Hunt List
12,927 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-24178 |
9.8 | 0.0057 | NET NO AUTH LOW CX NO UI | NVIDIA NVFlare Dashboard contains a vulnerability in the user management and aut | |
|
80
|
CVE-2026-20272 |
9.8 | 0.0057 | NET NO AUTH LOW CX NO UI | As part of Cisco's ongoing commitment to proactive security and product quality, | |
|
80
|
CVE-2026-48836 |
10.0 | 0.0057 | NET NO AUTH LOW CX NO UI | Unauthenticated Remote Code Execution (RCE) in Easy Invoice <= 2.1.19 versions. | |
|
80
|
CVE-2026-42996 |
10.0 | 0.0057 | NET NO AUTH LOW CX NO UI | JS8Call through 2.3.1 and JS8Call-improved before 3.0 have a stack-based buffer | |
|
80
|
CVE-2026-42854 |
9.8 | 0.0057 | NET NO AUTH LOW CX NO UI | arduino-esp32 is an Arduino core for the ESP32, ESP32-S2, ESP32-S3, ESP32-C3, ES | |
|
80
|
CVE-2026-5443 |
9.8 | 0.0057 | NET NO AUTH LOW CX NO UI | A heap buffer overflow vulnerability exists during the decoding of `PALETTE COLO | |
|
80
|
CVE-2026-16361 |
9.8 | 0.0057 | NET NO AUTH LOW CX NO UI | Memory safety bugs present in Thunderbird ESR 140.12. Some of these bugs showed | |
|
80
|
CVE-2026-16368 |
9.8 | 0.0057 | NET NO AUTH LOW CX NO UI | Incorrect boundary conditions in the JavaScript: WebAssembly component. This vul | |
|
80
|
CVE-2026-74989 |
9.8 | 0.0057 | NET NO AUTH LOW CX NO UI | Internally found bugs present in Firefox 153. Some of these bugs showed evidence | |
|
78
|
CVE-2026-70464 |
8.7 | 0.0057 | NET NO AUTH LOW CX NO UI | rsync daemon 2.0.0 before 3.5.0 contains a denial of service vulnerability that | |
|
78
|
CVE-2026-112397 |
8.7 | 0.0057 | NET NO AUTH LOW CX NO UI | Pillow is a Python imaging library. Prior to 13.0.0, Pillow's ImageMorph.MorphOp | |
|
78
|
CVE-2026-112406 |
8.7 | 0.0057 | NET NO AUTH LOW CX NO UI | Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow can enter an | |
|
78
|
CVE-2026-75111 |
8.7 | 0.0057 | NET NO AUTH LOW CX NO UI | Evidently UI fails to properly validate the filename parameter in the dataset ma | |
|
78
|
CVE-2026-40525 |
9.1 | 0.0057 | NET NO AUTH LOW CX NO UI | OpenViking prior to version 0.3.9 contains an authentication bypass vulnerabilit | |
|
78
|
CVE-2026-70461 |
8.8 | 0.0057 | NET NO AUTH LOW CX NO UI | rsync 3.2.5 before 3.5.0 contains a heap out-of-bounds write vulnerability that | |
|
77
|
CVE-2026-20263 |
8.6 | 0.0057 | NET NO AUTH LOW CX NO UI | A vulnerability in the Blocks Extensible Exchange Protocol (BEEP) feature of Cis | |
|
77
|
CVE-2026-72535 |
8.6 | 0.0057 | NET NO AUTH LOW CX NO UI | A missing authentication vulnerability in Chaskiq through commit 46dfdd1 allows | |
|
77
|
CVE-2026-72536 |
8.6 | 0.0057 | NET NO AUTH LOW CX NO UI | A missing authentication vulnerability in Chaskiq through commit 46dfdd1 allows | |
|
75
|
CVE-2026-48937 |
7.5 | 0.0057 | NET NO AUTH LOW CX NO UI | A flaw in Node.js HTTP/2 server API can cause servers to keep accepting data eve | |
|
75
|
CVE-2026-20213 |
7.5 | 0.0057 | NET NO AUTH LOW CX NO UI | A vulnerability in the PE file format parser of ClamAV could allow an unauthenti | |
|
75
|
CVE-2026-20214 |
7.5 | 0.0057 | NET NO AUTH LOW CX NO UI | A vulnerability in the FSG file format parser of ClamAV could allow an unauthent | |
|
75
|
CVE-2026-20215 |
7.5 | 0.0057 | NET NO AUTH LOW CX NO UI | A vulnerability in the 7z file format parser of ClamAV could allow an unauthenti | |
|
75
|
CVE-2026-20216 |
7.5 | 0.0057 | NET NO AUTH LOW CX NO UI | A vulnerability in the InstallShield file format parser of ClamAV could allow an | |
|
75
|
CVE-2026-20217 |
7.5 | 0.0057 | NET NO AUTH LOW CX NO UI | A vulnerability in the PESpin file format parser of ClamAV could allow an unauth | |
|
