Hunt List
8,494 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-6213 |
10.0 | 0.0033 | NET NO AUTH LOW CX NO UI | A vulnerability in Remote Spark SparkView before build 1122 allows an attacker t | |
|
80
|
CVE-2026-30496 |
9.8 | 0.0033 | NET NO AUTH LOW CX NO UI | The Optoma CinemaX P2 projector (firmware TVOS-04.24.010.04.01, Android 8.0.0) e | |
|
80
|
CVE-2026-62874 |
10.0 | 0.0032 | NET NO AUTH LOW CX NO UI | Insufficient verification of data authenticity in Azure Billing allows an unauth | |
|
79
|
CVE-2026-48768 |
9.3 | 0.0033 | NET NO AUTH LOW CX NO UI | TypeBot is a chatbot builder tool. In versions 3.16.1 and earlier, POST /api/blo | |
|
79
|
CVE-2026-8076 |
9.3 | 0.0032 | NET NO AUTH LOW CX NO UI | Weak credentials in the CashDro 3 web administration panel, version 24.01.00.26, | |
|
78
|
CVE-2026-45091 |
9.1 | 0.0033 | NET NO AUTH LOW CX NO UI | sealed-env is a cross-stack, zero-trust secret management library for Node.js an | |
|
78
|
CVE-2026-63569 |
9.1 | 0.0033 | NET NO AUTH LOW CX NO UI | Improper input validation in DHAgreement.CalculateAgreement (MTI/A0 two-pass Dif | |
|
78
|
CVE-2026-72794 |
9.2 | 0.0032 | NET NO AUTH LOW CX NO UI | siyuan versions before v3.7.4 expose the session cookie signing key through the | |
|
78
|
CVE-2026-4337 |
8.8 | 0.0032 | NET NO AUTH LOW CX NO UI | Unrestricted Upload of File with Dangerous Type vulnerability in the PuMuKIT app | |
|
78
|
CVE-2026-114611 |
9.1 | 0.0032 | NET NO AUTH LOW CX NO UI | OCO-Server is a self-hosted endpoint management application for computer invento | |
|
78
|
CVE-2026-54367 |
8.8 | 0.0032 | NET NO AUTH LOW CX NO UI | CentreStack before 17.2 contains an authentication bypass vulnerability that all | |
|
77
|
CVE-2026-110838 |
8.7 | 0.0033 | NET NO AUTH LOW CX NO UI | FreeRDP shadow server from 3.0.0 before 3.32.0 dispatches input PDUs during the | |
|
77
|
CVE-2026-33790 |
8.7 | 0.0032 | NET NO AUTH LOW CX NO UI | An Improper Check for Unusual or Exceptional Conditions vulnerability in the flo | |
|
77
|
CVE-2026-22925 |
8.7 | 0.0032 | NET NO AUTH LOW CX NO UI | A vulnerability has been identified in SIMATIC CN 4100 (All versions < V5.0). Th | |
|
77
|
CVE-2026-40060 |
8.7 | 0.0032 | NET NO AUTH LOW CX NO UI | When a BIG-IP Advanced WAF or ASM security policy is configured on a virtual ser | |
|
77
|
CVE-2026-40067 |
8.7 | 0.0032 | NET NO AUTH LOW CX NO UI | When a BIG-IP APM access policy is configured on a virtual server, undisclosed t | |
|
77
|
CVE-2026-40618 |
8.7 | 0.0032 | NET NO AUTH LOW CX NO UI | When an SSL profile is configured on a virtual server on BIG-IP Virtual Edition | |
|
77
|
CVE-2026-40629 |
8.7 | 0.0032 | NET NO AUTH LOW CX NO UI | When SSL profiles are configured on a virtual server, undisclosed traffic can ca | |
|
76
|
CVE-2026-55641 |
8.2 | 0.0033 | NET NO AUTH LOW CX NO UI | 9Router is an AI router & token saver. Prior to 0.5.2, 9router determines whethe | |
|
75
|
CVE-2025-46175 |
7.5 | 0.0033 | NET NO AUTH LOW CX NO UI | Ruoyi v4.8.0 is vulnerable to Incorrect Access Control. There is a missing check | |
|
75
|
CVE-2026-28913 |
7.5 | 0.0033 | NET NO AUTH LOW CX NO UI | The issue was addressed with improved memory handling. This issue is fixed in Sa | |
|
75
|
CVE-2026-49112 |
7.5 | 0.0033 | NET NO AUTH LOW CX NO UI | Unauthenticated Path Traversal in Shared Files <= 1.7.64 versions. | |
|
75
|
CVE-2026-9690 |
7.5 | 0.0033 | NET NO AUTH LOW CX NO UI | Unauthenticated Arbitrary File Download in WP Media folder Addon <= 4.0.1 versio | |
|
75
|
CVE-2026-28964 |
7.5 | 0.0032 | NET NO AUTH LOW CX NO UI | An inconsistent user interface issue was addressed with improved state managemen | |
|
75
|
