Hunt List
12,910 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
89
|
CVE-2026-54390 |
9.3 | 0.0060 | NET NO AUTH LOW CX NO UI | 1 PoC | JTL Shop versions 5.2.0 through 5.7.1 contains a server-side template injection |
|
80
|
CVE-2026-64633 |
10.0 | 0.0060 | NET NO AUTH LOW CX NO UI | A vulnerability allowing remote unauthenticated code execution on the agent host | |
|
80
|
CVE-2026-49352 |
9.8 | 0.0060 | NET NO AUTH LOW CX NO UI | 9Router is an AI router & token saver. From 0.2.21 until 0.4.44, 9Router used th | |
|
80
|
CVE-2026-70200 |
10.0 | 0.0060 | NET NO AUTH LOW CX NO UI | Improper limitation of a pathname to a restricted directory ('path traversal') i | |
|
80
|
CVE-2026-43414 |
9.8 | 0.0060 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: scsi: qla2x | |
|
79
|
CVE-2026-120201 |
9.3 | 0.0060 | NET NO AUTH LOW CX NO UI | Jpom 2.10.0 through 2.11.12 contains an authentication bypass vulnerability that | |
|
79
|
CVE-2026-69255 |
9.2 | 0.0060 | NET NO AUTH LOW CX NO UI | Flowise is a drag & drop user interface to build a customized large language mod | |
|
78
|
CVE-2026-53995 |
8.8 | 0.0060 | NET NO AUTH LOW CX NO UI | MLflow 3.17.1 and earlier contains a path traversal vulnerability in the FileSto | |
|
78
|
CVE-2026-42608 |
8.8 | 0.0060 | NET NO AUTH LOW CX NO UI | Grav is a file-based Web platform. Prior to 2.0.0-beta.2, there is a Path Traver | |
|
78
|
CVE-2026-53424 |
9.1 | 0.0060 | NET NO AUTH LOW CX NO UI | Authentication Bypass by Capture-replay vulnerability in dropbox samly allows an | |
|
78
|
CVE-2026-108525 |
8.7 | 0.0060 | NET NO AUTH LOW CX NO UI | Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 | |
|
78
|
CVE-2026-108529 |
8.7 | 0.0060 | NET NO AUTH LOW CX NO UI | Inefficient Algorithmic Complexity vulnerability in the HTTP/2 implementation of | |
|
78
|
CVE-2026-109584 |
8.7 | 0.0060 | NET NO AUTH LOW CX NO UI | Improper Handling of Highly Compressed Data (Data Amplification) vulnerability i | |
|
78
|
CVE-2026-110499 |
8.7 | 0.0060 | NET NO AUTH LOW CX NO UI | Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 | |
|
78
|
CVE-2026-111101 |
8.7 | 0.0060 | NET NO AUTH LOW CX NO UI | Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/1 | |
|
78
|
CVE-2026-113436 |
8.7 | 0.0060 | NET NO AUTH LOW CX NO UI | Inefficient Algorithmic Complexity vulnerability in the header integer parser of | |
|
78
|
CVE-2026-114213 |
8.7 | 0.0060 | NET NO AUTH LOW CX NO UI | Allocation of Resources Without Limits or Throttling vulnerability in the WebSoc | |
|
78
|
CVE-2026-115269 |
8.7 | 0.0060 | NET NO AUTH LOW CX NO UI | Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 | |
|
78
|
CVE-2026-48203 |
9.1 | 0.0060 | NET NO AUTH LOW CX NO UI | Improper Neutralization of Special Elements in Output Used by a Downstream Compo | |
|
78
|
CVE-2026-48205 |
9.1 | 0.0060 | NET NO AUTH LOW CX NO UI | Improper Input Validation, Server-Side Request Forgery (SSRF) vulnerability in A | |
|
78
|
CVE-2026-43083 |
9.1 | 0.0060 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: net: ioam6: | |
|
77
|
CVE-2026-96640 |
8.2 | 0.0060 | NET NO AUTH LOW CX NO UI | Pillow is a Python imaging library. From 5.1.0 until 13.0.0, PdfParser.linearize | |
|
76
|
CVE-2026-55488 |
7.7 | 0.0060 | NET NO AUTH LOW CX NO UI | motionEye (mEye) is an online interface for a piece of software called "motion," | |
|
76
|
CVE-2026-33267 |
7.7 | 0.0060 | NET NO AUTH LOW CX NO UI | Improper Input Validation vulnerability in Apache Traffic Server. This issue af | |
|
75
|
CVE-2026-28959 |
7.5 | 0.0060 | NET NO AUTH LOW CX NO UI | A buffer overflow was addressed with improved bounds checking. This issue is fix | |
