Hunt List
11,997 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-28672 |
9.8 | 0.0263 | NET NO AUTH LOW CX NO UI | Improper Neutralization of Special Elements used in a Command ('Command Injectio | |
|
80
|
CVE-2026-16766 |
9.8 | 0.0257 | NET NO AUTH LOW CX NO UI | Catalyst::View::Wkhtmltopdf versions before 0.6.1 for Perl allow shell command i | |
|
80
|
CVE-2026-4408 |
9.8 | 0.0250 | NET NO AUTH LOW CX NO UI | A flaw was found in Samba. A remote attacker can exploit a misconfiguration in S | |
|
80
|
CVE-2026-61808 |
9.8 | 0.0250 | NET NO AUTH LOW CX NO UI | LightRAG provides simple and fast retrieval-augmented generation. Through versio | |
|
80
|
CVE-2026-62392 |
9.8 | 0.0248 | NET NO AUTH LOW CX NO UI | Improper Neutralization of Special Elements used in an OS Command ('OS Command I | |
|
80
|
CVE-2023-23080 |
9.8 | 0.0246 | NET NO AUTH LOW CX NO UI | Certain Tenda products are vulnerable to command injection. This affects Tenda C | |
|
79
|
CVE-2026-110640 |
9.3 | 0.0273 | NET NO AUTH LOW CX NO UI | Whisper-node through 1.1.1 contains an OS command injection vulnerability that a | |
|
79
|
CVE-2026-7840 |
9.3 | 0.0263 | NET NO AUTH LOW CX NO UI | UltraVNC repeater through 1.8.2.2 contains a global buffer overflow in its embed | |
|
79
|
CVE-2026-46725 |
9.2 | 0.0262 | NET NO AUTH LOW CX NO UI | The extension passes an attacker-controlled cookie directly to PHP's unserialize | |
|
79
|
CVE-2026-59801 |
9.3 | 0.0262 | NET NO AUTH LOW CX NO UI | 9Router through version 0.4.41 contains an unauthenticated access vulnerability | |
|
79
|
CVE-2026-53976 |
9.3 | 0.0261 | NET NO AUTH LOW CX NO UI | OpenChamber 1.11.7 contains a path traversal vulnerability in the file-serving e | |
|
79
|
CVE-2026-110635 |
9.3 | 0.0252 | NET NO AUTH LOW CX NO UI | webp-converter before 3.0.0 contains an OS command injection vulnerability in sr | |
|
79
|
CVE-2026-65008 |
9.3 | 0.0249 | NET NO AUTH LOW CX NO UI | Grav 2.0.4 (fixed in 2.0.7) contains a remote code execution vulnerability in Bl | |
|
79
|
CVE-2026-71983 |
9.3 | 0.0246 | NET NO AUTH LOW CX NO UI | MSI Radix AXE6600 router firmware version v781521 contains a command injection v | |
|
79
|
CVE-2026-71984 |
9.3 | 0.0246 | NET NO AUTH LOW CX NO UI | MSI Radix AXE6600 router firmware version v781521 contains a command injection v | |
|
79
|
CVE-2026-71985 |
9.3 | 0.0246 | NET NO AUTH LOW CX NO UI | MSI Radix AXE6600 router firmware version v781521 contains a command injection v | |
|
79
|
CVE-2026-71986 |
9.3 | 0.0246 | NET NO AUTH LOW CX NO UI | MSI Radix AXE6600 router firmware version v781521 contains a command injection v | |
|
79
|
CVE-2026-71987 |
9.3 | 0.0246 | NET NO AUTH LOW CX NO UI | MSI Radix AXE6600 router firmware version v781521 contains a command injection v | |
|
79
|
CVE-2026-71988 |
9.3 | 0.0246 | NET NO AUTH LOW CX NO UI | MSI Radix AXE6600 router firmware version v781521 contains a command injection v | |
|
79
|
CVE-2026-71989 |
9.3 | 0.0246 | NET NO AUTH LOW CX NO UI | MSI Radix AXE6600 router firmware version v781521 contains a command injection v | |
|
79
|
CVE-2026-71990 |
9.3 | 0.0246 | NET NO AUTH LOW CX NO UI | MSI Radix AXE6600 router firmware version v781521 contains a command injection v | |
|
79
|
CVE-2026-71991 |
9.3 | 0.0246 | NET NO AUTH LOW CX NO UI | MSI Radix AXE6600 router firmware version v781521 contains a command injection v | |
|
79
|
CVE-2026-71992 |
9.3 | 0.0246 | NET NO AUTH LOW CX NO UI | MSI Radix AXE6600 router firmware version v781521 contains a command injection v | |
|
79
|
CVE-2026-71993 |
9.3 | 0.0246 | NET NO AUTH LOW CX NO UI | MSI Radix AXE6600 router firmware version v781521 contains a command injection v | |
|
79
|
CVE-2026-61515 |
