Hunt List
12,881 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-114383 |
10.0 | 0.0065 | NET NO AUTH LOW CX NO UI | A weakness has been identified in TOTOLINK EX200 5.2.3c.7200. This impacts the f | |
|
80
|
CVE-2026-25470 |
10.0 | 0.0065 | NET NO AUTH LOW CX NO UI | Unauthenticated Remote Code Execution (RCE) in ACPT (Pro) - Custom Post Types Pl | |
|
80
|
CVE-2026-26292 |
9.8 | 0.0065 | NET NO AUTH LOW CX NO UI | Gitea versions before 1.25.5 do not use the migration HTTP transport for LFS pus | |
|
80
|
CVE-2026-72472 |
9.8 | 0.0065 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: nfs: use nf | |
|
80
|
CVE-2026-89788 |
9.8 | 0.0065 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix | |
|
80
|
CVE-2026-57881 |
9.8 | 0.0065 | NET NO AUTH LOW CX NO UI | An unauthenticated stack-based buffer overflow vulnerability exists in vlsvr in | |
|
80
|
CVE-2026-58586 |
9.8 | 0.0065 | NET NO AUTH LOW CX NO UI | Image::WebP versions before 0.3.0 for Perl bundle a vulnerable version of libweb | |
|
80
|
CVE-2026-67967 |
9.8 | 0.0065 | NET NO AUTH LOW CX NO UI | Buffer Overflow vulnerability in Tenda W20E V16.01.0.6(2782) allows an attacker | |
|
80
|
CVE-2026-41553 |
10.0 | 0.0065 | NET NO AUTH LOW CX NO UI | PDF Export Module used in DHTMLX's products Gantt and Scheduler is vulnerable to | |
|
80
|
CVE-2026-8507 |
9.8 | 0.0065 | NET NO AUTH LOW CX NO UI | Crypt::OpenSSL::PKCS12 versions through 1.94 for Perl have out-of-bounds (OOB) w | |
|
79
|
CVE-2026-52830 |
9.4 | 0.0065 | NET NO AUTH LOW CX NO UI | fast-mcp-telegram is a Telegram MCP Server. Prior to 0.19.1, fast-mcp-telegram v | |
|
78
|
CVE-2026-56015 |
9.1 | 0.0065 | NET NO AUTH LOW CX NO UI | Net::IP::LPM versions before 1.11 for Perl allow a heap out-of-bounds read via a | |
|
78
|
CVE-2026-60082 |
9.1 | 0.0065 | NET NO AUTH LOW CX NO UI | DBI versions before 1.651 for Perl do not enforce statement handle consistency w | |
|
78
|
CVE-2026-57073 |
9.1 | 0.0065 | NET NO AUTH LOW CX NO UI | HTML::Bare versions through 0.04 for Perl have an unbounded character lookahead. | |
|
78
|
CVE-2024-58368 |
8.7 | 0.0065 | NET NO AUTH LOW CX NO UI | SurrealDB versions before 1.1.0 fail to properly parse the ID, DB, and NS header | |
|
78
|
CVE-2026-71479 |
9.1 | 0.0065 | NET NO AUTH LOW CX NO UI | New API is a large language mode (LLM) gateway and artificial intelligence (AI) | |
|
78
|
CVE-2026-42786 |
8.7 | 0.0065 | NET NO AUTH LOW CX NO UI | Allocation of Resources Without Limits or Throttling vulnerability in mtrudel ba | |
|
75
|
CVE-2026-65432 |
7.5 | 0.0065 | NET NO AUTH LOW CX NO UI | Apache CXF reads a top-level WSDL through its hardened StaxUtils path, which dis | |
|
75
|
CVE-2026-53404 |
7.3 | 0.0065 | NET NO AUTH LOW CX NO UI | Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat's re | |
|
75
|
CVE-2026-59928 |
7.5 | 0.0065 | NET NO AUTH LOW CX NO UI | Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, | |
|
75
|
CVE-2026-54425 |
7.5 | 0.0065 | NET NO AUTH LOW CX NO UI | Uncontrolled recursion in the HTTP/2 HPACK decoder in Apache bRPC before 1.18.0 | |
|
75
|
CVE-2023-25743 |
7.5 | 0.0065 | NET NO AUTH LOW CX NO UI | A lack of in app notification for entering fullscreen mode could have lead to a | |
|
75
|
CVE-2026-74758 |
7.5 | 0.0065 | NET NO AUTH LOW CX NO UI | A heap use-after-free in the RTMP protocol component of Apache bRPC (versions < | |
|
75
|
CVE-2026-20191 |
7.5 | 0.0065 | NET NO AUTH LOW CX NO UI | A vulnerability in Cisco Catalyst Center could allow an unauthenticated, remote | |
|
70
|
CVE-2026-46512 |
