Hunt List
11,998 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-72590 |
9.8 | 0.0204 | NET NO AUTH LOW CX NO UI | An OS command injection vulnerability in alseambusher/crontab-ui through 0.4.2 a | |
|
80
|
CVE-2026-46420 |
9.8 | 0.0201 | NET NO AUTH LOW CX NO UI | setup-php is a GitHub action to set up PHP with extensions, php.ini configuratio | |
|
80
|
CVE-2026-72589 |
9.8 | 0.0195 | NET NO AUTH LOW CX NO UI | An OS command injection vulnerability in alseambusher/crontab-ui through 0.4.2 a | |
|
80
|
CVE-2026-49060 |
9.8 | 0.0184 | NET NO AUTH LOW CX NO UI | Incorrect Privilege Assignment vulnerability in Hippoo Mobile App for WooCommerc | |
|
79
|
CVE-2021-48014 |
9.3 | 0.0203 | NET NO AUTH LOW CX NO UI | FineReport 9.0 contains a path traversal vulnerability in the /WebReport/ReportS | |
|
79
|
CVE-2026-6349 |
9.3 | 0.0203 | NET NO AUTH LOW CX NO UI | The iSherlock developed by HGiga has an OS Command Injection vulnerability, al | |
|
79
|
CVE-2026-82854 |
9.3 | 0.0198 | NET NO AUTH LOW CX NO UI | Nodemailer before 8.0.4 is vulnerable to SMTP command injection through the unsa | |
|
79
|
CVE-2026-53595 |
9.4 | 0.0194 | NET NO AUTH LOW CX NO UI | FreeScout is a free help desk and shared inbox built with PHP's Laravel framewor | |
|
79
|
CVE-2026-49772 |
9.3 | 0.0194 | NET NO AUTH LOW CX NO UI | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti | |
|
79
|
CVE-2026-53519 |
9.1 | 0.0193 | NET NO AUTH LOW CX NO UI | Nezha Monitoring is a self-hostable, lightweight, servers and websites monitorin | |
|
79
|
CVE-2026-6942 |
9.3 | 0.0192 | NET NO AUTH LOW CX NO UI | radare2-mcp version 1.6.0 and earlier contains an os command injection vulnerabi | |
|
79
|
CVE-2026-61500 |
9.3 | 0.0191 | NET NO AUTH LOW CX NO UI | Rejetto HFS 3.0.0 through 3.2.0 derives its session-cookie signing key from the | |
|
79
|
CVE-2026-58453 |
9.3 | 0.0190 | NET NO AUTH LOW CX NO UI | JAIOTlink C492A-W6 Wi-Fi IP cameras running firmware 4.8.30.57701411 contain a h | |
|
79
|
CVE-2026-58127 |
9.3 | 0.0188 | NET NO AUTH LOW CX NO UI | PACSgear MediaWriter 5.2.1 exposes a .NET Remoting TCP service on port 9000 via | |
|
79
|
CVE-2026-58126 |
9.3 | 0.0184 | NET NO AUTH LOW CX NO UI | PACSgear PACS Scan 5.2.1 contains an unauthenticated remote code execution vulne | |
|
78
|
CVE-2026-7121 |
8.9 | 0.0195 | NET NO AUTH LOW CX NO UI | A flaw has been found in Totolink A8000RU 7.1cu.643_b20200521. This affects the | |
|
78
|
CVE-2026-5995 |
8.9 | 0.0182 | NET NO AUTH LOW CX NO UI | A weakness has been identified in Totolink A7100RU 7.4cu.2313_b20191024. Impacte | |
|
78
|
CVE-2026-5996 |
8.9 | 0.0182 | NET NO AUTH LOW CX NO UI | A security vulnerability has been detected in Totolink A7100RU 7.4cu.2313_b20191 | |
|
75
|
CVE-2023-23918 |
7.5 | 0.0202 | NET NO AUTH LOW CX NO UI | A privilege escalation vulnerability exists in Node.js <19.6.1, <18.14.1, <16.19 | |
|
75
|
CVE-2026-48048 |
7.5 | 0.0201 | NET NO AUTH LOW CX NO UI | XWiki Platform is a generic wiki platform. XWiki discovered that the patch for G | |
|
75
|
CVE-2023-22974 |
7.5 | 0.0189 | NET NO AUTH LOW CX NO UI | A Path Traversal in setup.php in OpenEMR < 7.0.0 allows remote unauthenticated u | |
|
75
|
CVE-2026-9776 |
7.5 | 0.0185 | NET NO AUTH LOW CX NO UI | ATEN Unizon writeFileToHttpServletResponse Directory Traversal Information Discl | |
|
75
|
CVE-2023-27530 |
7.5 | 0.0183 | NET NO AUTH LOW CX NO UI | A DoS vulnerability exists in Rack <v3.0.4.2, <v2.2.6.3, <v2.1.4.3 and <v2.0.9.3 | |
|
70
|
CVE-2026-45744 |
9.9 | 0.0201 | NET LOW CX NO UI | Termix is a web-based server management platform with SSH terminal, tunneling, a | |
|
68
|
CVE-2026-66805 |
