Hunt List
13,066 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-99153 |
9.8 | 0.0055 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: scsi: libis | |
|
80
|
CVE-2026-89633 |
9.8 | 0.0055 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: smb: client | |
|
80
|
CVE-2026-16367 |
10.0 | 0.0055 | NET NO AUTH LOW CX NO UI | Sandbox escape due to invalid pointer in the Disability Access APIs component. T | |
|
80
|
CVE-2026-44277 |
9.8 | 0.0055 | NET NO AUTH LOW CX NO UI | A improper access control vulnerability in Fortinet FortiAuthenticator 8.0.2, Fo | |
|
80
|
CVE-2026-16388 |
9.8 | 0.0055 | NET NO AUTH LOW CX NO UI | Sandbox escape in the DOM: Networking component. This vulnerability was fixed in | |
|
80
|
CVE-2026-16410 |
9.8 | 0.0055 | NET NO AUTH LOW CX NO UI | JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability w | |
|
80
|
CVE-2026-13766 |
9.8 | 0.0055 | NET NO AUTH LOW CX NO UI | DBIx::QuickORM versions before 0.000026 for Perl allow SQL injection via unquote | |
|
80
|
CVE-2026-60264 |
9.8 | 0.0055 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (compo | |
|
80
|
CVE-2026-115806 |
9.8 | 0.0055 | NET NO AUTH LOW CX NO UI | The Prime Mover – Backup and Migration plugin for WordPress is vulnerable to PHP | |
|
79
|
CVE-2026-64639 |
9.3 | 0.0055 | NET NO AUTH LOW CX NO UI | Incorrect database cloning process in Plesk from 18.0.52 before 18.0.79.6 and 18 | |
|
79
|
CVE-2026-65886 |
9.2 | 0.0055 | NET NO AUTH LOW CX NO UI | Joomla Extension - balbooa.com - Unauthenticated arbitrary file read in Gridbox | |
|
79
|
CVE-2026-1496 |
9.3 | 0.0055 | NET NO AUTH LOW CX NO UI | Vulnerable versions of Coverity Connect lack an error handler in the authenticat | |
|
79
|
CVE-2023-54344 |
9.3 | 0.0055 | NET NO AUTH LOW CX NO UI | Eclipse Equinox OSGi 3.7.2 and earlier contains a remote code execution vulnerab | |
|
79
|
CVE-2026-48777 |
9.3 | 0.0055 | NET NO AUTH LOW CX NO UI | FileBrowser Quantum is a free, self-hosted, web-based file manager. Versions pri | |
|
79
|
CVE-2026-59106 |
9.3 | 0.0055 | NET NO AUTH LOW CX NO UI | A security vulnerability has been identified in the WolfProt interface implement | |
|
79
|
CVE-2026-101986 |
9.3 | 0.0055 | NET NO AUTH LOW CX NO UI | An Improper Authentication vulnerability in J-Web of Juniper Networks Junos OS | |
|
78
|
CVE-2010-20125 |
8.7 | 0.0055 | NET NO AUTH LOW CX NO UI | DedeCMS before 5.7 contains a file inclusion vulnerability in plus/carbuyaction. | |
|
78
|
CVE-2026-73381 |
9.1 | 0.0055 | NET NO AUTH LOW CX NO UI | Unauthenticated Broken Authentication in Popup by Supsystic <= 1.13.0 versions. | |
|
78
|
CVE-2026-42856 |
8.7 | 0.0055 | NET NO AUTH LOW CX NO UI | Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to 5.1.3, the | |
|
78
|
CVE-2026-14161 |
8.7 | 0.0055 | NET NO AUTH LOW CX NO UI | Hospital Quening Management developed by Advantech has a Sensitive Data Exposure | |
|
77
|
CVE-2026-120135 |
8.2 | 0.0055 | NET NO AUTH LOW CX NO UI | Uncontrolled Recursion vulnerability in Apache Thrift Java bindings. This iss | |
|
77
|
CVE-2026-65832 |
8.2 | 0.0055 | NET NO AUTH LOW CX NO UI | Deskflow is a keyboard and mouse sharing app. Prior to continuous build 1.26.0.2 | |
|
77
|
CVE-2026-46591 |
8.2 | 0.0055 | NET NO AUTH LOW CX NO UI | Improper Neutralization of Special Elements in Data Query Logic vulnerability in | |
|
75
|
CVE-2023-29105 |
7.5 | 0.0055 | NET NO AUTH LOW CX NO UI | A vulnerability has been identified in SIMATIC Cloud Connect 7 CC712 (All versio | |
|
75
|
CVE-2026-34148 |
7.5 | 0.0055 | NET NO AUTH LOW CX NO UI | Fedify is a TypeScript library for building federated server apps powered by Act | |