CVE-2026-6773 |
7.5 | 0.0032 | NET NO AUTH LOW CX NO UI | Denial-of-service due to integer overflow in the Graphics: WebGPU component. Thi | |
|
75
|
CVE-2026-34297 |
7.5 | 0.0032 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle HCM Common Architecture product of Oracle E-Business | |
|
74
|
CVE-2026-92210 |
7.2 | 0.0033 | NET NO AUTH LOW CX NO UI | NoMachine nxhtd Server-Side Request Forgery Information Disclosure Vulnerability | |
|
74
|
CVE-2025-55702 |
7.0 | 0.0032 | NET NO AUTH LOW CX NO UI | When a client sends a POST with Expect: 100-continue and the origin answers befo | |
|
69
|
CVE-2026-5166 |
9.6 | 0.0033 | NET NO AUTH LOW CX | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') v | |
|
69
|
CVE-2026-76475 |
9.3 | 0.0033 | NET NO AUTH LOW CX | As part of Cisco's ongoing commitment to proactive security and product quality, | |
|
69
|
CVE-2026-109705 |
9.6 | 0.0032 | NET NO AUTH LOW CX | Sandbox escape, site isolation issue due to incorrect boundary conditions, use-a | |
|
69
|
CVE-2026-109707 |
9.6 | 0.0032 | NET NO AUTH LOW CX | Sandbox escape due to use-after-free in the Networking component. This vulnerabi | |
|
68
|
CVE-2026-5161 |
8.8 | 0.0033 | NET NO AUTH LOW CX | Improper link resolution before file access ('link following') vulnerability in | |
|
67
|
CVE-2026-48716 |
8.7 | 0.0033 | NET NO AUTH NO UI | nanobot is a personal AI assistant. In versions 0.1.5.post3 and prior, the Whats | |
|
67
|
CVE-2026-54759 |
8.7 | 0.0033 | NET NO AUTH LOW CX | SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, L | |
|
67
|
CVE-2026-35271 |
8.7 | 0.0032 | NET NO AUTH NO UI | Vulnerability in the PeopleSoft Enterprise PT PeopleTools product of Oracle Peop | |
|
66
|
CVE-2026-14032 |
8.1 | 0.0032 | NET NO AUTH NO UI | Use after free in Bluetooth in Google Chrome on Mac prior to 150.0.7871.47 allow | |
|
66
|
CVE-2026-46806 |
8.2 | 0.0032 | NET NO AUTH LOW CX | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middlewar | |
|
64
|
CVE-2026-116740 |
7.1 | 0.0033 | NET NO AUTH LOW CX | libcss through 0.9.2 contains a NULL pointer dereference vulnerability in mq_par | |
|
64
|
CVE-2026-109938 |
7.1 | 0.0033 | NET NO AUTH LOW CX | Positive mapped-video coordinates overflow and abort FreeRDP clients A malicious | |
|
64
|
CVE-2026-109939 |
7.1 | 0.0033 | NET NO AUTH LOW CX | FreeRDP 3.27.1 before 3.32.0 contains a NULL pointer dereference in update_read_ | |
|
64
|
CVE-2026-109941 |
7.1 | 0.0033 | NET NO AUTH LOW CX | FreeRDP from 2.3.0 before 3.32.0 contains an infinite loop vulnerability in http | |
|
64
|
CVE-2026-109942 |
7.1 | 0.0032 | NET NO AUTH LOW CX | FreeRDP 2.3.0 before 3.32.0 dereferences a NULL stream in rdg_process_close_pack | |
|
57
|
CVE-2026-13829 |
8.3 | 0.0032 | NET NO AUTH | Insufficient validation of untrusted input in Settings in Google Chrome on Windo | |
|
57
|
CVE-2026-14428 |
8.3 | 0.0032 | NET NO AUTH | Insufficient validation of untrusted input in Dawn in Google Chrome on Android p | |
|
57
|
CVE-2026-15122 |
8.3 | 0.0032 | NET NO AUTH | Insufficient validation of untrusted input in Codecs in Google Chrome on Windows | |
|
57
|
CVE-2026-15769 |
8.3 | 0.0032 | NET NO AUTH | Insufficient validation of untrusted input in Linux Toolkit Theming in Google Ch | |
|
57
|
CVE-2026-17660 |
8.3 | 0.0032 | NET NO AUTH | Insufficient validation of untrusted input in Network in Google Chrome prior to | |
|
57
|
CVE-2026-17663 |
8.3 | 0.0032 | NET NO AUTH | Insufficient validation of untrusted input in GPU in Google Chrome on Android pr | |
|
57
|
CVE-2026-19177 |
8.3 | 0.0032 | NET NO AUTH | Insufficient validation of untrusted input in UI in Google Chrome prior to 151.0 |