75
|
CVE-2026-20243 |
7.5 | 0.0057 | NET NO AUTH LOW CX NO UI | A vulnerability in the ALZ file format parser of ClamAV could allow an unauthent | |
|
75
|
CVE-2026-20244 |
7.5 | 0.0057 | NET NO AUTH LOW CX NO UI | A vulnerability in the DMG file format parser of ClamAV could allow an unauthent | |
|
75
|
CVE-2026-44909 |
7.5 | 0.0057 | NET NO AUTH LOW CX NO UI | Proxygen lacked a generalized slow-consumer detection mechanism in its core HTTP | |
|
75
|
CVE-2026-75508 |
7.5 | 0.0057 | NET NO AUTH LOW CX NO UI | GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3 | |
|
75
|
CVE-2026-57195 |
7.5 | 0.0057 | NET NO AUTH LOW CX NO UI | Asterisk is an open source private branch exchange and telephony toolkit. Prior | |
|
75
|
CVE-2026-5088 |
7.5 | 0.0057 | NET NO AUTH LOW CX NO UI | Apache::API::Password versions through 0.5.2 for Perl can generate insecure rand | |
|
75
|
CVE-2026-49855 |
7.5 | 0.0057 | NET NO AUTH LOW CX NO UI | Tornado is a Python web framework and asynchronous networking library. Prior to | |
|
70
|
CVE-2026-104351 |
9.9 | 0.0057 | NET LOW CX NO UI | Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of | |
|
70
|
CVE-2026-7329 |
9.9 | 0.0057 | NET LOW CX NO UI | An improper privilege management vulnerability in the SQL, SPARQL, and Optic RES | |
|
69
|
CVE-2026-43631 |
9.2 | 0.0057 | NET NO AUTH NO UI | llama.cpp builds b7492 through the latest b9060 contains a use-after-free vulner | |
|
68
|
CVE-2026-76034 |
8.8 | 0.0057 | NET NO AUTH LOW CX | Buffer overflow in WebGL in Google Chrome prior to 151.0.7922.169 allowed a remo | |
|
68
|
CVE-2026-96192 |
8.8 | 0.0057 | NET NO AUTH LOW CX | Use after free in Microsoft Edge for iOS allows an unauthorized attacker to exec | |
|
68
|
CVE-2026-81352 |
8.8 | 0.0057 | NET NO AUTH LOW CX | Heap-based buffer overflow in Microsoft Windows Codecs Library allows an unautho | |
|
68
|
CVE-2026-16420 |
8.8 | 0.0057 | NET NO AUTH LOW CX | Type Confusion in WebAudio in Google Chrome prior to 150.0.7871.182 allowed a re | |
|
66
|
CVE-2025-71433 |
7.7 | 0.0057 | NET LOW CX NO UI | Kaneo before 2.1.6 contains a missing authorization vulnerability that allows au | |
|
65
|
CVE-2026-8775 |
7.4 | 0.0057 | NET LOW CX NO UI | A flaw has been found in Edimax BR-6428NS 1.10. This affects the function formL2 | |
|
65
|
CVE-2026-18733 |
7.5 | 0.0057 | NET NO AUTH LOW CX | A prompt injection vulnerability in the shell tool in Amazon Strands Agents Tool | |
|
65
|
CVE-2026-85165 |
7.2 | 0.0057 | NET LOW CX NO UI | n8n versions before 2.36.2 contain an expression sandbox bypass vulnerability wh | |
|
64
|
CVE-2026-61425 |
9.4 | 0.0057 | NET LOW CX NO UI | Joomla Extension - balbooa.com - Authentication bypass in Gridbox < 1.6.0 - The | |
|
64
|
CVE-2026-72749 |
7.1 | 0.0057 | NET LOW CX NO UI | n8n before 1.123.67, 2.31.5, and 2.32.1 contains a prototype pollution vulnerabi | |
|
62
|
CVE-2026-69250 |
8.5 | 0.0057 | NET LOW CX NO UI | Flowise is a drag & drop user interface to build a customized large language mod | |
|
60
|
CVE-2026-71292 |
7.2 | 0.0057 | NET LOW CX NO UI | Subrion CMS's admin grid sorting helper, _gridGetSorting in includes/classes/ia. | |
|
60
|
CVE-2026-66015 |
7.2 | 0.0057 | NET LOW CX NO UI | An authenticated privilege-escalation vulnerability in JFrog Platform may be exp | |
|
55
|
CVE-2026-70202 |
7.5 | 0.0057 | NET NO UI | Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an auth | |
|
55
|
CVE-2026-88206 |
7.5 | 0.0057 | NET NO UI | Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an auth | |
|
55
|
CVE-2026-96280 |
7.5 | 0.0057 | NET NO AUTH | The OCI delta stream parser read sizes as guint64 but passed them to GLib I/O an |