Hunt List
12,862 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2023-2186 |
9.8 | 0.0071 | NET NO AUTH LOW CX NO UI | On Triangle MicroWorks' SCADA Data Gateway version <= v5.01.03, an unauthenticat | |
|
80
|
CVE-2026-50628 |
9.8 | 0.0071 | NET NO AUTH LOW CX NO UI | A logic error in OAuthRequestFilter rejects legitimate requests originating from | |
|
80
|
CVE-2026-71207 |
9.8 | 0.0071 | NET NO AUTH LOW CX NO UI | The Stock-Inventory-Management-System application's login.php assigns raw userna | |
|
80
|
CVE-2026-48055 |
10.0 | 0.0070 | NET NO AUTH LOW CX NO UI | Streambert is a cross-platform Electron Desktop App to stream and download any v | |
|
80
|
CVE-2026-79848 |
10.0 | 0.0070 | NET NO AUTH LOW CX NO UI | Vulnerabilities in the affected interface of AOS-8 could allow an unauthenticate | |
|
80
|
CVE-2026-79849 |
10.0 | 0.0070 | NET NO AUTH LOW CX NO UI | Vulnerabilities in the affected interface of AOS-8 could allow an unauthenticate | |
|
80
|
CVE-2026-8457 |
9.8 | 0.0070 | NET NO AUTH LOW CX NO UI | The WooCommerce - Social Login plugin for WordPress is vulnerable to Authenticat | |
|
80
|
CVE-2026-111183 |
9.8 | 0.0070 | NET NO AUTH LOW CX NO UI | GStreamer rtpL16depay Heap-based Buffer Overflow Remote Code Execution Vulnerabi | |
|
80
|
CVE-2026-116692 |
9.8 | 0.0070 | NET NO AUTH LOW CX NO UI | MLflow is an open source AI engineering platform for agents, large language mode | |
|
80
|
CVE-2026-105944 |
10.0 | 0.0070 | NET NO AUTH LOW CX NO UI | Apache Pulsar Manager is a web console for administering Apache Pulsar clusters. | |
|
80
|
CVE-2026-46652 |
9.8 | 0.0070 | NET NO AUTH LOW CX NO UI | The Goobi viewer is a web application that allows digitised material to be displ | |
|
80
|
CVE-2026-12116 |
9.8 | 0.0070 | NET NO AUTH LOW CX NO UI | A vulnerability in the Xerte Online Tools allows for RCE through the antivirus b | |
|
80
|
CVE-2026-66902 |
9.8 | 0.0070 | NET NO AUTH LOW CX NO UI | Google::Auth versions before 0.06 for Perl run a command named in an external_ac | |
|
79
|
CVE-2026-13014 |
9.2 | 0.0070 | NET NO AUTH LOW CX NO UI | A vulnerability in Thales CERT "Suspicious" application =< 1.3.4 allows a remote | |
|
79
|
CVE-2026-26210 |
9.3 | 0.0070 | NET NO AUTH LOW CX NO UI | KTransformers through 0.5.3 contains an unsafe deserialization vulnerability in | |
|
79
|
CVE-2026-109444 |
9.3 | 0.0070 | NET NO AUTH LOW CX NO UI | OpenSRE through 0.1.2026.10.19 contains an approval gate bypass vulnerability th | |
|
79
|
CVE-2026-114403 |
9.2 | 0.0070 | NET NO AUTH LOW CX NO UI | PHPOffice PHPPresentation through 1.2.0 contains an insecure deserialization vul | |
|
79
|
CVE-2026-75143 |
9.3 | 0.0070 | NET NO AUTH LOW CX NO UI | FFmpeg before commit 1c10bcc contains a heap buffer overflow in the RIST protoco | |
|
78
|
CVE-2019-25654 |
8.7 | 0.0070 | NET NO AUTH LOW CX NO UI | Core FTP/SFTP Server 1.2 contains a buffer overflow vulnerability that allows at | |
|
78
|
CVE-2026-51346 |
9.1 | 0.0070 | NET NO AUTH LOW CX NO UI | SQL Injection vulnerability in StudIP 6.0.x before 6.0.3 and 5.4.x before 5.4.12 | |
|
78
|
CVE-2026-89537 |
9.1 | 0.0070 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Rej | |
|
75
|
CVE-2026-42895 |
7.5 | 0.0071 | NET NO AUTH LOW CX NO UI | Improper neutralization of special elements used in a command ('command injectio | |
|
75
|
CVE-2026-89528 |
7.5 | 0.0071 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: svcrdma: Re | |
|
75
|
CVE-2026-4967 |
7.5 | 0.0071 | NET NO AUTH LOW CX NO UI | In IMS, there is a possible out of bounds read due to a missing bounds check. Th | |
|
75
|
CVE-2026-20479 |
7.5 | 0.0071 | NET NO AUTH LOW CX NO UI | In Modem, there is a possible out of bounds read due to a missing bounds check. | |
