Hunt List
13,097 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-43125 |
9.8 | 0.0054 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: dlm: valida | |
|
80
|
CVE-2026-42369 |
10.0 | 0.0054 | NET NO AUTH LOW CX NO UI | GV-VMS V20 is a Video Monitoring Software used to gather the feeds of many surve | |
|
80
|
CVE-2026-16326 |
10.0 | 0.0054 | NET NO AUTH LOW CX NO UI | In consul-mcp-server, versions 0.1.0 up to 0.1.3 did not properly isolate sessio | |
|
80
|
CVE-2026-101484 |
9.8 | 0.0054 | NET NO AUTH LOW CX NO UI | Vulnerability in Oracle Secure Backup (component: Backup and Restore). Supporte | |
|
80
|
CVE-2026-35490 |
9.8 | 0.0054 | NET NO AUTH LOW CX NO UI | changedetection.io is a free open source web page change detection tool. Prior t | |
|
79
|
CVE-2026-15143 |
9.3 | 0.0054 | NET NO AUTH LOW CX NO UI | A flaw was found in the file_type content detector of guardrails-detectors. This | |
|
79
|
CVE-2026-24444 |
9.3 | 0.0053 | NET NO AUTH LOW CX NO UI | SDMC NE6037 cable modem routers running firmware 7.1.6.0.25 and 7.1.6.1.9_B9 con | |
|
79
|
CVE-2026-68584 |
9.2 | 0.0053 | NET NO AUTH LOW CX NO UI | SiYuan versions before v3.7.3 contain an authentication bypass vulnerability in | |
|
78
|
CVE-2026-51119 |
9.1 | 0.0054 | NET NO AUTH LOW CX NO UI | An issue in Invixium IXM WEB v.2.3.85.25 allows an attacker to escalate privileg | |
|
78
|
CVE-2026-17552 |
9.1 | 0.0054 | NET NO AUTH LOW CX NO UI | Plack::App::Prerender versions before 0.3.0 for Perl can proxy to an arbitrary h | |
|
78
|
CVE-2026-47683 |
8.7 | 0.0054 | NET NO AUTH LOW CX NO UI | vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.6, the bufferAllocLi | |
|
78
|
CVE-2026-40005 |
9.1 | 0.0054 | NET NO AUTH LOW CX NO UI | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') v | |
|
78
|
CVE-2023-54347 |
8.7 | 0.0054 | NET NO AUTH LOW CX NO UI | OpenEMR 7.0.1 contains an authentication brute force vulnerability that allows a | |
|
78
|
CVE-2026-42952 |
8.7 | 0.0054 | NET NO AUTH LOW CX NO UI | Previously, there was no throttling on repeated authentication attempts to the | |
|
78
|
CVE-2026-16393 |
9.1 | 0.0054 | NET NO AUTH LOW CX NO UI | Incorrect boundary conditions in the Graphics: WebGPU component. This vulnerabil | |
|
78
|
CVE-2018-25438 |
8.7 | 0.0054 | NET NO AUTH LOW CX NO UI | Intermesh Group-Office 3.3.0 before 3.5.5 contains an unauthenticated path trave | |
|
77
|
CVE-2026-48032 |
8.3 | 0.0054 | NET NO AUTH LOW CX NO UI | Hulumi is an open-source toolkit that ships secure-by-default cloud and platform | |
|
77
|
CVE-2026-58499 |
8.2 | 0.0054 | NET NO AUTH LOW CX NO UI | EverOS is a memory runtime for agents. Prior to 1.0.1, EverOS is vulnerable to p | |
|
77
|
CVE-2026-116682 |
8.6 | 0.0054 | NET NO AUTH LOW CX NO UI | FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to 1.5 | |
|
77
|
CVE-2026-40073 |
8.2 | 0.0054 | NET NO AUTH LOW CX NO UI | SvelteKit is a framework for rapidly developing robust, performant web applicati | |
|
77
|
CVE-2026-44129 |
8.3 | 0.0053 | NET NO AUTH LOW CX NO UI | SEPPmail Secure Email Gateway before version 15.0.4 contains a server-side templ | |
|
75
|
CVE-2026-5497 |
7.5 | 0.0054 | NET NO AUTH LOW CX NO UI | vLLM versions 0.8.0 and later are vulnerable to an Out-of-Memory (OOM) Denial of | |
|
75
|
CVE-2026-47476 |
7.5 | 0.0054 | NET NO AUTH LOW CX NO UI | NVIDIA Triton Inference Server for Linux contains a vulnerability where an attac | |
|
75
|
CVE-2026-72545 |
7.5 | 0.0054 | NET NO AUTH LOW CX NO UI | An insecure direct object reference vulnerability in OpenSignLabs OpenSign throu | |
