Hunt List
12,861 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-16656 |
9.8 | 0.0072 | NET NO AUTH LOW CX NO UI | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to g | |
|
80
|
CVE-2026-43682 |
9.8 | 0.0072 | NET NO AUTH LOW CX NO UI | The issue was addressed with improved memory handling. This issue is fixed in ma | |
|
80
|
CVE-2026-64696 |
9.8 | 0.0072 | NET NO AUTH LOW CX NO UI | The issue was addressed with improved memory handling. This issue is fixed in ma | |
|
80
|
CVE-2026-72494 |
9.8 | 0.0072 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: | |
|
80
|
CVE-2026-74269 |
9.8 | 0.0072 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: bnxt: fix h | |
|
80
|
CVE-2026-80634 |
9.8 | 0.0072 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: netfilter: | |
|
80
|
CVE-2026-89654 |
9.8 | 0.0072 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: ceph: fix U | |
|
80
|
CVE-2026-90048 |
9.8 | 0.0072 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: f | |
|
80
|
CVE-2026-9072 |
9.8 | 0.0072 | NET NO AUTH LOW CX NO UI | IBM WebSphere Application Server and IBM WebSphere Application Server Liberty - | |
|
80
|
CVE-2026-77900 |
9.8 | 0.0072 | NET NO AUTH LOW CX NO UI | Missing authentication for critical function in Azure App Service allows an unau | |
|
80
|
CVE-2026-12481 |
9.8 | 0.0072 | NET NO AUTH LOW CX NO UI | A vulnerability in keras-team/keras version 3.14.0 allows for arbitrary code exe | |
|
79
|
CVE-2026-50161 |
9.3 | 0.0072 | NET NO AUTH LOW CX NO UI | libre is a generic library for real-time communications with asynchronous input | |
|
79
|
CVE-2025-40795 |
9.3 | 0.0072 | NET NO AUTH LOW CX NO UI | A vulnerability has been identified in SIMATIC PCS neo V4.1 (All versions), SIMA | |
|
79
|
CVE-2026-18667 |
9.3 | 0.0072 | NET NO AUTH LOW CX NO UI | A vulnerability in Tenable Sensor Proxy allows a remote attacker to execute code | |
|
78
|
CVE-2026-69219 |
8.7 | 0.0073 | NET NO AUTH LOW CX NO UI | The RabbitMQ Java client library allows Java and JVM-based applications to conne | |
|
78
|
CVE-2026-69220 |
8.7 | 0.0073 | NET NO AUTH LOW CX NO UI | The RabbitMQ Java client library allows Java and JVM-based applications to conne | |
|
78
|
CVE-2026-28367 |
9.1 | 0.0072 | NET NO AUTH LOW CX NO UI | A flaw was found in Undertow. A remote attacker can exploit this vulnerability b | |
|
75
|
CVE-2024-25183 |
7.5 | 0.0073 | NET NO AUTH LOW CX NO UI | givanz VvvebJs 1.7.2 is vulnerable to Directory Traversal via scan.php. | |
|
75
|
CVE-2026-57875 |
7.5 | 0.0073 | NET NO AUTH LOW CX NO UI | An unauthenticated NULL pointer dereference vulnerability exists in the HTTP req | |
|
75
|
CVE-2026-49329 |
7.5 | 0.0072 | NET NO AUTH LOW CX NO UI | A flaw was found in openshift/oauth-server. The OAuth login and error page endpo | |
|
75
|
CVE-2022-43767 |
7.5 | 0.0072 | NET NO AUTH LOW CX NO UI | A vulnerability has been identified in SIMATIC CP 1242-7 V2 (6GK7242-7KX31-0XE0) | |
|
75
|
CVE-2026-48929 |
7.5 | 0.0072 | NET NO AUTH LOW CX NO UI | Rocket.Chat in versions <8.5.1, <8.4.4, <8.3.6, <8.2.6, <8.1.6, <8.0.7, <7.13.9, | |
|
75
|
CVE-2026-24264 |
7.5 | 0.0072 | NET NO AUTH LOW CX NO UI | NVIDIA Triton Inference Server for Linux contains a vulnerability where an attac | |
|
75
|
CVE-2026-20348 |
7.5 | 0.0072 | NET NO AUTH LOW CX NO UI | A vulnerability in the XAR file format parser of ClamAV could allow an unauthent | |
|
75
|
CVE-2023-29106 |
7.5 | 0.0072 | NET NO AUTH LOW CX NO UI | A vulnerability has been identified in SIMATIC Cloud Connect 7 CC712 (All versio | |
