Hunt List
13,108 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-63808 |
9.8 | 0.0053 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: exfat: fix | |
|
80
|
CVE-2026-65145 |
10.0 | 0.0053 | NET NO AUTH LOW CX NO UI | NVIDIA NeMo Agent Toolkit contains a vulnerability where a attacker could cause | |
|
80
|
CVE-2026-54859 |
9.8 | 0.0053 | NET NO AUTH LOW CX NO UI | Unauthenticated PHP Object Injection in Preservation <= 1.15 versions. | |
|
80
|
CVE-2026-61567 |
10.0 | 0.0053 | NET NO AUTH LOW CX NO UI | AVideo is a video-sharing Platform. Prior to 8.1.0, the live-streaming endpoint | |
|
80
|
CVE-2026-57692 |
9.8 | 0.0053 | NET NO AUTH LOW CX NO UI | Incorrect Privilege Assignment vulnerability in LCweb PrivateContent allows Priv | |
|
80
|
CVE-2026-14446 |
9.8 | 0.0053 | NET NO AUTH LOW CX NO UI | IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to broken access con | |
|
79
|
CVE-2026-15378 |
9.3 | 0.0053 | NET NO AUTH LOW CX NO UI | A flaw was found in the `guardrails-detectors` component. This vulnerability all | |
|
79
|
CVE-2026-5189 |
9.2 | 0.0053 | NET NO AUTH LOW CX NO UI | CWE-798: Use of Hard-coded Credentials in Sonatype Nexus Repository Manager vers | |
|
79
|
CVE-2026-93328 |
9.3 | 0.0053 | NET NO AUTH LOW CX NO UI | Path Traversal and Missing Authorization in cloud-storage source in Google Cloud | |
|
79
|
CVE-2023-22793 |
9.3 | 0.0053 | NET NO AUTH LOW CX NO UI | A vulnerability allowing an unauthenticated attacker to perform remote code exec | |
|
79
|
CVE-2026-58492 |
9.2 | 0.0053 | NET NO AUTH LOW CX NO UI | grav-plugin-database is the database plugin for Grav CMS. Prior to 1.2.0, the PD | |
|
78
|
CVE-2026-45689 |
9.1 | 0.0053 | NET NO AUTH LOW CX NO UI | Rocket.Chat is an open-source, secure, fully customizable communications platfor | |
|
78
|
CVE-2026-11403 |
8.7 | 0.0053 | NET NO AUTH LOW CX NO UI | A vulnerability in Sonatype Nexus Repository Manager's format-specific API key g | |
|
78
|
CVE-2026-70453 |
8.7 | 0.0053 | NET NO AUTH LOW CX NO UI | rsync before 3.5.0 contains an algorithmic complexity vulnerability in the hash_ | |
|
78
|
CVE-2026-62334 |
8.7 | 0.0053 | NET NO AUTH LOW CX NO UI | OpenVM is a performant and modular zkVM framework built for customization and ex | |
|
78
|
CVE-2026-62357 |
8.8 | 0.0052 | NET NO AUTH LOW CX NO UI | Dragonfly is an in-memory data store built for modern application workloads. Pri | |
|
78
|
CVE-2026-53653 |
8.7 | 0.0052 | NET NO AUTH LOW CX NO UI | Grav is a file-based Web platform. Prior to 1.7.53 and 2.0.0-rc.8, Grav allows a | |
|
77
|
CVE-2026-48763 |
8.2 | 0.0053 | NET NO AUTH LOW CX NO UI | TypeBot is a chatbot builder tool. Versions prior to 3.17.0 expose a deprecated | |
|
75
|
CVE-2026-44840 |
7.5 | 0.0053 | NET NO AUTH LOW CX NO UI | Dgraph is an open source distributed GraphQL database. Prior to version 25.3.4, | |
|
75
|
CVE-2026-47477 |
7.5 | 0.0053 | NET NO AUTH LOW CX NO UI | NVIDIA Triton Inference Server for Linux contains a vulnerability where an attac | |
|
75
|
CVE-2026-47478 |
7.5 | 0.0053 | NET NO AUTH LOW CX NO UI | NVIDIA Triton Inference Server for Linux contains a vulnerability where an attac | |
|
75
|
CVE-2026-98965 |
7.5 | 0.0053 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: ice: Restor | |
|
75
|
CVE-2026-99046 |
7.5 | 0.0053 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: gve: fix XS | |
|
75
|
CVE-2026-119195 |
7.5 | 0.0053 | NET NO AUTH LOW CX NO UI | pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, constructed string | |
|
75
|
CVE-2026-72689 |
