Hunt List
13,026 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
89
|
CVE-2017-20251 |
9.3 | 0.0056 | NET NO AUTH LOW CX NO UI | 1 PoC | WordPress Insert PHP plugin versions before 3.3.1 contain a PHP code injection v |
|
80
|
CVE-2026-64738 |
9.8 | 0.0056 | NET NO AUTH LOW CX NO UI | A permissions issue was addressed with additional restrictions. This issue is fi | |
|
80
|
CVE-2026-58663 |
9.8 | 0.0056 | NET NO AUTH LOW CX NO UI | An authentication bypass vulnerability exists in Apache IoTDB's Thrift RPC servi | |
|
80
|
CVE-2026-61738 |
10.0 | 0.0056 | NET NO AUTH LOW CX NO UI | SOCFortress CoPilot focuses on providing a single pane of glass for all your sec | |
|
80
|
CVE-2026-28982 |
9.8 | 0.0056 | NET NO AUTH LOW CX NO UI | A race condition was addressed with improved locking. This issue is fixed in mac | |
|
80
|
CVE-2026-45336 |
10.0 | 0.0056 | NET NO AUTH LOW CX NO UI | HireFlow is a web-based interview management system for managing candidates, sch | |
|
80
|
CVE-2026-27429 |
9.8 | 0.0056 | NET NO AUTH LOW CX NO UI | Unauthenticated PHP Object Injection in Nifty <= 1.4.1 versions. | |
|
80
|
CVE-2026-16382 |
9.8 | 0.0056 | NET NO AUTH LOW CX NO UI | Mitigation bypass in the DOM: Service Workers component. This vulnerability was | |
|
79
|
CVE-2026-74880 |
9.3 | 0.0056 | NET NO AUTH LOW CX NO UI | openssl_encrypt versions before 1.4.0 accept refresh tokens as URL query paramet | |
|
79
|
CVE-2026-54203 |
9.2 | 0.0056 | NET NO AUTH LOW CX NO UI | Memory Leak to an Unauthorized Actor vulnerability in Tobit Laboratories AG Team | |
|
79
|
CVE-2026-77645 |
9.2 | 0.0056 | NET NO AUTH LOW CX NO UI | A critical remote code execution (RCE) vulnerability has been reported in PTC Wi | |
|
79
|
CVE-2026-93857 |
9.2 | 0.0056 | NET NO AUTH LOW CX NO UI | A stack-based buffer overflow vulnerability in Fireware OS's SIP proxy allows a | |
|
78
|
CVE-2026-58016 |
9.1 | 0.0056 | NET NO AUTH LOW CX NO UI | A flaw was found in GLib. A state confusion issue exists in g_dbus_node_info_new | |
|
78
|
CVE-2026-55100 |
8.7 | 0.0056 | NET NO AUTH LOW CX NO UI | hashi-vault-js is a Node.js module for interacting with the HashiCorp Vault API. | |
|
78
|
CVE-2026-98549 |
9.1 | 0.0056 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: tcp: preven | |
|
78
|
CVE-2026-10130 |
8.8 | 0.0056 | NET NO AUTH LOW CX NO UI | QueryWeaver contains an authentication bypass vulnerability that allows unauthen | |
|
77
|
CVE-2026-58014 |
8.6 | 0.0056 | NET NO AUTH LOW CX NO UI | A flaw was found in GLib. An off-by-one error can occur in the g_key_file_get_lo | |
|
75
|
CVE-2026-97638 |
7.5 | 0.0056 | NET NO AUTH LOW CX NO UI | The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin f | |
|
75
|
CVE-2026-28991 |
7.5 | 0.0056 | NET NO AUTH LOW CX NO UI | An out-of-bounds read was addressed with improved bounds checking. This issue is | |
|
75
|
CVE-2026-20339 |
7.5 | 0.0056 | NET NO AUTH LOW CX NO UI | A vulnerability in the PESpin file format parser of ClamAV could allow an unauth | |
|
75
|
CVE-2026-20345 |
7.5 | 0.0056 | NET NO AUTH LOW CX NO UI | A vulnerability in the GPT file format parser of ClamAV could allow an unauthent | |
|
75
|
CVE-2026-20347 |
7.5 | 0.0056 | NET NO AUTH LOW CX NO UI | A vulnerability in the Mach-O file format parser of ClamAV could allow an unauth | |
|
75
|
CVE-2026-18828 |
7.5 | 0.0056 | NET NO AUTH LOW CX NO UI | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to c | |
|
75
|
CVE-2026-116690 |
7.5 | 0.0056 | NET NO AUTH LOW CX NO UI | MLflow is an open source AI engineering platform for agents, large language mode | |
|
75
|
CVE-2026-20338 |
