Hunt List
7,677 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
82
|
CVE-2026-45087 |
10.0 | 0.0873 | NET NO AUTH LOW CX NO UI | Dalfox is a powerful open-source XSS scanner and utility focused on automation. | |
|
81
|
CVE-2026-110447 |
9.2 | 0.1163 | NET NO AUTH LOW CX NO UI | KEV | Collabora Collabora Online – Built-in CODE Server when used within the NextCloud |
|
81
|
CVE-2026-64849 |
9.3 | 0.1002 | NET NO AUTH LOW CX NO UI | KEV | MLflow contains a server-side request forgery vulnerability that can allow attac |
|
81
|
CVE-2025-6424 |
9.8 | 0.0796 | NET NO AUTH LOW CX NO UI | A use-after-free in FontFaceSet resulted in a potentially exploitable crash. Thi | |
|
81
|
CVE-2026-8985 |
10.0 | 0.0709 | NET NO AUTH LOW CX NO UI | Autel Maxi Charger Single firmware through V1.03.51 is vulnerable to OS command | |
|
81
|
CVE-2026-15409 |
10.0 | 0.0679 | NET NO AUTH LOW CX NO UI | KEV RW | SonicWall SMA1000 Appliances contain a server-side request forgery vulnerability |
|
81
|
CVE-2026-13773 |
10.0 | 0.0610 | NET NO AUTH LOW CX NO UI | IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 Approximately 50 generated C | |
|
81
|
CVE-2026-4670 |
9.8 | 0.0504 | NET NO AUTH LOW CX NO UI | Authentication bypass by primary weakness vulnerability in Progress Software MOV | |
|
81
|
CVE-2026-6516 |
10.0 | 0.0473 | NET NO AUTH LOW CX NO UI | Zohocorp ManageEngine ADAudit Plus versions before 8606 are affected by Unauthen | |
|
81
|
CVE-2026-104286 |
9.8 | 0.0457 | NET NO AUTH LOW CX NO UI | KEV | Fortinet FortiMail contains a path traversal and an improper neutralization of N |
|
80
|
CVE-2026-5851 |
8.9 | 0.1337 | NET NO AUTH LOW CX NO UI | A security flaw has been discovered in Totolink A7100RU 7.4cu.2313_b20191024. Th | |
|
80
|
CVE-2026-58138 |
9.3 | 0.0914 | NET NO AUTH LOW CX NO UI | Orkes Conductor 3.21.21 before 3.30.2 contains an unauthenticated remote code ex | |
|
80
|
CVE-2026-58455 |
9.2 | 0.0804 | NET NO AUTH LOW CX NO UI | Dockwatch through 0.6.567 contains an unauthenticated OS command injection vulne | |
|
80
|
CVE-2026-54069 |
9.2 | 0.0747 | NET NO AUTH LOW CX NO UI | SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, S | |
|
80
|
CVE-2026-67208 |
9.3 | 0.0722 | NET NO AUTH LOW CX NO UI | Juggle through 1.6.0 contains a remote code execution vulnerability that allows | |
|
80
|
CVE-2026-42530 |
9.2 | 0.0645 | NET NO AUTH LOW CX NO UI | NGINX Open Source has a vulnerability in the ngx_http_v3_module module. When NGI | |
|
80
|
CVE-2026-62327 |
9.3 | 0.0627 | NET NO AUTH LOW CX NO UI | 9Router through version 0.4.41 contains an unauthenticated information disclosur | |
|
80
|
CVE-2026-44262 |
9.4 | 0.0586 | NET NO AUTH LOW CX NO UI | Scramble generates API documentation for Laravel project. From 0.13.2 to before | |
|
80
|
CVE-2026-19586 |
9.3 | 0.0572 | NET NO AUTH LOW CX NO UI | A pre-authentication OS command injection vulnerability has been identified in O | |
|
80
|
CVE-2026-73034 |
9.3 | 0.0570 | NET NO AUTH LOW CX NO UI | DB-GPT v0.8.1 contains an unauthenticated path traversal vulnerability that allo | |
|
80
|
CVE-2026-53787 |
9.3 | 0.0564 | NET NO AUTH LOW CX NO UI | Amasty Order Attributes for Magento 2 before version 4.0.0 contains an unauthent | |
|
80
|
CVE-2026-41922 |
9.3 | 0.0498 | NET NO AUTH LOW CX NO UI | WDR201A WiFi Extender (HW V2.1, FW LFMZX28040922V1.02) contains an OS command in | |
|
80
|
CVE-2026-48909 |
9.5 | 0.0494 | NET NO AUTH LOW CX NO UI | SP LMS (com_splms) < 4.1.4 by JoomShaper deserializes user-controlled cookie dat | |
|
80
|
CVE-2026-49952 |
9.3 | 0.0472 | NET NO AUTH LOW CX NO UI | Discuz! X5.0 releases 20260320 through 20260501 contains an authentication bypas | |
|
80
|
CVE-2026-58123 |
9.3 | 0.0465 | NET NO AUTH LOW CX NO UI | Hermes WebUI before 0.51.788 contains an unauthenticated remote code execution v | |
