Hunt List
12,861 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-39337 |
10.0 | 0.0072 | NET NO AUTH LOW CX NO UI | ChurchCRM is an open-source church management system. Prior to 7.1.0, critical p | |
|
80
|
CVE-2026-42288 |
10.0 | 0.0072 | NET NO AUTH LOW CX NO UI | ChurchCRM is an open-source church management system. Prior to 7.3.2, The fix fo | |
|
80
|
CVE-2026-44180 |
9.8 | 0.0072 | NET NO AUTH LOW CX NO UI | Jupyter Enterprise Gateway launches remote Jupyter Notebook kernels across distr | |
|
80
|
CVE-2026-74987 |
9.8 | 0.0072 | NET NO AUTH LOW CX NO UI | Internally found bugs present in Firefox ESR 140.13, Firefox ESR 153.0 and Firef | |
|
80
|
CVE-2026-74990 |
9.8 | 0.0072 | NET NO AUTH LOW CX NO UI | Internally found bugs present in Firefox ESR 115.38, Firefox ESR 140.13, Firefox | |
|
80
|
CVE-2026-33591 |
10.0 | 0.0071 | NET NO AUTH LOW CX NO UI | A vulnerability in Wapt Server before version 2.6.1.17813 allows a remote unaut | |
|
80
|
CVE-2026-63922 |
9.8 | 0.0071 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: ipv6: exthd | |
|
80
|
CVE-2026-63924 |
9.8 | 0.0071 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: ipv6: exthd | |
|
80
|
CVE-2026-89492 |
9.8 | 0.0071 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: ocfs2: vali | |
|
80
|
CVE-2026-89972 |
9.8 | 0.0071 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: nvme: add m | |
|
80
|
CVE-2026-63912 |
9.8 | 0.0071 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: xfrm: esp: | |
|
80
|
CVE-2025-67066 |
9.8 | 0.0071 | NET NO AUTH LOW CX NO UI | SQL Injection vulnerability in oasys sysoa version 1.0 allows a remote attacker | |
|
80
|
CVE-2026-89686 |
9.8 | 0.0071 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: nfsd: fix B | |
|
80
|
CVE-2026-63886 |
9.8 | 0.0071 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: scsi: targe | |
|
79
|
CVE-2026-112780 |
9.3 | 0.0072 | NET NO AUTH LOW CX NO UI | Grav from 2.0.15 before 2.2.2 contains an allowlist bypass vulnerability that al | |
|
79
|
CVE-2026-54213 |
9.2 | 0.0071 | NET NO AUTH LOW CX NO UI | Tobit Laboratories AG TeamDavid's Webbox application exposes a functionality tha | |
|
79
|
CVE-2026-63087 |
9.3 | 0.0071 | NET NO AUTH LOW CX NO UI | Grafana OnCall through 1.16.11 contains an unauthenticated access vulnerability | |
|
79
|
CVE-2026-56786 |
9.3 | 0.0071 | NET NO AUTH LOW CX NO UI | RTKLIB through 2.4.3 contains an out-of-bounds write vulnerability in decode_typ | |
|
78
|
CVE-2026-29145 |
9.1 | 0.0072 | NET NO AUTH LOW CX NO UI | CLIENT_CERT authentication does not fail as expected for some scenarios when sof | |
|
78
|
CVE-2026-61466 |
9.1 | 0.0071 | NET NO AUTH LOW CX NO UI | In Apache CXF's OAuth2 Dynamic Client Registration endpoint, the authorization s | |
|
78
|
CVE-2026-1840 |
8.7 | 0.0071 | NET NO AUTH LOW CX NO UI | The Aclara Metrum Cellular Web Interface is vulnerable to unauthorized access du | |
|
78
|
CVE-2026-50176 |
8.7 | 0.0071 | NET NO AUTH LOW CX NO UI | The WebSocket Application Programming Interface lacks restrictions on the number | |
|
77
|
CVE-2026-11972 |
8.2 | 0.0072 | NET NO AUTH LOW CX NO UI | When using the "tarfile" module with a file opened in "streaming mode" (mode="r| | |
|
75
|
CVE-2026-61899 |
7.5 | 0.0071 | NET NO AUTH LOW CX NO UI | Vulnerability in tapestry-core in Apache Tapestry 5.5.0+ on all platforms allows | |
|
75
|
CVE-2026-45859 |
7.5 | 0.0071 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: netfilter: | |
|
70
|
