Hunt List
13,123 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-66665 |
10.0 | 0.0052 | NET NO AUTH LOW CX NO UI | Unauthenticated Arbitrary File Upload in Type Hub <= 2.0.6 versions. | |
|
80
|
CVE-2026-56141 |
9.8 | 0.0052 | NET NO AUTH LOW CX NO UI | In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.14812 | |
|
80
|
CVE-2026-64874 |
9.8 | 0.0052 | NET NO AUTH LOW CX NO UI | Joomla Extension - regularlabs.com - CDN Credential leakage Cache Cleaner Pro ex | |
|
80
|
CVE-2026-14175 |
9.8 | 0.0052 | NET NO AUTH LOW CX NO UI | Unrestricted upload of file with dangerous type vulnerability in Bilin Software | |
|
80
|
CVE-2026-73996 |
9.8 | 0.0052 | NET NO AUTH LOW CX NO UI | Unauthenticated Arbitrary File Upload in Masteriyo - LMS <= 2.3.2 versions. | |
|
80
|
CVE-2026-20184 |
9.8 | 0.0052 | NET NO AUTH LOW CX NO UI | A vulnerability in the integration of single sign-on (SSO) with Control Hub in C | |
|
80
|
CVE-2026-7663 |
9.8 | 0.0052 | NET NO AUTH LOW CX NO UI | IBM Langflow OSS 1.0.0 through 1.9.6 could allow unauthenticated attackers to ac | |
|
80
|
CVE-2026-109220 |
9.8 | 0.0052 | NET NO AUTH LOW CX NO UI | The PDF Invoice for WooCommerce + Drag and Drop Template Builder plugin for Word | |
|
80
|
CVE-2026-46807 |
9.8 | 0.0052 | NET NO AUTH LOW CX NO UI | Vulnerability in the Identity Manager product of Oracle Fusion Middleware (compo | |
|
80
|
CVE-2026-58081 |
9.8 | 0.0052 | NET NO AUTH LOW CX NO UI | Several encoding modules, including HZ, UTF-7, VIQR, and ZW, did not properly ch | |
|
79
|
CVE-2026-32956 |
9.3 | 0.0052 | NET NO AUTH LOW CX NO UI | SD-330AC and AMC Manager provided by silex technology, Inc. contain a heap-based | |
|
79
|
CVE-2026-109422 |
9.2 | 0.0052 | NET NO AUTH LOW CX NO UI | NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 and 3.1. | |
|
79
|
CVE-2026-119660 |
9.3 | 0.0052 | NET NO AUTH LOW CX NO UI | MuseBot before 2.0.0 contains an authentication bypass vulnerability that allows | |
|
78
|
CVE-2026-9733 |
9.1 | 0.0052 | NET NO AUTH LOW CX NO UI | Mojolicious::Plugin::Web::Auth::OAuth2 versions through 0.17 for Perl have an in | |
|
78
|
CVE-2026-22547 |
9.1 | 0.0052 | NET NO AUTH LOW CX NO UI | Gitea versions before 1.25.5 lack validation constraints for repository creation | |
|
78
|
CVE-2026-63229 |
9.1 | 0.0052 | NET NO AUTH LOW CX NO UI | A pre-authentication blind SQL injection vulnerability in Koollab LMS allowed an | |
|
78
|
CVE-2026-63230 |
9.1 | 0.0052 | NET NO AUTH LOW CX NO UI | A pre-authentication error-based SQL injection vulnerability in Koollab LMS allo | |
|
78
|
CVE-2026-103603 |
8.7 | 0.0052 | NET NO AUTH LOW CX NO UI | Memory allocation with excessive size value in the HSS/LMS signature code (HssPu | |
|
78
|
CVE-2026-31908 |
9.1 | 0.0052 | NET NO AUTH LOW CX NO UI | Header injection vulnerability in Apache APISIX. The attacker can take advantag | |
|
78
|
CVE-2026-48544 |
8.7 | 0.0052 | NET NO AUTH LOW CX NO UI | Taipy 4.1.1, fixed in commit 129fd40, contains a path traversal vulnerability in | |
|
78
|
CVE-2026-49851 |
8.7 | 0.0052 | NET NO AUTH LOW CX NO UI | Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, | |
|
78
|
CVE-2026-63101 |
8.7 | 0.0052 | NET NO AUTH LOW CX NO UI | Open Event Server through 1.19.1 contains a missing authentication vulnerability | |
|
77
|
CVE-2026-21045 |
8.3 | 0.0052 | NET NO AUTH LOW CX NO UI | Out-of-bounds write in parsing TIFF format in libimagecodec.media.quram.so prior | |
|
77
|
CVE-2026-21048 |
8.3 | 0.0052 | NET NO AUTH LOW CX NO UI | Out-of-bounds write in parsing DNG format in libimagecodec.media.quram.so prior | |
|
77
|
CVE-2026-54058 |
