Hunt List
51 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
99
|
CVE-2026-21589 |
9.3 | 0.9948 | NET NO AUTH LOW CX NO UI | KEV 13 PoC | Multiple Atlassian products (Bitbucket Data Center ,Confluence Data Center, Jira |
|
98
|
CVE-2026-55040 |
9.1 | 0.6954 | NET NO AUTH LOW CX NO UI | KEV 5 PoC | Microsoft SharePoint contains a weak authentication vulnerability which allows a |
|
90
|
CVE-2026-63077 |
9.8 | 0.9356 | NET NO AUTH LOW CX NO UI | KEV RW | JetBrains TeamCity contains a deserialization of untrusted data vulnerability th |
|
90
|
CVE-2026-39808 |
9.8 | 0.9319 | NET NO AUTH LOW CX NO UI | KEV | Fortinet FortiSandbox contains an OS command injection vulnerability that could |
|
90
|
CVE-2026-20182 |
10.0 | 0.9182 | NET NO AUTH LOW CX NO UI | KEV | Cisco Catalyst SD-WAN Controller & Manager contain an authentication bypass vuln |
|
90
|
CVE-2026-48908 |
10.0 | 0.8851 | NET NO AUTH LOW CX NO UI | KEV | JoomShaper SP Page Builder contains an unrestricted upload of file with dangerou |
|
90
|
CVE-2024-21762 |
9.8 | 0.8459 | NET NO AUTH LOW CX NO UI | KEV RW | Fortinet FortiOS contains an out-of-bound write vulnerability that allows a remo |
|
90
|
CVE-2026-105134 |
10.0 | 0.8176 | NET NO AUTH LOW CX NO UI | KEV | Ahsay AhsayCBS contains a command injection vulnerability that could allow a rem |
|
89
|
CVE-2026-41940 |
9.3 | 0.9853 | NET NO AUTH LOW CX NO UI | KEV RW | WebPros cPanel & WHM (WebHost Manager) and WP2 (WordPress Squared) contain an au |
|
89
|
CVE-2026-42208 |
9.3 | 0.8942 | NET NO AUTH LOW CX NO UI | KEV | BerriAI LiteLLM contains a SQL injection vulnerability that allows an attacker t |
|
88
|
CVE-2026-109618 |
9.2 | 1.0000 | NET NO AUTH NO UI | KEV 710 PoC | PHP contains an out-of-memory corruption vulnerability that allows for unauthent |
|
88
|
CVE-2026-71362 |
9.1 | 0.9049 | NET NO AUTH LOW CX NO UI | KEV | Adobe Commerce and Magento contains an incorrect authorization vulnerability tha |
|
88
|
CVE-2026-111497 |
9.2 | 0.8799 | NET NO AUTH LOW CX NO UI | KEV | Google Brotli contains an unchecked return value vulnerability that allows a rem |
|
88
|
CVE-2026-48282 |
10.0 | 0.4239 | NET NO AUTH LOW CX NO UI | KEV | Adobe ColdFusion contains a path traversal vulnerability that could lead to arbi |
|
87
|
CVE-2026-0300 |
9.3 | 0.4171 | NET NO AUTH LOW CX NO UI | KEV | Palo Alto Networks PAN-OS contains an out-of-bounds write vulnerability in the U |
|
86
|
CVE-2026-0257 |
7.8 | 0.9501 | NET NO AUTH LOW CX NO UI | KEV RW | Palo Alto Networks PAN-OS contains an authentication bypass vulnerability that a |
|
86
|
CVE-2026-56290 |
10.0 | 0.3087 | NET NO AUTH LOW CX NO UI | KEV | Joomlack Page Builder contains an improper access control vulnerability that cou |
|
85
|
CVE-2026-19490 |
9.3 | 0.3265 | NET NO AUTH LOW CX NO UI | KEV | Citrix NetScaler ADC and NetScaler Gateway contain an authentication-bypass vuln |
|
85
|
CVE-2026-9198 |
9.8 | 0.2866 | NET NO AUTH LOW CX NO UI | KEV | Langflow contains a code injection vulnerability that allows unauthenticated att |
|
84
|
CVE-2026-48939 |
10.0 | 0.2007 | NET NO AUTH LOW CX NO UI | KEV | iCagenda contains an unrestricted upload of file with dangerous type vulnerabili |
|
83
|
CVE-2026-58644 |
9.8 | 0.1587 | NET NO AUTH LOW CX NO UI | KEV | Microsoft SharePoint contains a deserialization of untrusted data vulnerability |
|
83
|
CVE-2026-56291 |
10.0 | 0.1485 | NET NO AUTH LOW CX NO UI | KEV | Balbooa Forms contains an unrestricted upload of file with dangerous type vulner |
|
82
|
CVE-2026-9586 |
9.3 | 0.1898 | NET NO AUTH LOW CX NO UI | KEV | Sangoma Switchvox contains a SQL injection vulnerability which allows an unauthe |
|
81
|
CVE-2026-110447 |
9.2 | 0.1163 | NET NO AUTH LOW CX NO UI | KEV | Collabora Collabora Online – Built-in CODE Server when used within the NextCloud |
|
81
|
CVE-2026-64849 |
