Hunt List
8,506 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-16917 |
9.8 | 0.0080 | NET NO AUTH LOW CX NO UI | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to e | |
|
80
|
CVE-2026-16919 |
9.8 | 0.0080 | NET NO AUTH LOW CX NO UI | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to e | |
|
80
|
CVE-2026-17118 |
9.8 | 0.0080 | NET NO AUTH LOW CX NO UI | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to e | |
|
80
|
CVE-2026-17136 |
9.8 | 0.0080 | NET NO AUTH LOW CX NO UI | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to e | |
|
80
|
CVE-2026-17160 |
9.8 | 0.0080 | NET NO AUTH LOW CX NO UI | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to e | |
|
80
|
CVE-2026-46456 |
9.8 | 0.0079 | NET NO AUTH LOW CX NO UI | Improper Input Validation vulnerability in Apache Camel AWS2-SQS Component. Th | |
|
80
|
CVE-2026-72593 |
9.8 | 0.0079 | NET NO AUTH LOW CX NO UI | A missing authentication vulnerability in dulldusk/phpfm through 1.8.0 allows an | |
|
80
|
CVE-2026-72567 |
9.8 | 0.0079 | NET NO AUTH LOW CX NO UI | An improper path validation vulnerability in AsyncFuncAI/deepwiki-open through c | |
|
80
|
CVE-2026-7524 |
9.8 | 0.0079 | NET NO AUTH LOW CX NO UI | IBM Langflow OSS 1.0.0 through 1.9.1 could allow remote code execution due to im | |
|
80
|
CVE-2026-64606 |
9.8 | 0.0078 | NET NO AUTH LOW CX NO UI | Deserialization of untrusted data vulnerability that may allow class-registratio | |
|
79
|
CVE-2026-60112 |
9.3 | 0.0079 | NET NO AUTH LOW CX NO UI | AMMOS Instrument Toolkit (AIT) GUI before 2.5.1 contains a missing authenticatio | |
|
79
|
CVE-2026-8979 |
9.3 | 0.0078 | NET NO AUTH LOW CX NO UI | The Mennekes Amtron series (firmware versions ≤ 5.22.3) is vulnerable to an auth | |
|
79
|
CVE-2026-48853 |
9.2 | 0.0078 | NET NO AUTH LOW CX NO UI | Deserialization of Untrusted Data and Allocation of Resources Without Limits or | |
|
79
|
CVE-2026-63382 |
9.2 | 0.0078 | NET NO AUTH LOW CX NO UI | Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, the | |
|
78
|
CVE-2022-51022 |
8.8 | 0.0079 | NET NO AUTH LOW CX NO UI | YiShaAdmin 2.2 through 3.1, fixed in commit 025b062, contains an unauthenticated | |
|
78
|
CVE-2026-41473 |
8.8 | 0.0079 | NET NO AUTH LOW CX NO UI | CyberPanel versions prior to 2.4.5 contain an authentication bypass vulnerabilit | |
|
78
|
CVE-2026-59094 |
8.7 | 0.0079 | NET NO AUTH LOW CX NO UI | Pathway through 0.31.1, fixed in commit d09722e, document store applies a caller | |
|
78
|
CVE-2026-60108 |
8.7 | 0.0079 | NET NO AUTH LOW CX NO UI | Zeek before 8.0.9 contains an uncontrolled memory consumption vulnerability in t | |
|
78
|
CVE-2026-103882 |
9.1 | 0.0079 | NET NO AUTH LOW CX NO UI | The Acadlix LMS – AI Quiz Maker, Online Exam & Course Plugin for WordPress plugi | |
|
78
|
CVE-2026-118579 |
8.9 | 0.0079 | NET NO AUTH LOW CX NO UI | A weakness has been identified in D-Link DIR-505 1.10B02. The impacted element i | |
|
78
|
CVE-2026-3505 |
8.7 | 0.0079 | NET NO AUTH LOW CX NO UI | Allocation of resources without limits or throttling, Uncontrolled Resource Cons | |
|
78
|
CVE-2026-66729 |
8.7 | 0.0078 | NET NO AUTH LOW CX NO UI | facil.io 0.6.0 through 0.7.6 contains an integer underflow vulnerability in the | |
|
78
|
CVE-2026-66730 |
8.7 | 0.0078 | NET NO AUTH LOW CX NO UI | facil.io 0.6.0 through 0.7.6 contains a denial-of-service vulnerability in the m | |
|
78
|
CVE-2026-66731 |
8.7 | 0.0078 | NET NO AUTH LOW CX NO UI | facil.io 0.7.5 through 0.7.6 contains a denial-of-service vulnerability in the H | |
|
78
|
CVE-2026-18140 |
