Hunt List
12,896 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2025-11367 |
10.0 | 0.0063 | NET NO AUTH LOW CX NO UI | The N-central Software Probe < 2025.4 is vulnerable to Remote Code Execution via | |
|
80
|
CVE-2026-40351 |
9.8 | 0.0063 | NET NO AUTH LOW CX NO UI | FastGPT is an AI Agent building platform. In versions prior to 4.14.9.5, the pas | |
|
80
|
CVE-2026-53483 |
9.8 | 0.0063 | NET NO AUTH LOW CX NO UI | Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release ver | |
|
80
|
CVE-2026-113744 |
10.0 | 0.0062 | NET NO AUTH LOW CX NO UI | A security vulnerability has been detected in Tenda AC19 16.03.10.07. The impact | |
|
80
|
CVE-2026-16834 |
9.8 | 0.0062 | NET NO AUTH LOW CX NO UI | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to c | |
|
80
|
CVE-2026-110186 |
9.8 | 0.0062 | NET NO AUTH LOW CX NO UI | IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker to execute a | |
|
80
|
CVE-2026-49257 |
10.0 | 0.0062 | NET NO AUTH LOW CX NO UI | mcp-pinot is a Python-based Model Context Protocol (MCP) server for interacting | |
|
80
|
CVE-2026-50755 |
9.8 | 0.0062 | NET NO AUTH LOW CX NO UI | An issue in DayuanJiang next-ai-draw-io 0.4.13 allows a remote attacker to obtai | |
|
79
|
CVE-2026-35030 |
9.4 | 0.0063 | NET NO AUTH LOW CX NO UI | LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) fo | |
|
79
|
CVE-2026-35090 |
9.3 | 0.0063 | NET NO AUTH LOW CX NO UI | In Slican telephone exchanges it is possible to manage the control panel remotel | |
|
79
|
CVE-2026-116747 |
9.2 | 0.0062 | NET NO AUTH LOW CX NO UI | Kener 3.0.0 before 4.1.10 contains an authentication bypass vulnerability that a | |
|
78
|
CVE-2026-112332 |
8.7 | 0.0063 | NET NO AUTH LOW CX NO UI | Motor.NET before 0.19.0 contains an uncaught exception vulnerability in JsonNetD | |
|
78
|
CVE-2026-50203 |
9.1 | 0.0063 | NET NO AUTH LOW CX NO UI | A path traversal in the SFTP provider (`SFTPHook.retrieve_directory` / `SFTPOper | |
|
78
|
CVE-2026-48031 |
9.1 | 0.0063 | NET NO AUTH LOW CX NO UI | go-base is a Go RESTful API Boilerplate template with JWT Authentication, backed | |
|
78
|
CVE-2026-45230 |
8.8 | 0.0063 | NET NO AUTH LOW CX NO UI | DumbAssets through 1.0.11 contains a path traversal vulnerability in the POST /a | |
|
78
|
CVE-2026-108358 |
8.8 | 0.0063 | NET NO AUTH LOW CX NO UI | PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. | |
|
78
|
CVE-2026-47659 |
8.7 | 0.0062 | NET NO AUTH LOW CX NO UI | Pathling is a set of tools that make it easier to use FHIR and clinical terminol | |
|
78
|
CVE-2026-47661 |
8.7 | 0.0062 | NET NO AUTH LOW CX NO UI | Pathling is a set of tools that make it easier to use FHIR and clinical terminol | |
|
78
|
CVE-2026-69109 |
8.7 | 0.0062 | NET NO AUTH LOW CX NO UI | A vulnerability has been identified in Siemens License Server (SLS) (All version | |
|
77
|
CVE-2026-114397 |
8.3 | 0.0063 | NET NO AUTH LOW CX NO UI | Trudesk through 1.2.11 contains a missing authentication vulnerability in debug | |
|
76
|
CVE-2026-13762 |
7.9 | 0.0063 | NET NO AUTH LOW CX NO UI | Inconsistent interpretation of HTTP/2 requests in Amazon CloudFront with AWS WAF | |
|
75
|
CVE-2023-22839 |
7.5 | 0.0063 | NET NO AUTH LOW CX NO UI | On BIG-IP versions 17.0.x before 17.0.0.2, 16.1.x before 16.1.3.3, 15.1.x before | |
|
75
|
CVE-2023-36521 |
7.5 | 0.0063 | NET NO AUTH LOW CX NO UI | A vulnerability has been identified in SIMATIC MV540 H (All versions < V3.3.4), | |
|
75
|
CVE-2026-46592 |
7.5 | 0.0063 | NET NO AUTH LOW CX NO UI | Improper Input Validation, Unintended Proxy or Intermediary ('Confused Deputy') | |
|
75
|
