Hunt List
8,457 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
90
|
CVE-2026-76578 |
9.8 | 0.0121 | NET NO AUTH LOW CX NO UI | 1 PoC | A flaw was found in FreeIPA. The self-managed OTP token ACI does not require aut |
|
80
|
CVE-2025-29229 |
9.8 | 0.0127 | NET NO AUTH LOW CX NO UI | linksys E5600 V1.1.0.26 is vulnerable to command injection in the function ddnsS | |
|
80
|
CVE-2026-48276 |
10.0 | 0.0126 | NET NO AUTH LOW CX NO UI | ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Unrestricted | |
|
80
|
CVE-2026-48283 |
10.0 | 0.0126 | NET NO AUTH LOW CX NO UI | ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Unrestricted | |
|
80
|
CVE-2026-44416 |
9.8 | 0.0124 | NET NO AUTH LOW CX NO UI | Remote Code Execution via Arbitrary Class Instantiation in plugin-schema-registr | |
|
80
|
CVE-2026-42779 |
9.8 | 0.0123 | NET NO AUTH LOW CX NO UI | The fix for CVE-2026-41635 was not applied to the 2.1.X and 2.2.X branches. Here | |
|
80
|
CVE-2026-88131 |
9.8 | 0.0123 | NET NO AUTH LOW CX NO UI | Deserialization of untrusted data in Microsoft Dataverse allows an unauthorized | |
|
80
|
CVE-2026-55799 |
9.8 | 0.0122 | NET NO AUTH LOW CX NO UI | Remote Code Execution Vulnerability in GraalScriptEngineCreator in Apache Ranger | |
|
80
|
CVE-2026-8592 |
9.8 | 0.0120 | NET NO AUTH LOW CX NO UI | OS Command Injection vulnerability in the process_string action of Rapid7 Insigh | |
|
80
|
CVE-2026-8660 |
9.8 | 0.0120 | NET NO AUTH LOW CX NO UI | OS Command Injection vulnerability in the ping action of Rapid7 InsightConnect P | |
|
80
|
CVE-2026-8665 |
9.8 | 0.0120 | NET NO AUTH LOW CX NO UI | OS Command Injection vulnerability in the TR action of Rapid7 InsightConnect Tra | |
|
80
|
CVE-2026-8666 |
9.8 | 0.0120 | NET NO AUTH LOW CX NO UI | OS Command Injection vulnerability in the traceroute action of Rapid7 InsightCon | |
|
80
|
CVE-2026-110879 |
9.8 | 0.0120 | NET NO AUTH LOW CX NO UI | jackson-databind validates the outer class of a class-name type ID but accepts a | |
|
80
|
CVE-2026-97749 |
9.8 | 0.0120 | NET NO AUTH LOW CX NO UI | Double free in Microsoft Office Outlook allows an unauthorized attacker to execu | |
|
80
|
CVE-2025-63334 |
9.8 | 0.0118 | NET NO AUTH LOW CX NO UI | PocketVJ CP PocketVJ-CP-v3 pvj version 3.9.1 contains an unauthenticated remote | |
|
80
|
CVE-2025-50526 |
9.8 | 0.0118 | NET NO AUTH LOW CX NO UI | Netgear EX8000 V1.0.0.126 was discovered to contain a command injection vulnerab | |
|
80
|
CVE-2026-104252 |
9.8 | 0.0117 | NET NO AUTH LOW CX NO UI | Vitess is a database clustering system for horizontal scaling of MySQL. Prior to | |
|
79
|
CVE-2026-73519 |
9.3 | 0.0124 | NET NO AUTH LOW CX NO UI | WolfStack before 25.9.2 contains a hard-coded cluster-authentication secret comp | |
|
79
|
CVE-2026-41926 |
9.3 | 0.0123 | NET NO AUTH LOW CX NO UI | WDR201A WiFi Extender (HW V2.1, FW LFMZX28040922V1.02) contains an OS command in | |
|
79
|
CVE-2026-70554 |
9.3 | 0.0123 | NET NO AUTH LOW CX NO UI | MaxSite CMS contains a PHP object injection vulnerability that allows unauthenti | |
|
79
|
CVE-2026-55450 |
9.3 | 0.0119 | NET NO AUTH LOW CX NO UI | Langflow is a tool for building and deploying AI-powered agents and workflows. P | |
|
79
|
CVE-2026-52715 |
9.3 | 0.0119 | NET NO AUTH LOW CX NO UI | Unauthenticated SQL Injection in GEO my WordPress <= 4.5.5 versions. | |
|
78
|
CVE-2026-6043 |
8.8 | 0.0126 | NET NO AUTH LOW CX NO UI | P4 Server versions prior to 2026.1 are configured with insecure default settings | |
|
78
|
CVE-2026-43515 |
9.1 | 0.0122 | NET NO AUTH LOW CX NO UI | Improper Authorization vulnerability when multiple method constraints define an | |
|
77
|
CVE-2026-3324 |
8.2 | 0.0126 | NET NO AUTH LOW CX NO UI | Zohocorp ManageEngine Log360 versions 13000 through 13013 are vulnerable to auth | |
