Hunt List
12,999 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
89
|
CVE-2017-20251 |
9.3 | 0.0056 | NET NO AUTH LOW CX NO UI | 1 PoC | WordPress Insert PHP plugin versions before 3.3.1 contain a PHP code injection v |
|
80
|
CVE-2026-34208 |
10.0 | 0.0056 | NET NO AUTH LOW CX NO UI | SandboxJS is a JavaScript sandboxing library. Prior to 0.8.36, SandboxJS blocks | |
|
80
|
CVE-2026-64738 |
9.8 | 0.0056 | NET NO AUTH LOW CX NO UI | A permissions issue was addressed with additional restrictions. This issue is fi | |
|
80
|
CVE-2026-58663 |
9.8 | 0.0056 | NET NO AUTH LOW CX NO UI | An authentication bypass vulnerability exists in Apache IoTDB's Thrift RPC servi | |
|
79
|
CVE-2026-74880 |
9.3 | 0.0056 | NET NO AUTH LOW CX NO UI | openssl_encrypt versions before 1.4.0 accept refresh tokens as URL query paramet | |
|
79
|
CVE-2026-54203 |
9.2 | 0.0056 | NET NO AUTH LOW CX NO UI | Memory Leak to an Unauthorized Actor vulnerability in Tobit Laboratories AG Team | |
|
79
|
CVE-2026-77645 |
9.2 | 0.0056 | NET NO AUTH LOW CX NO UI | A critical remote code execution (RCE) vulnerability has been reported in PTC Wi | |
|
78
|
CVE-2026-14809 |
8.7 | 0.0056 | NET NO AUTH LOW CX NO UI | Prog Management System developed by PROG MIS has a SQL Injection vulnerability, | |
|
78
|
CVE-2026-44383 |
8.7 | 0.0056 | NET NO AUTH LOW CX NO UI | Multiple connections to the backend using the same charging station ID are allo | |
|
78
|
CVE-2021-48015 |
8.7 | 0.0056 | NET NO AUTH LOW CX NO UI | JeeWMS before commit 0a610e8 contains an unauthenticated path traversal vulnerab | |
|
78
|
CVE-2026-25718 |
9.1 | 0.0056 | NET NO AUTH LOW CX NO UI | Gitea versions before 1.25.5 mishandle path resolution during template repositor | |
|
78
|
CVE-2026-113682 |
9.1 | 0.0056 | NET NO AUTH LOW CX NO UI | Networknt light-4j from 2.1.5 before 2.4.0 contains an authentication bypass vul | |
|
78
|
CVE-2026-62292 |
8.7 | 0.0056 | NET NO AUTH LOW CX NO UI | libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1. | |
|
78
|
CVE-2026-86249 |
9.1 | 0.0056 | NET NO AUTH LOW CX NO UI | On a brpc::Server that sets both ServerOptions.auth and ServerOptions.internal_p | |
|
78
|
CVE-2026-96252 |
9.1 | 0.0056 | NET NO AUTH LOW CX NO UI | Improper verification of cryptographic signature in Active Directory Federation | |
|
78
|
CVE-2026-58016 |
9.1 | 0.0056 | NET NO AUTH LOW CX NO UI | A flaw was found in GLib. A state confusion issue exists in g_dbus_node_info_new | |
|
78
|
CVE-2026-55100 |
8.7 | 0.0056 | NET NO AUTH LOW CX NO UI | hashi-vault-js is a Node.js module for interacting with the HashiCorp Vault API. | |
|
78
|
CVE-2026-98549 |
9.1 | 0.0056 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: tcp: preven | |
|
77
|
CVE-2026-55117 |
8.6 | 0.0056 | NET NO AUTH LOW CX NO UI | A malicious actor with access to the network could exploit a Path Traversal vuln | |
|
75
|
CVE-2026-44248 |
7.5 | 0.0056 | NET NO AUTH LOW CX NO UI | Netty is an asynchronous, event-driven network application framework. Prior to 4 | |
|
75
|
CVE-2026-34645 |
7.5 | 0.0056 | NET NO AUTH LOW CX NO UI | Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2 | |
|
75
|
CVE-2026-47613 |
7.5 | 0.0056 | NET NO AUTH LOW CX NO UI | NVIDIA Dynamo for Linux contains a vulnerability where an attacker may cause imp | |
|
75
|
CVE-2026-47614 |
7.5 | 0.0056 | NET NO AUTH LOW CX NO UI | NVIDIA Dynamo for Linux contains a vulnerability where an attacker may cause ser | |
|
75
|
CVE-2026-47615 |
7.5 | 0.0056 | NET NO AUTH LOW CX NO UI | NVIDIA Dynamo for Linux contains a vulnerability where an attacker may cause ser | |
|
75
|
CVE-2026-47616 |