|
75
|
CVE-2026-21548 |
7.5 | 0.0071 | NET NO AUTH LOW CX NO UI | In nr modem, there is a possible improper input validation. This could lead to r | |
|
75
|
CVE-2026-21549 |
7.5 | 0.0071 | NET NO AUTH LOW CX NO UI | In modem, there is a possible improper input validation. This could lead to remo | |
|
75
|
CVE-2026-21550 |
7.5 | 0.0071 | NET NO AUTH LOW CX NO UI | In modem, there is a possible improper input validation. This could lead to remo | |
|
75
|
CVE-2026-21551 |
7.5 | 0.0071 | NET NO AUTH LOW CX NO UI | In modem, there is a possible improper input validation. This could lead to remo | |
|
75
|
CVE-2026-21552 |
7.5 | 0.0071 | NET NO AUTH LOW CX NO UI | In modem, there is a possible improper input validation. This could lead to remo | |
|
75
|
CVE-2026-21553 |
7.5 | 0.0071 | NET NO AUTH LOW CX NO UI | In modem, there is a possible improper input validation. This could lead to remo | |
|
75
|
CVE-2026-21554 |
7.5 | 0.0071 | NET NO AUTH LOW CX NO UI | In modem, there is a possible improper input validation. This could lead to remo | |
|
75
|
CVE-2026-21555 |
7.5 | 0.0071 | NET NO AUTH LOW CX NO UI | In modem, there is a possible improper input validation. This could lead to remo | |
|
75
|
CVE-2026-45742 |
7.5 | 0.0070 | NET NO AUTH LOW CX NO UI | Gotenberg is a Docker-powered stateless API for PDF files. From 8.10.0 until 8.3 | |
|
75
|
CVE-2026-64612 |
7.5 | 0.0070 | NET NO AUTH LOW CX NO UI | A flaw was found in libcupsfilters and cups-filters. The PNG image reading funct | |
|
70
|
CVE-2026-72526 |
9.9 | 0.0070 | NET LOW CX NO UI | A flaw was found in the multicloud-integrations component. The Application propa | |
|
68
|
CVE-2026-54368 |
8.7 | 0.0071 | NET LOW CX NO UI | CentreStack before 17.4 contains a SQL injection vulnerability in GladDBFiles.Se | |
|
68
|
CVE-2026-88115 |
8.8 | 0.0070 | NET NO AUTH LOW CX | Out-of-bounds read in Windows Server for NFS allows an unauthorized attacker to | |
|
68
|
CVE-2026-88112 |
8.8 | 0.0070 | NET NO AUTH LOW CX | Untrusted pointer dereference in DNS Server allows an unauthorized attacker to e | |
|
68
|
CVE-2026-88114 |
8.8 | 0.0070 | NET NO AUTH LOW CX | Untrusted pointer dereference in DNS Server allows an unauthorized attacker to e | |
|
68
|
CVE-2026-85903 |
8.8 | 0.0070 | NET NO AUTH LOW CX | Untrusted pointer dereference in DNS Server allows an unauthorized attacker to e | |
|
68
|
CVE-2023-23605 |
8.8 | 0.0070 | NET NO AUTH LOW CX | Mozilla developers and the Mozilla Fuzzing Team reported memory safety bugs pres | |
|
66
|
CVE-2026-69989 |
8.1 | 0.0071 | NET NO AUTH NO UI | Use after free in DNS Server allows an unauthorized attacker to execute code ove | |
|
66
|
CVE-2026-70342 |
8.1 | 0.0071 | NET NO AUTH NO UI | Use after free in Windows Ancillary Function Driver for WinSock allows an unauth | |
|
66
|
CVE-2026-72981 |
8.1 | 0.0071 | NET NO AUTH NO UI | Use after free in IP Helper allows an unauthorized attacker to execute code over | |
|
66
|
CVE-2026-77505 |
8.1 | 0.0071 | NET NO AUTH NO UI | Use after free in DNS Server allows an unauthorized attacker to execute code ove | |
|
66
|
CVE-2026-34728 |
8.1 | 0.0070 | NET NO AUTH LOW CX | phpMyFAQ is an open source FAQ web application. Prior to version 4.1.1, the Medi | |
|
66
|
CVE-2026-107928 |
8.1 | 0.0070 | NET NO AUTH NO UI | When curl is built with GnuTLS, a malicious WebSocket server can make curl send | |
|
64
|
CVE-2026-72770 |
7.1 | 0.0070 | NET LOW CX NO UI | n8n versions before 1.123.67 contain a path traversal vulnerability in the Git n | |
|
60
|
CVE-2026-79956 |
7.2 | 0.0070 | NET LOW CX NO UI | A vulnerability in the CLI command handling of the AOS-8 web interface could all |