Hunt List
12,959 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-59562 |
9.8 | 0.0057 | NET NO AUTH LOW CX NO UI | Missing authentication for critical function vulnerability in Apache IoTDB. T | |
|
80
|
CVE-2026-16377 |
9.8 | 0.0057 | NET NO AUTH LOW CX NO UI | Mitigation bypass in the PDF Viewer component. This vulnerability was fixed in F | |
|
80
|
CVE-2026-16383 |
9.8 | 0.0057 | NET NO AUTH LOW CX NO UI | Mitigation bypass in the DOM: Networking component. This vulnerability was fixed | |
|
80
|
CVE-2026-26150 |
10.0 | 0.0057 | NET NO AUTH LOW CX NO UI | Server-side request forgery (ssrf) in Microsoft Purview allows an unauthorized a | |
|
80
|
CVE-2026-94510 |
9.9 | 0.0057 | NET NO AUTH LOW CX NO UI | Authorization bypass through user-controlled key in Microsoft Bookings allows an | |
|
80
|
CVE-2026-54408 |
9.8 | 0.0057 | NET NO AUTH LOW CX NO UI | A malicious actor with access to the network could exploit an Improper Access Co | |
|
80
|
CVE-2026-42196 |
9.9 | 0.0056 | NET NO AUTH LOW CX NO UI | django-s3file is a lightweight file upload input for Django and Amazon S3. Prior | |
|
80
|
CVE-2026-35300 |
9.8 | 0.0056 | NET NO AUTH LOW CX NO UI | Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (compon | |
|
79
|
CVE-2026-101990 |
9.3 | 0.0057 | NET NO AUTH LOW CX NO UI | A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) | |
|
79
|
CVE-2026-58172 |
9.3 | 0.0056 | NET NO AUTH LOW CX NO UI | Ocelot through 24.1.0, fixed in commit f156fd4, contains a security control bypa | |
|
78
|
CVE-2026-11373 |
9.1 | 0.0057 | NET NO AUTH LOW CX NO UI | Net::Statsite::Client versions through 1.1.0 for Perl allow metric injections. | |
|
78
|
CVE-2026-72320 |
9.1 | 0.0057 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: netfilter: | |
|
78
|
CVE-2026-55471 |
8.7 | 0.0057 | NET NO AUTH LOW CX NO UI | HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare i | |
|
78
|
CVE-2026-60053 |
9.1 | 0.0057 | NET NO AUTH LOW CX NO UI | Insufficient Session Expiration vulnerability in Apache Answer. This issue affe | |
|
78
|
CVE-2026-70455 |
8.7 | 0.0057 | NET NO AUTH LOW CX NO UI | rsync 3.4.2 before 3.5.0 contains a denial of service vulnerability that allows | |
|
77
|
CVE-2026-66754 |
8.2 | 0.0056 | NET NO AUTH LOW CX NO UI | Rouille 0.1.6 through 3.6.2 contains a reachable assertion vulnerability in the | |
|
76
|
CVE-2026-54204 |
7.7 | 0.0057 | NET NO AUTH LOW CX NO UI | Tobit Laboratories AG TeamDavid's Webbox 's search functionality accepts a “path | |
|
76
|
CVE-2026-43946 |
7.7 | 0.0057 | NET NO AUTH LOW CX NO UI | FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Versio | |
|
75
|
CVE-2026-19667 |
7.5 | 0.0057 | NET NO AUTH LOW CX NO UI | If an attacker-controlled authoritative server can produce a negative answer tha | |
|
75
|
CVE-2026-81563 |
7.5 | 0.0057 | NET NO AUTH LOW CX NO UI | A BIND resolver encountering an SVCB/HTTPS AliasMode record referencing 14 or mo | |
|
75
|
CVE-2026-81736 |
7.5 | 0.0057 | NET NO AUTH LOW CX NO UI | If a BIND resolver has cached a tree of SVCB/HTTPS AliasMode records, and is the | |
|
75
|
CVE-2026-19666 |
7.5 | 0.0057 | NET NO AUTH LOW CX NO UI | On a resolver configured to use ``dns64``, if an applicable answer from the auth | |
|
75
|
CVE-2026-76163 |
7.5 | 0.0057 | NET NO AUTH LOW CX NO UI | If BIND is loaded with a "`named.conf`" file that contains no global "`options`" | |
|
75
|
CVE-2026-80274 |
7.5 | 0.0057 | NET NO AUTH LOW CX NO UI | If a BIND resolver sends a query for a DNSSEC-signed authoritative zone, and the | |
|
75
|
CVE-2026-56862 |
