Hunt List
11,991 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
90
|
CVE-2026-50522 |
9.8 | 0.0304 | NET NO AUTH LOW CX NO UI | KEV 5 PoC | Microsoft SharePoint contains a deserialization of untrusted data vulnerability |
|
81
|
CVE-2026-59726 |
10.0 | 0.0302 | NET NO AUTH LOW CX NO UI | Ruflo is an agent meta-harness for Claude Code and Codex. Prior to 3.16.3, ruflo | |
|
81
|
CVE-2026-53753 |
10.0 | 0.0290 | NET NO AUTH LOW CX NO UI | Crawl4AI is an open-source LLM friendly web crawler & scraper. Prior to 0.8.7, t | |
|
81
|
CVE-2026-46339 |
10.0 | 0.0276 | NET NO AUTH LOW CX NO UI | 9Router is an AI router & token saver. From 0.4.30 until 0.4.37, 9Router's src/p | |
|
80
|
CVE-2026-41492 |
9.8 | 0.0308 | NET NO AUTH LOW CX NO UI | Dgraph is an open source distributed GraphQL database. Prior to 25.3.3, Dgraphl | |
|
80
|
CVE-2026-49468 |
9.5 | 0.0303 | NET NO AUTH LOW CX NO UI | LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) fo | |
|
80
|
CVE-2026-52102 |
9.8 | 0.0294 | NET NO AUTH LOW CX NO UI | An OS command injection vulnerability in the openmediavault-md plugin of OpenMed | |
|
80
|
CVE-2026-8153 |
9.8 | 0.0285 | NET NO AUTH LOW CX NO UI | OS command injection in Dashboard Server interface in Universal Robots PolyScope | |
|
80
|
CVE-2026-20896 |
9.8 | 0.0276 | NET NO AUTH LOW CX NO UI | Gitea Docker image versions up to and including 1.26.2 use REVERSE_PROXY_TRUSTED | |
|
80
|
CVE-2026-38709 |
9.8 | 0.0275 | NET NO AUTH LOW CX NO UI | TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, W | |
|
80
|
CVE-2026-38711 |
9.8 | 0.0275 | NET NO AUTH LOW CX NO UI | TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, W | |
|
80
|
CVE-2026-38708 |
9.8 | 0.0275 | NET NO AUTH LOW CX NO UI | TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, W | |
|
80
|
CVE-2026-38713 |
9.8 | 0.0275 | NET NO AUTH LOW CX NO UI | TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, W | |
|
80
|
CVE-2019-15598 |
9.8 | 0.0274 | NET NO AUTH LOW CX NO UI | A Code Injection exists in treekill on Windows which allows a remote code execut | |
|
79
|
CVE-2026-71944 |
9.3 | 0.0317 | NET NO AUTH LOW CX NO UI | D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1 | |
|
79
|
CVE-2026-71945 |
9.3 | 0.0317 | NET NO AUTH LOW CX NO UI | D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1 | |
|
79
|
CVE-2026-71946 |
9.3 | 0.0317 | NET NO AUTH LOW CX NO UI | D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1 | |
|
79
|
CVE-2026-71947 |
9.3 | 0.0317 | NET NO AUTH LOW CX NO UI | D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1 | |
|
79
|
CVE-2026-71948 |
9.3 | 0.0317 | NET NO AUTH LOW CX NO UI | D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1 | |
|
79
|
CVE-2026-71949 |
9.3 | 0.0317 | NET NO AUTH LOW CX NO UI | D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1 | |
|
79
|
CVE-2026-71950 |
9.3 | 0.0317 | NET NO AUTH LOW CX NO UI | D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1 | |
|
79
|
CVE-2026-71951 |
9.3 | 0.0317 | NET NO AUTH LOW CX NO UI | D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1 | |
|
79
|
CVE-2026-71952 |
9.3 | 0.0317 | NET NO AUTH LOW CX NO UI | D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1 | |
|
79
|
CVE-2026-71953 |
9.3 | 0.0317 | NET NO AUTH LOW CX NO UI | D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1 | |
|
79
|
CVE-2026-71954 |
9.3 | 0.0317 | NET NO AUTH LOW CX NO UI | D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1 | |
|
79
|
CVE-2026-71955 |
