Hunt List
12,881 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
90
|
CVE-2026-97785 |
10.0 | 0.0065 | NET NO AUTH LOW CX NO UI | 1 PoC | Improper authentication in AAD App Proxy allows an unauthorized attacker to elev |
|
80
|
CVE-2026-33943 |
9.8 | 0.0065 | NET NO AUTH LOW CX NO UI | Happy DOM is a JavaScript implementation of a web browser without its graphical | |
|
80
|
CVE-2026-10025 |
9.8 | 0.0065 | NET NO AUTH LOW CX NO UI | IBM QRadar 7.6.0.0 through 7.6.0.1, and 7.5.0 through 7.5.0 UP 15 Interim Fix 00 | |
|
80
|
CVE-2026-40911 |
10.0 | 0.0065 | NET NO AUTH LOW CX NO UI | WWBN AVideo is an open source video platform. In versions 29.0 and prior, the YP | |
|
80
|
CVE-2026-35278 |
9.8 | 0.0064 | NET NO AUTH LOW CX NO UI | Vulnerability in the PeopleSoft Enterprise PT PeopleTools product of Oracle Peop | |
|
80
|
CVE-2026-7803 |
9.8 | 0.0064 | NET NO AUTH LOW CX NO UI | IBM Langflow OSS 1.0.0 through 1.10.0 could allow arbitrary code execution due t | |
|
80
|
CVE-2026-12692 |
9.8 | 0.0064 | NET NO AUTH LOW CX NO UI | Unverified password change vulnerability in Vimesoft Inc. Enterprise Video Platf | |
|
80
|
CVE-2026-59243 |
9.8 | 0.0064 | NET NO AUTH LOW CX NO UI | The FAB auth manager's Azure AD OAuth login defaulted `verify_signature=False` w | |
|
80
|
CVE-2026-15706 |
9.8 | 0.0064 | NET NO AUTH LOW CX NO UI | Missing authentication for critical function vulnerability in Baylan Measuring I | |
|
80
|
CVE-2026-76938 |
9.8 | 0.0064 | NET NO AUTH LOW CX NO UI | Authentication Bypass Vulnerability in JP1/Automatic Job Management System 3. | |
|
80
|
CVE-2026-82117 |
9.8 | 0.0064 | NET NO AUTH LOW CX NO UI | Authentication Bypass by Spoofing Vulnerability in HiRDB. This issue affects Hi | |
|
80
|
CVE-2026-109218 |
9.8 | 0.0064 | NET NO AUTH LOW CX NO UI | The Contact Manager plugin for WordPress is vulnerable to Arbitrary File Upload | |
|
80
|
CVE-2026-34265 |
9.8 | 0.0064 | NET NO AUTH LOW CX NO UI | SAP NetWeaver Application Server ABAP allows an unauthenticated attacker to expl | |
|
80
|
CVE-2026-79852 |
9.8 | 0.0064 | NET NO AUTH LOW CX NO UI | A vulnerability in the web-based management interface of AOS could allow an unau | |
|
80
|
CVE-2026-79854 |
9.8 | 0.0064 | NET NO AUTH LOW CX NO UI | A vulnerability in the affected interface of AOS-10 could allow an unauthenticat | |
|
79
|
CVE-2026-40702 |
9.3 | 0.0065 | NET NO AUTH LOW CX NO UI | WebSocket endpoints lack proper authentication mechanisms, enabling attackers to | |
|
79
|
CVE-2026-19425 |
9.3 | 0.0064 | NET NO AUTH LOW CX NO UI | Travel Agency Management System developed by Win Men Intermational has a SQL Inj | |
|
79
|
CVE-2026-40189 |
9.3 | 0.0064 | NET NO AUTH LOW CX NO UI | goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.4, goshs enforces | |
|
78
|
CVE-2026-35505 |
8.7 | 0.0065 | NET NO AUTH LOW CX NO UI | An unauthenticated remote attacker can repeatedly send crafted connection reques | |
|
78
|
CVE-2026-50254 |
8.7 | 0.0065 | NET NO AUTH LOW CX NO UI | An unauthenticated remote attacker can repeatedly send a single crafted connecti | |
|
78
|
CVE-2026-39803 |
8.7 | 0.0064 | NET NO AUTH LOW CX NO UI | Allocation of Resources Without Limits or Throttling vulnerability in mtrudel ba | |
|
77
|
CVE-2026-56111 |
8.3 | 0.0065 | NET NO AUTH LOW CX NO UI | Marlin Firmware through 2.1.2.7, fixed in commit 1f255d1, when built with MESH_B | |
|
77
|
CVE-2026-67216 |
8.2 | 0.0065 | NET NO AUTH LOW CX NO UI | cJSON through 1.7.19 contains an inefficient algorithmic complexity flaw in cJSO | |
|
75
|
CVE-2026-69152 |
7.5 | 0.0065 | NET NO AUTH LOW CX NO UI | The brace-expansion library generates arbitrary strings containing a common pref | |
