Hunt List
12,863 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-3031 |
9.8 | 0.0070 | NET NO AUTH LOW CX NO UI | Image::EPEG versions through 0.15 for Perl embeds an unsupported version of the | |
|
80
|
CVE-2026-74350 |
9.8 | 0.0070 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: ocfs2: vali | |
|
80
|
CVE-2026-74401 |
9.8 | 0.0070 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: dlm: fix ad | |
|
80
|
CVE-2026-54806 |
9.8 | 0.0070 | NET NO AUTH LOW CX NO UI | Unauthenticated PHP Object Injection in WP Activity Log <= 5.6.3.1 versions. | |
|
80
|
CVE-2026-111057 |
10.0 | 0.0070 | NET NO AUTH LOW CX NO UI | Mercury is a Python framework for sharing Jupyter notebooks as web applications | |
|
80
|
CVE-2026-79853 |
9.8 | 0.0070 | NET NO AUTH LOW CX NO UI | Sensitive information disclosure vulnerabilities in the affected interface of AO | |
|
80
|
CVE-2026-76604 |
10.0 | 0.0070 | NET NO AUTH LOW CX NO UI | Joomla Extension - fabrikar.com - Unauthenticated remote code execution via PHP | |
|
80
|
CVE-2026-76605 |
10.0 | 0.0070 | NET NO AUTH LOW CX NO UI | Joomla Extension - fabrikar.com - Remote code execution via image element in Fab | |
|
80
|
CVE-2026-61962 |
10.0 | 0.0069 | NET NO AUTH LOW CX NO UI | Unauthenticated Arbitrary Code Execution in WP BASE Booking <= 6.3.0 versions. | |
|
80
|
CVE-2026-7871 |
9.8 | 0.0069 | NET NO AUTH LOW CX NO UI | IBM Langflow OSS 1.0.0 through 1.10.0 allows users with Redis access to execute | |
|
80
|
CVE-2026-98490 |
9.8 | 0.0069 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: net: openvs | |
|
80
|
CVE-2026-98548 |
9.8 | 0.0069 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: sctp: disca | |
|
80
|
CVE-2026-79859 |
9.8 | 0.0069 | NET NO AUTH LOW CX NO UI | Buffer overflow vulnerabilities exist in the affected interface of AOS-8 that co | |
|
79
|
CVE-2026-115727 |
9.2 | 0.0070 | NET NO AUTH LOW CX NO UI | AgenticSeek before commit 409840c contains a remote code execution vulnerability | |
|
79
|
CVE-2026-43629 |
9.2 | 0.0070 | NET NO AUTH LOW CX NO UI | llama.cpp builds b4882 through b9058 contain a heap buffer overflow vulnerabilit | |
|
79
|
CVE-2026-12257 |
9.3 | 0.0070 | NET NO AUTH LOW CX NO UI | Versions of Mura CMS prior to 10.0.712 contain a critical remote code execution | |
|
79
|
CVE-2026-112398 |
9.2 | 0.0070 | NET NO AUTH LOW CX NO UI | Pillow is a Python imaging library. Prior to 13.0.0, Pillow's FlashPix JPEG-tile | |
|
79
|
CVE-2026-65701 |
9.3 | 0.0069 | NET NO AUTH LOW CX NO UI | SoftVC VITS Singing Voice Conversion through commit 730930d contains a path trav | |
|
78
|
CVE-2026-107326 |
8.8 | 0.0070 | NET LOW CX NO UI | 1 PoC | IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacke |
|
78
|
CVE-2021-47802 |
8.7 | 0.0070 | NET NO AUTH LOW CX NO UI | Tenda D151 and D301 routers contain an unauthenticated configuration download vu | |
|
78
|
CVE-2026-50369 |
8.8 | 0.0070 | NET LOW CX NO UI | 1 PoC | Use after free in Windows Remote Desktop Services allows an authorized attacker |
|
78
|
CVE-2026-67215 |
8.7 | 0.0070 | NET NO AUTH LOW CX NO UI | cJSON through 1.7.19 is vulnerable to uncontrolled recursion leading to stack ex | |
|
78
|
CVE-2017-20287 |
8.7 | 0.0070 | NET NO AUTH LOW CX NO UI | Javo Spot theme for WordPress before 3.0.0 contains a path traversal vulnerabili | |
|
78
|
CVE-2026-92388 |
9.1 | 0.0070 | NET NO AUTH LOW CX NO UI | When an FTP wildcard `LIST` operation fails, libcurl omits the restoration path | |
|
78
|
CVE-2026-63559 |
