Hunt List
12,894 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-57211 |
10.0 | 0.0063 | NET NO AUTH LOW CX NO UI | RabbitMQ is a messaging and streaming broker. Prior to 4.1.11 and 4.2.6 on Windo | |
|
80
|
CVE-2026-64439 |
9.8 | 0.0063 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: crypto: krb | |
|
80
|
CVE-2026-18452 |
10.0 | 0.0063 | NET NO AUTH LOW CX NO UI | DMS+ (Non-Mobile) developed by Rich Source has a Use of Hard-coded Credentials v | |
|
79
|
CVE-2026-14162 |
9.3 | 0.0063 | NET NO AUTH LOW CX NO UI | Hospital Queuing Management developed by Advantech has a Sensitive Data Exposure | |
|
79
|
CVE-2026-34099 |
9.3 | 0.0063 | NET NO AUTH LOW CX NO UI | Guardian language-system passes the id GET parameter directly into an unsanitize | |
|
79
|
CVE-2026-53790 |
9.2 | 0.0063 | NET NO AUTH LOW CX NO UI | rsync before 3.5.0 contains multiple command and argument injection vulnerabilit | |
|
78
|
CVE-2026-7834 |
8.9 | 0.0063 | NET NO AUTH LOW CX NO UI | A security vulnerability has been detected in EFM ipTIME NAS1dual 1.5.24. This i | |
|
76
|
CVE-2026-42859 |
8.1 | 0.0063 | NET NO AUTH LOW CX NO UI | Neat VNC is a VNC server library. Prior to 0.9.6, a pre-authentication stack buf | |
|
75
|
CVE-2025-67223 |
7.5 | 0.0063 | NET NO AUTH LOW CX NO UI | The Aranda File Server (AFS) component in Aranda Software Aranda Service Desk be | |
|
75
|
CVE-2026-26307 |
7.5 | 0.0063 | NET NO AUTH LOW CX NO UI | Gitea versions before 1.25.5 do not enforce a timeout on git grep searches, allo | |
|
75
|
CVE-2026-46585 |
7.5 | 0.0063 | NET NO AUTH LOW CX NO UI | Improper Input Validation, Authorization Bypass Through User-Controlled Key vuln | |
|
75
|
CVE-2026-14895 |
7.5 | 0.0063 | NET NO AUTH LOW CX NO UI | String::Util versions before 1.36 for Perl are susceptible to a regular expressi | |
|
75
|
CVE-2026-49866 |
7.5 | 0.0063 | NET NO AUTH LOW CX NO UI | libp2p is a JavaScript Implementation of libp2p networking stack. Prior to 16.0. | |
|
75
|
CVE-2026-56669 |
7.5 | 0.0063 | NET NO AUTH LOW CX NO UI | Elysia is a Typescript framework for request validation, type inference, OpenAPI | |
|
75
|
CVE-2026-60081 |
7.5 | 0.0063 | NET NO AUTH LOW CX NO UI | DBI::ProfileData versions before 1.651 for Perl do not limit the path index. Th | |
|
75
|
CVE-2026-14741 |
7.5 | 0.0063 | NET NO AUTH LOW CX NO UI | HTTP::Date versions before 6.08 for Perl allow CPU exhaustion via polynomial reg | |
|
75
|
CVE-2026-54638 |
7.5 | 0.0063 | NET NO AUTH LOW CX NO UI | gotd/td is a T Telegram MTProto API client in Go. Prior to 0.145.1, proto.Unencr | |
|
75
|
CVE-2026-60074 |
7.5 | 0.0063 | NET NO AUTH LOW CX NO UI | Date::Manip versions through 7.00 for Perl return corrupted dates via non-ASCII | |
|
75
|
CVE-2026-69185 |
7.5 | 0.0063 | NET NO AUTH LOW CX NO UI | Socket.IO enables bidirectional and low-latency communication for every platform | |
|
75
|
CVE-2026-71488 |
7.5 | 0.0063 | NET NO AUTH LOW CX NO UI | league/commonmark is a PHP library for parsing and rendering CommonMark Markdown | |
|
75
|
CVE-2026-19566 |
7.5 | 0.0063 | NET NO AUTH LOW CX NO UI | Net::CIDR::Set versions before 0.23 for Perl allow memory exhaustion and malform | |
|
75
|
CVE-2026-73493 |
7.5 | 0.0063 | NET NO AUTH LOW CX NO UI | Http4s (http4s-blaze-server) is a minimal, idiomatic Scala interface for HTTP se | |
|
75
|
CVE-2026-74757 |
7.5 | 0.0063 | NET NO AUTH LOW CX NO UI | Uncontrolled resource allocation in the mcpack2pb component in Apache bRPC (vers | |
|
75
|
CVE-2026-78048 |
7.5 | 0.0063 | NET NO AUTH LOW CX NO UI | A reachable-assertion flaw in the HPACK header-compression decoder of the HTTP/2 | |
