Hunt List
12,911 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-12485 |
10.0 | 0.0060 | NET NO AUTH LOW CX NO UI | GV-I/O Box 4E is a smart embedded device with 4 input and 4 relays output that c | |
|
80
|
CVE-2026-12846 |
10.0 | 0.0060 | NET NO AUTH LOW CX NO UI | GV-I/O Box 4E is a smart embedded device with 4 input and 4 relays output that c | |
|
80
|
CVE-2026-12847 |
10.0 | 0.0060 | NET NO AUTH LOW CX NO UI | GV-I/O Box 4E is a smart embedded device with 4 input and 4 relays output that c | |
|
80
|
CVE-2026-12848 |
10.0 | 0.0060 | NET NO AUTH LOW CX NO UI | GV-I/O Box 4E is a smart embedded device with 4 input and 4 relays output that c | |
|
80
|
CVE-2026-5442 |
9.8 | 0.0060 | NET NO AUTH LOW CX NO UI | A heap buffer overflow vulnerability exists in the DICOM image decoder. Dimensio | |
|
80
|
CVE-2026-59144 |
9.8 | 0.0060 | NET NO AUTH LOW CX NO UI | Data::RingBuffer::Shared versions before 0.04 for Perl allow a stack buffer over | |
|
80
|
CVE-2024-26011 |
9.8 | 0.0060 | NET NO AUTH LOW CX NO UI | A missing authentication for critical function vulnerability in Fortinet FortiMa | |
|
80
|
CVE-2026-40050 |
9.8 | 0.0060 | NET NO AUTH LOW CX NO UI | CrowdStrike has released security updates to address a critical unauthenticated | |
|
80
|
CVE-2026-40008 |
9.8 | 0.0060 | NET NO AUTH LOW CX NO UI | Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection | |
|
80
|
CVE-2026-10697 |
9.8 | 0.0060 | NET NO AUTH LOW CX NO UI | Improper Authentication vulnerability in Progress MOVEit Transfer. This issue a | |
|
80
|
CVE-2026-16350 |
9.8 | 0.0060 | NET NO AUTH LOW CX NO UI | Incorrect boundary conditions in the Audio/Video: cubeb component. This vulnerab | |
|
80
|
CVE-2026-16353 |
9.8 | 0.0060 | NET NO AUTH LOW CX NO UI | Invalid pointer in the DOM: Bindings (WebIDL) component. This vulnerability was | |
|
80
|
CVE-2026-16355 |
9.8 | 0.0060 | NET NO AUTH LOW CX NO UI | JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability w | |
|
80
|
CVE-2026-16357 |
9.8 | 0.0060 | NET NO AUTH LOW CX NO UI | Incorrect boundary conditions in the Graphics component. This vulnerability was | |
|
79
|
CVE-2026-117564 |
9.3 | 0.0060 | NET NO AUTH LOW CX NO UI | nest-admin before 1.0.1 contains an authentication bypass vulnerability that all | |
|
79
|
CVE-2026-64625 |
9.3 | 0.0060 | NET NO AUTH LOW CX NO UI | AVideo before 29.0 contains an incomplete fix for CVE-2026-45578 where execAsync | |
|
79
|
CVE-2026-118633 |
9.2 | 0.0060 | NET NO AUTH LOW CX NO UI | A path traversal vulnerability allows a remote unauthenticated attacker to execu | |
|
78
|
CVE-2026-37637 |
9.1 | 0.0060 | NET NO AUTH LOW CX NO UI | An issue in Alexantr filemanager v.1.0 allows a remote attacker to execute arbit | |
|
78
|
CVE-2019-25776 |
8.7 | 0.0060 | NET NO AUTH LOW CX NO UI | Weaver E-cology contains an unauthenticated SQL injection vulnerability that all | |
|
78
|
CVE-2026-41041 |
9.1 | 0.0060 | NET NO AUTH LOW CX NO UI | URL path injection via unencoded user-supplied identifiers vulnerability in Apac | |
|
78
|
CVE-2026-39912 |
9.1 | 0.0060 | NET NO AUTH LOW CX NO UI | V2Board 1.6.1 through 1.7.4 and Xboard through 0.1.9 expose authentication token | |
|
78
|
CVE-2026-89672 |
9.1 | 0.0060 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: nfsd: gate | |
|
77
|
CVE-2026-16857 |
8.2 | 0.0060 | NET NO AUTH LOW CX NO UI | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to m | |
|
75
|
CVE-2026-75507 |
7.5 | 0.0060 | NET NO AUTH LOW CX NO UI | GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3 | |
|
75
|
CVE-2025-14874 |
7.5 | 0.0060 | NET NO AUTH LOW CX NO UI | A flaw was found in Nodemailer. This vulnerability allows a denial of service (D | |
