Hunt List
12,861 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-15435 |
9.8 | 0.0073 | NET NO AUTH LOW CX NO UI | IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0. | |
|
80
|
CVE-2026-47627 |
9.8 | 0.0073 | NET NO AUTH LOW CX NO UI | NVIDIA Triton Inference Server for Linux contains a vulnerability where an attac | |
|
80
|
CVE-2026-26083 |
9.8 | 0.0073 | NET NO AUTH LOW CX NO UI | A missing authorization vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0 | |
|
80
|
CVE-2026-48204 |
9.8 | 0.0073 | NET NO AUTH LOW CX NO UI | Improper Input Validation, Improper Access Control vulnerability in Apache Camel | |
|
80
|
CVE-2026-40920 |
9.8 | 0.0073 | NET NO AUTH LOW CX NO UI | Privilege Escalation via URL Parameter is reported in Apache Ranger versions <= | |
|
80
|
CVE-2025-49901 |
9.8 | 0.0073 | NET NO AUTH LOW CX NO UI | Authentication Bypass Using an Alternate Path or Channel vulnerability in quantu | |
|
80
|
CVE-2026-57807 |
9.8 | 0.0073 | NET NO AUTH LOW CX NO UI | Authentication Bypass Using an Alternate Path or Channel vulnerability in miniOr | |
|
80
|
CVE-2026-64695 |
9.8 | 0.0073 | NET NO AUTH LOW CX NO UI | The issue was addressed with improved memory handling. This issue is fixed in iO | |
|
80
|
CVE-2026-42846 |
9.8 | 0.0073 | NET NO AUTH LOW CX NO UI | ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - | |
|
80
|
CVE-2026-52656 |
9.8 | 0.0073 | NET NO AUTH LOW CX NO UI | An issue in SJCAM AllWinner Tech products SJ4000-Air V1.4C and before and Whitel | |
|
80
|
CVE-2026-73211 |
9.8 | 0.0073 | NET NO AUTH LOW CX NO UI | PeerTube is an ActivityPub-federated video streaming platform. Prior to 8.1.6, A | |
|
80
|
CVE-2026-16770 |
9.8 | 0.0073 | NET NO AUTH LOW CX NO UI | PDF::WebKit versions through 1.2 for Perl allow argument injection into wkhtmlto | |
|
80
|
CVE-2026-73649 |
9.8 | 0.0073 | NET NO AUTH LOW CX NO UI | Velocity.js is a JavaScript implementation of the Apache Velocity template engin | |
|
80
|
CVE-2026-67960 |
9.8 | 0.0073 | NET NO AUTH LOW CX NO UI | An issue in PbootCMS v.3.2.15 allows an attacker to execute arbitrary code via t | |
|
79
|
CVE-2026-75885 |
9.3 | 0.0073 | NET NO AUTH LOW CX NO UI | A flaw was found in the OpenShift console. Unauthenticated access to the `/api/d | |
|
79
|
CVE-2026-40630 |
9.3 | 0.0073 | NET NO AUTH LOW CX NO UI | A vulnerability in SenseLive X3050’s web management interface allows unauthor | |
|
78
|
CVE-2026-28368 |
9.1 | 0.0073 | NET NO AUTH LOW CX NO UI | A flaw was found in Undertow. This vulnerability allows a remote attacker to con | |
|
78
|
CVE-2026-86413 |
9.1 | 0.0073 | NET NO AUTH LOW CX NO UI | When using an *ambient user* in a first transfer doing Negotiate authentication | |
|
78
|
CVE-2026-64834 |
8.7 | 0.0073 | NET NO AUTH LOW CX NO UI | FFmpeg versions 0.6.3 through 8.1.2 contain an infinite loop vulnerability in th | |
|
78
|
CVE-2026-53984 |
8.8 | 0.0073 | NET NO AUTH LOW CX NO UI | Ground Station prior to 0.6.0 contains an unauthenticated database-destruction a | |
|
77
|
CVE-2026-16616 |
8.6 | 0.0073 | NET NO AUTH LOW CX NO UI | The Simple File List WordPress plugin through 6.3.11 does not validate the sourc | |
|
77
|
CVE-2026-33602 |
8.2 | 0.0073 | NET NO AUTH LOW CX NO UI | A rogue backend can send a crafted UDP response with a query ID off by one relat | |
|
75
|
CVE-2026-5757 |
7.5 | 0.0073 | NET NO AUTH LOW CX NO UI | Unauthenticated remote information disclosure vulnerability in Ollama's model qu | |
|
75
|
CVE-2026-81755 |
7.5 | 0.0073 | NET NO AUTH LOW CX NO UI | Uncontrolled resource consumption in the streaming RPC component of Apache bRPC | |
|
75
|
CVE-2026-97801 |