8.8 | 0.0204 | NET LOW CX NO UI | Deserialization of untrusted data in Microsoft Office SharePoint allows an autho | |
|
68
|
CVE-2026-66808 |
8.8 | 0.0204 | NET LOW CX NO UI | Deserialization of untrusted data in Microsoft Office SharePoint allows an autho | |
|
68
|
CVE-2026-63514 |
8.8 | 0.0204 | NET LOW CX NO UI | Deserialization of untrusted data in Microsoft Office SharePoint allows an autho | |
|
68
|
CVE-2026-65658 |
8.8 | 0.0204 | NET LOW CX NO UI | Deserialization of untrusted data in Microsoft Office SharePoint allows an autho | |
|
68
|
CVE-2026-65663 |
8.8 | 0.0204 | NET LOW CX NO UI | Deserialization of untrusted data in Microsoft Office SharePoint allows an autho | |
|
68
|
CVE-2026-112370 |
8.6 | 0.0203 | NET LOW CX NO UI | A vulnerability was found in H3C Magic NX15 100R017. This issue affects the func | |
|
68
|
CVE-2026-35439 |
8.8 | 0.0203 | NET LOW CX NO UI | Deserialization of untrusted data in Microsoft Office SharePoint allows an autho | |
|
68
|
CVE-2026-58289 |
9.0 | 0.0199 | NET NO AUTH NO UI | Access of resource using incompatible type ('type confusion') in Microsoft Edge | |
|
68
|
CVE-2026-104085 |
8.7 | 0.0199 | NET LOW CX NO UI | odt2spip plugin for SPIP before 4.4.0 contains an OS command injection vulnerabi | |
|
68
|
CVE-2026-33110 |
8.8 | 0.0197 | NET LOW CX NO UI | Deserialization of untrusted data in Microsoft Office SharePoint allows an autho | |
|
68
|
CVE-2026-52356 |
8.8 | 0.0194 | NET LOW CX NO UI | An OS command injection vulnerability in the /htdocs/web/diagnostic.php endpoint | |
|
68
|
CVE-2026-116506 |
8.6 | 0.0188 | NET LOW CX NO UI | A vulnerability was determined in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affect | |
|
68
|
CVE-2026-7838 |
8.7 | 0.0187 | NET NO AUTH LOW CX | UltraVNC viewer through 1.8.2.2 contains an integer overflow leading to a heap b | |
|
68
|
CVE-2026-70374 |
8.8 | 0.0187 | NET LOW CX NO UI | HashBrown CMS through 1.4.6 contains an OS Command Injection vulnerability (CWE- | |
|
68
|
CVE-2026-70375 |
8.8 | 0.0187 | NET LOW CX NO UI | HashBrown CMS through 1.4.6 contains an OS Command Injection vulnerability (CWE- | |
|
68
|
CVE-2026-113390 |
8.6 | 0.0186 | NET LOW CX NO UI | A flaw has been found in DrayTek Vigor2960 1.5.1.6 Revision 8218. Affected by th | |
|
65
|
CVE-2026-48294 |
7.4 | 0.0191 | NET NO AUTH LOW CX | Adobe Acrobat PDF Extension (Chrome) versions 26.5.2.2 and earlier are affected | |
|
64
|
CVE-2026-56688 |
9.1 | 0.0200 | NET LOW CX NO UI | Dell PowerFlex Manager, Version prior to 5.1.0.1, contain(s) an Improper Neutral | |
|
64
|
CVE-2026-6644 |
9.4 | 0.0194 | NET LOW CX NO UI | A command injection vulnerability was found in the PPTP VPN Clients on the ADM. | |
|
63
|
CVE-2026-65711 |
8.6 | 0.0204 | NET LOW CX NO UI | sysPass through version 3.2.11 contains an OS command injection vulnerability th | |
|
63
|
CVE-2013-20007 |
8.6 | 0.0200 | NET LOW CX NO UI | Linksys WAG200G through 1.01.06 contains an OS command injection vulnerability t | |
|
60
|
CVE-2026-49814 |
7.2 | 0.0200 | NET LOW CX NO UI | Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release ver | |
|
60
|
CVE-2026-53478 |
7.2 | 0.0200 | NET LOW CX NO UI | Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release ver | |
|
60
|
CVE-2026-54796 |
7.2 | 0.0200 | NET LOW CX NO UI | Dell OpenManage Enterprise, versions prior to 4.7.0, contains an Improper Neutra | |
|
60
|
CVE-2026-53479 |
7.2 | 0.0197 | NET LOW CX NO UI | Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release ver | |
|
60
|
CVE-2026-8051 |
7.2 | 0.0191 | NET LOW CX NO UI | OS command injection in Ivanti Virtual Traffic Manager before version 22.9r4 all |