7.5 | 0.0053 | NET NO AUTH LOW CX NO UI | A broken object-level authorization vulnerability in OpenSignLabs opensignserver | |
|
75
|
CVE-2025-66974 |
7.5 | 0.0053 | NET NO AUTH LOW CX NO UI | An issue in Prolink 13A Smart Plug Model Version: DS-3202M-UKv3 Wi-Fi and Applic | |
|
75
|
CVE-2026-118758 |
7.5 | 0.0053 | NET NO AUTH LOW CX NO UI | Kubeflow Pipelines enables users to build and deploy portable, scalable machine | |
|
69
|
CVE-2026-71193 |
9.6 | 0.0053 | NET LOW CX NO UI | In OpenStack Designate before 22.0.1, zone creation checks (_is_subzone, _is_sup | |
|
68
|
CVE-2026-9196 |
8.8 | 0.0053 | NET LOW CX NO UI | IBM Langflow OSS 1.0.0 through 1.10.3 could allow an authenticated attacker to e | |
|
68
|
CVE-2026-57623 |
9.0 | 0.0053 | NET NO AUTH NO UI | Unauthenticated Arbitrary Code Execution in W3 Total Cache <= 2.9.4 versions. | |
|
68
|
CVE-2026-62199 |
8.7 | 0.0053 | NET LOW CX NO UI | OpenClaw versions before 2026.6.6 contain a flaw in host exec environment filter | |
|
68
|
CVE-2026-62200 |
8.7 | 0.0053 | NET LOW CX NO UI | OpenClaw versions before 2026.6.6 contain a flaw in host exec environment filter | |
|
68
|
CVE-2026-41053 |
8.8 | 0.0052 | NET LOW CX NO UI | Incorrect authentication caching in the team member ship expansion of the Ranche | |
|
68
|
CVE-2026-18713 |
8.8 | 0.0052 | NET LOW CX NO UI | IBM i 7.6, 7.5, 7.4, and 7.3 s vulnerable to privilege escalation via Navigator | |
|
68
|
CVE-2026-88157 |
8.8 | 0.0052 | NET NO AUTH LOW CX | Heap-based buffer overflow in OpenSSH for Windows allows an unauthorized attacke | |
|
68
|
CVE-2026-88197 |
8.8 | 0.0052 | NET NO AUTH LOW CX | Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker t | |
|
67
|
CVE-2026-56876 |
8.6 | 0.0053 | NET NO AUTH LOW CX | extract-zip does not validate symlink targets when extracting zip archives. When | |
|
66
|
CVE-2026-73137 |
7.7 | 0.0053 | NET LOW CX NO UI | A flaw was found in the multicloud-operators-subscription component of Red Hat A | |
|
66
|
CVE-2026-47412 |
8.1 | 0.0053 | NET LOW CX NO UI | PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams sys | |
|
66
|
CVE-2026-62203 |
7.7 | 0.0053 | NET LOW CX NO UI | OpenClaw versions before 2026.6.6 contain an environment variable filtering vuln | |
|
64
|
CVE-2026-47723 |
7.1 | 0.0053 | NET NO AUTH LOW CX | nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private | |
|
64
|
CVE-2026-66305 |
7.1 | 0.0053 | NET LOW CX NO UI | Use of client-side authentication in Skype for Business allows an authorized att | |
|
63
|
CVE-2026-60026 |
8.9 | 0.0053 | NET LOW CX NO UI | Joomla Extension - themexpert.com - Authenticated PHP code execution in Quix Pag | |
|
63
|
CVE-2026-54400 |
9.1 | 0.0052 | NET LOW CX NO UI | A malicious actor with access to the network and high privileges could exploit a | |
|
62
|
CVE-2026-58074 |
8.6 | 0.0053 | NET LOW CX NO UI | A vulnerability allowing a high-privileged user to execute arbitrary code on the | |
|
62
|
CVE-2026-49954 |
8.6 | 0.0053 | NET LOW CX NO UI | Discuz! X5.0 releases 20260320 through 20260610 contain a local file inclusion v | |
|
58
|
CVE-2026-68899 |
8.7 | 0.0053 | NET LOW CX | Wekan is open source kanban built with Meteor. Prior to 9.90, isFileValid() in m | |
|
57
|
CVE-2026-85925 |
8.2 | 0.0053 | NET NO UI | Improper restriction of communication channel to intended endpoints in Azure Key | |
|
55
|
CVE-2026-19176 |
7.5 | 0.0053 | NET NO AUTH | Use after free in Skia in Google Chrome prior to 151.0.7922.109 allowed a remote | |
|
52
|
CVE-2026-9292 |
8.4 | 0.0053 | NET LOW CX | A Stored Cross-Site Scripting security issue exists within FactoryTalk® DataMosa |