9.3 | 0.0317 | NET NO AUTH LOW CX NO UI | D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2_C1_2 | |
|
79
|
CVE-2026-71956 |
9.3 | 0.0317 | NET NO AUTH LOW CX NO UI | D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2_C1_2 | |
|
79
|
CVE-2026-89010 |
9.3 | 0.0317 | NET NO AUTH LOW CX NO UI | WAVLINK WN535M1 and WN535M3 routers running firmware prior to M35M1_V250922 cont | |
|
79
|
CVE-2026-41923 |
9.3 | 0.0309 | NET NO AUTH LOW CX NO UI | WDR201A WiFi Extender (HW V2.1, FW LFMZX28040922V1.02) contains an OS command in | |
|
79
|
CVE-2026-48313 |
9.3 | 0.0295 | NET NO AUTH LOW CX NO UI | ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Limi | |
|
79
|
CVE-2026-58457 |
9.3 | 0.0294 | NET NO AUTH LOW CX NO UI | Shenzhen Aitemi M300 Wi-Fi Repeater (hardware model MT02) contains an unauthenti | |
|
78
|
CVE-2026-34413 |
8.8 | 0.0311 | NET NO AUTH LOW CX NO UI | Xerte Online Toolkits versions 3.15 and earlier contain a missing authentication | |
|
78
|
CVE-2026-6025 |
8.9 | 0.0300 | NET NO AUTH LOW CX NO UI | A vulnerability was identified in Totolink A7100RU 7.4cu.2313_b20191024. This af | |
|
78
|
CVE-2026-6026 |
8.9 | 0.0298 | NET NO AUTH LOW CX NO UI | A security flaw has been discovered in Totolink A7100RU 7.4cu.2313_b20191024. Th | |
|
78
|
CVE-2026-6028 |
8.9 | 0.0298 | NET NO AUTH LOW CX NO UI | A security vulnerability has been detected in Totolink A7100RU 7.4cu.2313_b20191 | |
|
78
|
CVE-2026-6029 |
8.9 | 0.0298 | NET NO AUTH LOW CX NO UI | A vulnerability was detected in Totolink A7100RU 7.4cu.2313_b20191024. The affec | |
|
78
|
CVE-2026-96940 |
8.8 | 0.0275 | NET LOW CX NO UI | 1 PoC | Weak authentication in Microsoft Exchange Server allows an authorized attacker t |
|
76
|
CVE-2023-29180 |
7.5 | 0.0280 | NET NO AUTH LOW CX NO UI | A null pointer dereference vulnerability in Fortinet FortiOS 7.2.0 through 7.2.4 | |
|
75
|
CVE-2026-55957 |
7.3 | 0.0285 | NET NO AUTH LOW CX NO UI | Missing Critical Step in Authentication vulnerability in Apache Tomcat when the | |
|
68
|
CVE-2026-57219 |
8.7 | 0.0284 | NET NO AUTH LOW CX | RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20, 4.1.11, | |
|
68
|
CVE-2026-34599 |
8.8 | 0.0280 | NET LOW CX NO UI | Coolify is an open-source and self-hostable tool for managing servers, applicati | |
|
66
|
CVE-2026-41277 |
7.6 | 0.0311 | NET LOW CX NO UI | Flowise is a drag & drop user interface to build a customized large language mod | |
|
65
|
CVE-2026-15481 |
7.4 | 0.0289 | NET LOW CX NO UI | A security flaw has been discovered in Trendnet TEW-635BRM up to 1.00.03. This v | |
|
65
|
CVE-2026-34414 |
7.1 | 0.0283 | NET LOW CX NO UI | Xerte Online Toolkits versions 3.15 and earlier contain a relative path traversa | |
|
65
|
CVE-2026-6012 |
7.4 | 0.0282 | NET LOW CX NO UI | A security vulnerability has been detected in D-Link DIR-513 1.10. This affects | |
|
65
|
CVE-2026-19346 |
7.4 | 0.0273 | NET LOW CX NO UI | A vulnerability was determined in Tenda CH22 1.0.0.1. This vulnerability affects | |
|
63
|
CVE-2026-116505 |
8.5 | 0.0274 | NET LOW CX NO UI | A vulnerability was found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. This impact | |
|
60
|
CVE-2026-7833 |
7.3 | 0.0316 | NET LOW CX NO UI | A weakness has been identified in EFM ipTIME C200 up to 1.092. This vulnerabilit | |
|
60
|
CVE-2026-86379 |
7.2 | 0.0284 | NET LOW CX NO UI | Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1. | |
|
45
|
CVE-2026-20204 |
7.1 | 0.0310 | NET | In Splunk Enterprise versions below 10.2.1, 10.0.5, 9.4.10, and 9.3.11, and Splu |