|
75
|
CVE-2026-72203 |
7.5 | 0.0063 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: ntfs: skip | |
|
75
|
CVE-2026-16323 |
7.5 | 0.0063 | NET NO AUTH LOW CX NO UI | Execution after redirect (EAR) vulnerability in FuyaWeb Internet and Informatics | |
|
70
|
CVE-2026-93577 |
9.9 | 0.0063 | NET LOW CX NO UI | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 | |
|
69
|
CVE-2026-71319 |
9.6 | 0.0063 | NET NO AUTH LOW CX | Nuxt is an open-source web development framework for Vue.js. Prior to 3.3.1, Nux | |
|
68
|
CVE-2026-17168 |
8.8 | 0.0063 | NET LOW CX NO UI | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote authenticated | |
|
68
|
CVE-2026-18824 |
8.8 | 0.0063 | NET LOW CX NO UI | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote authenticated | |
|
66
|
CVE-2026-63909 |
8.1 | 0.0063 | NET LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: ksmbd: OOB | |
|
62
|
CVE-2026-54223 |
8.6 | 0.0063 | NET LOW CX NO UI | UBB.threads is vulnerable to Path traversal, allowing attackers with privilege t | |
|
55
|
CVE-2026-69976 |
7.5 | 0.0063 | NET NO AUTH | Use after free in Remote Desktop Client allows an unauthorized attacker to execu | |
|
55
|
CVE-2026-69984 |
7.5 | 0.0063 | NET NO AUTH | Use after free in Remote Desktop Client allows an unauthorized attacker to execu | |
|
55
|
CVE-2026-69986 |
7.5 | 0.0063 | NET NO AUTH | Use after free in Remote Desktop Client allows an unauthorized attacker to execu | |
|
55
|
CVE-2026-69987 |
7.5 | 0.0063 | NET NO AUTH | Use after free in Remote Desktop Client allows an unauthorized attacker to execu | |
|
55
|
CVE-2026-69988 |
7.5 | 0.0063 | NET NO AUTH | Use after free in Remote Desktop Client allows an unauthorized attacker to execu | |
|
55
|
CVE-2026-70006 |
7.5 | 0.0063 | NET NO AUTH | Use after free in Remote Desktop Client allows an unauthorized attacker to execu | |
|
55
|
CVE-2026-96071 |
7.5 | 0.0063 | NET NO AUTH | Heap-based buffer overflow in Windows Media allows an unauthorized attacker to e | |
|
55
|
CVE-2026-69991 |
7.5 | 0.0063 | NET NO AUTH | Use after free in Remote Desktop Client allows an unauthorized attacker to execu | |
|
55
|
CVE-2026-69992 |
7.5 | 0.0063 | NET NO AUTH | Use after free in Windows Remote Desktop Services allows an unauthorized attacke | |
|
55
|
CVE-2026-69994 |
7.5 | 0.0063 | NET NO AUTH | Use after free in Remote Desktop Client allows an unauthorized attacker to execu | |
|
55
|
CVE-2026-69995 |
7.5 | 0.0063 | NET NO AUTH | Use after free in Remote Desktop Client allows an unauthorized attacker to execu | |
|
55
|
CVE-2026-69996 |
7.5 | 0.0063 | NET NO AUTH | Use after free in Remote Desktop Client allows an unauthorized attacker to execu | |
|
55
|
CVE-2026-69997 |
7.5 | 0.0063 | NET NO AUTH | Use after free in Remote Desktop Client allows an unauthorized attacker to execu | |
|
55
|
CVE-2026-69998 |
7.5 | 0.0063 | NET NO AUTH | Use after free in Remote Desktop Client allows an unauthorized attacker to execu | |
|
55
|
CVE-2026-70004 |
7.5 | 0.0063 | NET NO AUTH | Use after free in Remote Desktop Client allows an unauthorized attacker to execu | |
|
55
|
CVE-2026-70012 |
7.5 | 0.0063 | NET NO AUTH | Use after free in Remote Desktop Client allows an unauthorized attacker to execu | |
|
55
|
CVE-2026-83856 |
7.5 | 0.0063 | NET NO AUTH | Out-of-bounds read in Windows Event Logging Service allows an unauthorized attac | |
|
55
|
CVE-2026-70179 |
7.5 | 0.0063 | NET NO UI | Authentication bypass by spoofing in ASP.NET Core allows an authorized attacker |