Hunt List
12,912 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-104317 |
9.8 | 0.0059 | NET NO AUTH LOW CX NO UI | IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote attacker who could re | |
|
80
|
CVE-2026-48085 |
9.8 | 0.0059 | NET NO AUTH LOW CX NO UI | OpenReception's appointment booking software provides an end-to-end encrypted ap | |
|
79
|
CVE-2026-57580 |
9.4 | 0.0059 | NET NO AUTH LOW CX NO UI | authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, a | |
|
78
|
CVE-2026-112400 |
8.7 | 0.0059 | NET NO AUTH LOW CX NO UI | Pillow is a Python imaging library. From 9.2.0 until 13.0.0, Pillow can retain a | |
|
78
|
CVE-2026-112402 |
8.7 | 0.0059 | NET NO AUTH LOW CX NO UI | Pillow is a Python imaging library. Prior to 13.0.0, Pillow can double free imag | |
|
78
|
CVE-2026-112405 |
8.7 | 0.0059 | NET NO AUTH LOW CX NO UI | Pillow is a Python imaging library. From 12.0.0 until 13.0.0, Pillow's Image.mer | |
|
78
|
CVE-2026-112894 |
8.7 | 0.0059 | NET NO AUTH LOW CX NO UI | Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow takes quadra | |
|
78
|
CVE-2026-112895 |
8.7 | 0.0059 | NET NO AUTH LOW CX NO UI | Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow can exhaust | |
|
78
|
CVE-2026-59708 |
8.7 | 0.0059 | NET NO AUTH LOW CX NO UI | The GET /api/v1/public/:accessId/portfolio endpoint in ghostfolio accepts privat | |
|
78
|
CVE-2026-33079 |
8.7 | 0.0059 | NET NO AUTH LOW CX NO UI | In versions 3.0.0a1 through 3.2.0 of Mistune, there is a ReDoS (Regular Expressi | |
|
78
|
CVE-2026-53869 |
8.7 | 0.0059 | NET NO AUTH LOW CX NO UI | Hermes Agent before 0.16.0 contains a DNS rebinding vulnerability in WebSocket e | |
|
78
|
CVE-2026-111613 |
8.7 | 0.0059 | NET NO AUTH LOW CX NO UI | AllData through 0.7.1 contains an unauthenticated JDBC injection vulnerability t | |
|
78
|
CVE-2026-6351 |
8.7 | 0.0059 | NET NO AUTH LOW CX NO UI | MailGates/MailAudit developed by Openfind has a CRLF Injection vulnerability, al | |
|
77
|
CVE-2026-15061 |
8.2 | 0.0059 | NET NO AUTH LOW CX NO UI | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 's nimesis registration service co | |
|
77
|
CVE-2026-112390 |
8.2 | 0.0059 | NET NO AUTH LOW CX NO UI | Pillow is a Python imaging library. From 7.2.0 until 13.0.0, Pillow can enter an | |
|
77
|
CVE-2026-112392 |
8.2 | 0.0059 | NET NO AUTH LOW CX NO UI | Pillow is a Python imaging library. Prior to 13.0.0, Pillow's rank-based filters | |
|
77
|
CVE-2026-45309 |
8.2 | 0.0059 | NET NO AUTH LOW CX NO UI | AsyncSSH is a Python package which provides an asynchronous client and server im | |
|
77
|
CVE-2026-47719 |
8.2 | 0.0059 | NET NO AUTH LOW CX NO UI | FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior | |
|
77
|
CVE-2026-57191 |
8.2 | 0.0059 | NET NO AUTH LOW CX NO UI | Asterisk is an open source private branch exchange and telephony toolkit. Prior | |
|
75
|
CVE-2026-56741 |
7.5 | 0.0060 | NET NO AUTH LOW CX NO UI | JLine is a Java library for handling console input. Prior to 3.30.14, 4.0.16, an | |
|
75
|
CVE-2026-98401 |
7.5 | 0.0060 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: net: iptunn | |
|
75
|
CVE-2026-56387 |
7.5 | 0.0060 | NET NO AUTH LOW CX NO UI | The RTMP AMF parser in Apache bRPC accepts AMF string lengths and array counts d | |
|
75
|
CVE-2026-114138 |
7.5 | 0.0060 | NET NO AUTH LOW CX NO UI | Django REST framework is a toolkit for building Web APIs. Prior to 3.18.2, Defau | |
|
75
|
CVE-2026-29169 |
7.5 | 0.0059 | NET NO AUTH LOW CX NO UI | A NULL pointer dereference in mod_dav_lock in Apache HTTP Server 2.4.66 and earl | |
|
75
|
CVE-2026-56740 |
7.5 | 0.0059 | NET NO AUTH LOW CX NO UI | JLine is a Java library for handling console input. Prior to 3.30.14, 4.0.16, an | |
|
75
|
CVE-2026-93446 |
7.5 | 0.0059 | NET NO AUTH LOW CX NO UI | Incomplete cleanup vulnerability in Apache Tomcat could cause TLS 1.3 connection | |
|
75
|
CVE-2024-27686 |
7.5 | 0.0059 | NET NO AUTH LOW CX NO UI | Mikrotik RouterOS (x86) 6.40.5 through 6.49.10 (fixed in 7) allows a remote atta | |
|
70
|
CVE-2026-8635 |
9.9 | 0.0059 | NET LOW CX NO UI | IBM Langflow OSS 1.0.0 through 1.10.0 allows authenticated users to escalate pri | |
|
70
|
CVE-2026-63293 |
9.9 | 0.0059 | NET LOW CX NO UI | A link following vulnerability in LXD allows an attacker to achieve arbitrary fi | |
|
70
|
CVE-2026-66898 |
9.9 | 0.0059 | NET LOW CX NO UI | A path traversal vulnerability in LXD allows an attacker to manipulate file syst | |
|
70
|
CVE-2026-69399 |
9.9 | 0.0059 | NET LOW CX NO UI | Unintended proxy or intermediary in Azure Arc allows an authorized attacker to e | |
|
68
|
CVE-2026-14534 |
8.8 | 0.0059 | NET NO AUTH LOW CX | Trail of Bits fickling versions up to and including 0.1.10 do not include the Py | |
|
68
|
CVE-2026-83929 |
8.8 | 0.0059 | NET NO AUTH LOW CX | Out-of-bounds write in Windows GDI allows an unauthorized attacker to execute co | |
|
68
|
CVE-2026-7841 |
8.8 | 0.0059 | NET LOW CX NO UI | A remote code execution vulnerability exists in Notification Settings on GeoVisi | |
|
68
|
CVE-2026-46414 |
8.8 | 0.0059 | NET LOW CX NO UI | Microsoft UFO open-source framework for intelligent automation across devices an | |
|
68
|
CVE-2026-65921 |
8.8 | 0.0059 | NET LOW CX NO UI | A path validation weakness in archive extraction/write handling allows entries w | |
|
68
|
CVE-2026-115189 |
8.8 | 0.0059 | NET LOW CX NO UI | A server-side template injection vulnerability exists in the Twig theme renderin | |
|
68
|
CVE-2026-112655 |
8.8 | 0.0059 | NET NO AUTH LOW CX | A use-after-free issue was addressed with improved memory management. This issue | |
|
68
|
CVE-2026-33858 |
8.8 | 0.0059 | NET LOW CX NO UI | Dag Authors, who normally should not be able to execute code in the webserver co | |
|
68
|
CVE-2026-41208 |
8.8 | 0.0059 | NET LOW CX NO UI | Paperclip is a Node.js server and React UI that orchestrates a team of AI agents | |
|
68
|
CVE-2026-86055 |
8.7 | 0.0059 | NET NO AUTH LOW CX | Part-DB is an open source inventory management system for electronic components. | |
|
66
|
CVE-2026-79887 |
8.1 | 0.0059 | NET NO AUTH NO UI | A vulnerability in the web interface of AOS-8 could allow an unauthenticated rem | |
|
66
|
CVE-2026-89682 |
8.1 | 0.0059 | NET NO AUTH NO UI | In the Linux kernel, the following vulnerability has been resolved: nfsd: fix f | |
|
66
|
CVE-2026-89709 |
8.1 | 0.0059 | NET NO AUTH NO UI | In the Linux kernel, the following vulnerability has been resolved: lockd, nfsd | |
|
66
|
CVE-2026-90301 |
8.1 | 0.0059 | NET NO AUTH NO UI | In the Linux kernel, the following vulnerability has been resolved: ocfs2: o2hb | |
|
65
|
CVE-2026-73030 |
7.2 | 0.0059 | NET NO AUTH LOW CX | unearth through 0.18.2, fixed in commit 6c78164, contains a path traversal vulne | |
|
60
|
CVE-2026-113673 |
7.2 | 0.0060 | NET LOW CX NO UI | The GeoDirectory WordPress plugin before 2.8.194 does not properly escape admin | |
|
60
|
CVE-2026-29782 |
7.2 | 0.0059 | NET LOW CX NO UI | OpenSTAManager is an open source management software for technical assistance an | |
|
59
|
CVE-2026-114399 |
7.0 | 0.0059 | NET LOW CX NO UI | Trudesk through 1.2.11 contains a path traversal vulnerability that allows admin | |
|
46
|
CVE-2026-83948 |
8.0 | 0.0059 | NET | Improper neutralization of special elements used in a command ('command injectio |