Hunt List
12,872 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
88
|
CVE-2026-105014 |
9.1 | 0.0067 | NET NO AUTH LOW CX NO UI | 1 PoC | Improper neutralization of special elements used in a command ('command injectio |
|
80
|
CVE-2026-72200 |
9.8 | 0.0067 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: ntfs: detec | |
|
80
|
CVE-2026-80668 |
9.8 | 0.0067 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: netfilter: | |
|
80
|
CVE-2026-114382 |
10.0 | 0.0067 | NET NO AUTH LOW CX NO UI | A security flaw has been discovered in TOTOLINK EX200 5.2.3c.7200. This affects | |
|
80
|
CVE-2026-13448 |
9.8 | 0.0067 | NET NO AUTH LOW CX NO UI | IBM Langflow OSS 1.0.0 through 1.10.1 Lanflow OSS contains an unauthenticated re | |
|
80
|
CVE-2026-71231 |
9.8 | 0.0066 | NET NO AUTH LOW CX NO UI | IOTSmartHome's gui/login.php checkCookie function builds an authentication query | |
|
80
|
CVE-2026-71278 |
9.8 | 0.0066 | NET NO AUTH LOW CX NO UI | rust-iot-platform allows creating a "calc rule" via POST /calc-rule/create (api/ | |
|
80
|
CVE-2026-90235 |
9.8 | 0.0066 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: sunrpc: xpr | |
|
79
|
CVE-2026-48158 |
9.3 | 0.0067 | NET NO AUTH LOW CX NO UI | use-context-selector is a React useContextSelector hook in userland Between 2026 | |
|
79
|
CVE-2026-48159 |
9.3 | 0.0067 | NET NO AUTH LOW CX NO UI | use-reducer-async is a React useReducer with async actions. Between 2026-05-18 1 | |
|
79
|
CVE-2026-48160 |
9.3 | 0.0067 | NET NO AUTH LOW CX NO UI | react-tracked provides state usage tracking with Proxies. Between 2026-05-18 19: | |
|
79
|
CVE-2026-48161 |
9.3 | 0.0067 | NET NO AUTH LOW CX NO UI | react18-use is a React 19 use hook shim. Between 2026-05-19 01:07:01 and 2026-05 | |
|
79
|
CVE-2026-13737 |
9.2 | 0.0067 | NET NO AUTH LOW CX NO UI | CommServe contained an allowlist bypass vulnerability affecting command executio | |
|
79
|
CVE-2026-13738 |
9.2 | 0.0067 | NET NO AUTH LOW CX NO UI | CommServe contained an authorization bypass vulnerability affecting a limited se | |
|
79
|
CVE-2026-62241 |
9.3 | 0.0067 | NET NO AUTH LOW CX NO UI | clawvet self-hosted API server (apps/api) before 0.7.5 hard-codes a fallback JWT | |
|
79
|
CVE-2026-92152 |
9.3 | 0.0067 | NET NO AUTH LOW CX NO UI | F´ (F Prime) is a framework that enables development and deployment of spaceflig | |
|
79
|
CVE-2026-54210 |
9.5 | 0.0066 | NET NO AUTH LOW CX NO UI | Tobit Laboratories AG TeamDavid's Webbox application implements various file upl | |
|
79
|
CVE-2026-54212 |
9.5 | 0.0066 | NET NO AUTH LOW CX NO UI | Tobit Laboratories AG TeamDavid's Webbox application implements an API endpoint | |
|
79
|
CVE-2026-39918 |
9.2 | 0.0066 | NET NO AUTH LOW CX NO UI | Vvveb prior to 1.0.8.1 contains a code injection vulnerability in the installati | |
|
79
|
CVE-2026-54414 |
9.3 | 0.0066 | NET NO AUTH LOW CX NO UI | FileRise before 3.16.0 is vulnerable to path traversal in the shared-folder uplo | |
|
79
|
CVE-2026-50003 |
9.3 | 0.0066 | NET NO AUTH LOW CX NO UI | A malicious or compromised server can make a DCMTK client using bit-preserving C | |
|
78
|
CVE-2026-41521 |
9.1 | 0.0067 | NET NO AUTH LOW CX NO UI | xrdp is an open source RDP server. Versions 0.10.6 and prior contain an integer | |
|
78
|
CVE-2026-40192 |
8.7 | 0.0067 | NET NO AUTH LOW CX NO UI | Pillow is a Python imaging library. Versions 10.3.0 through 12.1.1 did not limit | |
|
78
|
CVE-2026-69258 |
8.8 | 0.0067 | NET NO AUTH LOW CX NO UI | Flowise is a drag & drop user interface to build a customized large language mod | |
|
78
|
CVE-2026-5445 |
