Hunt List
12,904 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-79856 |
9.8 | 0.0061 | NET NO AUTH LOW CX NO UI | A buffer overflow vulnerability exists in the PAPI protocol of AOS-8 that could | |
|
80
|
CVE-2026-103688 |
9.8 | 0.0061 | NET NO AUTH LOW CX NO UI | The Checkout Files Upload for WooCommerce WordPress plugin before 2.4.0 does not | |
|
80
|
CVE-2026-50770 |
9.8 | 0.0061 | NET NO AUTH LOW CX NO UI | An issue in Squirro Cognitive Search before v.3.14.2 allows a remote attacker to | |
|
80
|
CVE-2026-50774 |
9.8 | 0.0061 | NET NO AUTH LOW CX NO UI | An issue in GAPTEQ Designer v.3.5 allows a remote attacker to escalate privilege | |
|
80
|
CVE-2026-116508 |
10.0 | 0.0061 | NET NO AUTH LOW CX NO UI | A security flaw has been discovered in TOTOLINK A950RG 4.1.2cu.5268_B20221104. A | |
|
80
|
CVE-2026-40288 |
9.8 | 0.0061 | NET NO AUTH LOW CX NO UI | PraisonAI is a multi-agent teams system. In versions below 4.5.139 of PraisonAI | |
|
80
|
CVE-2026-16360 |
9.8 | 0.0061 | NET NO AUTH LOW CX NO UI | Memory safety bugs present in Thunderbird ESR 140.12 and Thunderbird 152. Some o | |
|
80
|
CVE-2026-74988 |
9.8 | 0.0061 | NET NO AUTH LOW CX NO UI | Internally found bugs present in Firefox ESR 153.0 and Firefox 153. Some of thes | |
|
80
|
CVE-2023-0758 |
9.8 | 0.0061 | NET NO AUTH LOW CX NO UI | A vulnerability was found in glorylion JFinalOA 1.0.2 and classified as critical | |
|
80
|
CVE-2026-72550 |
9.8 | 0.0061 | NET NO AUTH LOW CX NO UI | An SQL injection vulnerability in Friendica through the 2026.08-dev branch allow | |
|
80
|
CVE-2026-72599 |
9.8 | 0.0061 | NET NO AUTH LOW CX NO UI | An SQL injection vulnerability in e107 2.4.0 allows unauthenticated remote attac | |
|
79
|
CVE-2026-65317 |
9.2 | 0.0061 | NET NO AUTH LOW CX NO UI | Verba RAG application version 2.1.3 contains a server-side request forgery vulne | |
|
78
|
CVE-2026-13007 |
8.7 | 0.0061 | NET NO AUTH LOW CX NO UI | Tenable Identity Exposure contains multiple unauthenticated API endpoints under | |
|
78
|
CVE-2026-52736 |
8.7 | 0.0061 | NET NO AUTH LOW CX NO UI | ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, a remote unauthe | |
|
78
|
CVE-2026-13207 |
8.7 | 0.0061 | NET NO AUTH LOW CX NO UI | FUXA versions 1.3.1 and prior contain an authentication bypass vulnerability via | |
|
78
|
CVE-2026-71980 |
8.7 | 0.0061 | NET NO AUTH LOW CX NO UI | Belledonne Communications bcg729 through 1.1.2 contains an out-of-bounds read vu | |
|
78
|
CVE-2026-75935 |
8.7 | 0.0061 | NET NO AUTH LOW CX NO UI | Uncontrolled memory allocation in the binary Ion stream cursor in Amazon ion-jav | |
|
78
|
CVE-2026-75936 |
8.7 | 0.0061 | NET NO AUTH LOW CX NO UI | Improper handling of highly compressed data in the GZIP auto-decompression handl | |
|
78
|
CVE-2026-13084 |
8.7 | 0.0061 | NET NO AUTH LOW CX NO UI | A null pointer dereference vulnerability in WatchGuard Fireware OS may allow a r | |
|
78
|
CVE-2026-11404 |
8.7 | 0.0061 | NET NO AUTH LOW CX NO UI | Cesanta Mongoose before 7.22 contains an out-of-bounds read in the built-in TLS | |
|
78
|
CVE-2026-67184 |
8.7 | 0.0061 | NET NO AUTH LOW CX NO UI | TinyWeb through 0.0.8 contains a null pointer dereference vulnerability that all | |
|
77
|
CVE-2026-50528 |
8.2 | 0.0061 | NET NO AUTH LOW CX NO UI | Incorrect authorization in .NET allows an unauthorized attacker to bypass a secu | |
|
77
|
CVE-2026-15352 |
8.2 | 0.0061 | NET NO AUTH LOW CX NO UI | A vulnerability exists in the Health & Safety (HS) application of NASA's Core Fl | |
|
77
|
CVE-2026-18064 |
8.2 | 0.0061 | NET NO AUTH LOW CX NO UI | An incomplete fix for CVE-2026-15352 in the NASA core Flight System (cFS) Healt | |
|
75
|
CVE-2026-48706 |
7.5 | 0.0061 | NET NO AUTH LOW CX NO UI | Envoy is an open source edge and service proxy designed for cloud-native applica | |
