Hunt List
7,769 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
99
|
CVE-2026-21589 |
9.3 | 0.9948 | NET NO AUTH LOW CX NO UI | KEV 13 PoC | Multiple Atlassian products (Bitbucket Data Center ,Confluence Data Center, Jira |
|
98
|
CVE-2026-55040 |
9.1 | 0.6954 | NET NO AUTH LOW CX NO UI | KEV 5 PoC | Microsoft SharePoint contains a weak authentication vulnerability which allows a |
|
90
|
CVE-2026-63077 |
9.8 | 0.9356 | NET NO AUTH LOW CX NO UI | KEV RW | JetBrains TeamCity contains a deserialization of untrusted data vulnerability th |
|
90
|
CVE-2026-39808 |
9.8 | 0.9319 | NET NO AUTH LOW CX NO UI | KEV | Fortinet FortiSandbox contains an OS command injection vulnerability that could |
|
90
|
CVE-2026-20182 |
10.0 | 0.9182 | NET NO AUTH LOW CX NO UI | KEV | Cisco Catalyst SD-WAN Controller & Manager contain an authentication bypass vuln |
|
90
|
CVE-2026-48908 |
10.0 | 0.8851 | NET NO AUTH LOW CX NO UI | KEV | JoomShaper SP Page Builder contains an unrestricted upload of file with dangerou |
|
90
|
CVE-2024-21762 |
9.8 | 0.8459 | NET NO AUTH LOW CX NO UI | KEV RW | Fortinet FortiOS contains an out-of-bound write vulnerability that allows a remo |
|
90
|
CVE-2026-105134 |
10.0 | 0.8176 | NET NO AUTH LOW CX NO UI | KEV | Ahsay AhsayCBS contains a command injection vulnerability that could allow a rem |
|
90
|
CVE-2026-41089 |
9.8 | 0.7962 | NET NO AUTH LOW CX NO UI | Stack-based buffer overflow in Windows Netlogon allows an unauthorized attacker | |
|
90
|
CVE-2026-0740 |
9.8 | 0.6290 | NET NO AUTH LOW CX NO UI | The Ninja Forms - File Uploads plugin for WordPress is vulnerable to arbitrary f | |
|
90
|
CVE-2026-2699 |
9.8 | 0.5839 | NET NO AUTH LOW CX NO UI | Customer Managed ShareFile Storage Zones Controller (SZC) allows an unauthentica | |
|
89
|
CVE-2026-41940 |
9.3 | 0.9853 | NET NO AUTH LOW CX NO UI | KEV RW | WebPros cPanel & WHM (WebHost Manager) and WP2 (WordPress Squared) contain an au |
|
89
|
CVE-2026-42208 |
9.3 | 0.8942 | NET NO AUTH LOW CX NO UI | KEV | BerriAI LiteLLM contains a SQL injection vulnerability that allows an attacker t |
|
88
|
CVE-2026-109618 |
9.2 | 1.0000 | NET NO AUTH NO UI | KEV 710 PoC | PHP contains an out-of-memory corruption vulnerability that allows for unauthent |
|
88
|
CVE-2026-71362 |
9.1 | 0.9049 | NET NO AUTH LOW CX NO UI | KEV | Adobe Commerce and Magento contains an incorrect authorization vulnerability tha |
|
88
|
CVE-2026-111497 |
9.2 | 0.8264 | NET NO AUTH LOW CX NO UI | KEV | Google Brotli contains an unchecked return value vulnerability that allows a rem |
|
88
|
CVE-2026-110447 |
9.2 | 0.7331 | NET NO AUTH LOW CX NO UI | KEV | Collabora Collabora Online – Built-in CODE Server when used within the NextCloud |
|
88
|
CVE-2026-42945 |
9.2 | 0.6805 | NET NO AUTH LOW CX NO UI | NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_mo | |
|
88
|
CVE-2026-48282 |
10.0 | 0.4239 | NET NO AUTH LOW CX NO UI | KEV | Adobe ColdFusion contains a path traversal vulnerability that could lead to arbi |
|
87
|
CVE-2026-0300 |
9.3 | 0.4171 | NET NO AUTH LOW CX NO UI | KEV | Palo Alto Networks PAN-OS contains an out-of-bounds write vulnerability in the U |
|
86
|
CVE-2026-0257 |
7.8 | 0.9501 | NET NO AUTH LOW CX NO UI | KEV RW | Palo Alto Networks PAN-OS contains an authentication bypass vulnerability that a |
|
86
|
CVE-2026-41679 |
10.0 | 0.3167 | NET NO AUTH LOW CX NO UI | Paperclip is a Node.js server and React UI that orchestrates a team of AI agents | |
|
86
|
CVE-2026-56290 |
10.0 | 0.3087 | NET NO AUTH LOW CX NO UI | KEV | Joomlack Page Builder contains an improper access control vulnerability that cou |
|
85
|
CVE-2026-19490 |
9.3 | 0.3265 | NET NO AUTH LOW CX NO UI | KEV | Citrix NetScaler ADC and NetScaler Gateway contain an authentication-bypass vuln |
|
85
|
CVE-2026-9198 |
