Hunt List
13,139 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2024-51315 |
9.8 | 0.0051 | NET NO AUTH LOW CX NO UI | The Tenda TX9 V22.03.02.20 firmware has a stack overflow vulnerability in the su | |
|
80
|
CVE-2026-42933 |
10.0 | 0.0051 | NET NO AUTH LOW CX NO UI | Pronetiqs IntraVUE versions 3.2.1a14 and prior have an unintended proxy or inter | |
|
80
|
CVE-2026-64796 |
9.8 | 0.0051 | NET NO AUTH LOW CX NO UI | Joomla Extension - regularlabs.com - various code injection vectors in Sourcerer | |
|
80
|
CVE-2026-65879 |
9.8 | 0.0051 | NET NO AUTH LOW CX NO UI | Joomla Extension - joomshaper.com - Unauthenticated mail relay via a hardcoded, | |
|
80
|
CVE-2026-2346 |
9.8 | 0.0051 | NET NO AUTH LOW CX NO UI | Authorization bypass through User-Controlled key vulnerability in Menulux Softwa | |
|
80
|
CVE-2026-18749 |
9.8 | 0.0051 | NET NO AUTH LOW CX NO UI | The type=track branch authorises on _is_my_case(t_attach.case) only and never ch | |
|
80
|
CVE-2026-35431 |
10.0 | 0.0051 | NET NO AUTH LOW CX NO UI | Server-side request forgery (ssrf) in Microsoft Entra ID Entitlement Management | |
|
80
|
CVE-2026-61997 |
9.8 | 0.0051 | NET NO AUTH LOW CX NO UI | Unauthenticated PHP Object Injection in Legal Stone <= 1.2.11 versions. | |
|
80
|
CVE-2026-62002 |
9.8 | 0.0051 | NET NO AUTH LOW CX NO UI | Unauthenticated PHP Object Injection in Meals & Wheels <= 1.1.13 versions. | |
|
79
|
CVE-2024-58307 |
9.3 | 0.0051 | NET NO AUTH LOW CX NO UI | CSZCMS 1.3.0 contains an authenticated SQL injection vulnerability in the member | |
|
79
|
CVE-2026-56261 |
9.2 | 0.0051 | NET NO AUTH LOW CX NO UI | Crawl4AI before 0.8.7 contains a server-side request forgery (SSRF) vulnerabilit | |
|
79
|
CVE-2023-53969 |
9.3 | 0.0051 | NET NO AUTH LOW CX NO UI | Screen SFT DAB 600/C firmware 1.9.3 contains a session management vulnerability | |
|
79
|
CVE-2026-114087 |
9.2 | 0.0051 | NET NO AUTH LOW CX NO UI | Trigger.dev before 4.5.6 self-hosted Docker Compose deployments using the defaul | |
|
79
|
CVE-2026-53690 |
9.3 | 0.0051 | NET NO AUTH LOW CX NO UI | An SQL Injection vulnerability exists in Redeight CMS version 1.0 via the "userE | |
|
79
|
CVE-2026-58473 |
9.3 | 0.0051 | NET NO AUTH LOW CX NO UI | Cognee before 1.2.0 contains an improper access control vulnerability that allow | |
|
78
|
CVE-2026-49268 |
8.8 | 0.0051 | NET NO AUTH LOW CX NO UI | A remote attacker can inject LDAP special characters into the Distinguished Name | |
|
78
|
CVE-2026-53431 |
9.1 | 0.0051 | NET NO AUTH LOW CX NO UI | Authentication Bypass by Capture-replay vulnerability in malach-it Boruta allows | |
|
78
|
CVE-2026-58477 |
8.8 | 0.0051 | NET NO AUTH LOW CX NO UI | Sustainable Irrigation Platform (SIP) through version 5.2.16 contains a mass ass | |
|
78
|
CVE-2026-114142 |
8.8 | 0.0051 | NET NO AUTH LOW CX NO UI | toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.par | |
|
77
|
CVE-2026-43970 |
8.2 | 0.0051 | NET NO AUTH LOW CX NO UI | Improper Handling of Highly Compressed Data (Data Amplification) vulnerability i | |
|
77
|
CVE-2026-71252 |
8.2 | 0.0051 | NET NO AUTH LOW CX NO UI | toner-management's admin state-changing handlers (add.php, edit.php, delete.php | |
|
76
|
CVE-2026-50197 |
7.8 | 0.0051 | NET NO AUTH LOW CX NO UI | Skipper is an HTTP router and reverse proxy for service composition. Prior to 0. | |
|
76
|
CVE-2026-51954 |
8.1 | 0.0051 | NET NO AUTH LOW CX | 2 PoC | An issue in Webasyst Framework 4.0.3 and before allows a remote attacker to exec |
|
75
|
CVE-2026-101508 |
7.5 | 0.0051 | NET NO AUTH LOW CX NO UI | Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (compon | |
|