|
75
|
CVE-2026-72688 |
7.5 | 0.0061 | NET NO AUTH LOW CX NO UI | A missing authentication vulnerability in OpenSignLabs opensignserver through 2. | |
|
75
|
CVE-2026-72543 |
7.5 | 0.0061 | NET NO AUTH LOW CX NO UI | An insecure direct object reference vulnerability in OpenSignLabs OpenSign throu | |
|
75
|
CVE-2026-72552 |
7.5 | 0.0061 | NET NO AUTH LOW CX NO UI | A server-side request forgery vulnerability in Dub as of 2026-07-10 allows unaut | |
|
75
|
CVE-2026-72600 |
7.5 | 0.0061 | NET NO AUTH LOW CX NO UI | A broken access control vulnerability in Idurar IDURAR ERP CRM 4.1.0 allows unau | |
|
75
|
CVE-2026-72601 |
7.5 | 0.0061 | NET NO AUTH LOW CX NO UI | A broken access control vulnerability in CSZ CMS 1.3.2 allows unauthenticated re | |
|
75
|
CVE-2026-66908 |
7.5 | 0.0061 | NET NO AUTH LOW CX NO UI | Improper Authentication vulnerability in Apache Camel Platform HTTP Main compone | |
|
75
|
CVE-2026-46601 |
7.5 | 0.0061 | NET NO AUTH LOW CX NO UI | The webp decoder can panic when processing a VP8 chunk with dimensions that do n | |
|
75
|
CVE-2026-46602 |
7.5 | 0.0061 | NET NO AUTH LOW CX NO UI | The TIFF decoder does not set a limit on the size of tiles in tiled images, perm | |
|
75
|
CVE-2026-46604 |
7.5 | 0.0061 | NET NO AUTH LOW CX NO UI | The TIFF decoder can panic when decoding an invalid image with an out-of-bounds | |
|
75
|
CVE-2026-56018 |
7.5 | 0.0061 | NET NO AUTH LOW CX NO UI | JavaScript::Minifier::XS versions before 0.16 for Perl leak memory on every call | |
|
75
|
CVE-2026-13708 |
7.5 | 0.0061 | NET NO AUTH LOW CX NO UI | Imager::File::JPEG versions before 1.003 for Perl leak heap memory when reading | |
|
75
|
CVE-2026-49146 |
7.5 | 0.0061 | NET NO AUTH LOW CX NO UI | App::Ack versions before 3.10.0 for Perl allow memory exhaustion via an unbounde | |
|
75
|
CVE-2026-59724 |
7.5 | 0.0061 | NET NO AUTH LOW CX NO UI | Socket.IO enables bidirectional and low-latency communication for every platform | |
|
75
|
CVE-2026-13397 |
7.5 | 0.0061 | NET NO AUTH LOW CX NO UI | HTML::Bare versions through 0.04 for Perl will hang in an infinite loop when par | |
|
75
|
CVE-2026-13401 |
7.5 | 0.0061 | NET NO AUTH LOW CX NO UI | XML::Bare versions through 0.53 for Perl will hang in an infinite loop when pars | |
|
75
|
CVE-2026-52856 |
7.5 | 0.0061 | NET NO AUTH LOW CX NO UI | Wings is the server control plane for Pterodactyl, a free, open-source game serv | |
|
75
|
CVE-2026-17510 |
7.5 | 0.0061 | NET NO AUTH LOW CX NO UI | Crypt::OpenSSL::PKCS12 versions before 1.98 for Perl allow a NULL pointer derefe | |
|
75
|
CVE-2026-73561 |
7.5 | 0.0061 | NET NO AUTH LOW CX NO UI | Hub is a Node.js WebSocket server and client with added features. Prior to 0.2.1 | |
|
75
|
CVE-2026-52829 |
7.5 | 0.0061 | NET NO AUTH LOW CX NO UI | ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, an unauthenticat | |
|
75
|
CVE-2026-63495 |
7.5 | 0.0061 | NET NO AUTH LOW CX NO UI | Libevent is an event notification library. From 2.2.0-alpha-dev until 2.2.2-alph | |
|
69
|
CVE-2026-34263 |
9.6 | 0.0061 | NET NO AUTH LOW CX | Due to improper Spring Security configuration, SAP Commerce Cloud allows an unau | |
|
68
|
CVE-2026-67587 |
8.8 | 0.0061 | NET LOW CX NO UI | Apache Airflow's Task SDK rebuilt a `Callback` object from serialized data by re | |
|
68
|
CVE-2023-54345 |
8.7 | 0.0061 | NET LOW CX NO UI | Frappe Framework ERPNext 13.4.0 contains a sandbox escape vulnerability in Restr | |
|
64
|
CVE-2026-66881 |
7.0 | 0.0061 | NET NO AUTH LOW CX | Relative Path Traversal vulnerability in livebook-dev livebook allows an attacke | |
|
62
|
CVE-2024-58313 |
8.6 | 0.0061 | NET LOW CX NO UI | xbtitFM 4.1.18 contains an insecure file upload vulnerability that allows authen |