Hunt List
12,918 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-16351 |
9.8 | 0.0058 | NET NO AUTH LOW CX NO UI | Sandbox escape due to use-after-free in the DOM: Navigation component. This vuln | |
|
80
|
CVE-2026-16352 |
9.8 | 0.0058 | NET NO AUTH LOW CX NO UI | Sandbox escape due to use-after-free in the Disability Access APIs component. Th | |
|
80
|
CVE-2026-16356 |
9.8 | 0.0058 | NET NO AUTH LOW CX NO UI | Sandbox escape due to use-after-free in the Disability Access APIs component. Th | |
|
80
|
CVE-2026-7413 |
9.8 | 0.0058 | NET NO AUTH LOW CX NO UI | A hidden, persistent backdoor was found in Yarbo firmware v2.3.9 that provides r | |
|
80
|
CVE-2026-5801 |
9.8 | 0.0058 | NET NO AUTH LOW CX NO UI | Improper neutralization of special elements used in an SQL command ('SQL injecti | |
|
80
|
CVE-2025-56563 |
9.8 | 0.0058 | NET NO AUTH LOW CX NO UI | A Server-Side Request Forgery vulnerability exists in sat_proxy.php in Zenith Sa | |
|
80
|
CVE-2024-53095 |
9.8 | 0.0058 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: smb: client | |
|
80
|
CVE-2026-101521 |
9.8 | 0.0058 | NET NO AUTH LOW CX NO UI | Vulnerability in Oracle APEX (component: General). Supported versions that are | |
|
80
|
CVE-2026-67429 |
10.0 | 0.0057 | NET NO AUTH LOW CX NO UI | Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior | |
|
80
|
CVE-2026-109516 |
9.8 | 0.0057 | NET NO AUTH LOW CX NO UI | The Bot for Telegram on WooCommerce plugin for WordPress is vulnerable to Authen | |
|
80
|
CVE-2026-118636 |
9.8 | 0.0057 | NET NO AUTH LOW CX NO UI | **UNSUPPORTED WHEN ASSIGNED** JavaNativeMessageDecoder in the MINA 3.0 codec m | |
|
80
|
CVE-2026-48087 |
9.8 | 0.0057 | NET NO AUTH LOW CX NO UI | OpenReception's appointment booking software provides an end-to-end encrypted ap | |
|
79
|
CVE-2026-78403 |
9.3 | 0.0058 | NET NO AUTH LOW CX NO UI | Stack-based buffer overflow and missing authorization vulnerability in Thales Se | |
|
79
|
CVE-2026-53983 |
9.2 | 0.0057 | NET NO AUTH LOW CX NO UI | Ground Station prior to 0.6.0 contains an unauthenticated blind server-side requ | |
|
78
|
CVE-2026-71979 |
8.7 | 0.0058 | NET NO AUTH LOW CX NO UI | INDI (Instrument Neutral Distributed Interface) indiserver through 2.2.4.2, fixe | |
|
78
|
CVE-2026-12087 |
9.1 | 0.0057 | NET NO AUTH LOW CX NO UI | Socket versions before 2.041 for Perl have an out-of-bounds heap read. In Socke | |
|
78
|
CVE-2026-53224 |
9.1 | 0.0057 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: sctp: valid | |
|
78
|
CVE-2026-58226 |
8.7 | 0.0057 | NET NO AUTH LOW CX NO UI | Inefficient Algorithmic Complexity vulnerability in elixir-mint hpax allows unau | |
|
77
|
CVE-2026-52854 |
8.6 | 0.0058 | NET NO AUTH LOW CX NO UI | Maps is a MediaWiki extension that enables visualization of geographic data thro | |
|
77
|
CVE-2026-14254 |
8.3 | 0.0058 | NET NO AUTH LOW CX NO UI | A race condition in the account lockout mechanism in Delphix Continous Data allo | |
|
77
|
CVE-2026-53571 |
8.2 | 0.0058 | NET NO AUTH LOW CX NO UI | Vite is a frontend tooling framework for JavaScript. Prior to 8.0.16, 7.3.5, and | |
|
75
|
CVE-2025-52290 |
7.5 | 0.0058 | NET NO AUTH LOW CX NO UI | A NULL pointer dereference in the avpriv_h264_has_num_reorder_frames function of | |
|
75
|
CVE-2026-107020 |
7.5 | 0.0058 | NET NO AUTH LOW CX NO UI | An issue in the activity.LoadLinkLaterActivity component of FeedEx / Handy News | |
|
75
|
CVE-2026-48911 |
7.5 | 0.0057 | NET NO AUTH LOW CX NO UI | Insufficient Verification of Data Authenticity vulnerability in Apache Answer. | |
|
75
|
CVE-2026-59954 |
