Hunt List
12,917 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-35546 |
9.8 | 0.0059 | NET NO AUTH LOW CX NO UI | Anviz CX2 Lite and CX7 are vulnerable to unauthenticated firmware uploads. This | |
|
80
|
CVE-2026-39873 |
9.8 | 0.0059 | NET NO AUTH LOW CX NO UI | The issue was addressed with improved memory handling. This issue is fixed in ma | |
|
80
|
CVE-2026-43694 |
9.8 | 0.0059 | NET NO AUTH LOW CX NO UI | The issue was addressed with improved memory handling. This issue is fixed in ma | |
|
80
|
CVE-2026-43710 |
9.8 | 0.0059 | NET NO AUTH LOW CX NO UI | The issue was addressed with improved memory handling. This issue is fixed in ma | |
|
80
|
CVE-2026-43748 |
9.8 | 0.0059 | NET NO AUTH LOW CX NO UI | An out-of-bounds write issue was addressed with improved bounds checking. This i | |
|
80
|
CVE-2026-43764 |
9.8 | 0.0059 | NET NO AUTH LOW CX NO UI | An integer overflow was addressed with improved input validation. This issue is | |
|
80
|
CVE-2026-43773 |
9.8 | 0.0059 | NET NO AUTH LOW CX NO UI | An out-of-bounds read was addressed with improved bounds checking. This issue is | |
|
80
|
CVE-2026-43793 |
9.8 | 0.0059 | NET NO AUTH LOW CX NO UI | An issue existed in the handling of environment variables. This issue was addres | |
|
80
|
CVE-2026-64694 |
9.8 | 0.0059 | NET NO AUTH LOW CX NO UI | An integer overflow was addressed with improved input validation. This issue is | |
|
80
|
CVE-2026-64697 |
9.8 | 0.0059 | NET NO AUTH LOW CX NO UI | The issue was addressed with improved memory handling. This issue is fixed in ma | |
|
80
|
CVE-2026-64698 |
9.8 | 0.0059 | NET NO AUTH LOW CX NO UI | The issue was addressed with improved memory handling. This issue is fixed in ma | |
|
80
|
CVE-2026-64704 |
9.8 | 0.0059 | NET NO AUTH LOW CX NO UI | A type confusion issue was addressed with improved memory handling. This issue i | |
|
79
|
CVE-2026-57580 |
9.4 | 0.0059 | NET NO AUTH LOW CX NO UI | authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, a | |
|
79
|
CVE-2026-111312 |
9.2 | 0.0059 | NET NO AUTH LOW CX NO UI | OpenHealth through 0.2.0 contains a missing authentication and authorization vul | |
|
78
|
CVE-2026-57480 |
8.7 | 0.0059 | NET NO AUTH LOW CX NO UI | Parse Server is an open source backend that can be deployed to any infrastructur | |
|
78
|
CVE-2026-73413 |
8.7 | 0.0059 | NET NO AUTH LOW CX NO UI | Shescape is a simple shell escape library for JavaScript. From 2.1.11 until 2.1. | |
|
78
|
CVE-2026-20706 |
9.1 | 0.0059 | NET NO AUTH LOW CX NO UI | Gitea versions up to and including 1.26.1 allow repository archive downloads to | |
|
78
|
CVE-2026-48039 |
9.1 | 0.0059 | NET NO AUTH LOW CX NO UI | Meta Ads MCP is a Model Context Protocol (MCP) server that lets AI assistants ru | |
|
78
|
CVE-2026-35089 |
8.7 | 0.0059 | NET NO AUTH LOW CX NO UI | In Slican telephone exchanges secure key is generated in a predictable manner us | |
|
78
|
CVE-2026-34191 |
9.1 | 0.0059 | NET NO AUTH LOW CX NO UI | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti | |
|
78
|
CVE-2026-53779 |
8.7 | 0.0059 | NET NO AUTH LOW CX NO UI | WebP Server Go through 0.14.4 contains a path traversal vulnerability on Windows | |
|
78
|
CVE-2026-53434 |
9.1 | 0.0059 | NET NO AUTH LOW CX NO UI | Detection of Error Condition Without Action vulnerability in Apache Tomcat when | |
|
77
|
CVE-2026-114092 |
8.3 | 0.0059 | NET NO AUTH LOW CX NO UI | Trigger.dev before 4.5.0 performs no authentication or organization check in the | |
|
77
|
CVE-2026-58177 |
8.3 | 0.0059 | NET NO AUTH LOW CX NO UI | The Apache Traffic Server Cripts framework has out-of-bounds writes, path traver | |
|
77
|
CVE-2026-5423 |
8.2 | 0.0059 | NET NO AUTH LOW CX NO UI | @neo4j/graphql library versions prior to 7.5.6 fail to verify the authenticity o | |
|
75
|
CVE-2026-44630 |
7.5 | 0.0059 | NET NO AUTH LOW CX NO UI | Improper validation of length fields in the Apache IoTDB RPC service may allow a | |
|
75
|
CVE-2026-65942 |
7.5 | 0.0059 | NET NO AUTH LOW CX NO UI | TLS hostname verification issue in Apache Ranger Client Code in versions <= 2.8. | |
|
75
|
CVE-2026-92390 |
7.5 | 0.0059 | NET NO AUTH LOW CX NO UI | When invoked with `--remote-header-name` (`-J`), curl fails to preserve its docu | |
|
75
|
CVE-2026-36590 |
7.5 | 0.0059 | NET NO AUTH LOW CX NO UI | An issue in EMQ NanoMQ v.0.24.9 allows a remote attacker to cause a denial of se | |
|
75
|
CVE-2026-19654 |
7.5 | 0.0059 | NET NO AUTH LOW CX NO UI | A unauthenticated remote peer may lead rsyslogd to crash due to a flaw in the op | |
|
70
|
CVE-2026-63299 |
9.9 | 0.0059 | NET LOW CX NO UI | An authorization bypass vulnerability in LXD allows an authenticated user to byp | |
|
70
|
CVE-2026-41512 |
9.9 | 0.0059 | NET LOW CX NO UI | ai-scanner is an AI model safety scanner built on NVIDIA garak. From version 1.0 | |
|
68
|
CVE-2026-97758 |
8.8 | 0.0059 | NET NO AUTH LOW CX | Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized atta | |
|
68
|
CVE-2026-75853 |
8.7 | 0.0059 | NET LOW CX NO UI | ArcadeDB's Gremlin wire-protocol plugin (com.arcadedb:arcadedb-gremlin) in versi | |
|
68
|
CVE-2026-50186 |
8.8 | 0.0059 | NET LOW CX NO UI | 4gaBoards is a boards system for realtime project management. Prior to 3.3.8, 4g | |
|
68
|
CVE-2026-85890 |
8.8 | 0.0059 | NET NO AUTH LOW CX | Double free in Microsoft Edge (Chromium-based) allows an unauthorized attacker t | |
|
68
|
CVE-2026-85897 |
8.8 | 0.0059 | NET NO AUTH LOW CX | Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthor | |
|
68
|
CVE-2026-96198 |
8.8 | 0.0059 | NET NO AUTH LOW CX | Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthor | |
|
68
|
CVE-2026-96199 |
8.8 | 0.0059 | NET NO AUTH LOW CX | Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthor | |
|
68
|
CVE-2025-40937 |
8.7 | 0.0059 | NET LOW CX NO UI | A vulnerability has been identified in SIMATIC CN 4100 (All versions < V4.0.1). | |
|
67
|
CVE-2026-19734 |
8.6 | 0.0059 | NET LOW CX NO UI | Missing Authorization and Authorization Bypass Through User-Controlled Key in th | |
|
66
|
CVE-2025-58214 |
8.1 | 0.0059 | NET NO AUTH NO UI | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP | |
|
66
|
CVE-2026-89848 |
8.1 | 0.0059 | NET NO AUTH NO UI | In the Linux kernel, the following vulnerability has been resolved: scsi: qla2x | |
|
65
|
CVE-2026-48787 |
7.4 | 0.0059 | NET LOW CX NO UI | gin-vue-admin is an AI-assisted basic development platform. In version 2.9.1, an | |
|
65
|
CVE-2026-96222 |
7.4 | 0.0059 | NET NO AUTH NO UI | Improper certificate validation in Active Directory Federation Services (AD FS) | |
|
64
|
CVE-2026-65607 |
7.1 | 0.0059 | NET LOW CX NO UI | SiYuan before v3.7.2 contains a path traversal vulnerability in the /export/temp | |
|
63
|
CVE-2026-20310 |
9.1 | 0.0059 | NET LOW CX NO UI | As part of Cisco's ongoing commitment to proactive security and product quality, | |
|
63
|
CVE-2026-54406 |
8.7 | 0.0059 | NET LOW CX NO UI | A malicious actor with access to the network and high privileges could exploit a | |
|
56
|
CVE-2026-21575 |
8.0 | 0.0059 | NET LOW CX | This High severity RCE (Remote Code Execution) vulnerability was introduced in v | |
|
55
|
CVE-2026-88207 |
7.5 | 0.0059 | NET NO AUTH | Heap-based buffer overflow in Microsoft Office PowerPoint allows an unauthorized |