7.5 | 0.0056 | NET NO AUTH LOW CX NO UI | NVIDIA Dynamo for Linux contains a vulnerability in the multimodal media fetcher | |
|
75
|
CVE-2026-47617 |
7.5 | 0.0056 | NET NO AUTH LOW CX NO UI | NVIDIA Dynamo for Linux contains a vulnerability in the multimodal media fetcher | |
|
75
|
CVE-2026-47618 |
7.5 | 0.0056 | NET NO AUTH LOW CX NO UI | NVIDIA Dynamo for Linux contains a vulnerability in the Rust multimodal media fe | |
|
75
|
CVE-2026-85783 |
7.5 | 0.0056 | NET NO AUTH LOW CX NO UI | Crypt::Age versions before 0.004 for Perl allow CPU exhaustion via an unbounded | |
|
75
|
CVE-2026-97638 |
7.5 | 0.0056 | NET NO AUTH LOW CX NO UI | The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin f | |
|
75
|
CVE-2026-28991 |
7.5 | 0.0056 | NET NO AUTH LOW CX NO UI | An out-of-bounds read was addressed with improved bounds checking. This issue is | |
|
70
|
CVE-2026-50551 |
9.9 | 0.0056 | NET LOW CX NO UI | SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, S | |
|
70
|
CVE-2026-73269 |
9.9 | 0.0056 | NET LOW CX NO UI | A flaw was found in the cluster-curator-controller component. A local user, by c | |
|
70
|
CVE-2026-8859 |
9.9 | 0.0056 | NET LOW CX NO UI | IBM Langflow OSS 1.0.0 through 1.10.0 Langflow could allow an attacker to write | |
|
69
|
CVE-2026-113072 |
9.6 | 0.0056 | NET NO AUTH LOW CX | Memory corruption in CSS in Google Chrome prior to 156.0.8078.47 allowed a remot | |
|
68
|
CVE-2026-54232 |
8.8 | 0.0056 | NET NO AUTH LOW CX | vLLM is an inference and serving engine for large language models (LLMs). Prior | |
|
68
|
CVE-2026-58195 |
8.8 | 0.0056 | NET NO AUTH LOW CX | Agentic-Flow is an AI agent orchestration platform. Prior to 2.0.14, agentic-flo | |
|
68
|
CVE-2026-34427 |
8.7 | 0.0056 | NET LOW CX NO UI | Vvveb prior to 1.0.8.1 contains a privilege escalation vulnerability in the admi | |
|
68
|
CVE-2026-5272 |
8.8 | 0.0056 | NET NO AUTH LOW CX | Heap buffer overflow in GPU in Google Chrome prior to 146.0.7680.178 allowed a r | |
|
68
|
CVE-2026-8170 |
8.7 | 0.0056 | NET LOW CX NO UI | The mv, cp, and rm file utilities exposed within the ExtremeXOS (EXOS) shell env | |
|
68
|
CVE-2026-7667 |
8.8 | 0.0056 | NET LOW CX NO UI | IBM Langflow OSS 1.0.0 through 1.10.0 allows an authenticated attacker to create | |
|
68
|
CVE-2026-113161 |
8.8 | 0.0056 | NET NO AUTH LOW CX | Use after free in WebRTC in Google Chrome prior to 156.0.8078.47 allowed a remot | |
|
68
|
CVE-2026-113202 |
8.8 | 0.0056 | NET NO AUTH LOW CX | Use after free in BrowserTag in Google Chrome prior to 156.0.8078.47 allowed a r | |
|
66
|
CVE-2026-11816 |
8.1 | 0.0056 | NET NO AUTH LOW CX | Keras versions prior to 3.14.0 are vulnerable to a path traversal issue in the a | |
|
66
|
CVE-2026-8183 |
7.7 | 0.0056 | NET LOW CX NO UI | IBM Langflow OSS 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10. | |
|
65
|
CVE-2026-7418 |
7.4 | 0.0056 | NET LOW CX NO UI | A vulnerability was determined in UTT HiPER 1250GW up to 3.2.7-210907-180535. Th | |
|
65
|
CVE-2026-7749 |
7.4 | 0.0056 | NET LOW CX NO UI | A security vulnerability has been detected in Totolink N300RH 3.2.4-B20220812. T | |
|
64
|
CVE-2026-118485 |
7.0 | 0.0056 | NET NO AUTH LOW CX | Axel Download Accelerator 2.17.14 and earlier performs URL percent-decoding (htt | |
|
63
|
CVE-2026-44945 |
9.1 | 0.0056 | NET LOW CX NO UI | A privilege escalation vulnerability exists in Rancher's impersonation middlewar | |
|
60
|
CVE-2026-35581 |
7.2 | 0.0056 | NET LOW CX NO UI | Emissary is a P2P based data-driven workflow engine. Prior to 8.39.0, the Execut | |
|
57
|
CVE-2026-58284 |
8.3 | 0.0056 | NET NO AUTH | Improper authorization in Microsoft Edge (Chromium-based) allows an unauthorized |