Hunt List
8,524 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
89
|
CVE-2026-116366 |
9.5 | 0.0040 | NET NO AUTH LOW CX NO UI | 1 PoC | An issue has been discovered in ClickHouse Server that, under certain conditions |
|
80
|
CVE-2026-62016 |
9.8 | 0.0040 | NET NO AUTH LOW CX NO UI | Unauthenticated PHP Object Injection in Gamic <= 1.19 versions. | |
|
80
|
CVE-2026-2053 |
10.0 | 0.0039 | NET NO AUTH LOW CX NO UI | The WSO2 API Manager's message flow component, when processing WS-Addressing hea | |
|
80
|
CVE-2026-107249 |
9.8 | 0.0039 | NET NO AUTH LOW CX NO UI | Improperly Controlled Modification of Dynamically-Determined Object Attributes v | |
|
79
|
CVE-2026-73090 |
9.3 | 0.0040 | NET NO AUTH LOW CX NO UI | PeerTube is an ActivityPub-federated video streaming platform. Prior to 8.2.2, p | |
|
78
|
CVE-2026-46892 |
9.1 | 0.0040 | NET NO AUTH LOW CX NO UI | Vulnerability in the JD Edwards EnterpriseOne Human Resources Management product | |
|
78
|
CVE-2026-91490 |
9.1 | 0.0040 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion | |
|
78
|
CVE-2026-70456 |
8.8 | 0.0040 | NET NO AUTH LOW CX NO UI | rsync 3.0.1 before 3.5.0 contains an out-of-bounds write vulnerability in the re | |
|
78
|
CVE-2026-70458 |
8.8 | 0.0040 | NET NO AUTH LOW CX NO UI | rsync 3.0.0 before 3.5.0 contains an out-of-bounds write vulnerability that allo | |
|
78
|
CVE-2026-18716 |
9.1 | 0.0039 | NET NO AUTH LOW CX NO UI | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote authenticated | |
|
78
|
CVE-2026-93895 |
9.1 | 0.0039 | NET NO AUTH LOW CX NO UI | IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could all | |
|
77
|
CVE-2026-73500 |
8.7 | 0.0040 | NET NO AUTH LOW CX NO UI | etcd is a distributed key-value store for the data of a distributed system. Prio | |
|
77
|
CVE-2026-111733 |
8.7 | 0.0040 | NET NO AUTH LOW CX NO UI | P-Net before 1.0.3 dereferences a NULL AR pointer when handling an implicit read | |
|
77
|
CVE-2026-111736 |
8.7 | 0.0040 | NET NO AUTH LOW CX NO UI | P-Net before 1.0.3 dereferences a NULL AR pointer in pf_fspm_cm_read_ind() when | |
|
77
|
CVE-2026-115793 |
8.7 | 0.0040 | NET NO AUTH LOW CX NO UI | P-Net before 1.0.3 does not release the RPC session allocated for an RPC request | |
|
77
|
CVE-2026-62333 |
8.7 | 0.0040 | NET NO AUTH LOW CX NO UI | OpenVM is a performant and modular zkVM framework built for customization and ex | |
|
77
|
CVE-2026-91217 |
8.6 | 0.0040 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (compo | |
|
77
|
CVE-2026-41927 |
8.3 | 0.0040 | NET NO AUTH LOW CX NO UI | WDR201A WiFi Extender (HW V2.1, FW LFMZX28040922V1.02) contains a stack-based bu | |
|
77
|
CVE-2026-40850 |
8.7 | 0.0040 | NET NO AUTH LOW CX NO UI | An unauthenticated remote attacker can exploit an unauthenticated SQL Injection | |
|
77
|
CVE-2026-112309 |
8.7 | 0.0040 | NET NO AUTH LOW CX NO UI | @rvf/set-get before 7.0.4 contains a prototype pollution vulnerability in setPat | |
|
77
|
CVE-2026-53920 |
8.7 | 0.0040 | NET NO AUTH LOW CX NO UI | odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. F | |
|
77
|
CVE-2026-24222 |
8.6 | 0.0040 | NET NO AUTH LOW CX NO UI | NVIDIA NeMoClaw contains a vulnerability in the sandbox environment initializati | |
|
77
|
CVE-2026-59835 |
8.6 | 0.0040 | NET NO AUTH LOW CX NO UI | A exposure of resource to wrong sphere vulnerability in Fortinet FortiSandbox 5. | |
|
76
|
CVE-2026-42268 |
8.2 | 0.0040 | NET NO AUTH LOW CX NO UI | ModSecurity is an open source, cross platform web application firewall (WAF) eng | |
|
76
|
CVE-2026-116539 |
