Hunt List
13,050 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2023-1357 |
9.8 | 0.0055 | NET NO AUTH LOW CX NO UI | A vulnerability, which was classified as critical, has been found in SourceCodes | |
|
80
|
CVE-2024-53177 |
9.8 | 0.0055 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: smb: preven | |
|
80
|
CVE-2026-48056 |
10.0 | 0.0055 | NET NO AUTH LOW CX NO UI | Streambert is a cross-platform Electron Desktop App to stream and download video | |
|
80
|
CVE-2026-84295 |
10.0 | 0.0055 | NET NO AUTH LOW CX NO UI | Improper authentication in Progress Software WS_FTP Server versions prior to 202 | |
|
80
|
CVE-2026-16235 |
9.8 | 0.0055 | NET NO AUTH LOW CX NO UI | Crypt::Password versions through 0.28 for Perl generate insecure random values f | |
|
80
|
CVE-2026-59147 |
9.8 | 0.0055 | NET NO AUTH LOW CX NO UI | Data::DisjointSet::Shared versions before 0.02 for Perl allow out-of-bounds read | |
|
80
|
CVE-2026-71254 |
9.8 | 0.0055 | NET NO AUTH LOW CX NO UI | nanoMODBUS through v1.23.0 contains an out-of-bounds write in the Modbus server- | |
|
80
|
CVE-2026-71256 |
9.8 | 0.0055 | NET NO AUTH LOW CX NO UI | nanoMODBUS through v1.23.0 contains an out-of-bounds stack read leading to a wil | |
|
80
|
CVE-2026-71267 |
9.8 | 0.0055 | NET NO AUTH LOW CX NO UI | microtar's mtar_write_file_header and mtar_write_dir_header functions (src/micro | |
|
80
|
CVE-2026-106013 |
9.8 | 0.0055 | NET NO AUTH LOW CX NO UI | The Jupiter X Core plugin for WordPress is vulnerable to Authentication Bypass v | |
|
79
|
CVE-2026-79872 |
9.4 | 0.0056 | NET NO AUTH LOW CX NO UI | A buffer overflow vulnerability exists in the underlying operating system of AOS | |
|
79
|
CVE-2026-61884 |
9.3 | 0.0056 | NET NO AUTH LOW CX NO UI | The Tycon Systems TPDIN-Monitor-WEB2 ships without HTTP credentials configured, | |
|
79
|
CVE-2025-34522 |
9.2 | 0.0056 | NET NO AUTH LOW CX NO UI | A heap-based buffer overflow vulnerability exists in the input parsing logic of | |
|
79
|
CVE-2026-42882 |
9.4 | 0.0055 | NET NO AUTH LOW CX NO UI | oxyno-zeta/s3-proxy is an aws s3 proxy written in go. Prior to 5.0.0, s3-proxy c | |
|
79
|
CVE-2026-35047 |
9.3 | 0.0055 | NET NO AUTH LOW CX NO UI | Brave CMS is an open-source CMS. Prior to 2.0.6, an Unrestricted File Upload vul | |
|
79
|
CVE-2026-6074 |
9.3 | 0.0055 | NET NO AUTH LOW CX NO UI | Intrado 911 Emergency Gateway (EGW) 5.x, 6.x, and 7.x contain a path traversal v | |
|
79
|
CVE-2026-65318 |
9.2 | 0.0055 | NET NO AUTH LOW CX NO UI | Verba RAG application version 2.1.3 contains an unauthenticated server-side requ | |
|
78
|
CVE-2026-48830 |
9.1 | 0.0056 | NET NO AUTH LOW CX NO UI | Improper authentication in Apache bRPC through 1.17.0 allows a remote unauthenti | |
|
78
|
CVE-2026-62184 |
8.7 | 0.0056 | NET NO AUTH LOW CX NO UI | luci-app-banip contains a log parsing vulnerability where the awk-based parser e | |
|
78
|
CVE-2026-54078 |
8.7 | 0.0056 | NET NO AUTH LOW CX NO UI | veraPDF validation model is an implementation of the veraPDF validation model. F | |
|
78
|
CVE-2026-54079 |
8.7 | 0.0056 | NET NO AUTH LOW CX NO UI | veraPDF validation provides PDF/A and PDF/UA validation, feature reporting, and | |
|
78
|
CVE-2026-55629 |
8.7 | 0.0055 | NET NO AUTH LOW CX NO UI | Whistle is an HTTP, HTTP2, HTTPS, and WebSocket debugging proxy. Prior to 2.10.3 | |
|
78
|
CVE-2026-60007 |
9.1 | 0.0055 | NET NO AUTH LOW CX NO UI | In Eclipse Milo versions 0.6.0 through 1.1.4, username-token processing returns | |
|
78
|
CVE-2026-56122 |
8.7 | 0.0055 | NET NO AUTH LOW CX NO UI | Winstone Servlet Engine through 0.9.10 contains a path traversal vulnerability t | |
|
77
|
CVE-2026-28808 |