9.8 | 0.2866 | NET NO AUTH LOW CX NO UI | KEV | Langflow contains a code injection vulnerability that allows unauthenticated att |
|
84
|
CVE-2026-33626 |
7.5 | 0.4525 | NET NO AUTH LOW CX NO UI | LMDeploy is a toolkit for compressing, deploying, and serving large language mod | |
|
84
|
CVE-2026-39813 |
9.8 | 0.2222 | NET NO AUTH LOW CX NO UI | A path traversal: '../filedir' vulnerability in Fortinet FortiSandbox 5.0.0 thro | |
|
84
|
CVE-2026-48939 |
10.0 | 0.2007 | NET NO AUTH LOW CX NO UI | KEV | iCagenda contains an unrestricted upload of file with dangerous type vulnerabili |
|
83
|
CVE-2026-22679 |
9.3 | 0.2036 | NET NO AUTH LOW CX NO UI | Weaver (Fanwei) E-cology 10.0 versions prior to 20260312 contain an unauthentica | |
|
83
|
CVE-2026-41268 |
9.8 | 0.1744 | NET NO AUTH LOW CX NO UI | Flowise is a drag & drop user interface to build a customized large language mod | |
|
83
|
CVE-2026-58644 |
9.8 | 0.1587 | NET NO AUTH LOW CX NO UI | KEV | Microsoft SharePoint contains a deserialization of untrusted data vulnerability |
|
83
|
CVE-2026-61447 |
10.0 | 0.1524 | NET NO AUTH LOW CX NO UI | PraisonAI before 1.6.78 contains a remote code execution vulnerability in CodeAg | |
|
83
|
CVE-2026-45829 |
10.0 | 0.1515 | NET NO AUTH LOW CX NO UI | A pre-authentication, code injection vulnerability in version 1.0.0 or later of | |
|
83
|
CVE-2026-56291 |
10.0 | 0.1485 | NET NO AUTH LOW CX NO UI | KEV | Balbooa Forms contains an unrestricted upload of file with dangerous type vulner |
|
82
|
CVE-2026-9586 |
9.3 | 0.1898 | NET NO AUTH LOW CX NO UI | KEV | Sangoma Switchvox contains a SQL injection vulnerability which allows an unauthe |
|
82
|
CVE-2026-25874 |
9.3 | 0.1555 | NET NO AUTH LOW CX NO UI | LeRobot through 0.5.1 contains an unsafe deserialization vulnerability in the as | |
|
81
|
CVE-2026-5854 |
8.9 | 0.1661 | NET NO AUTH LOW CX NO UI | A vulnerability was detected in Totolink A7100RU 7.4cu.2313_b20191024. Affected | |
|
81
|
CVE-2024-48884 |
9.1 | 0.1521 | NET NO AUTH LOW CX NO UI | A improper limitation of a pathname to a restricted directory ('path traversal') | |
|
81
|
CVE-2026-5850 |
8.9 | 0.1510 | NET NO AUTH LOW CX NO UI | A vulnerability was identified in Totolink A7100RU 7.4cu.2313_b20191024. This af | |
|
81
|
CVE-2026-5852 |
8.9 | 0.1351 | NET NO AUTH LOW CX NO UI | A weakness has been identified in Totolink A7100RU 7.4cu.2313_b20191024. Affecte | |
|
81
|
CVE-2026-5853 |
8.9 | 0.1351 | NET NO AUTH LOW CX NO UI | A security vulnerability has been detected in Totolink A7100RU 7.4cu.2313_b20191 | |
|
79
|
CVE-2026-34648 |
7.5 | 0.2138 | NET NO AUTH LOW CX NO UI | Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2 | |
|
79
|
CVE-2026-18577 |
8.2 | 0.1462 | NET NO AUTH LOW CX NO UI | KEV | N-able N-central contains an authentication bypass using an alternate path or ch |
|
78
|
CVE-2026-109619 |
9.2 | 1.0000 | NET NO AUTH NO UI | KEV | PHP contains a stale internal request-state vulnerability that allows for unauth |
|
78
|
CVE-2026-48356 |
9.3 | 0.4458 | NET NO AUTH LOW CX | KEV | Adobe Commerce and Magento contain an unrestricted upload of file with dangerous |
|
78
|
CVE-2026-34650 |
7.5 | 0.1508 | NET NO AUTH LOW CX NO UI | Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2 | |
|
78
|
CVE-2026-34649 |
7.5 | 0.1361 | NET NO AUTH LOW CX NO UI | Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2 | |
|
77
|
CVE-2026-43825 |
7.3 | 0.1392 | NET NO AUTH LOW CX NO UI | Untrusted Java Deserialization in Apache OpenNLP SvmDoccatModel Versions Affect | |
|
73
|
CVE-2026-86950 |
8.8 | 0.2617 | NET NO AUTH LOW CX | KEV | Apple iOS, macOS, and iPadOS contain an out-of-bounds write vulnerability in Cor |
|
72
|
CVE-2026-0628 |
8.8 | 0.2095 | NET NO AUTH LOW CX | Insufficient policy enforcement in WebView tag in Google Chrome prior to 143.0.7 |