8.2 | 0.0040 | NET NO AUTH LOW CX NO UI | Netty netty-tcnative before 2.0.84.Final contains a heap buffer overflow vulnera | |
|
76
|
CVE-2026-72753 |
8.2 | 0.0040 | NET NO AUTH LOW CX NO UI | When Routinator encounters an RRDP notification file with gaps in the delta entr | |
|
76
|
CVE-2026-42272 |
7.8 | 0.0040 | NET NO AUTH LOW CX NO UI | Heimdall is a cloud native Identity Aware Proxy and Access Control Decision serv | |
|
76
|
CVE-2026-67607 |
8.2 | 0.0040 | NET NO AUTH LOW CX NO UI | LightFTP 2.3.1 contains a residual race condition vulnerability (an incomplete f | |
|
75
|
CVE-2026-5086 |
7.5 | 0.0040 | NET NO AUTH LOW CX NO UI | Crypt::SecretBuffer versions before 0.019 for Perl is suseceptible to timing att | |
|
75
|
CVE-2026-58421 |
7.5 | 0.0040 | NET NO AUTH LOW CX NO UI | Unauthenticated ReDoS via CODEOWNERS pattern matching allows denial of service | |
|
75
|
CVE-2026-118650 |
7.5 | 0.0040 | NET NO AUTH LOW CX NO UI | Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, a globally mounted middle | |
|
75
|
CVE-2026-101421 |
7.5 | 0.0040 | NET NO AUTH LOW CX NO UI | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleS | |
|
75
|
CVE-2026-91237 |
7.5 | 0.0040 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (compo | |
|
75
|
CVE-2024-9684 |
7.5 | 0.0040 | NET NO AUTH LOW CX NO UI | FreyrSCADA/IEC-60870-5-104 server v21.06.008 allows remote attackers to cause a | |
|
75
|
CVE-2026-40863 |
7.5 | 0.0040 | NET NO AUTH LOW CX NO UI | PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. | |
|
75
|
CVE-2026-40902 |
7.5 | 0.0040 | NET NO AUTH LOW CX NO UI | PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. | |
|
75
|
CVE-2026-11721 |
7.5 | 0.0040 | NET NO AUTH LOW CX NO UI | It is possible for an attacker's zone to respond to a query with an RRSIG that h | |
|
75
|
CVE-2026-12947 |
7.5 | 0.0040 | NET NO AUTH LOW CX NO UI | IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0. | |
|
68
|
CVE-2026-12442 |
8.8 | 0.0040 | NET NO AUTH LOW CX | Use after free in Passwords in Google Chrome on Android prior to 149.0.7827.155 | |
|
68
|
CVE-2026-119419 |
9.2 | 0.0039 | NET NO AUTH NO UI | CakePHP through 5.4.3 contains an sql injection vulnerability that allows attack | |
|
67
|
CVE-2026-85613 |
8.4 | 0.0040 | NET NO AUTH LOW CX | OpenPanel before 2.3.0 contains a cross-site scripting vulnerability in the unau | |
|
66
|
CVE-2026-65570 |
8.1 | 0.0040 | NET NO AUTH NO UI | Unauthenticated Bypass Vulnerability in Login with phone number <= 1.8.70 versio | |
|
66
|
CVE-2026-39545 |
8.1 | 0.0040 | NET NO AUTH NO UI | Unauthenticated PHP Object Injection in Zermatt <= 1.6.1 versions. | |
|
66
|
CVE-2026-39557 |
8.1 | 0.0040 | NET NO AUTH NO UI | Unauthenticated PHP Object Injection in NeoBeat <= 1.7 versions. | |
|
66
|
CVE-2026-39573 |
8.1 | 0.0040 | NET NO AUTH NO UI | Unauthenticated PHP Object Injection in Mildhill <= 1.5 versions. | |
|
66
|
CVE-2026-40735 |
8.1 | 0.0040 | NET NO AUTH NO UI | Unauthenticated PHP Object Injection in Reina <= 2.1 versions. | |
|
66
|
CVE-2026-39445 |
8.1 | 0.0040 | NET NO AUTH NO UI | Unauthenticated PHP Object Injection in Alukas < 3.0.0 versions. | |
|
66
|
CVE-2026-39576 |
8.1 | 0.0040 | NET NO AUTH NO UI | Unauthenticated PHP Object Injection in SingleMalt <= 1.5 versions. | |
|
64
|
CVE-2026-53795 |
7.2 | 0.0040 | NET NO AUTH LOW CX | rsync before 3.5.0 contains an arbitrary file write vulnerability that allows at | |
|
64
|
CVE-2026-64833 |
7.1 | 0.0040 | NET NO AUTH LOW CX | FFmpeg versions 0.7.1 through 8.1.2 contain an out-of-bounds read vulnerability |