7.5 | 0.0057 | NET NO AUTH LOW CX NO UI | Apollo is a reliable configuration management system suitable for microservice c | |
|
75
|
CVE-2026-59955 |
7.5 | 0.0057 | NET NO AUTH LOW CX NO UI | Apollo is a reliable configuration management system suitable for microservice c | |
|
70
|
CVE-2026-58046 |
9.9 | 0.0057 | NET LOW CX NO UI | Improper neutralization in the Plesk XML-RPC API allows a remote authenticated l | |
|
68
|
CVE-2026-41139 |
8.8 | 0.0058 | NET LOW CX NO UI | Math.js is an extensive math library for JavaScript and Node.js. From version 13 | |
|
68
|
CVE-2026-50622 |
8.8 | 0.0058 | NET LOW CX NO UI | Description: Missing Authorization in Apache Atlas. A missing authorization vuln | |
|
68
|
CVE-2026-114045 |
8.7 | 0.0058 | NET LOW CX NO UI | FreeRDP before 3.32.1 contains a heap-based buffer overflow in the server-side r | |
|
68
|
CVE-2026-114107 |
8.7 | 0.0058 | NET NO AUTH LOW CX | HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains an indirect prompt injection | |
|
68
|
CVE-2026-55771 |
8.8 | 0.0057 | NET LOW CX NO UI | CedarJava is an open source Java implementation of the Cedar policy language, us | |
|
68
|
CVE-2026-112626 |
8.8 | 0.0057 | NET NO AUTH LOW CX | A use-after-free issue was addressed with improved memory management. This issue | |
|
68
|
CVE-2026-110309 |
8.8 | 0.0057 | NET LOW CX NO UI | IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacke | |
|
68
|
CVE-2026-13717 |
8.8 | 0.0057 | NET LOW CX NO UI | A flaw was found in the Red Hat OpenShift AI (RHOAI) MaaS Gateway. Improper conf | |
|
66
|
CVE-2026-51924 |
8.1 | 0.0057 | NET LOW CX NO UI | An issue in docuForm GmbH Client v.11.11c allows a remote attacker to execute ar | |
|
66
|
CVE-2026-18692 |
7.7 | 0.0057 | NET LOW CX NO UI | An issue in MongoDB Server's handling of timeseries bucket lifecycle could allow | |
|
65
|
CVE-2026-16907 |
7.6 | 0.0057 | NET LOW CX NO UI | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to exec | |
|
65
|
CVE-2026-6168 |
7.4 | 0.0057 | NET LOW CX NO UI | A flaw has been found in TOTOLINK A7000R up to 9.1.0u.6115. The affected element | |
|
65
|
CVE-2026-6196 |
7.4 | 0.0057 | NET LOW CX NO UI | A vulnerability was detected in Tenda F456 1.0.0.5. This affects the function fr | |
|
65
|
CVE-2026-103577 |
7.5 | 0.0057 | NET NO AUTH NO UI | Insecure default variable initialization in Microsoft QUIC allows an unauthorize | |
|
65
|
CVE-2026-73620 |
7.2 | 0.0057 | NET LOW CX NO UI | GitPython before 3.1.57 fails to guard git option forwarding in IndexFile.checko | |
|
64
|
CVE-2026-57977 |
7.1 | 0.0058 | NET NO AUTH LOW CX | Improper neutralization of input during web page generation ('cross-site scripti | |
|
63
|
CVE-2026-28312 |
9.1 | 0.0058 | NET LOW CX NO UI | SolarWinds Serv-U is affected by a privilege escalation vulnerability. This woul | |
|
63
|
CVE-2026-28321 |
9.1 | 0.0058 | NET LOW CX NO UI | SolarWinds Serv-U is affected by a broken access control vulnerability that coul | |
|
63
|
CVE-2026-10090 |
9.0 | 0.0058 | NET LOW CX NO UI | A flaw was found in the Application Subscription controller (multicluster-operat | |
|
63
|
CVE-2026-42555 |
9.1 | 0.0058 | NET LOW CX NO UI | Valtimo is an open-source business process automation platform. com.ritense.valt | |
|
63
|
CVE-2026-58256 |
9.1 | 0.0057 | NET LOW CX NO UI | GRR is a resource management and reservation application. Prior to the advisory- | |
|
59
|
CVE-2026-63301 |
7.0 | 0.0057 | NET LOW CX NO UI | In Quick.CMS, the administrative user interface restricts deletion of the primar | |
|
58
|
CVE-2024-58366 |
9.0 | 0.0057 | NET NO UI | SurrealDB before 1.1.1 contains a format string vulnerability in the rquickjs Ex |