Hunt List
12,871 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-13473 |
9.8 | 0.0067 | NET NO AUTH LOW CX NO UI | IBM Storage Protect Client 8.1.0.0 through 8.1.27.0, 8.1.27.1, and 8.2.0.0 throu | |
|
80
|
CVE-2026-17138 |
9.8 | 0.0067 | NET NO AUTH LOW CX NO UI | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to e | |
|
80
|
CVE-2026-19437 |
9.8 | 0.0067 | NET NO AUTH LOW CX NO UI | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to e | |
|
80
|
CVE-2026-96207 |
10.0 | 0.0067 | NET NO AUTH LOW CX NO UI | Improper certificate validation in Microsoft Partner Center allows an unauthoriz | |
|
80
|
CVE-2026-85889 |
10.0 | 0.0067 | NET NO AUTH LOW CX NO UI | Missing authentication for critical function in Azure AI Foundry allows an unaut | |
|
80
|
CVE-2026-15043 |
9.8 | 0.0067 | NET NO AUTH LOW CX NO UI | DBI::SQL::Nano versions from 1.42 before 1.651 for Perl have inverted <= and >= | |
|
80
|
CVE-2025-70290 |
9.8 | 0.0067 | NET NO AUTH LOW CX NO UI | An issue was discovered in Denx U-Boot before 2026.04. An integer overflow vulne | |
|
79
|
CVE-2026-117532 |
9.3 | 0.0068 | NET NO AUTH LOW CX NO UI | REDAXO core from 5.3.0 before 5.21.4 contains an authentication bypass vulnerabi | |
|
78
|
CVE-2026-112330 |
8.7 | 0.0068 | NET NO AUTH LOW CX NO UI | Motor.NET before 0.19.0 contains a denial of service vulnerability that allows a | |
|
78
|
CVE-2026-112331 |
8.7 | 0.0068 | NET NO AUTH LOW CX NO UI | Motor.NET before 0.19.0 contains a denial-of-service vulnerability that allows a | |
|
78
|
CVE-2026-75915 |
8.7 | 0.0068 | NET NO AUTH LOW CX NO UI | CodeWhale versions before 0.8.64 contain an environment variable exposure vulner | |
|
78
|
CVE-2026-86414 |
9.1 | 0.0068 | NET NO AUTH LOW CX NO UI | An HTTP proxy can trick libcurl into sending the origin's credentials (Basic pas | |
|
78
|
CVE-2026-87861 |
9.1 | 0.0068 | NET NO AUTH LOW CX NO UI | When using ambient user credentials, an HTTP request directed to one origin may | |
|
78
|
CVE-2026-107327 |
8.8 | 0.0067 | NET LOW CX NO UI | 1 PoC | IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacke |
|
77
|
CVE-2026-54904 |
8.2 | 0.0067 | NET NO AUTH LOW CX NO UI | concurrent-ruby is a modern concurrency tools for Ruby. Prior to 1.3.7, Concurre | |
|
76
|
CVE-2026-13763 |
7.9 | 0.0068 | NET NO AUTH LOW CX NO UI | Inconsistent interpretation of HTTP/2 requests in AWS Application Load Balancer | |
|
75
|
CVE-2026-64194 |
7.5 | 0.0068 | NET NO AUTH LOW CX NO UI | Net::DNS versions through 1.55 for Perl allow Denial of Service via deep DNS com | |
|
75
|
CVE-2026-27857 |
7.5 | 0.0068 | NET NO AUTH LOW CX NO UI | Sending "NOOP (((...)))" command with 4000 parenthesis open+close results in ~1M | |
|
75
|
CVE-2026-104016 |
7.5 | 0.0068 | NET NO AUTH LOW CX NO UI | ProtobufParser parses length-prefixed protobuf string and bytes fields by checki | |
|
75
|
CVE-2026-35485 |
7.5 | 0.0068 | NET NO AUTH LOW CX NO UI | text-generation-webui is an open-source web interface for running Large Language | |
|
75
|
CVE-2026-98550 |
7.5 | 0.0068 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: tipc: rejec | |
|
75
|
CVE-2026-89544 |
7.5 | 0.0068 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: SUNRPC: fix | |
|
75
|
CVE-2026-34651 |
7.5 | 0.0067 | NET NO AUTH LOW CX NO UI | Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2 | |
|
75
|
CVE-2026-89647 |
7.5 | 0.0067 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: ceph: do no | |
|
75
|
CVE-2026-89648 |
7.5 | 0.0067 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: ceph: cap d | |
