Hunt List
12,862 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-118235 |
9.8 | 0.0074 | NET NO AUTH LOW CX NO UI | The SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifica | |
|
80
|
CVE-2026-6264 |
9.8 | 0.0074 | NET NO AUTH LOW CX NO UI | A critical vulnerability in the Talend JobServer and Talend Runtime allows unaut | |
|
80
|
CVE-2026-72098 |
9.8 | 0.0074 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: dm-verity: | |
|
80
|
CVE-2026-17145 |
9.8 | 0.0073 | NET NO AUTH LOW CX NO UI | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to e | |
|
79
|
CVE-2026-67531 |
9.3 | 0.0073 | NET NO AUTH LOW CX NO UI | FrontMCP is a TypeScript-first framework for the Model Context Protocol (MCP). P | |
|
78
|
CVE-2026-66046 |
8.7 | 0.0074 | NET NO AUTH LOW CX NO UI | Expat through 2.8.3 contains a denial of service vulnerability caused by quadrat | |
|
78
|
CVE-2026-72818 |
8.7 | 0.0074 | NET NO AUTH LOW CX NO UI | The URLS regular expression in nltk/tokenize/casual.py, compiled into TweetToken | |
|
78
|
CVE-2026-29009 |
8.8 | 0.0074 | NET NO AUTH LOW CX NO UI | U-Boot before 2026.07-rc2 contains a buffer overflow vulnerability in nfs_readli | |
|
78
|
CVE-2026-68981 |
8.8 | 0.0074 | NET NO AUTH LOW CX NO UI | Apache NiFi 1.5.0 through 2.10.0 support gzip-encoded HTTP requests for the appl | |
|
78
|
CVE-2026-47606 |
9.1 | 0.0074 | NET NO AUTH LOW CX NO UI | NVIDIA Triton Inference Server for Linux contains a vulnerability where an attac | |
|
78
|
CVE-2026-9190 |
9.1 | 0.0074 | NET NO AUTH LOW CX NO UI | An HTTP request smuggling vulnerability in the HTTP App Server of Progress MarkL | |
|
78
|
CVE-2026-72569 |
9.1 | 0.0074 | NET NO AUTH LOW CX NO UI | A path traversal vulnerability in cube-root/directory-serve through 1.3.7 allows | |
|
78
|
CVE-2021-48013 |
8.7 | 0.0074 | NET NO AUTH LOW CX NO UI | Weaver E-cology 8.0 contains a path traversal vulnerability that allows unauthen | |
|
78
|
CVE-2019-25765 |
8.7 | 0.0074 | NET NO AUTH LOW CX NO UI | ASP-CMS contains a SQL injection vulnerability in the commentList.asp endpoint t | |
|
76
|
CVE-2026-42845 |
7.7 | 0.0074 | NET NO AUTH LOW CX NO UI | The form plugin for Grav adds the ability to create and use forms. Prior to 9.1. | |
|
75
|
CVE-2026-58210 |
7.5 | 0.0074 | NET NO AUTH LOW CX NO UI | NATS Server is a high-performance server for NATS.io, the cloud and edge native | |
|
75
|
CVE-2026-58250 |
7.5 | 0.0074 | NET NO AUTH LOW CX NO UI | NATS Server is a high-performance server for NATS.io, the cloud and edge native | |
|
75
|
CVE-2026-24012 |
7.5 | 0.0074 | NET NO AUTH LOW CX NO UI | Uncontrolled Resource Consumption vulnerability in Apache IoTDB. Some interfac | |
|
75
|
CVE-2026-59870 |
7.5 | 0.0074 | NET NO AUTH LOW CX NO UI | js-yaml is a JavaScript YAML parser and dumper. Prior to 3.15.1, 4.3.1, and 5.2. | |
|
75
|
CVE-2026-59173 |
7.5 | 0.0074 | NET NO AUTH LOW CX NO UI | Uncontrolled Resource Consumption vulnerability in Apache Traffic Server. This | |
|
75
|
CVE-2026-66142 |
7.5 | 0.0074 | NET NO AUTH LOW CX NO UI | Apache Neethi is vulnerable to uncontrolled recursion when parsing policies that | |
|
75
|
CVE-2026-66144 |
7.5 | 0.0074 | NET NO AUTH LOW CX NO UI | Although remote policy references are not retrieved during policy normalization, | |
|
75
|
CVE-2026-67592 |
7.5 | 0.0074 | NET NO AUTH LOW CX NO UI | It was not possible to govern the maximum number of transfer frames per incoming | |
|
75
|
CVE-2026-89680 |
7.5 | 0.0074 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: nfsd: fix n | |
|
75
|
CVE-2026-31987 |