|
75
|
CVE-2026-13369 |
7.5 | 0.0060 | NET NO AUTH LOW CX NO UI | The Ninja Forms - File Uploads plugin for WordPress is vulnerable to Arbitrary F | |
|
75
|
CVE-2026-12413 |
7.5 | 0.0060 | NET NO AUTH LOW CX NO UI | An invalidly formatted IKEv2 fragment causes the Libreswan pluto daemon to crash | |
|
75
|
CVE-2026-73246 |
7.5 | 0.0060 | NET NO AUTH LOW CX NO UI | Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0-rc | |
|
75
|
CVE-2026-51367 |
7.5 | 0.0060 | NET NO AUTH LOW CX NO UI | An issue in Bottinelli Informatica Vedo Suite v.1.2.5 allows a remote attacker t | |
|
75
|
CVE-2026-90885 |
7.5 | 0.0060 | NET NO AUTH LOW CX NO UI | Improper Restriction of XML External Entity Reference vulnerability in Apache Ca | |
|
75
|
CVE-2026-3366 |
7.5 | 0.0060 | NET NO AUTH LOW CX NO UI | IBM InfoSphere Optim Test Data Fabrication 1.0.0, 1.0.0.1, 1.0.0.2, 1.0.2, 1.0.2 | |
|
69
|
CVE-2026-67330 |
9.4 | 0.0060 | NET LOW CX NO UI | @better-auth/scim (a better-auth plugin) versions >= 1.4.0-beta.27 through <= 1. | |
|
69
|
CVE-2026-8178 |
9.2 | 0.0060 | NET NO AUTH NO UI | An issue exists in Amazon Redshift JDBC Driver versions prior to 2.2.2. Under ce | |
|
68
|
CVE-2026-21042 |
8.7 | 0.0060 | NET LOW CX NO UI | Out-of-bounds write in libsavsac.so prior to SMR Jul-2026 Release 1 allows remot | |
|
68
|
CVE-2026-42096 |
8.7 | 0.0060 | NET LOW CX NO UI | Sparx Pro Cloud Server is vulnerable to Broken Access Control within communicati | |
|
68
|
CVE-2026-73485 |
9.0 | 0.0060 | NET LOW CX NO UI | Flowise before 3.1.3 contains a code injection vulnerability in the Airtable Age | |
|
68
|
CVE-2026-28940 |
8.8 | 0.0060 | NET NO AUTH LOW CX | The issue was addressed with improved memory handling. This issue is fixed in iO | |
|
68
|
CVE-2026-56767 |
8.7 | 0.0060 | NET LOW CX NO UI | Maxun before 0.0.42 contains a cross-tenant insecure direct object reference vul | |
|
68
|
CVE-2026-9863 |
8.8 | 0.0060 | NET NO AUTH LOW CX | Fortra BoKS Manager contains an OS command injection vulnerability in the client | |
|
66
|
CVE-2026-59245 |
8.1 | 0.0060 | NET LOW CX NO UI | In the Apache Airflow FAB auth manager, a DAG whose `dag_id` is `DAGs` collided | |
|
65
|
CVE-2026-84003 |
7.4 | 0.0060 | NET NO AUTH NO UI | Authentication bypass by capture-replay in Microsoft Authentication Library (MSA | |
|
65
|
CVE-2026-19341 |
7.4 | 0.0060 | NET LOW CX NO UI | A security vulnerability has been detected in UTT HiPER 1200GW up to 2.5.3-17030 | |
|
63
|
CVE-2026-10132 |
9.1 | 0.0060 | NET LOW CX NO UI | A stack-based buffer overflow vulnerability exists in the boa formIpQos mac func | |
|
63
|
CVE-2026-10133 |
9.1 | 0.0060 | NET LOW CX NO UI | A stack-based buffer overflow vulnerability exists in the batchupg functionality | |
|
63
|
CVE-2026-10136 |
9.1 | 0.0060 | NET LOW CX NO UI | A heap-based buffer overflow vulnerability exists in the boa formUpload() functi | |
|
63
|
CVE-2026-10137 |
9.1 | 0.0060 | NET LOW CX NO UI | A stack-based buffer overflow vulnerability exists in the boa formUpload() funct | |
|
63
|
CVE-2026-43639 |
8.9 | 0.0060 | NET LOW CX NO UI | Bitwarden Server prior to v2026.4.0 contains a missing authorization vulnerabili | |
|
63
|
CVE-2026-116852 |
9.1 | 0.0060 | NET LOW CX NO UI | Author Remote Code Execution (RCE) in Widget Options <= 4.2.5 versions. | |
|
60
|
CVE-2026-44878 |
7.2 | 0.0060 | NET LOW CX NO UI | A vulnerability in the web-based management interface of an ECOS device could al | |
|
51
|
CVE-2026-75569 |
7.7 | 0.0060 | NET NO UI | A flaw was found in mce-operator-bundle. The build process fetches and executes |