Hunt List
12,879 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-65906 |
10.0 | 0.0066 | NET NO AUTH LOW CX NO UI | In JetBrains TeamCity before 2026.1.2, 2025.11.6 сode execution via Kotlin DSL s | |
|
80
|
CVE-2026-96639 |
9.8 | 0.0066 | NET NO AUTH LOW CX NO UI | Pillow is a Python imaging library. From 11.0.0 until 13.0.0, multi-frame loader | |
|
80
|
CVE-2026-96096 |
9.8 | 0.0066 | NET NO AUTH LOW CX NO UI | Heap-based buffer overflow in Windows Media Player allows an unauthorized attack | |
|
80
|
CVE-2026-42778 |
9.8 | 0.0066 | NET NO AUTH LOW CX NO UI | The fix for CVE-2026-41409 was not applied to the 2.1.X and 2.2.X branches. Here | |
|
80
|
CVE-2026-14454 |
9.8 | 0.0066 | NET NO AUTH LOW CX NO UI | Imager versions before 1.033 for Perl treat unsigned EXIF IFD entry counts as si | |
|
80
|
CVE-2026-63244 |
9.8 | 0.0066 | NET NO AUTH LOW CX NO UI | An authentication bypass vulnerability in WizLearn Technologies' Learning Manage | |
|
80
|
CVE-2026-10666 |
9.8 | 0.0065 | NET NO AUTH LOW CX NO UI | parse_ipv4() in subsys/net/ip/utils.c (reached via net_ipaddr_parse() for string | |
|
79
|
CVE-2026-63146 |
9.3 | 0.0066 | NET NO AUTH LOW CX NO UI | Omnispace Agora Project before 26.10.0 contains a code injection vulnerability w | |
|
79
|
CVE-2026-56271 |
9.3 | 0.0066 | NET NO AUTH LOW CX NO UI | Flowise before 3.1.0 (affected versions 3.0.13 and earlier) uses weak hardcoded | |
|
78
|
CVE-2023-54357 |
8.7 | 0.0066 | NET NO AUTH LOW CX NO UI | Joomla com_booking component 2.4.9 contains an information disclosure vulnerabil | |
|
78
|
CVE-2026-59235 |
8.7 | 0.0066 | NET NO AUTH LOW CX NO UI | Missing Authorization (CWE-862) in BankAccountListController (app/Http/Controlle | |
|
78
|
CVE-2026-35469 |
8.7 | 0.0066 | NET NO AUTH LOW CX NO UI | spdystream is a Go library for multiplexing streams over SPDY connections. In ve | |
|
78
|
CVE-2026-7839 |
9.1 | 0.0066 | NET NO AUTH LOW CX NO UI | UltraVNC repeater through 1.8.2.2 initializes the HTTP administration server wit | |
|
78
|
CVE-2026-59161 |
8.7 | 0.0066 | NET NO AUTH LOW CX NO UI | Excelize is a Go language library for reading and writing Microsoft Excel spread | |
|
78
|
CVE-2026-43897 |
8.7 | 0.0065 | NET NO AUTH LOW CX NO UI | Link Preview JS extracts web links information. Prior to 4.0.1, the library did | |
|
77
|
CVE-2026-22620 |
8.6 | 0.0066 | NET NO AUTH LOW CX NO UI | Improper input validation in the authentication component of Eaton's Tripp Lite | |
|
75
|
CVE-2026-12844 |
7.5 | 0.0066 | NET NO AUTH LOW CX NO UI | List::SomeUtils::XS versions before 0.59 for Perl have a heap buffer overflow in | |
|
75
|
CVE-2026-46457 |
7.5 | 0.0066 | NET NO AUTH LOW CX NO UI | Improper Input Validation vulnerability in Apache Camel NATS component. The cam | |
|
75
|
CVE-2026-28814 |
7.5 | 0.0066 | NET NO AUTH LOW CX NO UI | Arbitrary Wiki Markup rendering due to lack of authentication in Apache JSPWiki | |
|
75
|
CVE-2026-55814 |
7.5 | 0.0066 | NET NO AUTH LOW CX NO UI | Missing Authentication in Apache Ranger Download APIs on versions <= 2.8.0. User | |
|
75
|
CVE-2026-50142 |
7.5 | 0.0066 | NET NO AUTH LOW CX NO UI | libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1. | |
|
75
|
CVE-2026-43866 |
7.3 | 0.0065 | NET NO AUTH LOW CX NO UI | Deserialization of Untrusted Data vulnerability in Apache Camel, Apache Camel JM | |
|
70
|
CVE-2026-33821 |
9.9 | 0.0066 | NET LOW CX NO UI | Improper privilege management in Microsoft Dynamics 365 Customer Insights allows | |
|
70
|
CVE-2026-56843 |
9.9 | 0.0066 | NET LOW CX NO UI | Incorrect authorization in the XML-RPC API of WebPros Plesk before 18.0.78.4 all | |
|
69