|
75
|
CVE-2026-72605 |
7.5 | 0.0054 | NET NO AUTH LOW CX NO UI | A missing authentication vulnerability in Swing Music 3.0.0 allows unauthenticat | |
|
75
|
CVE-2026-23827 |
7.5 | 0.0053 | NET NO AUTH LOW CX NO UI | A heap-based buffer overflow vulnerability exists in a Network management servic | |
|
75
|
CVE-2026-37452 |
7.5 | 0.0053 | NET NO AUTH LOW CX NO UI | Insecure Permissions vulnerability in MSI NBFoundation Service v.2.0.2506.1201 a | |
|
75
|
CVE-2026-79893 |
7.5 | 0.0053 | NET NO AUTH LOW CX NO UI | Memory corruption vulnerabilities in AOS-10 could allow an unauthenticated remot | |
|
69
|
CVE-2026-65048 |
9.3 | 0.0054 | NET NO AUTH LOW CX | Ninja Forms plugin for WordPress versions 3.10.4 through 3.14.9 contains an unau | |
|
69
|
CVE-2026-44791 |
9.4 | 0.0054 | NET LOW CX NO UI | n8n is an open source workflow automation platform. Prior to 1.123.43, 2.22.1, a | |
|
68
|
CVE-2026-13749 |
8.8 | 0.0054 | NET NO AUTH LOW CX | Improper neutralization in the Snowpark annotation processor callback template i | |
|
68
|
CVE-2026-1928 |
8.8 | 0.0054 | NET LOW CX NO UI | The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress i | |
|
68
|
CVE-2026-35519 |
8.8 | 0.0054 | NET LOW CX NO UI | FTLDNS (pihole-FTL) provides an interactive API and also generates statistics fo | |
|
68
|
CVE-2026-98171 |
8.8 | 0.0054 | NET NO AUTH LOW CX | In the Linux kernel, the following vulnerability has been resolved: smb: client | |
|
68
|
CVE-2026-56773 |
8.7 | 0.0054 | NET LOW CX NO UI | Teable's v2 REST API controller lacks @Permissions metadata on ORPC endpoints, a | |
|
68
|
CVE-2026-63085 |
8.7 | 0.0054 | NET LOW CX NO UI | Axelor Open Platform versions 8.x prior to 8.2.2 contains an authorization bypas | |
|
68
|
CVE-2026-14334 |
8.8 | 0.0054 | NET NO AUTH LOW CX | The Booking calendar, Appointment Booking System WordPress plugin through 3.2.36 | |
|
68
|
CVE-2026-42143 |
8.8 | 0.0053 | NET LOW CX NO UI | Coolify is an open-source and self-hostable tool for managing servers, applicati | |
|
68
|
CVE-2026-118619 |
8.8 | 0.0053 | NET NO AUTH LOW CX | Ultralytics Google Drive Download Path Traversal Remote Code Execution Vulnerabi | |
|
68
|
CVE-2026-97751 |
8.8 | 0.0053 | NET NO AUTH LOW CX | Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized atta | |
|
67
|
CVE-2023-3399 |
8.5 | 0.0054 | NET LOW CX NO UI | An issue has been discovered in GitLab EE affecting all versions starting from 1 | |
|
66
|
CVE-2025-58958 |
8.1 | 0.0053 | NET NO AUTH NO UI | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP | |
|
66
|
CVE-2025-58967 |
8.1 | 0.0053 | NET NO AUTH NO UI | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP | |
|
66
|
CVE-2025-59555 |
8.1 | 0.0053 | NET NO AUTH NO UI | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP | |
|
66
|
CVE-2025-59558 |
8.1 | 0.0053 | NET NO AUTH NO UI | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP | |
|
66
|
CVE-2025-59564 |
8.1 | 0.0053 | NET NO AUTH NO UI | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP | |
|
64
|
CVE-2026-17094 |
7.1 | 0.0054 | NET LOW CX NO UI | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obta | |
|
63
|
CVE-2026-115547 |
9.1 | 0.0054 | NET LOW CX NO UI | An input validation issue in the Okta Access Gateway (OAG) Admin Console allows | |
|
62
|
CVE-2026-7435 |
8.6 | 0.0053 | NET LOW CX NO UI | SSCMS v7.4.0 contains a SQL injection vulnerability in the stl:sqlContent tag wh | |
|
60
|
CVE-2024-50571 |
7.2 | 0.0054 | NET LOW CX NO UI | A heap-based buffer overflow vulnerability in Fortinet FortiAnalyzer 7.6.0 throu |