7.5 | 0.0073 | NET NO AUTH LOW CX NO UI | Improper validation of specified type of input in .NET Framework allows an unaut | |
|
75
|
CVE-2026-54225 |
7.5 | 0.0073 | NET NO AUTH LOW CX NO UI | Apache CXF allows to control the maximum attachment size via the "attachment-max | |
|
75
|
CVE-2026-57819 |
7.5 | 0.0073 | NET NO AUTH LOW CX NO UI | Apache CXF allows to set a limit on the number of form parameters in a JAX-RS me | |
|
75
|
CVE-2026-56386 |
7.5 | 0.0073 | NET NO AUTH LOW CX NO UI | Integer underflow and out-of-bounds read in the HTTP/2 server DATA frame parser | |
|
75
|
CVE-2026-28846 |
7.5 | 0.0073 | NET NO AUTH LOW CX NO UI | A buffer overflow was addressed with improved bounds checking. This issue is fix | |
|
75
|
CVE-2026-45799 |
7.5 | 0.0073 | NET NO AUTH LOW CX NO UI | Wire provides gRPC and protocol buffers for Android, Kotlin, Swift, and Java. Pr | |
|
70
|
CVE-2026-115188 |
9.9 | 0.0073 | NET LOW CX NO UI | An unrestricted file upload vulnerability exists in the campaign import feature | |
|
68
|
CVE-2026-20200 |
8.8 | 0.0073 | NET LOW CX NO UI | A vulnerability in the web-based management interface of Cisco IMC could allow a | |
|
68
|
CVE-2026-82814 |
8.8 | 0.0073 | NET NO AUTH LOW CX | The Duplicator and Duplicator Pro plugins for WordPress are vulnerable to PHP Ob | |
|
68
|
CVE-2026-86404 |
8.8 | 0.0073 | NET LOW CX NO UI | EAP's Artemis deserialization configuration permits deserialization by default. | |
|
68
|
CVE-2026-16095 |
8.7 | 0.0073 | NET LOW CX NO UI | A flaw has been found in Shibby Tomato 1.28 RT-N5x MIPSR2 Build 124. Affected by | |
|
68
|
CVE-2023-32207 |
8.8 | 0.0073 | NET NO AUTH LOW CX | A missing delay in popup notifications could have made it possible for an attack | |
|
68
|
CVE-2026-112438 |
8.8 | 0.0073 | NET LOW CX NO UI | A logic issue was addressed with improved state management. This issue is fixed | |
|
68
|
CVE-2026-25077 |
8.8 | 0.0073 | NET LOW CX NO UI | Account users are allowed by default to register templates to be downloaded dire | |
|
68
|
CVE-2026-61434 |
8.7 | 0.0073 | NET LOW CX NO UI | PraisonAI versions before 4.6.78 contain an allowlist bypass vulnerability in sh | |
|
68
|
CVE-2026-109384 |
8.8 | 0.0073 | NET LOW CX NO UI | The The Innovative Form Builder – IvyForms plugin for WordPress is vulnerable to | |
|
67
|
CVE-2026-72970 |
8.3 | 0.0073 | NET NO AUTH LOW CX | Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthor | |
|
66
|
CVE-2026-49286 |
8.1 | 0.0073 | NET NO AUTH NO UI | PhpWeasyPrint is a PHP library allowing PDF generation from a URL or an HTML pag | |
|
66
|
CVE-2026-83844 |
8.1 | 0.0073 | NET NO AUTH NO UI | Out-of-bounds read in Windows Paint allows an unauthorized attacker to execute c | |
|
66
|
CVE-2026-13181 |
8.1 | 0.0073 | NET NO AUTH NO UI | In Progress® Telerik® UI for AJAX prior to v2026.2.708, forged upload metadata c | |
|
66
|
CVE-2026-13186 |
8.1 | 0.0073 | NET NO AUTH NO UI | In Progress® Telerik® UI for AJAX prior to v2026.2.708, a path traversal vulnera | |
|
66
|
CVE-2026-70175 |
8.1 | 0.0073 | NET NO AUTH NO UI | Improper authentication in ASP.NET Core allows an unauthorized attacker to eleva | |
|
66
|
CVE-2026-14265 |
7.7 | 0.0073 | NET LOW CX NO UI | Deserialization of untrusted data in the RemoteQueryCachePlugin in Amazon Web Se | |
|
65
|
CVE-2026-6014 |
7.4 | 0.0073 | NET LOW CX NO UI | A flaw has been found in D-Link DIR-513 1.10. This issue affects the function fo | |
|
65
|
CVE-2026-15545 |
7.4 | 0.0073 | NET LOW CX NO UI | A vulnerability was identified in Shibby Tomato up to 1.28.0000. Affected by thi | |
|
63
|
CVE-2026-90866 |
9.1 | 0.0073 | NET LOW CX NO UI | A path traversal vulnerability in Progress Software WS_FTP Server versions prior |