Hunt List
12,867 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-24014 |
9.8 | 0.0069 | NET NO AUTH LOW CX NO UI | Apache IoTDB DataNode’s internal RPC interface for creating Trigger instances us | |
|
80
|
CVE-2026-46455 |
9.8 | 0.0069 | NET NO AUTH LOW CX NO UI | Insufficient Session Expiration vulnerability in Apache Camel Keycloak Component | |
|
80
|
CVE-2026-62183 |
9.8 | 0.0069 | NET NO AUTH LOW CX NO UI | Improper Privilege Management vulnerability in Apache Syncope. When: * the all | |
|
80
|
CVE-2026-28812 |
9.8 | 0.0069 | NET NO AUTH LOW CX NO UI | UserManager lack of checks allows impersonation in Apache JSPWiki up to 2.12.3 w | |
|
80
|
CVE-2026-34884 |
9.8 | 0.0069 | NET NO AUTH LOW CX NO UI | SSRF via set_skywalking_url Tool and GraphQL expression injection vulnerability | |
|
80
|
CVE-2026-79844 |
10.0 | 0.0069 | NET NO AUTH LOW CX NO UI | Authentication bypass vulnerabilities in the affected interface of AOS-10 could | |
|
80
|
CVE-2026-79850 |
10.0 | 0.0069 | NET NO AUTH LOW CX NO UI | Vulnerabilities in the affected interface of AOS-8 could allow an unauthenticate | |
|
80
|
CVE-2026-48773 |
9.8 | 0.0069 | NET NO AUTH LOW CX NO UI | ProxySQL is a proxy for MySQL and its forks, as well as PostgreSQL. Versions 2.0 | |
|
80
|
CVE-2026-8983 |
10.0 | 0.0069 | NET NO AUTH LOW CX NO UI | Autel Maxi Charger Single firmware through V1.03.51 contains a hard-coded authen | |
|
80
|
CVE-2026-62390 |
9.8 | 0.0069 | NET NO AUTH LOW CX NO UI | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti | |
|
80
|
CVE-2026-32227 |
9.8 | 0.0069 | NET NO AUTH LOW CX NO UI | SQL Injection vulnerability vulnerability in Apache Ranger. This issue affects | |
|
79
|
CVE-2026-112005 |
9.2 | 0.0069 | NET NO AUTH LOW CX NO UI | WhoDB 0.104.0 before 0.135.0 contains a path traversal vulnerability that allows | |
|
79
|
CVE-2026-18191 |
9.3 | 0.0069 | NET NO AUTH LOW CX NO UI | VIN-DS783E-E6 developed by Vacron has a Hidden Functionality vulnerability, allo | |
|
79
|
CVE-2026-77930 |
9.3 | 0.0069 | NET NO AUTH LOW CX NO UI | EvoScientist 0.1.0 before 0.2.5 contains an approval bypass vulnerability that a | |
|
79
|
CVE-2026-118690 |
9.3 | 0.0069 | NET NO AUTH LOW CX NO UI | Signal K Server before 2.33.0 contains a missing authentication vulnerability th | |
|
79
|
CVE-2026-54363 |
9.3 | 0.0069 | NET NO AUTH LOW CX NO UI | CentreStack before 17.5 contains a hardcoded cryptographic key vulnerability tha | |
|
79
|
CVE-2026-67443 |
9.2 | 0.0069 | NET NO AUTH LOW CX NO UI | FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. In 1.3 | |
|
78
|
CVE-2026-49119 |
8.7 | 0.0069 | NET NO AUTH LOW CX NO UI | Gradio before 6.16.0 contain a path traversal vulnerability in the FileExplorer | |
|
78
|
CVE-2026-28369 |
9.1 | 0.0069 | NET NO AUTH LOW CX NO UI | A flaw was found in Undertow. When Undertow receives an HTTP request where the f | |
|
77
|
CVE-2026-47623 |
8.2 | 0.0069 | NET NO AUTH LOW CX NO UI | NVIDIA Dynamo for Linux contains a vulnerability where an attacker could cause d | |
|
75
|
CVE-2023-54219 |
7.5 | 0.0069 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: Revert "IB/ | |
|
75
|
CVE-2026-46587 |
7.3 | 0.0069 | NET NO AUTH LOW CX NO UI | Improper Input Validation vulnerability in Apache Camel. This issue affects Apa | |
|
75
|
CVE-2026-46588 |
7.3 | 0.0069 | NET NO AUTH LOW CX NO UI | Improper Input Validation vulnerability in Apache Camel. This issue affects Apa | |
|
75
|
CVE-2026-49042 |
7.3 | 0.0069 | NET NO AUTH LOW CX NO UI | Improper Input Validation vulnerability in Apache Camel. This issue affects Apa | |
|
75
|
CVE-2026-52746 |