75
|
CVE-2026-54635 |
7.5 | 0.0051 | NET NO AUTH LOW CX NO UI | pytonapi is a Python SDK for TONAPI that provides REST API, streaming, and webho | |
|
75
|
CVE-2026-101520 |
7.5 | 0.0051 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Global Lifecycle Management NextGen OUI Framework pr | |
|
75
|
CVE-2026-79895 |
7.5 | 0.0051 | NET NO AUTH LOW CX NO UI | Vulnerabilities in the affected interface of AOS-10 could allow an unauthenticat | |
|
69
|
CVE-2026-107861 |
9.4 | 0.0051 | NET LOW CX NO UI | The system control service on affected Kiloview E3 NDI encoder firmware fails to | |
|
69
|
CVE-2026-110243 |
9.4 | 0.0051 | NET LOW CX NO UI | The network management service on affected Kiloview E3 NDI encoder firmware fail | |
|
69
|
CVE-2026-114268 |
9.4 | 0.0051 | NET LOW CX NO UI | A flaw has been found in Tenda BE3L Pro 16.03.60.62. Affected by this vulnerabil | |
|
68
|
CVE-2026-46519 |
8.8 | 0.0051 | NET LOW CX NO UI | mcp-server-kubernetes is a Model Context Protocol server for Kubernetes cluster | |
|
68
|
CVE-2026-57280 |
8.8 | 0.0051 | NET LOW CX NO UI | Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not intercept | |
|
68
|
CVE-2026-113947 |
8.8 | 0.0051 | NET NO AUTH LOW CX | This issue was addressed with improved access restrictions. This issue is fixed | |
|
68
|
CVE-2026-34570 |
8.8 | 0.0051 | NET LOW CX NO UI | CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, mo | |
|
68
|
CVE-2026-34572 |
8.8 | 0.0051 | NET LOW CX NO UI | CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, mo | |
|
67
|
CVE-2026-58525 |
8.2 | 0.0051 | NET NO AUTH LOW CX | Improper access control in Microsoft Edge (Chromium-based) allows an unauthorize | |
|
67
|
CVE-2026-81357 |
8.2 | 0.0051 | NET NO AUTH LOW CX | Server-side request forgery (ssrf) in Visual Studio Code allows an unauthorized | |
|
67
|
CVE-2026-48036 |
8.4 | 0.0051 | NET NO AUTH LOW CX | Hulumi is an open-source toolkit that ships secure-by-default cloud and platform | |
|
66
|
CVE-2026-49877 |
8.1 | 0.0051 | NET LOW CX NO UI | Improper Authorization vulnerability in Apache ActiveMQ. An authenticated low-p | |
|
66
|
CVE-2026-57859 |
7.7 | 0.0051 | NET LOW CX NO UI | e107 prior to version 2.3.8 contains a code execution vulnerability in the e_arr | |
|
65
|
CVE-2026-50577 |
7.4 | 0.0051 | NET NO AUTH NO UI | ePA 3.x Integration implements the authorization workflow and writes Medical Inf | |
|
65
|
CVE-2026-114137 |
7.4 | 0.0051 | NET NO AUTH NO UI | Django REST framework is a toolkit for building Web APIs. From 3.12.0 until 3.18 | |
|
64
|
CVE-2026-70633 |
7.1 | 0.0051 | NET LOW CX NO UI | TimescaleDB through 2.29.1, fixed in commit 517c13e, contains an out-of-bounds r | |
|
63
|
CVE-2026-42023 |
9.1 | 0.0051 | NET LOW CX NO UI | Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Se | |
|
63
|
CVE-2026-42024 |
9.1 | 0.0051 | NET LOW CX NO UI | Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Se | |
|
63
|
CVE-2026-42025 |
9.1 | 0.0051 | NET LOW CX NO UI | Multiple exploitable stack-based buffer overflow vulnerabilities exist in the bo | |
|
63
|
CVE-2026-42026 |
9.1 | 0.0051 | NET LOW CX NO UI | Multiple exploitable stack-based buffer overflow vulnerabilities exist in the bo | |
|
63
|
CVE-2026-9660 |
9.1 | 0.0051 | NET LOW CX NO UI | Multiple exploitable stack-based buffer overflow vulnerabilities exist in the bo | |
|
63
|
CVE-2026-9817 |
9.1 | 0.0051 | NET LOW CX NO UI | A stack-based buffer overflow vulnerability exists in the boa formUploadFile fun | |
|
63
|
CVE-2026-9869 |
9.1 | 0.0051 | NET LOW CX NO UI | A stack-based buffer overflow vulnerability exists in the boa formTR069Config fu |