9.1 | 0.0067 | NET NO AUTH LOW CX NO UI | An out-of-bounds read vulnerability exists in the `DecodeLookupTable` function w | |
|
78
|
CVE-2026-89713 |
9.1 | 0.0066 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: NFSD: check | |
|
78
|
CVE-2026-52199 |
9.1 | 0.0066 | NET NO AUTH LOW CX NO UI | An issue in Generic OEM UZ801_v2.1 4G LTE Router V3.4.3 allows a remote attacker | |
|
77
|
CVE-2026-21047 |
8.3 | 0.0067 | NET NO AUTH LOW CX NO UI | Out-of-bounds write in ImsService prior to SMR Jul-2026 Release 1 allows remote | |
|
77
|
CVE-2026-56091 |
8.2 | 0.0067 | NET NO AUTH LOW CX NO UI | When using Apache Shiro with the shiro-guice module in a web servlet context, a | |
|
75
|
CVE-2026-24266 |
7.5 | 0.0067 | NET NO AUTH LOW CX NO UI | NVIDIA Triton Inference Server for Linux contains a vulnerability where an attac | |
|
75
|
CVE-2026-72254 |
7.5 | 0.0066 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: netfilter: | |
|
75
|
CVE-2026-90149 |
7.5 | 0.0066 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: NFSv4/flexf | |
|
75
|
CVE-2026-63968 |
7.5 | 0.0066 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: ipv6: fix p | |
|
68
|
CVE-2026-56747 |
8.7 | 0.0067 | NET LOW CX NO UI | Improper control of generation of code in the JSON Pointer-to-accessor compiler | |
|
68
|
CVE-2023-25746 |
8.8 | 0.0067 | NET NO AUTH LOW CX | Memory safety bugs present in Firefox ESR 102.7. Some of these bugs showed evide | |
|
68
|
CVE-2026-14499 |
8.8 | 0.0066 | NET LOW CX NO UI | IBM Langflow OSS 1.0.0 through 1.10.1 Langflow could allow an authenticated user | |
|
68
|
CVE-2026-18683 |
8.8 | 0.0066 | NET LOW CX NO UI | IBM i 7.6, 7.5, 7.4, and 7.3 is vulnerable to privilege escalation via Navigator | |
|
67
|
CVE-2026-53691 |
8.6 | 0.0067 | NET NO AUTH LOW CX | An Unrestricted File Upload vulnerability in Redeight CMS version 1.0 allows aut | |
|
67
|
CVE-2026-50733 |
8.6 | 0.0067 | NET NO AUTH LOW CX | Markdown Preview Enhanced before 0.8.28 parses WaveDrom diagrams by evaluating u | |
|
67
|
CVE-2026-59239 |
8.6 | 0.0067 | NET NO AUTH LOW CX | Stored Cross-site Scripting (CWE-79) in the email module in Roskus Prospero Flow | |
|
66
|
CVE-2026-42527 |
8.1 | 0.0067 | NET NO AUTH NO UI | Deserialization of Untrusted Data vulnerability in Apache Camel. The default Ob | |
|
66
|
CVE-2026-13185 |
8.1 | 0.0067 | NET NO AUTH NO UI | In Progress® Telerik® UI for AJAX prior to v2026.2.708, applications using cooki | |
|
66
|
CVE-2026-107929 |
8.1 | 0.0067 | NET NO AUTH NO UI | When `CURLOPT_INTERFACE` (or the command line tool's `--interface` option) is se | |
|
66
|
CVE-2026-102866 |
8.1 | 0.0067 | NET NO AUTH NO UI | Improper verification of cryptographic signature in Microsoft Office SharePoint | |
|
65
|
CVE-2026-4976 |
7.4 | 0.0067 | NET LOW CX NO UI | A vulnerability was found in Totolink LR350 9.3.5u.6369_B20220309. This vulnerab | |
|
65
|
CVE-2025-34248 |
7.2 | 0.0066 | NET LOW CX NO UI | D-Link Nuclias Connect firmware versions < 1.3.1.4 contain a directory traversal | |
|
64
|
CVE-2026-55514 |
7.1 | 0.0066 | NET LOW CX NO UI | vLLM is a library for LLM inference and serving. From 0.12.0 to before 0.24.0, s | |
|
63
|
CVE-2026-27436 |
9.1 | 0.0066 | NET LOW CX NO UI | Editor Arbitrary Code Execution in Five Star Business Profile and Schema <= 2.3. | |
|
63
|
CVE-2026-65907 |
9.1 | 0.0066 | NET LOW CX NO UI | In JetBrains TeamCity before 2026.1.2, 2025.11.6 code execution in Git VCS roots | |
|
51
|
CVE-2026-14476 |
8.0 | 0.0067 | NET NO UI | A path traversal flaw was found in SSSD's AD GPO provider. The ad_gpo_extract_sm |