|
75
|
CVE-2026-55390 |
7.5 | 0.0055 | NET NO AUTH LOW CX NO UI | datamodel-code-generator generates Python data models from schema definitions. F | |
|
75
|
CVE-2026-111758 |
7.5 | 0.0055 | NET NO AUTH LOW CX NO UI | markdown-it is a Markdown parser. From versions 14.1.0 to before 14.3.3, and 15. | |
|
75
|
CVE-2026-82230 |
7.5 | 0.0055 | NET NO AUTH LOW CX NO UI | Uncontrolled recursion in the mcpack2pb component in Apache bRPC (version < 1.18 | |
|
75
|
CVE-2026-86146 |
7.5 | 0.0055 | NET NO AUTH LOW CX NO UI | Inconsistent interpretation of HTTP requests (HTTP request/response smuggling) i | |
|
75
|
CVE-2026-86147 |
7.5 | 0.0055 | NET NO AUTH LOW CX NO UI | External control of file name or path and uncontrolled resource consumption in A | |
|
70
|
CVE-2026-34047 |
9.9 | 0.0055 | NET LOW CX NO UI | Coolify is an open-source and self-hostable tool for managing servers, applicati | |
|
70
|
CVE-2026-70496 |
9.9 | 0.0055 | NET LOW CX NO UI | A flaw was found in search-v2-operator. The operator's ClusterRole has permissio | |
|
69
|
CVE-2025-65200 |
9.6 | 0.0055 | NET NO AUTH LOW CX | An issue was discovered in localstack 4.9.2 allowing attackers to execute arbitr | |
|
68
|
CVE-2026-55249 |
8.8 | 0.0055 | NET NO AUTH LOW CX | @rtk-ai/rtk-rewrite transparently rewrites shell commands executed via OpenClaw' | |
|
68
|
CVE-2026-49221 |
8.8 | 0.0055 | NET LOW CX NO UI | Vvveb is a powerful and easy to use CMS with page builder to build websites, blo | |
|
68
|
CVE-2026-49228 |
8.8 | 0.0055 | NET LOW CX NO UI | Vvveb is a powerful and easy to use CMS with page builder to build websites, blo | |
|
68
|
CVE-2026-71851 |
9.0 | 0.0055 | NET NO AUTH NO UI | crypto-js is a JavaScript library of crypto standards. Versions of crypto-js pri | |
|
68
|
CVE-2026-45172 |
8.7 | 0.0055 | NET LOW CX NO UI | Due to incomplete input validation in Idira Privileged Session Manager for SSH ( | |
|
68
|
CVE-2026-22622 |
8.8 | 0.0055 | NET LOW CX NO UI | Improper input validation in one of the session management interface of Eaton's | |
|
68
|
CVE-2026-71288 |
8.8 | 0.0055 | NET LOW CX NO UI | Koha's guided report builder (reports/guided_reports.pl) reads the CGI parameter | |
|
68
|
CVE-2026-71291 |
8.8 | 0.0055 | NET LOW CX NO UI | Bolt CMS renders content field values through Twig's full application-level Envi | |
|
67
|
CVE-2026-56167 |
8.5 | 0.0055 | NET LOW CX NO UI | Server-side request forgery (ssrf) in Azure AI Search allows an authorized attac | |
|
66
|
CVE-2026-79891 |
8.1 | 0.0055 | NET NO AUTH NO UI | A buffer overflow vulnerability exists in the command line interface of AOS-8 th | |
|
66
|
CVE-2026-28699 |
8.1 | 0.0055 | NET LOW CX NO UI | Gitea versions up to and including 1.26.1 allow OAuth2 access token scope enforc | |
|
65
|
CVE-2026-73624 |
7.2 | 0.0055 | NET LOW CX NO UI | GitPython versions before 3.1.54 contain an arbitrary file overwrite vulnerabili | |
|
65
|
CVE-2026-6197 |
7.4 | 0.0055 | NET LOW CX NO UI | A flaw has been found in Tenda F456 1.0.0.5. This vulnerability affects the func | |
|
64
|
CVE-2026-53875 |
7.1 | 0.0055 | NET NO AUTH LOW CX | picklescan before 1.0.3 contains a scanning bypass vulnerability in the scan_pyt | |
|
64
|
CVE-2025-71397 |
7.1 | 0.0055 | NET LOW CX NO UI | SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 allows authen | |
|
58
|
CVE-2026-58592 |
8.9 | 0.0055 | NET NO AUTH | Ladybird before commit 2f9dc7e contains a dangling-reference memory-safety flaw | |
|
55
|
CVE-2026-57574 |
7.4 | 0.0055 | NET NO AUTH | Misskey is an open source, federated social media platform. Prior to 2026.6.0, M |