Hunt List
12,165 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-48173 |
9.8 | 0.0014 | NET NO AUTH LOW CX NO UI | In the NAS message handler, improper validation of the length field in NAS messa | |
|
80
|
CVE-2026-68991 |
9.8 | 0.0014 | NET NO AUTH LOW CX NO UI | In the Samsung Exynos ENN NeuralNetworks HAL, improper input validation during r | |
|
80
|
CVE-2026-69050 |
9.8 | 0.0014 | NET NO AUTH LOW CX NO UI | Out-of-bounds memory access in a device driver due to improper resource state tr | |
|
80
|
CVE-2026-28573 |
10.0 | 0.0014 | NET NO AUTH LOW CX NO UI | In AndroidManifest.xml, there is a possible persistent denial of service due to | |
|
79
|
CVE-2026-13385 |
9.5 | 0.0014 | NET NO AUTH LOW CX NO UI | An Improper Validation of Integrity Check Value and Improper Certificate Validat | |
|
78
|
CVE-2026-48186 |
9.1 | 0.0014 | NET NO AUTH LOW CX NO UI | Improper handling of messages before AS security activation can cause unexpected | |
|
78
|
CVE-2026-69006 |
9.1 | 0.0014 | NET NO AUTH LOW CX NO UI | Insufficient validation of length fields in the GNSS firmware loader can result | |
|
78
|
CVE-2026-69043 |
9.1 | 0.0014 | NET NO AUTH LOW CX NO UI | In the Samsung Exynos GPU driver, improper synchronization during buffer object | |
|
78
|
CVE-2026-69068 |
9.1 | 0.0014 | NET NO AUTH LOW CX NO UI | Insufficient length validation in the GNSS firmware loader may lead to corruptio | |
|
78
|
CVE-2026-48183 |
9.1 | 0.0013 | NET NO AUTH LOW CX NO UI | Improper permission handling during buffer operations allows untrusted applicati | |
|
78
|
CVE-2026-108014 |
9.1 | 0.0013 | NET NO AUTH LOW CX NO UI | Private keys for eight eMudhra intermediate CA certificates have been compromis | |
|
78
|
CVE-2026-108015 |
9.1 | 0.0013 | NET NO AUTH LOW CX NO UI | Private keys for eight eMudhra intermediate CA certificates have been compromis | |
|
77
|
CVE-2026-63571 |
8.7 | 0.0014 | NET NO AUTH LOW CX NO UI | Improper verification of cryptographic signature in the attribute certificate pa | |
|
76
|
CVE-2026-14540 |
8.0 | 0.0013 | NET NO AUTH LOW CX NO UI | A Server-Side Request Forgery (SSRF) vulnerability exists in the generic HTTP so | |
|
75
|
CVE-2025-66364 |
7.5 | 0.0014 | NET NO AUTH LOW CX NO UI | Continuously sending control‑plane messages causes the baseband to crashes. | |
|
75
|
CVE-2025-66366 |
7.5 | 0.0014 | NET NO AUTH LOW CX NO UI | Incorrect handling of unauthenticated downlink RRC Setup messages can cause the | |
|
75
|
CVE-2026-35494 |
7.5 | 0.0014 | NET NO AUTH LOW CX NO UI | In the baseband, memory corruption during NAS packet processing can cause a deni | |
|
75
|
CVE-2026-68985 |
7.5 | 0.0014 | NET NO AUTH LOW CX NO UI | In the Samsung Exynos NPU driver, improper validation of user input in the ioctl | |
|
75
|
CVE-2026-69025 |
7.5 | 0.0014 | NET NO AUTH LOW CX NO UI | In the Exynos NPU driver, improper validation of user input in the ioctl handler | |
|
75
|
CVE-2026-48176 |
7.5 | 0.0014 | NET NO AUTH LOW CX NO UI | A memory corruption vulnerability caused by improper validation of messages | |
|
75
|
CVE-2026-48179 |
7.5 | 0.0014 | NET NO AUTH LOW CX NO UI | In the Exynos modem's IMS stack, improper handling of SDP payload leads to a Den | |
|
75
|
CVE-2026-68994 |
7.3 | 0.0014 | NET NO AUTH LOW CX NO UI | A double free vulnerability in NPU driver due to improper pointer management (94 | |
|
75
|
CVE-2026-69005 |
7.3 | 0.0014 | NET NO AUTH LOW CX NO UI | Integer overflow in NPU driver parameter processing due to insufficient bounds c | |
|
75
|
CVE-2026-34856 |
7.5 | 0.0014 | NET NO AUTH LOW CX NO UI | UAF vulnerability in the communication module. Impact: Successful exploitation o | |