|
75
|
CVE-2026-83647 |
7.5 | 0.0127 | NET NO AUTH LOW CX NO UI | Out-of-bounds read in Active Directory Domain Services allows an unauthorized at | |
|
75
|
CVE-2022-44566 |
7.5 | 0.0126 | NET NO AUTH LOW CX NO UI | A denial of service vulnerability present in ActiveRecord's PostgreSQL adapter < | |
|
75
|
CVE-2026-43661 |
7.5 | 0.0126 | NET NO AUTH LOW CX NO UI | A buffer overflow issue was addressed with improved memory handling. This issue | |
|
75
|
CVE-2026-50330 |
7.5 | 0.0125 | NET NO AUTH LOW CX NO UI | Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attac | |
|
75
|
CVE-2026-58280 |
7.5 | 0.0125 | NET NO AUTH LOW CX NO UI | Uncontrolled recursion in .NET allows an unauthorized attacker to deny service o | |
|
75
|
CVE-2026-69651 |
7.5 | 0.0125 | NET NO AUTH LOW CX NO UI | Inefficient algorithmic complexity in .NET allows an unauthorized attacker to de | |
|
75
|
CVE-2026-50524 |
7.5 | 0.0123 | NET NO AUTH LOW CX NO UI | Improper validation of specified type of input in .NET Framework allows an unaut | |
|
75
|
CVE-2026-62901 |
7.5 | 0.0123 | NET NO AUTH LOW CX NO UI | Unchecked input for loop condition in .NET allows an unauthorized attacker to de | |
|
75
|
CVE-2026-50328 |
7.5 | 0.0123 | NET NO AUTH LOW CX NO UI | Uncaught exception in Windows Server Update Service allows an unauthorized attac | |
|
75
|
CVE-2026-70159 |
7.5 | 0.0123 | NET NO AUTH LOW CX NO UI | Allocation of resources without limits or throttling in ASP.NET Core allows an u | |
|
75
|
CVE-2026-70181 |
7.5 | 0.0123 | NET NO AUTH LOW CX NO UI | Allocation of resources without limits or throttling in ASP.NET Core allows an u | |
|
75
|
CVE-2026-70163 |
7.5 | 0.0123 | NET NO AUTH LOW CX NO UI | Allocation of resources without limits or throttling in OpenSSH for Windows allo | |
|
75
|
CVE-2026-83645 |
7.5 | 0.0122 | NET NO AUTH LOW CX NO UI | Allocation of resources without limits or throttling in Active Directory Federat | |
|
75
|
CVE-2026-9181 |
7.5 | 0.0122 | NET NO AUTH LOW CX NO UI | Esri ArcGIS Server contains a directory traversal vulnerability. ArcGIS Enterpri | |
|
75
|
CVE-2026-96958 |
7.5 | 0.0120 | NET NO AUTH LOW CX NO UI | Inefficient algorithmic complexity in .NET allows an unauthorized attacker to de | |
|
75
|
CVE-2026-96960 |
7.5 | 0.0120 | NET NO AUTH LOW CX NO UI | Asymmetric resource consumption (amplification) in .NET allows an unauthorized a | |
|
75
|
CVE-2026-56170 |
7.5 | 0.0117 | NET NO AUTH LOW CX NO UI | Allocation of resources without limits or throttling in ASP.NET Core allows an u | |
|
75
|
CVE-2026-57108 |
7.5 | 0.0117 | NET NO AUTH LOW CX NO UI | Access of resource using incompatible type ('type confusion') in .NET Core allow | |
|
75
|
CVE-2026-47302 |
7.5 | 0.0117 | NET NO AUTH LOW CX NO UI | Allocation of resources without limits or throttling in .NET allows an unauthori | |
|
75
|
CVE-2026-50525 |
7.5 | 0.0117 | NET NO AUTH LOW CX NO UI | Allocation of resources without limits or throttling in .NET allows an unauthori | |
|
69
|
CVE-2026-1115 |
9.6 | 0.0126 | NET NO AUTH LOW CX | A Stored Cross-Site Scripting (XSS) vulnerability was identified in the social f | |
|
68
|
CVE-2026-43715 |
8.8 | 0.0126 | NET NO AUTH LOW CX | A use-after-free issue was addressed with improved memory management. This issue | |
|
68
|
CVE-2026-116748 |
8.7 | 0.0125 | NET NO AUTH LOW CX | Transmission 4.0.0 before 4.1.3 contains a permissive CORS vulnerability in hand | |
|
67
|
CVE-2026-75779 |
8.6 | 0.0120 | NET NO AUTH LOW CX | Improper Neutralization of Special Elements used in an OS Command (“OS Command I | |
|
66
|
CVE-2026-93479 |
8.1 | 0.0120 | NET NO AUTH NO UI | A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive |