Hunt List
12,874 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-56004 |
10.0 | 0.0066 | NET NO AUTH LOW CX NO UI | A shellcode injection in the mercurial handler of the obs tar_scm source service | |
|
80
|
CVE-2026-36669 |
9.8 | 0.0066 | NET NO AUTH LOW CX NO UI | An unauthenticated arbitrary file upload vulnerability in ck_upload_handler.php | |
|
80
|
CVE-2026-115915 |
9.8 | 0.0066 | NET NO AUTH LOW CX NO UI | vLLM is an inference and serving engine for large language models. Prior to 0.32 | |
|
79
|
CVE-2026-75110 |
9.3 | 0.0066 | NET NO AUTH LOW CX NO UI | MemOS is a memory operating system for LLMs and AI agents. In deployments where | |
|
79
|
CVE-2026-75852 |
9.3 | 0.0066 | NET NO AUTH LOW CX NO UI | ArcadeDB versions before 26.8.1 fail to enforce SASL authentication on data comm | |
|
79
|
CVE-2026-35087 |
9.3 | 0.0066 | NET NO AUTH LOW CX NO UI | Slican telephone exchanges allow administrative protocol authentication bypass. | |
|
78
|
CVE-2026-66145 |
9.1 | 0.0066 | NET NO AUTH LOW CX NO UI | An unauthenticated remote code execution vulnerability was identified in GMS 9.5 | |
|
78
|
CVE-2026-78334 |
9.1 | 0.0066 | NET NO AUTH LOW CX NO UI | Missing authentication in the streaming RPC path of Apache bRPC (version < 1.18. | |
|
78
|
CVE-2026-70636 |
8.7 | 0.0066 | NET NO AUTH LOW CX NO UI | Flowise through 3.1.4 contains an authentication bypass vulnerability that allow | |
|
78
|
CVE-2026-43637 |
8.8 | 0.0066 | NET NO AUTH LOW CX NO UI | Cornac before 2.6.0 contains a path traversal (Tar Slip) vulnerability that allo | |
|
78
|
CVE-2026-65894 |
8.7 | 0.0066 | NET NO AUTH LOW CX NO UI | This vulnerability exists in CP PLUS EZ-P21 IP Camera due to improper authentica | |
|
78
|
CVE-2026-14740 |
9.1 | 0.0066 | NET NO AUTH LOW CX NO UI | DBI versions before 1.650 for Perl read one byte out-of-bounds in preparse when | |
|
78
|
CVE-2026-93471 |
8.7 | 0.0066 | NET NO AUTH LOW CX NO UI | Improper Handling of Highly Compressed Data (Data Amplification) in esaml_bindin | |
|
78
|
CVE-2026-108359 |
8.7 | 0.0066 | NET NO AUTH LOW CX NO UI | PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. | |
|
77
|
CVE-2026-86696 |
8.2 | 0.0066 | NET NO AUTH LOW CX NO UI | Allocation of Resources Without Limits or Throttling vulnerability in esaml in d | |
|
75
|
CVE-2026-64958 |
7.5 | 0.0066 | NET NO AUTH LOW CX NO UI | An incomplete fix for CVE-2026-50645 means that it is still possible to perform | |
|
75
|
CVE-2026-68481 |
7.5 | 0.0066 | NET NO AUTH LOW CX NO UI | In Apache CXF's DefaultEncryptingOAuthDataProvider, revoked access tokens still | |
|
69
|
CVE-2026-55447 |
9.6 | 0.0066 | NET NO AUTH LOW CX | Langflow is a tool for building and deploying AI-powered agents and workflows. P | |
|
68
|
CVE-2026-69253 |
9.0 | 0.0066 | NET LOW CX NO UI | Flowise is a drag-and-drop user interface for building customized large language | |
|
68
|
CVE-2026-105008 |
9.0 | 0.0066 | NET NO AUTH NO UI | No cwe for this issue in Windows Schannel allows an unauthorized attacker to per | |
|
68
|
CVE-2026-16723 |
9.0 | 0.0066 | NET NO AUTH NO UI | A remote code execution (RCE) vulnerability exists in fastjson 1.2.68 through 1. | |
|
68
|
CVE-2026-34597 |
8.8 | 0.0066 | NET LOW CX NO UI | Coolify is an open-source and self-hostable tool for managing servers, applicati | |
|
68
|
CVE-2026-18949 |
8.8 | 0.0066 | NET LOW CX NO UI | A flaw was found in odh-dashboard. This vulnerability allows an attacker, who ha | |
|
68
|
CVE-2026-76587 |
8.8 | 0.0066 | NET LOW CX NO UI | IBM Planning Analytics 2.0 and 2.1 are vulnerable to a stack-based buffer overfl | |