|
75
|
CVE-2026-69002 |
7.5 | 0.0013 | NET NO AUTH LOW CX NO UI | Incorrect authorization in Samsung framework services due to missing permission | |
|
75
|
CVE-2026-34851 |
7.5 | 0.0013 | NET NO AUTH LOW CX NO UI | Race condition vulnerability in the event notification module. Impact: Successfu | |
|
68
|
CVE-2026-111841 |
8.8 | 0.0013 | NET NO AUTH LOW CX | Cross-Site Request Forgery (CSRF) vulnerability in Aman FunnelKit Automations wp | |
|
68
|
CVE-2026-122001 |
8.8 | 0.0013 | NET NO AUTH LOW CX | The Komfortkasse for WooCommerce WordPress plugin before 1.4.9 does not properly | |
|
68
|
CVE-2026-66669 |
8.8 | 0.0013 | NET NO AUTH LOW CX | Cross-Site Request Forgery (CSRF) vulnerability in Suplugins Superb Addons: Bloc | |
|
67
|
CVE-2026-117536 |
8.6 | 0.0014 | NET NO AUTH LOW CX | REDAXO before 5.21.3 contains a cross-site request forgery vulnerability in the | |
|
67
|
CVE-2026-28761 |
8.5 | 0.0013 | NET NO AUTH LOW CX | Cross-site request forgery vulnerability exists in Musetheque V4 Information Dis | |
|
66
|
CVE-2026-68984 |
8.1 | 0.0014 | NET NO AUTH LOW CX | In the Samsung Exynos NPU kernel driver, an integer overflow allows an unprivile | |
|
66
|
CVE-2026-44548 |
8.1 | 0.0014 | NET NO AUTH LOW CX | ChurchCRM is an open-source church management system. Prior to 7.3.2, top-level | |
|
66
|
CVE-2026-123591 |
8.2 | 0.0013 | NET NO AUTH NO UI | Hickory DNS hickory-net 0.26.0-beta.1 before 0.26.2 and hickory-proto through 0. | |
|
65
|
CVE-2026-119755 |
7.5 | 0.0013 | NET NO AUTH LOW CX | Tasmota through 16.0.0, fixed in commit 1cb7ebc, contains a cross-site request f | |
|
64
|
CVE-2026-41554 |
7.1 | 0.0014 | NET NO AUTH LOW CX | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti | |
|
64
|
CVE-2026-42762 |
7.1 | 0.0014 | NET NO AUTH LOW CX | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti | |
|
64
|
CVE-2026-42653 |
7.1 | 0.0014 | NET NO AUTH LOW CX | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti | |
|
64
|
CVE-2026-49396 |
7.1 | 0.0014 | NET NO AUTH LOW CX | Nezha Monitoring is a self-hostable, lightweight, servers and websites monitorin | |
|
64
|
CVE-2026-39437 |
7.1 | 0.0014 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in Min Max Step Quantity Limits Manag | |
|
64
|
CVE-2026-54188 |
7.1 | 0.0014 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.10 versions. | |
|
64
|
CVE-2026-54189 |
7.1 | 0.0014 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.10 versions. | |
|
64
|
CVE-2026-119407 |
7.1 | 0.0014 | NET NO AUTH LOW CX | Element Web and Element Desktop before 1.12.32 accept guest credentials from URL | |
|
64
|
CVE-2026-116204 |
7.2 | 0.0014 | NET NO AUTH LOW CX | YesWiki before 4.7.0 contains a cross-site request forgery vulnerability in the | |
|
64
|
CVE-2026-45037 |
7.1 | 0.0014 | NET NO AUTH LOW CX | Tabby (formerly Terminus) is a highly configurable terminal emulator. Prior to 1 | |
|
64
|
CVE-2025-62005 |
7.1 | 0.0014 | NET NO AUTH LOW CX | Cross-Site Request Forgery (CSRF) vulnerability in FantasticPlugins SUMO Members | |
|
64
|
CVE-2026-41057 |
7.1 | 0.0013 | NET NO AUTH LOW CX | WWBN AVideo is an open source video platform. In versions 29.0 and below, the CO | |
|
55
|
CVE-2026-116189 |
7.7 | 0.0014 | NET NO AUTH | rclone from 1.55.0 before 1.75.2 contains a signature verification bypass in sta | |
|
55
|
CVE-2026-7948 |
7.5 | 0.0013 | NET NO AUTH | Race in Chromoting in Google Chrome on Windows prior to 148.0.7778.96 allowed a | |
|
54
|
CVE-2026-101176 |
7.1 | 0.0013 | NET NO AUTH | Permission control vulnerability in the event notification management module. Im |