|
75
|
CVE-2026-72691 |
7.5 | 0.0065 | NET NO AUTH LOW CX NO UI | An authentication bypass vulnerability in OpenSignLabs opensignserver through 2. | |
|
75
|
CVE-2026-59978 |
7.5 | 0.0065 | NET NO AUTH LOW CX NO UI | AdminNeo is a full-featured database management tool written in PHP. From 4.6.2 | |
|
75
|
CVE-2026-42498 |
7.3 | 0.0065 | NET NO AUTH LOW CX NO UI | Exposure of HTTP Authentication Header to unexpected hosts during WebSocket auth | |
|
75
|
CVE-2026-40355 |
7.5 | 0.0065 | NET NO AUTH LOW CX NO UI | In MIT Kerberos 5 (aka krb5) before 1.22.3, there is a NULL pointer dereference | |
|
75
|
CVE-2026-49293 |
7.5 | 0.0064 | NET NO AUTH LOW CX NO UI | js-toml is a TOML parser for JavaScript, fully compliant with the TOML 1.0.0 Spe | |
|
75
|
CVE-2026-59868 |
7.5 | 0.0064 | NET NO AUTH LOW CX NO UI | js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 before 5.2.0, when me | |
|
75
|
CVE-2026-59871 |
7.5 | 0.0064 | NET NO AUTH LOW CX NO UI | node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, nod | |
|
75
|
CVE-2026-59922 |
7.5 | 0.0064 | NET NO AUTH LOW CX NO UI | Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, | |
|
75
|
CVE-2026-59925 |
7.5 | 0.0064 | NET NO AUTH LOW CX NO UI | Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, | |
|
75
|
CVE-2026-49476 |
7.5 | 0.0064 | NET NO AUTH LOW CX NO UI | Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. | |
|
75
|
CVE-2026-49477 |
7.5 | 0.0064 | NET NO AUTH LOW CX NO UI | Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. | |
|
75
|
CVE-2026-14257 |
7.5 | 0.0064 | NET NO AUTH LOW CX NO UI | brace-expansion through 5.0.7 is vulnerable to denial of service via memory exha | |
|
68
|
CVE-2026-64830 |
8.7 | 0.0065 | NET NO AUTH LOW CX | FFmpeg versions 2.1 through 8.1.2 contains a heap buffer overflow vulnerability | |
|
68
|
CVE-2026-56340 |
8.7 | 0.0064 | NET LOW CX NO UI | vLLM versions >= 0.10.2 and < 0.13.0 are missing sparse tensor validation in mul | |
|
68
|
CVE-2023-3634 |
8.8 | 0.0064 | NET LOW CX NO UI | In products of the MSE6 product-family by Festo a remote authenticated, low priv | |
|
68
|
CVE-2026-111422 |
8.8 | 0.0064 | NET LOW CX NO UI | In apache-airflow-providers-ssh before 7.0.1, SSHRemoteJobOperator quoted the va | |
|
68
|
CVE-2026-46640 |
8.7 | 0.0064 | NET LOW CX NO UI | Twig is a template language for PHP. From 3.15.0 until 3.26.0, _self.(<string>) | |
|
66
|
CVE-2026-114059 |
7.7 | 0.0064 | NET LOW CX NO UI | ArcadeDB before 26.10.1 contains a remote code execution vulnerability that allo | |
|
66
|
CVE-2026-42075 |
8.1 | 0.0064 | NET LOW CX NO UI | Evolver is a GEP-powered self-evolving engine for AI agents. Prior to version 1. | |
|
65
|
CVE-2026-6134 |
7.4 | 0.0065 | NET LOW CX NO UI | A security flaw has been discovered in Tenda F451 1.0.0.7_cn_svn7958. This vulne | |
|
65
|
CVE-2026-4974 |
7.4 | 0.0064 | NET LOW CX NO UI | A flaw has been found in Tenda AC7 15.03.06.44. Affected by this issue is the fu | |
|
65
|
CVE-2026-4975 |
7.4 | 0.0064 | NET LOW CX NO UI | A vulnerability has been found in Tenda AC15 15.03.05.19. This affects the funct | |
|
64
|
CVE-2026-44503 |
7.0 | 0.0064 | NET NO AUTH LOW CX | The RedirectHandler middleware in microsoft/kiota-java (com.microsoft.kiota:micr | |
|
62
|
CVE-2026-13050 |
8.6 | 0.0064 | NET LOW CX NO UI | An Out-of-bounds Write vulnerability in WatchGuard Fireware OS networkd process | |
|
62
|
CVE-2026-13053 |
8.6 | 0.0064 | NET LOW CX NO UI | An Out-of-bounds Write vulnerability in WatchGuard Fireware OS's CLI could allow | |
|
60
|
CVE-2026-10698 |
7.2 | 0.0064 | NET LOW CX NO UI | Improper Neutralization of Special Elements in Data Query Logic vulnerability in |