8.3 | 0.0052 | NET NO AUTH LOW CX NO UI | Pillow is a Python imaging library. Prior to 12.3.0, when Pillow loads an uncomp | |
|
77
|
CVE-2025-15620 |
8.6 | 0.0052 | NET NO AUTH LOW CX NO UI | HiOS Switch Platform versions 09.1.00 through 09.4.04 and 10.0.00 through 10.3.0 | |
|
76
|
CVE-2026-8034 |
7.9 | 0.0052 | NET NO AUTH LOW CX NO UI | A server-side request forgery (SSRF) vulnerability was identified in the GitHub | |
|
75
|
CVE-2026-52196 |
7.5 | 0.0052 | NET NO AUTH LOW CX NO UI | Buffer Overflow vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows | |
|
75
|
CVE-2026-52195 |
7.5 | 0.0052 | NET NO AUTH LOW CX NO UI | Buffer Overflow vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows | |
|
75
|
CVE-2026-52190 |
7.5 | 0.0052 | NET NO AUTH LOW CX NO UI | Buffer Overflow vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows | |
|
75
|
CVE-2026-54405 |
7.5 | 0.0052 | NET NO AUTH LOW CX NO UI | A malicious actor with access to the network could exploit an Improper Input Val | |
|
75
|
CVE-2026-52187 |
7.5 | 0.0052 | NET NO AUTH LOW CX NO UI | Buffer Overflow vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows | |
|
75
|
CVE-2026-52189 |
7.5 | 0.0052 | NET NO AUTH LOW CX NO UI | Buffer Overflow vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows | |
|
75
|
CVE-2026-52191 |
7.5 | 0.0052 | NET NO AUTH LOW CX NO UI | Buffer Overflow vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows | |
|
75
|
CVE-2026-55379 |
7.5 | 0.0052 | NET NO AUTH LOW CX NO UI | Pillow is a Python imaging library. Prior to 12.3.0, PIL/BdfFontFile.py bdf_char | |
|
75
|
CVE-2026-113873 |
7.5 | 0.0052 | NET NO AUTH LOW CX NO UI | SmileCDR HAPI FHIR does not properly handle highly compressed data, allowing an | |
|
75
|
CVE-2026-87743 |
7.5 | 0.0052 | NET NO AUTH LOW CX NO UI | A flaw was found in Quarkus HTTP security. An unauthenticated attacker can explo | |
|
75
|
CVE-2026-56848 |
7.5 | 0.0052 | NET NO AUTH LOW CX NO UI | A flaw in Node.js HTTP/2 handling allows `nghttp2_session_mem_send()` to be call | |
|
70
|
CVE-2026-89078 |
9.9 | 0.0052 | NET LOW CX NO UI | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 | |
|
70
|
CVE-2026-46850 |
9.9 | 0.0052 | NET LOW CX NO UI | Vulnerability in the MySQL Shell product of Oracle MySQL (component: Shell for V | |
|
70
|
CVE-2026-19656 |
9.9 | 0.0052 | NET LOW CX NO UI | ScadaLTS 2.7.8.1 exposes a server-side method that lacks authorization checks, a | |
|
69
|
CVE-2026-70398 |
9.6 | 0.0052 | NET LOW CX NO UI | A flaw was found in multicloud-integrations, a component of Red Hat Advanced Clu | |
|
68
|
CVE-2026-41613 |
8.8 | 0.0052 | NET NO AUTH LOW CX | Session fixation in Visual Studio Code allows an unauthorized attacker to elevat | |
|
67
|
CVE-2026-54208 |
8.5 | 0.0052 | NET NO AUTH LOW CX | Tobit Laboratories AG TeamDavid's Webbox application is vulnerable to arbitrary | |
|
67
|
CVE-2026-62240 |
8.3 | 0.0052 | NET NO AUTH LOW CX | CrewAI before 1.15.1 contains a server-side request forgery vulnerability in the | |
|
66
|
CVE-2026-90153 |
8.1 | 0.0052 | NET LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: ksmbd: boun | |
|
66
|
CVE-2026-8442 |
8.1 | 0.0052 | NET LOW CX NO UI | The WP Review Slider Pro plugin for WordPress is vulnerable to Arbitrary File De | |
|
64
|
CVE-2026-109122 |
9.4 | 0.0052 | NET LOW CX NO UI | The network management service on affected Kiloview E3 NDI encoder firmware fail | |
|
64
|
CVE-2026-57188 |
7.1 | 0.0052 | NET LOW CX NO UI | Asterisk is an open source private branch exchange and telephony toolkit. Prior | |
|
64
|
CVE-2026-65885 |
9.4 | 0.0052 | NET LOW CX NO UI | Joomla Extension - balbooa.com - Authenticated arbitrary file upload in Gridbox |