|
75
|
CVE-2026-54538 |
7.5 | 0.0067 | NET NO AUTH LOW CX NO UI | xrdp is an open source RDP server. In versions 0.10.6 and prior, a n issue was d | |
|
75
|
CVE-2026-11605 |
7.5 | 0.0067 | NET NO AUTH LOW CX NO UI | The issue is a resource exhaustion vulnerability associated with DNSSEC validati | |
|
75
|
CVE-2026-47628 |
7.5 | 0.0067 | NET NO AUTH LOW CX NO UI | NVIDIA Triton Inference Server for Linux contains a vulnerability where an attac | |
|
75
|
CVE-2026-47629 |
7.5 | 0.0067 | NET NO AUTH LOW CX NO UI | NVIDIA Triton Inference Server for Linux contains a vulnerability where an attac | |
|
74
|
CVE-2026-57190 |
7.0 | 0.0068 | NET NO AUTH LOW CX NO UI | Asterisk is an open source private branch exchange and telephony toolkit. Prior | |
|
69
|
CVE-2026-41202 |
9.4 | 0.0068 | NET LOW CX NO UI | CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, mo | |
|
69
|
CVE-2026-17566 |
9.4 | 0.0067 | NET LOW CX NO UI | pgAdmin 4's Import/Export Data tool builds a psql \copy (...) command line by in | |
|
68
|
CVE-2026-73614 |
8.7 | 0.0068 | NET LOW CX NO UI | Network-AI ClaudeHookBridge before 5.15.1 truncates the target string to 500 cha | |
|
68
|
CVE-2026-17624 |
8.8 | 0.0068 | NET LOW CX NO UI | IBM Langflow OSS 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10. | |
|
68
|
CVE-2026-17633 |
8.8 | 0.0068 | NET LOW CX NO UI | IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote authenticated attacke | |
|
68
|
CVE-2026-73625 |
8.7 | 0.0068 | NET LOW CX NO UI | GitPython versions before 3.1.54 contain a remote code execution vulnerability i | |
|
68
|
CVE-2023-25744 |
8.8 | 0.0067 | NET NO AUTH LOW CX | Mmemory safety bugs present in Firefox 109 and Firefox ESR 102.7. Some of these | |
|
66
|
CVE-2026-69913 |
8.1 | 0.0068 | NET NO AUTH NO UI | Use after free in Windows TCP/IP allows an unauthorized attacker to execute code | |
|
66
|
CVE-2026-45135 |
8.1 | 0.0068 | NET NO AUTH NO UI | Caddy is an extensible server platform that uses TLS by default. From 2.7.0 unti | |
|
66
|
CVE-2026-84012 |
8.1 | 0.0067 | NET NO AUTH NO UI | Double free in Remote Desktop Gateway Service allows an unauthorized attacker to | |
|
66
|
CVE-2026-85371 |
8.1 | 0.0067 | NET NO AUTH NO UI | Use after free in Network Policy Server (NPS) allows an unauthorized attacker to | |
|
65
|
CVE-2026-5980 |
7.4 | 0.0068 | NET LOW CX NO UI | A flaw has been found in D-Link DIR-605L 2.13B01. Affected by this issue is the | |
|
65
|
CVE-2026-5983 |
7.4 | 0.0068 | NET LOW CX NO UI | A vulnerability was determined in D-Link DIR-605L 2.13B01. This issue affects th | |
|
65
|
CVE-2026-6120 |
7.4 | 0.0067 | NET LOW CX NO UI | A vulnerability was detected in Tenda F451 1.0.0.7. Affected is the function fro | |
|
65
|
CVE-2026-6124 |
7.4 | 0.0067 | NET LOW CX NO UI | A vulnerability was determined in Tenda F451 1.0.0.7. This vulnerability affects | |
|
63
|
CVE-2025-40949 |
8.9 | 0.0067 | NET LOW CX NO UI | A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.1 | |
|
62
|
CVE-2026-56382 |
8.6 | 0.0068 | NET LOW CX NO UI | Craft CMS (composer package craftcms/cms) versions >= 5.5.0 and <= 5.9.13 contai | |
|
60
|
CVE-2026-9779 |
7.2 | 0.0068 | NET LOW CX NO UI | ATEN Unizon doCryptoHugeFileToFile Improper Verification of Cryptographic Signat | |
|
56
|
CVE-2026-85881 |
8.0 | 0.0068 | NET LOW CX | Stack-based buffer overflow in Microsoft Graphics Component allows an authorized | |
|
56
|
CVE-2026-58652 |
7.7 | 0.0067 | NET NO UI | luci-app-travelmate (and the travelmate package) contain a privilege-escalation |