CVE-2026-14519 |
7.5 | 0.0062 | NET NO AUTH LOW CX NO UI | IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0. | |
|
75
|
CVE-2026-12942 |
7.5 | 0.0062 | NET NO AUTH LOW CX NO UI | IBM Langflow OSS 1.0.0 through 1.10.1 could allow a remote attacker to traverse | |
|
75
|
CVE-2026-60023 |
7.5 | 0.0062 | NET NO AUTH LOW CX NO UI | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apac | |
|
68
|
CVE-2026-57301 |
8.8 | 0.0063 | NET LOW CX NO UI | Jenkins OWASP ZAP Plugin 1.0.7 and earlier performs build operations on the Jenk | |
|
68
|
CVE-2026-119408 |
8.7 | 0.0063 | NET LOW CX NO UI | n8n before 2.42.6, 2.43.x before 2.43.3, and 3.x before 3.0.1 contains a remote | |
|
68
|
CVE-2026-83526 |
8.8 | 0.0063 | NET LOW CX NO UI | The FV Player 8 plugin for WordPress is vulnerable to Arbitrary File Upload in a | |
|
68
|
CVE-2026-61574 |
8.8 | 0.0062 | NET LOW CX NO UI | authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, t | |
|
68
|
CVE-2026-32955 |
8.7 | 0.0062 | NET LOW CX NO UI | SD-330AC and AMC Manager provided by silex technology, Inc. contain a stack-base | |
|
68
|
CVE-2026-6249 |
8.7 | 0.0062 | NET LOW CX NO UI | Vvveb CMS 1.0.8.2 contains a remote code execution vulnerability in its media up | |
|
68
|
CVE-2026-57510 |
8.7 | 0.0062 | NET LOW CX NO UI | SuperPlane before 0.27.0 contains a broken object-level authorization vulnerabil | |
|
68
|
CVE-2026-75103 |
8.7 | 0.0062 | NET LOW CX NO UI | Crawlab fails to verify user ownership or administrative role on the password-ch | |
|
68
|
CVE-2026-56142 |
8.8 | 0.0062 | NET LOW CX NO UI | In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.14812 | |
|
66
|
CVE-2026-69802 |
8.1 | 0.0063 | NET NO AUTH NO UI | Weak authentication in Network Device Enrollment Service (NDES) allows an unauth | |
|
66
|
CVE-2026-73267 |
7.7 | 0.0063 | NET LOW CX NO UI | A flaw was found in the clusterclaims-controller component of multicluster engin | |
|
66
|
CVE-2026-79889 |
8.1 | 0.0063 | NET NO AUTH NO UI | Vulnerabilities in multiple web interface endpoints of AOS-8 devices could allow | |
|
66
|
CVE-2026-7872 |
8.1 | 0.0062 | NET LOW CX NO UI | IBM Langflow OSS 1.0.0 through 1.10.0 allows an authenticated attacker to read a | |
|
66
|
CVE-2026-66374 |
8.1 | 0.0062 | NET NO AUTH NO UI | Knot Resolver before 6.4.1 allows remote code execution via a heap-based buffer | |
|
65
|
CVE-2026-6135 |
7.4 | 0.0062 | NET LOW CX NO UI | A weakness has been identified in Tenda F451 1.0.0.7_cn_svn7958. This issue affe | |
|
65
|
CVE-2026-7056 |
7.4 | 0.0062 | NET LOW CX NO UI | A vulnerability was detected in Tenda F456 1.0.0.5. Impacted is the function fro | |
|
64
|
CVE-2026-114659 |
7.1 | 0.0063 | NET LOW CX NO UI | Grav Flex Objects plugin 1.4.0 before 1.4.17 contains an authorization bypass be | |
|
63
|
CVE-2026-10139 |
9.1 | 0.0062 | NET LOW CX NO UI | A stack-based buffer overflow vulnerability exists in the Mcli functionality of | |
|
62
|
CVE-2026-41587 |
8.6 | 0.0062 | NET LOW CX NO UI | CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, mo | |
|
62
|
CVE-2026-11407 |
8.6 | 0.0062 | NET LOW CX NO UI | Pimcore CMS/DXP version 12.3.8 contains a sandbox bypass vulnerability that allo | |
|
60
|
CVE-2026-46737 |
7.2 | 0.0063 | NET LOW CX NO UI | Dell PowerProtect Data Manager, versions prior to 20.2.0.0, contain(s) an Improp | |
|
55
|
CVE-2026-88204 |
7.3 | 0.0063 | NET LOW CX | Improper neutralization of input during web page generation ('cross-site scripti | |
|
55
|
CVE-2026-105599 |
7.5 | 0.0062 | NET NO AUTH | Heap-based buffer overflow in Microsoft Office PowerPoint allows an unauthorized |