|
CVE-2026-9195 |
9.3 | 0.0065 | NET NO AUTH LOW CX | A cross-site scripting vulnerability in the Query Console of Progress MarkLogic | |
|
68
|
CVE-2026-70619 |
8.7 | 0.0066 | NET LOW CX NO UI | Odysseus before commit bf325f6 contains a missing authorization vulnerability th | |
|
68
|
CVE-2026-78314 |
8.8 | 0.0066 | NET LOW CX NO UI | SQL Injection in Delta DIAEnergie v1.11.00.002 allows attacker to remote code e | |
|
68
|
CVE-2026-24072 |
8.8 | 0.0065 | NET LOW CX NO UI | An escalation of privilege bug in various modules in Apache HTTP 2.4.66 and earl | |
|
68
|
CVE-2026-92574 |
8.8 | 0.0065 | NET LOW CX NO UI | A vulnerability in CRI-O checkpoint restore allows a user who can create a pod f | |
|
68
|
CVE-2026-73615 |
8.7 | 0.0065 | NET LOW CX NO UI | Network-AI versions before 5.15.1 contain a security matcher bypass vulnerabilit | |
|
67
|
CVE-2026-12195 |
8.5 | 0.0066 | NET LOW CX NO UI | myVesta is affected by an authenticated remote code execution vulnerability. Low | |
|
66
|
CVE-2026-85799 |
8.1 | 0.0066 | NET NO AUTH NO UI | Use after free in Network Policy Server (NPS) allows an unauthorized attacker to | |
|
66
|
CVE-2026-85926 |
8.1 | 0.0066 | NET NO AUTH NO UI | Use after free in Windows Secure Socket Tunneling Protocol (SSTP) allows an unau | |
|
66
|
CVE-2026-70013 |
8.1 | 0.0066 | NET NO AUTH NO UI | Use after free in Windows iSCSI allows an unauthorized attacker to execute code | |
|
66
|
CVE-2026-56287 |
8.1 | 0.0065 | NET LOW CX NO UI | A boolean-based SQL Injection vulnerability exists in Apache Fineract's Client S | |
|
66
|
CVE-2026-15560 |
8.1 | 0.0065 | NET NO AUTH NO UI | when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplie | |
|
65
|
CVE-2026-7031 |
7.4 | 0.0066 | NET LOW CX NO UI | A vulnerability was detected in Tenda F456 1.0.0.5. This impacts the function fr | |
|
65
|
CVE-2026-7054 |
7.4 | 0.0066 | NET LOW CX NO UI | A weakness has been identified in Tenda F456 1.0.0.5. This vulnerability affects | |
|
65
|
CVE-2026-34647 |
7.4 | 0.0065 | NET NO AUTH LOW CX | Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2 | |
|
65
|
CVE-2026-45539 |
7.4 | 0.0065 | NET NO AUTH LOW CX | Microsoft APM is an open-source, community-driven dependency manager for AI agen | |
|
63
|
CVE-2026-90863 |
9.1 | 0.0066 | NET LOW CX NO UI | Missing authorization in the administrative interface of Progress Software WS_FT | |
|
63
|
CVE-2026-73069 |
9.1 | 0.0066 | NET LOW CX NO UI | Twenty is an open-source CRM (customer relationship management) platform. Prior | |
|
62
|
CVE-2026-104068 |
8.6 | 0.0066 | NET LOW CX NO UI | JetBackup plugin for WordPress before 3.1.24.10 contains a symlink-based arbitra | |
|
60
|
CVE-2023-45583 |
7.2 | 0.0066 | NET LOW CX NO UI | A use of externally-controlled format string vulnerability in Fortinet FortiOS 7 | |
|
60
|
CVE-2026-95704 |
7.2 | 0.0066 | NET LOW CX NO UI | A vulnerability in the web-based management interface of wireless network manage | |
|
59
|
CVE-2026-12045 |
9.4 | 0.0066 | NET LOW CX | Read-only transaction bypass in the pgAdmin 4 AI Assistant allows an attacker wh | |
|
57
|
CVE-2026-74860 |
8.5 | 0.0066 | NET NO UI | A flaw was found in libxml2 with Python bindings enabled. A remote attacker coul | |
|
56
|
CVE-2026-50502 |
8.0 | 0.0065 | NET LOW CX | Insufficient granularity of access control in Windows Event Logging Service allo | |
|
55
|
CVE-2026-116167 |
7.6 | 0.0066 | NET NO AUTH | SiYuan from 2.9.0 before 3.8.7 contains a cross-site scripting vulnerability in | |
|
55
|
CVE-2026-109556 |
7.3 | 0.0065 | NET LOW CX | EdgeEver Desktop 1.92.0 through 1.112.0 contains a remote code execution vulnera |