8.7 | 0.0070 | NET NO AUTH LOW CX NO UI | An integer overflow in the UA_Variant arrayDimensions product computation in op | |
|
78
|
CVE-2026-65591 |
8.9 | 0.0069 | NET LOW CX NO UI | 1 PoC | n8n contains a sanitizer bypass vulnerability in the legacy expression evaluator |
|
75
|
CVE-2026-55687 |
7.5 | 0.0070 | NET NO AUTH LOW CX NO UI | ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. Version | |
|
75
|
CVE-2026-57201 |
7.5 | 0.0070 | NET NO AUTH LOW CX NO UI | Asterisk is an open source private branch exchange and telephony toolkit. Prior | |
|
75
|
CVE-2026-43777 |
7.5 | 0.0070 | NET NO AUTH LOW CX NO UI | This issue was addressed with improved input validation. This issue is fixed in | |
|
75
|
CVE-2026-24880 |
7.5 | 0.0070 | NET NO AUTH LOW CX NO UI | Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') | |
|
75
|
CVE-2026-89707 |
7.5 | 0.0070 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: nfsd: relea | |
|
75
|
CVE-2026-97557 |
7.5 | 0.0070 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: smb: client | |
|
75
|
CVE-2026-112396 |
7.5 | 0.0069 | NET NO AUTH LOW CX NO UI | Pillow is a Python imaging library. From 11.3.0 until 13.0.0, Pillow has a heap | |
|
70
|
CVE-2026-21515 |
9.9 | 0.0070 | NET LOW CX NO UI | Exposure of sensitive information to an unauthorized actor in Azure IOT Central | |
|
69
|
CVE-2026-10789 |
9.6 | 0.0070 | NET NO AUTH LOW CX | A maliciously crafted webpage, when visited by a user with Autodesk Fusion Deskt | |
|
68
|
CVE-2023-25737 |
8.8 | 0.0070 | NET NO AUTH LOW CX | An invalid downcast from <code>nsTextNode</code> to <code>SVGElement</code> coul | |
|
68
|
CVE-2023-28162 |
8.8 | 0.0070 | NET NO AUTH LOW CX | While implementing AudioWorklets, some code may have casted one type to another, | |
|
68
|
CVE-2023-29536 |
8.8 | 0.0070 | NET NO AUTH LOW CX | An attacker could cause the memory manager to incorrectly free a pointer that ad | |
|
68
|
CVE-2026-101288 |
8.8 | 0.0070 | NET LOW CX NO UI | IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacke | |
|
68
|
CVE-2026-104328 |
8.8 | 0.0070 | NET LOW CX NO UI | IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacke | |
|
68
|
CVE-2026-90162 |
8.8 | 0.0070 | NET LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: ksmbd: defe | |
|
68
|
CVE-2026-35518 |
8.8 | 0.0070 | NET LOW CX NO UI | FTLDNS (pihole-FTL) provides an interactive API and also generates statistics fo | |
|
68
|
CVE-2026-35520 |
8.8 | 0.0070 | NET LOW CX NO UI | FTLDNS (pihole-FTL) provides an interactive API and also generates statistics fo | |
|
68
|
CVE-2026-92207 |
8.8 | 0.0070 | NET LOW CX NO UI | MindsDB OpenBBtable Code Injection Remote Code Execution Vulnerability. This vul | |
|
66
|
CVE-2026-108456 |
7.7 | 0.0070 | NET LOW CX NO UI | Server-side request forgery (ssrf) in Azure AI Foundry allows an authorized atta | |
|
66
|
CVE-2026-88117 |
8.1 | 0.0070 | NET NO AUTH NO UI | Use after free in Windows DHCP Server allows an unauthorized attacker to execute | |
|
66
|
CVE-2026-62911 |
8.0 | 0.0069 | NET LOW CX | 3 PoC | Authentication bypass by capture-replay in Microsoft Exchange Server allows an a |
|
65
|
CVE-2026-7675 |
7.4 | 0.0070 | NET LOW CX NO UI | A vulnerability has been found in Shenzhen Libituo Technology LBT-T300-HW1 up to | |
|
65
|
CVE-2026-49987 |
7.5 | 0.0070 | NET NO AUTH LOW CX | Repomix is a tool that packs repositories into AI-friendly files. Prior to 1.14. | |
|
51
|
CVE-2026-35425 |
8.0 | 0.0070 | NET NO UI | Improper access control in Azure API Management (APIM) allows an authorized atta |