7.5 | 0.0056 | NET NO AUTH LOW CX NO UI | A vulnerability in the zip archive parser of ClamAV could allow an unauthenticat | |
|
75
|
CVE-2026-48042 |
7.5 | 0.0056 | NET NO AUTH LOW CX NO UI | Envoy is an open source edge and service proxy designed for cloud-native applica | |
|
75
|
CVE-2026-59892 |
7.5 | 0.0056 | NET NO AUTH LOW CX NO UI | OpenTelemetry JavaScript is the OpenTelemetry JavaScript client. Prior to 2.9.0, | |
|
75
|
CVE-2026-59675 |
7.5 | 0.0056 | NET NO AUTH LOW CX NO UI | When API audit logging is enabled, the middleware reads the entire HTTP request | |
|
75
|
CVE-2026-41114 |
7.5 | 0.0056 | NET NO AUTH LOW CX NO UI | Uncontrolled Resource Consumption vulnerability in Apache IoTDB JDBC driver. | |
|
70
|
CVE-2026-8859 |
9.9 | 0.0056 | NET LOW CX NO UI | IBM Langflow OSS 1.0.0 through 1.10.0 Langflow could allow an attacker to write | |
|
69
|
CVE-2026-113072 |
9.6 | 0.0056 | NET NO AUTH LOW CX | Memory corruption in CSS in Google Chrome prior to 156.0.8078.47 allowed a remot | |
|
69
|
CVE-2026-47705 |
9.6 | 0.0056 | NET NO AUTH LOW CX | TypeBot is a chatbot builder tool. Version 3.16.1 has a CSV injection vulnerabil | |
|
69
|
CVE-2026-73032 |
9.4 | 0.0056 | NET NO AUTH LOW CX | PapersGPT for Zotero 0.6.1 contains a remote code execution vulnerability that a | |
|
69
|
CVE-2026-119717 |
9.2 | 0.0056 | NET NO AUTH NO UI | pybars4 through 0.9.13 contains a code injection vulnerability in pybars/_compil | |
|
69
|
CVE-2026-17687 |
9.6 | 0.0056 | NET NO AUTH LOW CX | Type Confusion in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote | |
|
69
|
CVE-2026-69435 |
9.6 | 0.0056 | NET LOW CX NO UI | Missing authorization in Azure SRE Agent allows an authorized attacker to elevat | |
|
68
|
CVE-2026-7667 |
8.8 | 0.0056 | NET LOW CX NO UI | IBM Langflow OSS 1.0.0 through 1.10.0 allows an authenticated attacker to create | |
|
68
|
CVE-2026-113161 |
8.8 | 0.0056 | NET NO AUTH LOW CX | Use after free in WebRTC in Google Chrome prior to 156.0.8078.47 allowed a remot | |
|
68
|
CVE-2026-113202 |
8.8 | 0.0056 | NET NO AUTH LOW CX | Use after free in BrowserTag in Google Chrome prior to 156.0.8078.47 allowed a r | |
|
68
|
CVE-2025-61196 |
8.8 | 0.0056 | NET LOW CX NO UI | An issue in BusinessNext CRMnext v.10.8.3.0 allows a remote attacker to execute | |
|
68
|
CVE-2026-96275 |
8.8 | 0.0056 | NET NO AUTH LOW CX | A malicious or compromised Flatpak repository can write attacker-controlled cont | |
|
67
|
CVE-2026-35438 |
8.3 | 0.0056 | NET LOW CX NO UI | Missing authorization in Windows Admin Center allows an authorized attacker to e | |
|
66
|
CVE-2026-57743 |
8.1 | 0.0056 | NET NO AUTH NO UI | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP | |
|
65
|
CVE-2026-41615 |
7.4 | 0.0056 | NET NO AUTH LOW CX | Exposure of sensitive information to an unauthorized actor in Microsoft Authenti | |
|
64
|
CVE-2026-118485 |
7.0 | 0.0056 | NET NO AUTH LOW CX | Axel Download Accelerator 2.17.14 and earlier performs URL percent-decoding (htt | |
|
64
|
CVE-2026-47704 |
7.1 | 0.0056 | NET LOW CX NO UI | TypeBot is a chatbot builder tool. Prior to version 3.17.0, an authenticated use | |
|
64
|
CVE-2026-15265 |
9.4 | 0.0056 | NET LOW CX NO UI | A path traversal vulnerability in Tenable Agent 11.2.0 and 11.1.3 and lower allo | |
|
63
|
CVE-2026-44945 |
9.1 | 0.0056 | NET LOW CX NO UI | A privilege escalation vulnerability exists in Rancher's impersonation middlewar | |
|
55
|
CVE-2026-63337 |
7.5 | 0.0056 | NET LOW CX | The RabbitMQ Java client library allows Java and JVM-based applications to conne | |
|
55
|
CVE-2026-97789 |
7.5 | 0.0056 | NET NO AUTH | Use after free in Remote Desktop Client allows an unauthorized attacker to execu |