CVE-2026-72911 |
9.9 | 0.0072 | NET LOW CX NO UI | ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15 | |
|
70
|
CVE-2026-66897 |
9.9 | 0.0072 | NET LOW CX NO UI | A path traversal vulnerability in LXD's instance template processing allows an a | |
|
70
|
CVE-2026-75732 |
9.9 | 0.0071 | NET LOW CX NO UI | Adobe Experience Manager is affected by an Incorrect Authorization vulnerability | |
|
70
|
CVE-2026-33109 |
9.9 | 0.0071 | NET LOW CX NO UI | Improper access control in Azure Managed Instance for Apache Cassandra allows an | |
|
69
|
CVE-2026-41106 |
9.3 | 0.0072 | NET NO AUTH LOW CX | Url redirection to untrusted site ('open redirect') in M365 Copilot allows an un | |
|
69
|
CVE-2026-59118 |
9.3 | 0.0072 | NET NO AUTH LOW CX | Improper authorization in Copilot Cowork allows an unauthorized attacker to elev | |
|
68
|
CVE-2023-25735 |
8.8 | 0.0072 | NET NO AUTH LOW CX | Cross-compartment wrappers wrapping a scripted proxy could have caused objects f | |
|
68
|
CVE-2026-20034 |
8.8 | 0.0071 | NET LOW CX NO UI | A vulnerability in the web-based management interface of Cisco Unity Connection | |
|
68
|
CVE-2026-88198 |
8.8 | 0.0071 | NET LOW CX NO UI | Missing authorization in Microsoft Office SharePoint allows an authorized attack | |
|
68
|
CVE-2026-56768 |
8.7 | 0.0071 | NET LOW CX NO UI | Seahub before 13.0.23 does not enforce SHARE_LINK_LOGIN_REQUIRED on GET /api/v2. | |
|
68
|
CVE-2026-112770 |
8.7 | 0.0071 | NET LOW CX NO UI | Craft CMS 4.x before 4.18.8 and 5.x before 5.11.0 contains a remote code executi | |
|
68
|
CVE-2026-54653 |
8.8 | 0.0071 | NET NO AUTH LOW CX | datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, a | |
|
68
|
CVE-2026-63162 |
8.7 | 0.0071 | NET LOW CX NO UI | Omnispace Agora Project before 26.10.0 contains a path traversal vulnerability t | |
|
66
|
CVE-2026-62229 |
7.7 | 0.0072 | NET LOW CX NO UI | OpenClaw before 2026.5.18 contain an authorization bypass vulnerability in exec | |
|
66
|
CVE-2026-17347 |
7.7 | 0.0072 | NET LOW CX NO UI | The MASTER_PASSWORD_HOOK setting, introduced in pgAdmin 4 7.2, lets an administr | |
|
66
|
CVE-2026-45062 |
8.1 | 0.0071 | NET NO AUTH NO UI | FrankenPHP is a modern application server for PHP. From version 1.11.2 to before | |
|
66
|
CVE-2026-83674 |
8.1 | 0.0071 | NET NO AUTH NO UI | Weak authentication in Active Directory Federation Services (AD FS) allows an un | |
|
66
|
CVE-2026-39861 |
7.7 | 0.0071 | NET NO AUTH LOW CX | Claude Code is an agentic coding tool. Prior to version 2.1.64, Claude Code's sa | |
|
65
|
CVE-2026-5981 |
7.4 | 0.0072 | NET LOW CX NO UI | A vulnerability has been found in D-Link DIR-605L 2.13B01. This affects the func | |
|
65
|
CVE-2026-7289 |
7.4 | 0.0072 | NET LOW CX NO UI | A vulnerability was found in D-Link DIR-825M 1.1.12. This issue affects the func | |
|
65
|
CVE-2023-29104 |
7.6 | 0.0071 | NET LOW CX NO UI | A vulnerability has been identified in SIMATIC Cloud Connect 7 CC712 (All versio | |
|
64
|
CVE-2026-74040 |
9.4 | 0.0072 | NET LOW CX NO UI | Wazuh versions from 3.9.0 before 4.14.8 contain an arbitrary file overwrite vuln | |
|
60
|
CVE-2026-7247 |
7.3 | 0.0072 | NET LOW CX NO UI | A vulnerability has been found in D-Link DI-8100 16.07.26A1. Affected by this is | |
|
54
|
CVE-2026-64824 |
9.3 | 0.0071 | NET LOW CX | Home Assistant Core before 2026.7.0 contains a path traversal vulnerability in t | |
|
52
|
CVE-2022-43760 |
8.4 | 0.0071 | NET LOW CX | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scri |