7.5 | 0.0057 | NET NO AUTH LOW CX NO UI | Handshake messages, such as KeyUpdate, are always considered as state-advancing, | |
|
75
|
CVE-2026-5440 |
7.5 | 0.0057 | NET NO AUTH LOW CX NO UI | A memory exhaustion vulnerability exists in the HTTP server due to unbounded use | |
|
75
|
CVE-2026-4155 |
7.5 | 0.0057 | NET NO AUTH LOW CX NO UI | ChargePoint Home Flex Inclusion of Sensitive Information in Source Code Informat | |
|
69
|
CVE-2026-46515 |
9.3 | 0.0057 | NET LOW CX NO UI | Frogman provides headless PBX control through MCP and HTTP API. Prior to 1.6.3, | |
|
69
|
CVE-2026-15091 |
9.3 | 0.0057 | NET NO AUTH LOW CX | IBM Engineering AI Hub 1.0.0, 1.1.0, and 1.2.0 could allow a remote attacker to | |
|
69
|
CVE-2026-41265 |
9.2 | 0.0057 | NET NO AUTH NO UI | Flowise is a drag & drop user interface to build a customized large language mod | |
|
69
|
CVE-2026-45311 |
9.6 | 0.0057 | NET NO AUTH LOW CX | CodeWhale is a DeepSeek + MiMo coding agent in terminal. From 0.3.0 to 0.8.23, t | |
|
69
|
CVE-2026-66395 |
9.4 | 0.0056 | NET NO AUTH LOW CX | SiYuan desktop before v3.7.2 contains a reflected cross-site scripting vulnerabi | |
|
68
|
CVE-2026-73293 |
8.8 | 0.0057 | NET LOW CX NO UI | Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.19 and | |
|
68
|
CVE-2026-50398 |
8.8 | 0.0057 | NET LOW CX NO UI | Concurrent execution using shared resource with improper synchronization ('race | |
|
68
|
CVE-2026-58608 |
8.8 | 0.0057 | NET LOW CX NO UI | Concurrent execution using shared resource with improper synchronization ('race | |
|
68
|
CVE-2026-14474 |
8.8 | 0.0057 | NET LOW CX NO UI | A flaw was found in SSSD's LDAP sudo provider. When the ldap_sudo_search_base op | |
|
68
|
CVE-2026-83928 |
8.8 | 0.0056 | NET LOW CX NO UI | Out-of-bounds write in Windows Local Security Authority Subsystem Service (LSASS | |
|
67
|
CVE-2026-11311 |
8.6 | 0.0057 | NET LOW CX NO UI | When NGINX Plus is configured as the data plane for NGINX Gateway Fabric, an inj | |
|
67
|
CVE-2026-67345 |
8.5 | 0.0056 | NET NO AUTH LOW CX | MaxKey through 4.1.12, fixed in commit ddbb72f, contains an insufficient redirec | |
|
66
|
CVE-2026-45807 |
7.7 | 0.0057 | NET LOW CX NO UI | Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.43 a | |
|
66
|
CVE-2026-17527 |
7.7 | 0.0057 | NET LOW CX NO UI | In containerized-data-importer (CDI), the aggregated cdi.kubevirt.io:view Cluste | |
|
65
|
CVE-2026-8138 |
7.4 | 0.0057 | NET LOW CX NO UI | A vulnerability was found in Tenda CX12L 16.03.53.12. This issue affects the fun | |
|
65
|
CVE-2026-3833 |
7.4 | 0.0056 | NET NO AUTH NO UI | A flaw was found in gnutls. This vulnerability occurs because gnutls performs ca | |
|
63
|
CVE-2026-58409 |
9.1 | 0.0057 | NET LOW CX NO UI | ChurchCRM is an open-source church management system. Prior to version 7.4.0, an | |
|
63
|
CVE-2026-35580 |
9.1 | 0.0057 | NET LOW CX NO UI | Emissary is a P2P based data-driven workflow engine. Prior to 8.39.0, GitHub Act | |
|
60
|
CVE-2026-4757 |
7.2 | 0.0057 | NET LOW CX NO UI | A VAPIX API parameter had improper input validation which could allow code execu | |
|
60
|
CVE-2026-42510 |
7.2 | 0.0057 | NET LOW CX NO UI | OpenStack Ironic before 35.0.1 allows ipmitool execution in a non-default config | |
|
57
|
CVE-2026-44522 |
8.6 | 0.0056 | NET LOW CX | Note Mark is an open-source note-taking application. From 0.13.0 to before 0.19. | |
|
57
|
CVE-2026-69543 |
8.5 | 0.0056 | NET NO UI | Server-side request forgery (ssrf) in Azure Virtual Machines allows an authorize | |
|
55
|
CVE-2026-50414 |
7.5 | 0.0057 | NET NO UI | Concurrent execution using shared resource with improper synchronization ('race |