|
80
|
CVE-2026-15748 |
9.8 | 0.0409 | NET NO AUTH LOW CX NO UI | The Forminator Forms plugin for WordPress is vulnerable to Arbitrary File Upload | |
|
79
|
CVE-2026-29205 |
8.6 | 0.0837 | NET NO AUTH LOW CX NO UI | Incorrect privileges management and insufficient path filtering allow to read ar | |
|
79
|
CVE-2026-55638 |
8.6 | 0.0658 | NET NO AUTH LOW CX NO UI | 9Router is an AI router & token saver. Prior to 0.5.2, 9router protects /v1, /v1 | |
|
79
|
CVE-2026-41103 |
9.1 | 0.0538 | NET NO AUTH LOW CX NO UI | Incorrect implementation of authentication algorithm in Microsoft SSO Plugin for | |
|
79
|
CVE-2026-15511 |
8.9 | 0.0473 | NET NO AUTH LOW CX NO UI | A vulnerability was determined in Comfast CF-WR631AX V3 up to 2.7.0.8. Affected | |
|
79
|
CVE-2026-18686 |
8.9 | 0.0473 | NET NO AUTH LOW CX NO UI | A vulnerability was detected in GL.iNet GL-MT3000 up to 4.4.5. The affected elem | |
|
79
|
CVE-2026-18963 |
9.1 | 0.0468 | NET NO AUTH LOW CX NO UI | A flaw was found in the reset-credentials flow of the keycloak-services componen | |
|
79
|
CVE-2026-58479 |
9.2 | 0.0440 | NET NO AUTH LOW CX NO UI | Sustainable Irrigation Platform (SIP) through version 5.2.16 contains a command | |
|
79
|
CVE-2026-59865 |
9.3 | 0.0436 | NET NO AUTH LOW CX NO UI | Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5 | |
|
79
|
CVE-2026-61498 |
9.3 | 0.0401 | NET NO AUTH LOW CX NO UI | Vitec Flamingo 4.12.2 contains an unauthenticated OS command injection vulnerabi | |
|
79
|
CVE-2026-41925 |
9.3 | 0.0400 | NET NO AUTH LOW CX NO UI | WDR201A WiFi Extender (HW V2.1, FW LFMZX28040922V1.02) contains an OS command in | |
|
79
|
CVE-2026-18612 |
8.9 | 0.0397 | NET NO AUTH LOW CX NO UI | A flaw has been found in GL-iNet GL-MT3000 up to 4.4.5. This vulnerability affec | |
|
79
|
CVE-2026-55200 |
9.2 | 0.0388 | NET NO AUTH LOW CX NO UI | libssh2 1.11.1, fixed in commit 97acf3d, contains an out-of-bounds write vulnera | |
|
78
|
CVE-2023-4050 |
7.5 | 0.1258 | NET NO AUTH LOW CX NO UI | In some cases, an untrusted input stream was copied to a stack buffer without ch | |
|
78
|
CVE-2026-18556 |
8.2 | 0.0788 | NET NO AUTH LOW CX NO UI | KEV | N-able N-central contains an authentication bypass using an alternate path or ch |
|
78
|
CVE-2026-73522 |
8.7 | 0.0395 | NET NO AUTH LOW CX NO UI | COVESA Open1722 through 0.9.2 contains a stack buffer overflow vulnerability tha | |
|
77
|
CVE-2026-42018 |
7.5 | 0.0980 | NET NO AUTH LOW CX NO UI | KEV | JFrog Artifactory contains an improper authentication vulnerability that could r |
|
76
|
CVE-2026-77692 |
7.5 | 0.0656 | NET NO AUTH LOW CX NO UI | An attacker can cause `named` to abort by sending a crafted DNS-over-HTTPS reque | |
|
76
|
CVE-2026-41266 |
7.7 | 0.0406 | NET NO AUTH LOW CX NO UI | Flowise is a drag & drop user interface to build a customized large language mod | |
|
75
|
CVE-2024-46507 |
7.3 | 0.0392 | NET NO AUTH LOW CX NO UI | A SSTI (server side template injection) vulnerability in the custom template exp | |
|
75
|
CVE-2024-45257 |
7.3 | 0.0389 | NET NO AUTH LOW CX NO UI | A Command Injection issue in the payload build page in BYOB (Build Your Own Botn | |
|
70
|
CVE-2026-96951 |
8.8 | 0.0981 | NET NO AUTH LOW CX | KEV | Microsoft Windows Shell contains a command injection vulnerability that allows a |
|
68
|
CVE-2023-43000 |
8.8 | 0.0404 | NET NO AUTH LOW CX | KEV | Apple macOS, iOS, iPadOS, and Safari 16.6 contain a use-after-free vulnerability |
|
57
|
CVE-2026-8510 |
7.5 | 0.0995 | NET NO AUTH | Integer overflow in Skia in Google Chrome on Windows prior to 148.0.7778.168 all | |
|
57
|
CVE-2026-41276 |
7.7 | 0.0687 | NET NO AUTH | Flowise is a drag & drop user interface to build a customized large language mod |