|
75
|
CVE-2026-113811 |
7.5 | 0.0060 | NET NO AUTH LOW CX NO UI | Algorithm::UrataniTakeda versions from 0.1.5 before 0.1.7 for Perl allow memory | |
|
75
|
CVE-2026-40356 |
7.5 | 0.0060 | NET NO AUTH LOW CX NO UI | In MIT Kerberos 5 (aka krb5) before 1.22.3, there is an integer underflow and re | |
|
75
|
CVE-2026-20337 |
7.5 | 0.0060 | NET NO AUTH LOW CX NO UI | A vulnerability in the zip archive parser of ClamAV could allow an unauthenticat | |
|
75
|
CVE-2026-57186 |
7.5 | 0.0060 | NET NO AUTH LOW CX NO UI | Asterisk is an open source private branch exchange and telephony toolkit. From 2 | |
|
75
|
CVE-2026-8650 |
7.5 | 0.0060 | NET NO AUTH LOW CX NO UI | Relative path traversal vulnerability in Progress MOVEit Transfer (Admin Setting | |
|
75
|
CVE-2026-58208 |
7.5 | 0.0060 | NET NO AUTH LOW CX NO UI | NATS Server is a high-performance server for NATS.io, the cloud and edge native | |
|
70
|
CVE-2026-55454 |
9.9 | 0.0060 | NET LOW CX NO UI | Appsmith is a platform to build admin panels, internal tools, and dashboards. Pr | |
|
70
|
CVE-2026-42823 |
9.9 | 0.0060 | NET LOW CX NO UI | Improper access control in Azure Logic Apps allows an authorized attacker to ele | |
|
69
|
CVE-2025-11366 |
9.4 | 0.0060 | NET LOW CX NO UI | N-central < 2025.4 is vulnerable to authentication bypass via path traversal | |
|
68
|
CVE-2026-108426 |
8.8 | 0.0060 | NET NO AUTH LOW CX | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attac | |
|
68
|
CVE-2026-41138 |
8.8 | 0.0060 | NET LOW CX NO UI | Flowise is a drag & drop user interface to build a customized large language mod | |
|
68
|
CVE-2026-96943 |
8.8 | 0.0060 | NET NO AUTH LOW CX | Integer overflow or wraparound in Windows Raw Image Extension allows an unauthor | |
|
68
|
CVE-2026-97767 |
8.8 | 0.0060 | NET NO AUTH LOW CX | Double free in Microsoft Office Excel allows an unauthorized attacker to execute | |
|
68
|
CVE-2026-97778 |
8.8 | 0.0060 | NET NO AUTH LOW CX | Integer overflow or wraparound in Microsoft Office Excel allows an unauthorized | |
|
68
|
CVE-2026-55676 |
8.7 | 0.0060 | NET LOW CX NO UI | Malcolm is a network traffic analysis tool suite. The file-upload component (Fil | |
|
68
|
CVE-2026-109440 |
8.7 | 0.0060 | NET NO AUTH LOW CX | LangAlpha through 2026.09.07 contains an indirect prompt injection vulnerability | |
|
68
|
CVE-2026-25707 |
8.8 | 0.0060 | NET NO AUTH LOW CX | A relative path traversal bug problem when processing repository metadata in lib | |
|
66
|
CVE-2026-119977 |
8.1 | 0.0060 | NET NO AUTH NO UI | WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7. | |
|
65
|
CVE-2026-87865 |
7.4 | 0.0060 | NET NO AUTH NO UI | When libcurl uses libssh2 with a hashed `known_hosts` file, an unrelated initial | |
|
65
|
CVE-2026-10665 |
7.4 | 0.0060 | NET NO AUTH NO UI | In Zephyr's WireGuard subsystem (subsys/net/lib/wireguard), wg_process_data_mess | |
|
62
|
CVE-2026-13054 |
8.6 | 0.0060 | NET LOW CX NO UI | A path traversal vulnerability in the WatchGuard Fireware OS Management Web UI a | |
|
60
|
CVE-2026-114622 |
7.2 | 0.0060 | NET LOW CX NO UI | baserCMS is a website development framework. In versions 5.2.3 before 5.3.2 and | |
|
59
|
CVE-2026-74044 |
7.0 | 0.0060 | NET LOW CX NO UI | Wazuh 4.0.0 before 4.14.6 contains a path traversal vulnerability that allows au | |
|
51
|
CVE-2026-96956 |
8.0 | 0.0060 | NET NO UI | Stack-based buffer overflow in SQL Server allows an authorized attacker to eleva | |
|
51
|
CVE-2023-4379 |
8.1 | 0.0060 | NET LOW CX | An issue has been discovered in GitLab EE affecting all versions starting from 1 |