9.9 | 0.0065 | NET LOW CX NO UI | Frogman provides headless PBX control through MCP and HTTP API. Prior to 1.6.2, | |
|
70
|
CVE-2026-73263 |
9.9 | 0.0065 | NET LOW CX NO UI | Prowler is a cloud security platform. Prior to 5.36.0, the Kubernetes provider c | |
|
70
|
CVE-2026-73294 |
9.9 | 0.0065 | NET LOW CX NO UI | Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.17 and | |
|
68
|
CVE-2026-8182 |
8.8 | 0.0065 | NET LOW CX NO UI | IBM Langflow OSS 1.0.0 through 1.10.3 installations allow anyone on the internet | |
|
68
|
CVE-2026-86929 |
8.8 | 0.0065 | NET NO AUTH LOW CX | An out-of-bounds write issue was addressed with improved bounds checking. This i | |
|
68
|
CVE-2026-34152 |
8.8 | 0.0065 | NET LOW CX NO UI | Coolify is an open-source and self-hostable tool for managing servers, applicati | |
|
68
|
CVE-2026-63919 |
8.8 | 0.0065 | NET LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: xfrm: input | |
|
68
|
CVE-2026-94512 |
8.8 | 0.0065 | NET LOW CX NO UI | Heap-based buffer overflow in SQL Server allows an authorized attacker to execut | |
|
68
|
CVE-2023-0698 |
8.8 | 0.0065 | NET NO AUTH LOW CX | Out of bounds read in WebRTC in Google Chrome prior to 110.0.5481.77 allowed a r | |
|
68
|
CVE-2026-7551 |
8.7 | 0.0065 | NET LOW CX NO UI | HKUDS OpenHarness contains a remote code execution vulnerability in the /bridge | |
|
68
|
CVE-2026-72420 |
8.8 | 0.0065 | NET LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: md/raid5: a | |
|
68
|
CVE-2026-89601 |
8.8 | 0.0065 | NET LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: ext2: Fix l | |
|
68
|
CVE-2026-57983 |
8.7 | 0.0065 | NET NO AUTH NO UI | Improper authorization in Microsoft Edge (Chromium-based) allows an unauthorized | |
|
68
|
CVE-2026-62836 |
8.7 | 0.0065 | NET NO AUTH NO UI | Improper restriction of communication channel to intended endpoints in Azure SQL | |
|
68
|
CVE-2026-65617 |
8.8 | 0.0065 | NET LOW CX NO UI | A deserialization weakness in JFrog Artifactory package handling could allow a l | |
|
66
|
CVE-2026-109411 |
8.1 | 0.0065 | NET LOW CX NO UI | An access control bypass flaw was identified in Samba's vfs_ceph_rgw module in i | |
|
65
|
CVE-2026-41107 |
7.4 | 0.0065 | NET NO AUTH LOW CX | External control of file name or path in Microsoft Edge (Chromium-based) allows | |
|
65
|
CVE-2026-83511 |
7.4 | 0.0065 | NET NO AUTH NO UI | Weak authentication in Active Directory Federation Services (AD FS) allows an un | |
|
65
|
CVE-2026-7055 |
7.4 | 0.0065 | NET LOW CX NO UI | A security vulnerability has been detected in Tenda F456 1.0.0.5. This issue aff | |
|
64
|
CVE-2026-34790 |
7.1 | 0.0065 | NET LOW CX NO UI | Endian Firewall version 3.3.25 and prior allow authenticated users to delete arb | |
|
64
|
CVE-2026-24727 |
9.3 | 0.0065 | NET LOW CX NO UI | An unrestricted upload of file with dangerous type vulnerability in the e-paper | |
|
63
|
CVE-2026-48162 |
9.1 | 0.0065 | NET LOW CX NO UI | Wazuh is a free and open source platform used for threat prevention, detection, | |
|
63
|
CVE-2026-73373 |
8.9 | 0.0065 | NET LOW CX NO UI | Joomla! Core - [20260810] - Unrestricted uploads of SHTML files in Joomla 1.0.0- | |
|
58
|
CVE-2026-107239 |
8.8 | 0.0065 | NET LOW CX | A vulnerability allowing a member of the Veeam Virtualization Extensions Users g | |
|
55
|
CVE-2026-64900 |
7.3 | 0.0065 | NET LOW CX | Improper neutralization of input during web page generation ('cross-site scripti | |
|
55
|
CVE-2026-55126 |
7.3 | 0.0065 | NET LOW CX | Improper neutralization of input during web page generation ('cross-site scripti |