7.5 | 0.0069 | NET NO AUTH LOW CX NO UI | JSONata is a JSON query and transformation language. Prior to 2.2.0 and 1.8.9, m | |
|
70
|
CVE-2026-40342 |
9.9 | 0.0069 | NET LOW CX NO UI | Firebird is an open-source relational database management system. In versions pr | |
|
70
|
CVE-2026-63298 |
9.9 | 0.0069 | NET LOW CX NO UI | An improper neutralization of special elements vulnerability in LXD's NVIDIA ins | |
|
70
|
CVE-2026-44179 |
9.9 | 0.0069 | NET LOW CX NO UI | XWiki Remote Macros provides XWiki rendering macros that are useful when migrati | |
|
69
|
CVE-2026-69254 |
9.4 | 0.0069 | NET LOW CX NO UI | Flowise is a drag & drop user interface to build a customized large language mod | |
|
69
|
CVE-2026-48582 |
9.6 | 0.0069 | NET LOW CX NO UI | Missing authorization in Microsoft Exchange Online allows an authorized attacker | |
|
69
|
CVE-2026-56161 |
9.6 | 0.0069 | NET LOW CX NO UI | Improper access control in Azure Logic Apps allows an authorized attacker to dis | |
|
69
|
CVE-2026-62896 |
9.6 | 0.0069 | NET LOW CX NO UI | Improper authentication in Microsoft Teams allows an authorized attacker to elev | |
|
68
|
CVE-2026-65595 |
8.9 | 0.0069 | NET LOW CX NO UI | n8n before 2.30.1 and 2.29.8 assigns all Public API key scopes to JWTs issued th | |
|
68
|
CVE-2026-96251 |
8.8 | 0.0069 | NET NO AUTH LOW CX | Reliance on untrusted inputs in a security decision in Microsoft PowerShell allo | |
|
68
|
CVE-2026-40488 |
8.7 | 0.0069 | NET LOW CX NO UI | Magento Long Term Support (LTS) is an unofficial, community-driven project provi | |
|
68
|
CVE-2026-46633 |
8.7 | 0.0069 | NET LOW CX NO UI | Twig is a template language for PHP. Prior to 3.26.0, Compiler::string() does no | |
|
66
|
CVE-2026-57817 |
8.1 | 0.0069 | NET NO AUTH NO UI | The OpenID Connect Core 1.0 specification mandates that the RP MUST validate the | |
|
66
|
CVE-2026-58595 |
8.1 | 0.0069 | NET NO AUTH LOW CX | Improper restriction of rendered ui layers or frames in Microsoft Bing App for I | |
|
66
|
CVE-2026-69380 |
8.1 | 0.0069 | NET LOW CX NO UI | Missing authorization in Microsoft Exchange Server allows an authorized attacker | |
|
66
|
CVE-2026-112427 |
8.1 | 0.0069 | NET NO AUTH NO UI | An authentication issue was addressed with improved state management. This issue | |
|
66
|
CVE-2026-88171 |
8.1 | 0.0069 | NET NO AUTH NO UI | Double free in Windows DHCP Server allows an unauthorized attacker to execute co | |
|
66
|
CVE-2026-53510 |
8.1 | 0.0069 | NET NO AUTH NO UI | Savon is a Ruby SOAP client. From 0.9.8 until 2.17.2, Savon::Model .all_operatio | |
|
66
|
CVE-2026-55607 |
7.7 | 0.0069 | NET NO AUTH LOW CX | Claude Code is an agentic coding tool. From 2.1.38 until 2.1.163, Claude Code's | |
|
65
|
CVE-2026-5979 |
7.4 | 0.0069 | NET LOW CX NO UI | A vulnerability was detected in D-Link DIR-605L 2.13B01. Affected by this vulner | |
|
65
|
CVE-2026-5982 |
7.4 | 0.0069 | NET LOW CX NO UI | A vulnerability was found in D-Link DIR-605L 2.13B01. This vulnerability affects | |
|
65
|
CVE-2026-7288 |
7.4 | 0.0069 | NET LOW CX NO UI | A vulnerability has been found in D-Link DIR-825M 1.1.12. This vulnerability aff | |
|
62
|
CVE-2026-34176 |
8.5 | 0.0069 | NET LOW CX NO UI | When running in Appliance mode, an authenticated remote command injection vulner | |
|
62
|
CVE-2026-3987 |
8.6 | 0.0069 | NET LOW CX NO UI | A path traversal vulnerability in the Fireware OS Web UI on WatchGuard Firebox s | |
|
55
|
CVE-2026-114463 |
7.5 | 0.0069 | NET NO UI | The webhook platform gateway in Nous Research Hermes Agent versions builds the s | |
|
55
|
CVE-2026-47296 |
7.5 | 0.0069 | NET NO UI | Improper neutralization of special elements used in an sql command ('sql injecti |