDK contains a useful object model for OpenAPI documents in .NET | |
|
75
|
CVE-2026-45736 |
7.5 | 0.0075 | NET NO AUTH LOW CX NO UI | ws is an open source WebSocket client and server for Node.js. Prior to 8.20.1, t | |
|
75
|
CVE-2025-60467 |
7.5 | 0.0074 | NET NO AUTH LOW CX NO UI | A use-after-free in the gf_filter_pid_inst_swap_delete_task function (/filter_co | |
|
75
|
CVE-2026-49835 |
7.5 | 0.0074 | NET NO AUTH LOW CX NO UI | Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Prior | |
|
75
|
CVE-2026-72602 |
7.5 | 0.0074 | NET NO AUTH LOW CX NO UI | A path traversal vulnerability in AsyncFuncAI deepwiki-open through commit 16f35 | |
|
70
|
CVE-2026-16860 |
9.9 | 0.0075 | NET LOW CX NO UI | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to exec | |
|
69
|
CVE-2026-115904 |
9.6 | 0.0074 | NET NO AUTH LOW CX | Topluyo is a social networking platform. A vulnerability exists in Topluyo Deskt | |
|
68
|
CVE-2026-11826 |
8.7 | 0.0075 | NET LOW CX NO UI | OpenPLC_v3 contains a heap-based buffer overflow in the getData() function in we | |
|
68
|
CVE-2026-17110 |
8.8 | 0.0075 | NET LOW CX NO UI | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to exec | |
|
68
|
CVE-2026-7755 |
8.8 | 0.0075 | NET LOW CX NO UI | IBM Langflow OSS 1.0.0 through 1.10.0 Langflow could allow remote code execution | |
|
68
|
CVE-2026-18669 |
8.8 | 0.0075 | NET LOW CX NO UI | IBM i 7.6, 7.5, 7.4, and 7.3 is vulnerable to a privilege escalation as the resu | |
|
68
|
CVE-2026-88145 |
8.8 | 0.0074 | NET NO AUTH LOW CX | Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized atta | |
|
68
|
CVE-2026-97747 |
8.8 | 0.0074 | NET NO AUTH LOW CX | Use after free in Microsoft Office Excel allows an unauthorized attacker to exec | |
|
68
|
CVE-2026-97752 |
8.8 | 0.0074 | NET NO AUTH LOW CX | Use after free in Microsoft Office Excel allows an unauthorized attacker to exec | |
|
68
|
CVE-2026-97754 |
8.8 | 0.0074 | NET NO AUTH LOW CX | Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized atta | |
|
68
|
CVE-2026-97770 |
8.8 | 0.0074 | NET NO AUTH LOW CX | Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized att | |
|
68
|
CVE-2026-97771 |
8.8 | 0.0074 | NET NO AUTH LOW CX | Use after free in Microsoft Office Excel allows an unauthorized attacker to exec | |
|
67
|
CVE-2026-15343 |
8.6 | 0.0075 | NET LOW CX NO UI | A path traversal vulnerability was identified in GitHub Enterprise Server that a | |
|
66
|
CVE-2026-56169 |
8.1 | 0.0075 | NET LOW CX NO UI | Improper authentication in Windows Admin Center allows an authorized attacker to | |
|
66
|
CVE-2026-105005 |
8.1 | 0.0075 | NET NO AUTH NO UI | Out-of-bounds write in Windows Schannel allows an unauthorized attacker to execu | |
|
66
|
CVE-2026-70038 |
8.1 | 0.0075 | NET NO AUTH NO UI | Use after free in Windows iSCSI allows an unauthorized attacker to execute code | |
|
66
|
CVE-2026-46402 |
8.1 | 0.0075 | NET LOW CX NO UI | Microsoft UFO open-source framework for intelligent automation across devices an | |
|
66
|
CVE-2026-57821 |
8.1 | 0.0074 | NET LOW CX NO UI | A SQL Injection vulnerability exists in Apache Fineract's Office Search API (GET | |
|
65
|
CVE-2026-7033 |
7.4 | 0.0075 | NET LOW CX NO UI | A vulnerability has been found in Tenda F456 1.0.0.5. Affected by this vulnerabi | |
|
63
|
CVE-2026-76404 |
9.1 | 0.0075 | NET LOW CX NO UI | In Splunk MCP Server app versions below 1.2.1, a user who holds the "admin" Splu | |
|
63
|
CVE-2026-42833 |
9.1 | 0.0075 | NET LOW CX NO UI | Improper control of generation of code ('code injection') in Microsoft Dynamics | |
|
63
|
CVE-2026-55240 |
9.1 | 0.0075 | NET LOW CX NO UI | Tianji is an open source analytics, uptime monitoring, and server status platfor | |
|
63
|
CVE-2026-13097 |
8.7 | 0.0075 | NET LOW CX NO UI | A privilege escalation flaw was found in FreeIPA. The uniqueness constraint enfo | |
|
57
|
CVE-2026-17497 |
8.3 | 0.0075 | NET NO AUTH | NoteGen before 0.32.0 grants the Tauri shell plugin shell:allow-execute capabili | |
|
56
|
CVE-2026-69363 |
8.0 | 0.0075 | NET LOW CX | Heap-based buffer overflow in Windows Error Reporting allows an authorized attac | |
|
55
|
CVE-2026-70207 |
7.5 | 0.0075 | NET NO UI | Heap-based buffer overflow in Network Policy Server (NPS) allows an authorized a | |
|
55
|
CVE-2026-70014 |
7.5 | 0.0075 | NET NO UI | Use after free in Windows Cryptographic Services allows an authorized attacker t |