9.3 | 0.0244 | NET NO AUTH LOW CX NO UI | Puwell IP Camera firmware versions 2.x through 4.x contains an unauthenticated c | |
|
79
|
CVE-2026-40047 |
9.1 | 0.0243 | NET NO AUTH LOW CX NO UI | Improper Neutralization of Argument Delimiters in a Command ('Argument Injection | |
|
78
|
CVE-2026-6027 |
8.9 | 0.0250 | NET NO AUTH LOW CX NO UI | A weakness has been identified in Totolink A7100RU 7.4cu.2313_b20191024. This is | |
|
78
|
CVE-2026-7242 |
8.9 | 0.0245 | NET NO AUTH LOW CX NO UI | A vulnerability was determined in Totolink A8000RU 7.1cu.643_b20200521. Impacted | |
|
78
|
CVE-2026-7241 |
8.9 | 0.0245 | NET NO AUTH LOW CX NO UI | A vulnerability was found in Totolink A8000RU 7.1cu.643_b20200521. This issue af | |
|
78
|
CVE-2026-7243 |
8.9 | 0.0245 | NET NO AUTH LOW CX NO UI | A vulnerability was identified in Totolink A8000RU 7.1cu.643_b20200521. The affe | |
|
78
|
CVE-2026-7240 |
8.9 | 0.0243 | NET NO AUTH LOW CX NO UI | A vulnerability has been found in Totolink A8000RU 7.1cu.643_b20200521. This vul | |
|
76
|
CVE-2023-52356 |
7.5 | 0.0251 | NET NO AUTH LOW CX NO UI | A segment fault (SEGV) flaw was found in libtiff that could be triggered by pass | |
|
75
|
CVE-2023-28319 |
7.5 | 0.0249 | NET NO AUTH LOW CX NO UI | A use after free vulnerability exists in curl <v8.1.0 in the way libcurl offers | |
|
75
|
CVE-2023-2911 |
7.5 | 0.0243 | NET NO AUTH LOW CX NO UI | If the `recursive-clients` quota is reached on a BIND 9 resolver configured with | |
|
70
|
CVE-2026-34038 |
9.9 | 0.0254 | NET LOW CX NO UI | Coolify is an open-source and self-hostable tool for managing servers, applicati | |
|
68
|
CVE-2026-112351 |
8.7 | 0.0268 | NET LOW CX NO UI | Sunhillo SureLine before 9.1.5 contains an OS command injection vulnerability in | |
|
68
|
CVE-2026-58452 |
8.7 | 0.0267 | NET LOW CX NO UI | JAIOTlink C492A-W6 Wi-Fi IP cameras running firmware 4.8.30.57701411 contain an | |
|
68
|
CVE-2026-22683 |
8.7 | 0.0261 | NET LOW CX NO UI | Windmill versions 1.56.0 through 1.614.0 contain a missing authorization vulnera | |
|
68
|
CVE-2023-27534 |
8.8 | 0.0244 | NET LOW CX NO UI | A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes | |
|
68
|
CVE-2026-56766 |
8.6 | 0.0244 | NET NO AUTH LOW CX | Hydra through 9.7, fixed in commit 9cc84c2, contains a stack buffer overflow in | |
|
68
|
CVE-2026-32833 |
8.7 | 0.0242 | NET LOW CX NO UI | Cudy LT300 3.0 running firmware prior to version 2.5.12 contains an OS command i | |
|
67
|
CVE-2026-55173 |
8.1 | 0.0268 | NET NO AUTH NO UI | WWBN AVideo is an open source video platform. Versions 29.0 and below remain vul | |
|
65
|
CVE-2026-7082 |
7.4 | 0.0255 | NET LOW CX NO UI | A flaw has been found in Tenda F456 1.0.0.5. Affected by this vulnerability is t | |
|
64
|
CVE-2026-12486 |
9.1 | 0.0270 | NET LOW CX NO UI | Multiple OS command injection vulnerabilities exist in the libNetSetObj.so funct | |
|
64
|
CVE-2026-12849 |
9.1 | 0.0270 | NET LOW CX NO UI | Multiple OS command injection vulnerabilities exist in the libNetSetObj.so funct | |
|
64
|
CVE-2026-12850 |
9.1 | 0.0270 | NET LOW CX NO UI | Multiple OS command injection vulnerabilities exist in the libNetSetObj.so funct | |
|
64
|
CVE-2026-12851 |
9.1 | 0.0270 | NET LOW CX NO UI | Multiple OS command injection vulnerabilities exist in the libNetSetObj.so funct | |
|
63
|
CVE-2026-56808 |
8.6 | 0.0248 | NET LOW CX NO UI | DGM3103SCT provided by AVTECH Security Corporation contains an OS command inject | |
|
63
|
CVE-2026-67608 |
8.6 | 0.0243 | NET LOW CX NO UI | Telenia Software TVox 26.5.3 and prior 26.x versions, and 24.9.21 and prior 24.x | |
|
63
|
CVE-2026-67599 |
8.6 | 0.0243 | NET LOW CX NO UI | ClearOS 7.9 contains an OS command injection vulnerability in the Log Viewer com |