7.5 | 0.0074 | NET NO AUTH LOW CX NO UI | JWT Tokens used by tasks were exposed in logs. This could allow UI users to act | |
|
75
|
CVE-2026-5057 |
7.5 | 0.0074 | NET NO AUTH LOW CX NO UI | ATEN Unizon RpcProvider Missing Authentication Denial-of-Service Vulnerability. | |
|
75
|
CVE-2026-110353 |
7.5 | 0.0074 | NET NO AUTH LOW CX NO UI | HAProxy 3.2 before 3.4.6 allows a remote unauthenticated attacker to cause a den | |
|
75
|
CVE-2026-71469 |
7.5 | 0.0074 | NET NO AUTH LOW CX NO UI | A flaw was found in search-v2-api. An unauthenticated attacker can exploit this | |
|
75
|
CVE-2025-61581 |
7.5 | 0.0074 | NET NO AUTH LOW CX NO UI | ** UNSUPPORTED WHEN ASSIGNED ** Inefficient Regular Expression Complexity vulner | |
|
68
|
CVE-2026-47867 |
8.8 | 0.0074 | NET LOW CX NO UI | VMware Avi Load Balancer contains a remote code execution vulnerability. A malic | |
|
68
|
CVE-2026-47869 |
8.8 | 0.0074 | NET LOW CX NO UI | VMware Avi Load Balancer contains a remote code execution vulnerability. A malic | |
|
68
|
CVE-2026-88196 |
8.8 | 0.0074 | NET NO AUTH LOW CX | Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker t | |
|
68
|
CVE-2026-97012 |
8.8 | 0.0074 | NET NO AUTH LOW CX | Stack-based buffer overflow in Microsoft Office Outlook allows an unauthorized a | |
|
68
|
CVE-2023-25732 |
8.8 | 0.0074 | NET NO AUTH LOW CX | When encoding data from an <code>inputStream</code> in <code>xpcom</code> the si | |
|
68
|
CVE-2023-29539 |
8.8 | 0.0074 | NET NO AUTH LOW CX | When handling the filename directive in the Content-Disposition header, the file | |
|
66
|
CVE-2026-58065 |
8.1 | 0.0074 | NET NO AUTH NO UI | The Apache Airflow Git provider runs its git-over-SSH operations with `StrictHos | |
|
65
|
CVE-2026-6013 |
7.4 | 0.0074 | NET LOW CX NO UI | A vulnerability was detected in D-Link DIR-513 1.10. This vulnerability affects | |
|
65
|
CVE-2026-7831 |
7.6 | 0.0074 | NET NO AUTH LOW CX | UltraVNC viewer through 1.8.2.2 contains an off-by-one stack buffer overflow in | |
|
65
|
CVE-2026-63720 |
7.5 | 0.0074 | NET NO AUTH LOW CX | datamodel-code-generator prior to version 0.70.0 contains a code injection vulne | |
|
63
|
CVE-2026-106626 |
9.1 | 0.0074 | NET LOW CX NO UI | Adobe Experience Manager is affected by an Improper Input Validation vulnerabili | |
|
63
|
CVE-2026-28763 |
9.1 | 0.0074 | NET LOW CX NO UI | A stack-based buffer overflow vulnerability exists in the boa formMapDelDevice h | |
|
63
|
CVE-2026-40615 |
9.1 | 0.0074 | NET LOW CX NO UI | A stack-based buffer overflow vulnerability exists in the boa formParentControl | |
|
63
|
CVE-2026-41222 |
9.1 | 0.0074 | NET LOW CX NO UI | A stack-based buffer overflow vulnerability exists in the boa formParentControl | |
|
63
|
CVE-2026-41223 |
9.1 | 0.0074 | NET LOW CX NO UI | A stack-based buffer overflow vulnerability exists in the boa formMapDelDevice m | |
|
63
|
CVE-2026-42019 |
9.1 | 0.0074 | NET LOW CX NO UI | Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Se | |
|
63
|
CVE-2026-42020 |
9.1 | 0.0074 | NET LOW CX NO UI | Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Se | |
|
57
|
CVE-2026-69419 |
8.5 | 0.0074 | NET NO UI | Integer overflow or wraparound in Azure Data Manager for Energy allows an author | |
|
57
|
CVE-2026-50340 |
8.5 | 0.0074 | NET NO UI | Use after free in Windows Runtime allows an authorized attacker to elevate privi | |
|
55
|
CVE-2026-50500 |
7.5 | 0.0074 | NET NO UI | Use after free in Windows Netlogon allows an authorized attacker to elevate priv | |
|
55
|
CVE-2026-50505 |
7.5 | 0.0074 | NET NO UI | Use after free in Windows Message Queuing allows an authorized attacker to execu |