|
68
|
CVE-2026-104324 |
8.8 | 0.0066 | NET LOW CX NO UI | IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacke | |
|
68
|
CVE-2026-73486 |
9.0 | 0.0066 | NET LOW CX NO UI | Flowise before 3.1.3 contains a code injection vulnerability in the CSV Agent no | |
|
68
|
CVE-2026-8053 |
8.7 | 0.0066 | NET LOW CX NO UI | An issue in MongoDB Server's time-series collection implementation allows an aut | |
|
68
|
CVE-2026-69263 |
8.7 | 0.0066 | NET LOW CX NO UI | Flowise is a drag & drop user interface to build a customized large language mod | |
|
68
|
CVE-2026-42200 |
8.8 | 0.0066 | NET LOW CX NO UI | Coolify is an open-source and self-hostable tool for managing servers, applicati | |
|
66
|
CVE-2026-115346 |
8.1 | 0.0066 | NET NO AUTH NO UI | The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is v | |
|
65
|
CVE-2026-15563 |
7.4 | 0.0066 | NET NO AUTH NO UI | A flaw was found in EAP's IIOP. The listener's NameService would accept bind ope | |
|
64
|
CVE-2026-73499 |
7.1 | 0.0066 | NET LOW CX NO UI | etcd is a distributed key-value store for the data of a distributed system. Prio | |
|
64
|
CVE-2026-59206 |
7.1 | 0.0066 | NET LOW CX NO UI | n8n is an open source workflow automation platform. Prior to 1.123.61, 2.27.4, a | |
|
64
|
CVE-2026-56171 |
7.1 | 0.0066 | NET NO AUTH LOW CX | Exposure of private personal information to an unauthorized actor in Windows RDP | |
|
60
|
CVE-2026-44914 |
7.5 | 0.0066 | NET LOW CX NO UI | Apache NiFi 1.12.0 through 2.9.0 are missing authorization when replacing Proces | |
|
57
|
CVE-2026-67379 |
8.5 | 0.0066 | NET NO UI | Stack-based buffer overflow in SQL Server allows an authorized attacker to execu | |
|
57
|
CVE-2026-73031 |
8.2 | 0.0066 | NET LOW CX | telegram-search contains a stored cross-site scripting vulnerability that allows | |
|
55
|
CVE-2026-50685 |
7.5 | 0.0066 | NET NO UI | Double free in Windows DHCP Server allows an authorized attacker to execute code | |
|
55
|
CVE-2026-62787 |
7.5 | 0.0066 | NET NO UI | Use after free in Windows DNS allows an authorized attacker to execute code over | |
|
55
|
CVE-2026-69599 |
7.5 | 0.0066 | NET NO UI | Use after free in Windows Remote Desktop Services allows an authorized attacker | |
|
55
|
CVE-2026-69852 |
7.5 | 0.0066 | NET NO UI | Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows | |
|
55
|
CVE-2026-72928 |
7.5 | 0.0066 | NET NO UI | Use after free in Windows DNS allows an authorized attacker to execute code over | |
|
55
|
CVE-2026-72954 |
7.5 | 0.0066 | NET NO UI | Use after free in Windows Deployment Services allows an authorized attacker to e | |
|
55
|
CVE-2026-62813 |
7.5 | 0.0066 | NET NO UI | Use after free in Active Directory Domain Services allows an authorized attacker | |
|
55
|
CVE-2026-69429 |
7.5 | 0.0066 | NET NO UI | Heap-based buffer overflow in Windows IKE Extension allows an authorized attacke | |
|
55
|
CVE-2026-69514 |
7.5 | 0.0066 | NET NO UI | Heap-based buffer overflow in Windows Remote Desktop Services allows an authoriz | |
|
55
|
CVE-2026-69539 |
7.5 | 0.0066 | NET NO UI | Use after free in Windows Remote Desktop Services allows an authorized attacker | |
|
55
|
CVE-2026-72943 |
7.5 | 0.0066 | NET NO UI | Use after free in Windows Deployment Services allows an authorized attacker to e | |
|
55
|
CVE-2026-83754 |
7.5 | 0.0066 | NET NO AUTH | Heap-based buffer overflow in OpenSSH for Windows allows an unauthorized attacke | |
|
44
|
CVE-2026-69452 |
7.1 | 0.0066 | NET | Use after free in Windows Enterprise App Management allows an authorized attacke |