|
70
|
CVE-2026-85885 |
9.9 | 0.0072 | NET LOW CX NO UI | Improper neutralization of special elements used in a command ('command injectio | |
|
69
|
CVE-2026-33976 |
9.6 | 0.0072 | NET NO AUTH LOW CX | Notesnook is a note-taking app. Prior to version 3.3.11 on Web/Desktop and 3.3.1 | |
|
69
|
CVE-2026-58370 |
9.2 | 0.0072 | NET NO AUTH NO UI | Woodpecker before 3.15.0 matches the ApprovalAllowedUsers bypass list against pi | |
|
68
|
CVE-2026-116738 |
8.7 | 0.0073 | NET NO AUTH LOW CX | VMime through 0.9.2 contains an integer underflow in the uuEncoder::decode funct | |
|
68
|
CVE-2023-29181 |
8.8 | 0.0072 | NET LOW CX NO UI | A use of externally-controlled format string vulnerability in Fortinet FortiOS 7 | |
|
68
|
CVE-2026-64966 |
8.7 | 0.0072 | NET LOW CX NO UI | ATutor is vulnerable to a Path Traversal vulnerability in ZIP extraction functio | |
|
68
|
CVE-2026-85817 |
8.8 | 0.0072 | NET NO AUTH LOW CX | Reliance on untrusted inputs in a security decision in Windows PowerShell allows | |
|
68
|
CVE-2026-47897 |
8.9 | 0.0072 | NET NO AUTH NO UI | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') v | |
|
68
|
CVE-2026-102235 |
8.8 | 0.0072 | NET NO AUTH LOW CX | Improper encoding or escaping of output in Visual Studio Code allows an unauthor | |
|
68
|
CVE-2023-28176 |
8.8 | 0.0072 | NET NO AUTH LOW CX | Memory safety bugs present in Firefox 110 and Firefox ESR 102.8. Some of these b | |
|
68
|
CVE-2026-44827 |
8.8 | 0.0072 | NET NO AUTH LOW CX | Diffusers is the a library for pretrained diffusion models. Prior to 0.38.0, di | |
|
68
|
CVE-2026-88116 |
8.8 | 0.0072 | NET NO AUTH LOW CX | Untrusted pointer dereference in DNS Server allows an unauthorized attacker to e | |
|
68
|
CVE-2026-41938 |
8.7 | 0.0072 | NET LOW CX NO UI | Vvveb before version 1.0.8.2 contains an unrestricted file upload vulnerability | |
|
66
|
CVE-2026-39253 |
8.1 | 0.0072 | NET NO AUTH NO UI | An issue in Pivotal CRM v.6.6.04.08 allows a remote attacker to execute arbitrar | |
|
66
|
CVE-2026-50758 |
8.1 | 0.0072 | NET NO AUTH LOW CX | Cross Site Scripting vulnerability in DayuanJiang next-ai-draw-io 0.4.13 allows | |
|
66
|
CVE-2026-92389 |
8.1 | 0.0072 | NET NO AUTH NO UI | libcurl's TFTP state machine fails to validate state transitions against the req | |
|
66
|
CVE-2026-18127 |
7.7 | 0.0072 | NET LOW CX NO UI | External control of a filename in the Core of Ivanti Endpoint Manager before ver | |
|
65
|
CVE-2026-57985 |
7.6 | 0.0072 | NET NO AUTH LOW CX | Improper input validation in Microsoft Edge (Chromium-based) allows an unauthori | |
|
64
|
CVE-2026-2334 |
9.4 | 0.0072 | NET LOW CX NO UI | An issue was discovered in vsDesk v14.0101. An authenticated attacker with admin | |
|
64
|
CVE-2014-125137 |
7.1 | 0.0072 | NET LOW CX NO UI | C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engin | |
|
62
|
CVE-2026-13383 |
8.6 | 0.0072 | NET LOW CX NO UI | An Out-of-bounds Write vulnerability in WatchGuard Fireware OS ikestubd process | |
|
62
|
CVE-2026-13384 |
8.6 | 0.0072 | NET LOW CX NO UI | An Out-of-bounds Write vulnerability in WatchGuard Fireware OS wgagent process c | |
|
57
|
CVE-2026-16796 |
8.4 | 0.0073 | NET LOW CX | Improper neutralization of argument delimiters in the install_packages() method | |
|
56
|
CVE-2026-42099 |
7.7 | 0.0072 | NET NO UI | Sparx Pro Cloud Server is vulnerable to a Race Condition in the /data_api/dl_int | |
|
51
|
CVE-2026-76139 |
8.0 | 0.0072 | NET NO UI | A flaw was found in acm-operator-bundle. The build process for this component do |