8.3 | 0.0056 | NET NO AUTH LOW CX NO UI | Incorrect Authorization vulnerability in Erlang OTP (inets modules) allows unaut | |
|
77
|
CVE-2026-48448 |
8.6 | 0.0056 | NET NO AUTH LOW CX NO UI | Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Specia | |
|
76
|
CVE-2026-67363 |
7.7 | 0.0056 | NET NO AUTH LOW CX NO UI | Joomla Extension - balbooa.com - Pre-auth Payment Amount Tampering in Balbooa Fo | |
|
75
|
CVE-2026-28936 |
7.5 | 0.0056 | NET NO AUTH LOW CX NO UI | The issue was addressed with improved checks. This issue is fixed in iOS 18.7.9 | |
|
75
|
CVE-2026-46581 |
7.5 | 0.0056 | NET NO AUTH LOW CX NO UI | In Eclipse Mojarra versions 2.3 and following, URL handing in `DefaultFaceletFac | |
|
75
|
CVE-2026-94266 |
7.5 | 0.0056 | NET NO AUTH LOW CX NO UI | libcurl could accidentally return a URL for `curl_easy_getinfo()`'s `CURLINFO_EF | |
|
75
|
CVE-2026-118779 |
7.5 | 0.0056 | NET NO AUTH LOW CX NO UI | Forge (also called node-forge) is a native implementation of Transport Layer Sec | |
|
69
|
CVE-2026-17687 |
9.6 | 0.0056 | NET NO AUTH LOW CX | Type Confusion in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote | |
|
69
|
CVE-2026-69435 |
9.6 | 0.0056 | NET LOW CX NO UI | Missing authorization in Azure SRE Agent allows an authorized attacker to elevat | |
|
69
|
CVE-2026-6296 |
9.6 | 0.0056 | NET NO AUTH LOW CX | Heap buffer overflow in ANGLE in Google Chrome prior to 147.0.7727.101 allowed a | |
|
68
|
CVE-2026-72533 |
8.8 | 0.0056 | NET LOW CX NO UI | An authentication bypass vulnerability in Portainer CE through 2.44.0 allows aut | |
|
68
|
CVE-2026-40370 |
8.8 | 0.0056 | NET LOW CX NO UI | External control of file name or path in SQL Server allows an authorized attacke | |
|
68
|
CVE-2026-112659 |
8.8 | 0.0056 | NET NO AUTH LOW CX | A type confusion issue was addressed with improved memory handling. This issue i | |
|
68
|
CVE-2026-67351 |
8.7 | 0.0056 | NET LOW CX NO UI | Serendipity before 2.6.1 contains an authentication context confusion vulnerabil | |
|
68
|
CVE-2026-54526 |
8.9 | 0.0055 | NET LOW CX NO UI | Argo Workflows is an open source container-native workflow engine for orchestrat | |
|
68
|
CVE-2026-6912 |
8.7 | 0.0055 | NET LOW CX NO UI | Improperly controlled modification of dynamically-determined object attributes i | |
|
67
|
CVE-2026-9585 |
8.6 | 0.0055 | NET NO AUTH LOW CX | An unauthenticated reflected cross-site scripting (XSS) vulnerability exists in | |
|
66
|
CVE-2025-40158 |
8.1 | 0.0056 | NET NO AUTH NO UI | In the Linux kernel, the following vulnerability has been resolved: ipv6: use R | |
|
65
|
CVE-2026-66745 |
7.5 | 0.0055 | NET NO AUTH LOW CX | Artica Proxy before 4.50.000000 Service Pack 7 (fixed in hotfix 20260724-02) con | |
|
65
|
CVE-2026-58170 |
7.2 | 0.0055 | NET LOW CX NO UI | Vibe-Trading before 0.1.10 builds the proposal file path by joining a caller-sup | |
|
64
|
CVE-2026-74039 |
7.1 | 0.0056 | NET LOW CX NO UI | Wazuh 4.0.0 before 4.14.7 and 5.0.0-beta2 contain a denial of service vulnerabil | |
|
64
|
CVE-2025-71391 |
7.1 | 0.0056 | NET LOW CX NO UI | SurrealDB versions before 2.2.2 contain an uncaught exception vulnerability in t | |
|
60
|
CVE-2026-23820 |
7.2 | 0.0056 | NET LOW CX NO UI | A vulnerability in the command line interface of Access Points running AOS-10 an | |
|
57
|
CVE-2026-67625 |
8.5 | 0.0056 | NET NO UI | Heap-based buffer overflow in SQL Server allows an authorized attacker to execut | |
|
57
|
CVE-2026-68883 |
8.5 | 0.0056 | NET NO UI | Heap-based buffer overflow in SQL Server allows an authorized attacker to elevat | |
|
55
|
CVE-2026-58233 |
7.6 | 0.0056 | NET LOW CX | SAP Change and Transport System Attach Tool (ctsattach) allows an authenticated |