9.3 | 0.1002 | NET NO AUTH LOW CX NO UI | KEV | MLflow contains a server-side request forgery vulnerability that can allow attac |
|
81
|
CVE-2026-15409 |
10.0 | 0.0679 | NET NO AUTH LOW CX NO UI | KEV RW | SonicWall SMA1000 Appliances contain a server-side request forgery vulnerability |
|
81
|
CVE-2026-104286 |
9.8 | 0.0457 | NET NO AUTH LOW CX NO UI | KEV | Fortinet FortiMail contains a path traversal and an improper neutralization of N |
|
80
|
CVE-2026-50522 |
9.8 | 0.0304 | NET NO AUTH LOW CX NO UI | KEV | Microsoft SharePoint contains a deserialization of untrusted data vulnerability |
|
80
|
CVE-2026-49869 |
10.0 | 0.0209 | NET NO AUTH LOW CX NO UI | KEV | Kestra OSS contains an OS command injection vulnerability that could allow an un |
|
80
|
CVE-2026-65400 |
9.8 | 0.0172 | NET NO AUTH LOW CX NO UI | KEV | Apple macOS contains an improper authentication vulnerability that could allow a |
|
80
|
CVE-2026-16812 |
10.0 | 0.0100 | NET NO AUTH LOW CX NO UI | KEV | Arista VeloCloud Orchestrator On-Prem contains an OS command injection vulnerabi |
|
79
|
CVE-2026-48356 |
9.3 | 0.5908 | NET NO AUTH LOW CX | KEV | Adobe Commerce and Magento contain an unrestricted upload of file with dangerous |
|
79
|
CVE-2026-18577 |
8.2 | 0.1462 | NET NO AUTH LOW CX NO UI | KEV | N-able N-central contains an authentication bypass using an alternate path or ch |
|
79
|
CVE-2026-65660 |
8.8 | 0.0819 | NET LOW CX NO UI | KEV 2 PoC | Microsoft SharePoint contains a code injection vulnerability which could allow a |
|
79
|
CVE-2026-16232 |
9.3 | 0.0352 | NET NO AUTH LOW CX NO UI | KEV | Check Point SmartConsole contains an improper authentication vulnerability which |
|
79
|
CVE-2026-8398 |
9.3 | 0.0146 | NET NO AUTH LOW CX NO UI | KEV | Daemon Tools contains an unspecified vulnerability that has a high impact on con |
|
78
|
CVE-2026-109619 |
9.2 | 1.0000 | NET NO AUTH NO UI | KEV | PHP contains a stale internal request-state vulnerability that allows for unauth |
|
78
|
CVE-2026-18556 |
8.2 | 0.0788 | NET NO AUTH LOW CX NO UI | KEV | N-able N-central contains an authentication bypass using an alternate path or ch |
|
77
|
CVE-2026-42271 |
8.7 | 0.9144 | NET LOW CX NO UI | KEV | BerriAI LiteLLM contains a command injection vulnerability that could allow any |
|
77
|
CVE-2026-42018 |
7.5 | 0.0980 | NET NO AUTH LOW CX NO UI | KEV | JFrog Artifactory contains an improper authentication vulnerability that could r |
|
77
|
CVE-2026-20349 |
8.6 | 0.0101 | NET NO AUTH LOW CX NO UI | KEV | Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Thre |
|
73
|
CVE-2026-86950 |
8.8 | 0.2617 | NET NO AUTH LOW CX | KEV | Apple iOS, macOS, and iPadOS contain an out-of-bounds write vulnerability in Cor |
|
70
|
CVE-2026-96951 |
8.8 | 0.0981 | NET NO AUTH LOW CX | KEV | Microsoft Windows Shell contains a command injection vulnerability that allows a |
|
70
|
CVE-2026-45321 |
9.6 | 0.0328 | NET NO AUTH LOW CX | KEV RW | TanStack contains an unspecified vulnerability that allowed malicious versions o |
|
69
|
CVE-2026-42016 |
8.8 | 0.0864 | NET LOW CX NO UI | KEV | JFrog Artifactory contains an incorrect authorization vulnerability that leads t |
|
69
|
CVE-2026-114625 |
9.4 | 0.0103 | NET LOW CX NO UI | KEV | Arista VeloCloud Orchestrator on-prem contains a SQL injection vulnerability tha |
|
68
|
CVE-2023-43000 |
8.8 | 0.0404 | NET NO AUTH LOW CX | KEV | Apple macOS, iOS, iPadOS, and Safari 16.6 contain a use-after-free vulnerability |
|
66
|
CVE-2026-6973 |
7.2 | 0.3445 | NET LOW CX NO UI | KEV | Ivanti Endpoint Manager Mobile (EPMM) contains an improper input validation vuln |
|
62
|
CVE-2026-15410 |
7.2 | 0.1179 | NET LOW CX NO UI | KEV RW | SonicWall SMA1000 Appliances contain a code injection vulnerability which in spe |
|
57
|
CVE-2026-55255 |
8.4 | 0.0089 | NET NO UI | KEV | Langflow contains an authorization bypass through user-controlled key vulnerabil |