8.7 | 0.0078 | NET NO AUTH LOW CX NO UI | Uncontrolled recursion in the unknown-key skip path of the aws-smithy-json runti | |
|
78
|
CVE-2026-50234 |
8.7 | 0.0078 | NET NO AUTH LOW CX NO UI | Lyrion Music Server 9.2.0 contains a path traversal vulnerability that allows un | |
|
75
|
CVE-2026-50273 |
7.5 | 0.0079 | NET NO AUTH LOW CX NO UI | Datadog .NET Tracer is a client library for Datadog APM for .NET applications. P | |
|
75
|
CVE-2026-50271 |
7.5 | 0.0079 | NET NO AUTH LOW CX NO UI | Datadog dd-trace-py is the Datadog Python APM client. Prior to 4.8.2, Datadog tr | |
|
75
|
CVE-2026-50272 |
7.5 | 0.0079 | NET NO AUTH LOW CX NO UI | dd-trace is the Datadog APM client for Node.js. Prior to 5.100.0, W3C baggage pr | |
|
75
|
CVE-2026-50274 |
7.5 | 0.0079 | NET NO AUTH LOW CX NO UI | Datadog dd-trace-go is a Go client library for Datadog application performance m | |
|
75
|
CVE-2026-14164 |
7.5 | 0.0079 | NET NO AUTH LOW CX NO UI | A double free issue has been identified in libarchive's RAR5 reader. During pars | |
|
75
|
CVE-2026-32316 |
7.5 | 0.0079 | NET NO AUTH LOW CX NO UI | jq is a command-line JSON processor. An integer overflow vulnerability exists th | |
|
75
|
CVE-2026-28811 |
7.5 | 0.0079 | NET NO AUTH LOW CX NO UI | Debug Messages Revealing Unnecessary Information in Apache JSPWiki up to 2.12.3. | |
|
75
|
CVE-2026-34665 |
7.5 | 0.0079 | NET NO AUTH LOW CX NO UI | CAI Content Credentials versions c2pa-web@0.7.0, c2pa-v0.78.2 and earlier are af | |
|
75
|
CVE-2026-39820 |
7.5 | 0.0078 | NET NO AUTH LOW CX NO UI | Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were | |
|
75
|
CVE-2026-67432 |
7.5 | 0.0078 | NET NO AUTH LOW CX NO UI | MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and cli | |
|
69
|
CVE-2026-65605 |
9.4 | 0.0079 | NET NO AUTH LOW CX | SiYuan before v3.7.2 contains a stored cross-site scripting vulnerability in Att | |
|
69
|
CVE-2026-48519 |
9.6 | 0.0078 | NET NO AUTH LOW CX | Langflow is a tool for building and deploying AI-powered agents and workflows. P | |
|
68
|
CVE-2026-57087 |
8.8 | 0.0079 | NET NO AUTH LOW CX | Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unaut | |
|
68
|
CVE-2026-49255 |
8.8 | 0.0079 | NET NO AUTH LOW CX | electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ft | |
|
68
|
CVE-2026-48381 |
9.0 | 0.0078 | NET NO AUTH NO UI | Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Specia | |
|
66
|
CVE-2026-49164 |
8.1 | 0.0079 | NET NO AUTH NO UI | Heap-based buffer overflow in Active Directory Domain Services allows an unautho | |
|
66
|
CVE-2026-50439 |
8.1 | 0.0079 | NET NO AUTH NO UI | Use after free in Microsoft Message Queuing Queue Manager allows an unauthorized | |
|
66
|
CVE-2026-50487 |
8.1 | 0.0079 | NET NO AUTH NO UI | Use after free in Microsoft Windows DNS allows an unauthorized attacker to eleva | |
|
66
|
CVE-2026-50694 |
8.1 | 0.0079 | NET NO AUTH NO UI | Use after free in Windows Secure Socket Tunneling Protocol (SSTP) allows an unau | |
|
66
|
CVE-2026-54995 |
8.1 | 0.0079 | NET NO AUTH NO UI | Use after free in Reliable Multicast Transport Driver (RMCAST) allows an unautho | |
|
66
|
CVE-2026-70269 |
8.1 | 0.0079 | NET NO AUTH NO UI | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attac | |
|
66
|
CVE-2026-70197 |
8.1 | 0.0079 | NET NO AUTH NO UI | Out-of-bounds write in .NET allows an unauthorized attacker to execute code over | |
|
66
|
CVE-2026-58617 |
8.1 | 0.0079 | NET NO AUTH LOW CX | Improper access control in Microsoft 365 Copilot for iOS allows an unauthorized | |
|
55
|
CVE-2024-26010 |
7.5 | 0.0079 | NET NO AUTH | A stack-based buffer overflow vulnerability in Fortinet FortiOS 7.4.0 through 7. |