Hunt List
8,506 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
89
|
CVE-2026-114509 |
9.2 | 0.0078 | NET NO AUTH LOW CX NO UI | 6 PoC | Laravel is a web application framework. Prior to 12.68.0 and 13.29.0, TokenGuard |
|
80
|
CVE-2026-67282 |
10.0 | 0.0078 | NET NO AUTH LOW CX NO UI | Joomla Extension - fabrikar.com - Unauthenticated remote code execution in Fabri | |
|
80
|
CVE-2026-63887 |
9.8 | 0.0078 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: scsi: targe | |
|
80
|
CVE-2026-63888 |
9.8 | 0.0078 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: scsi: targe | |
|
80
|
CVE-2026-67688 |
9.8 | 0.0077 | NET NO AUTH LOW CX NO UI | ICS-Park Smart Park Management System v2.0 contains an unrestricted file upload | |
|
80
|
CVE-2026-67678 |
9.8 | 0.0077 | NET NO AUTH LOW CX NO UI | File Upload vulnerability in RainyGao-Hithub DocSys v.2.02.80 allows a remote at | |
|
80
|
CVE-2025-70293 |
9.8 | 0.0077 | NET NO AUTH LOW CX NO UI | An issue was discovered in Denx U-Boot before 2026.04. An integer overflow vulne | |
|
80
|
CVE-2026-78845 |
9.8 | 0.0077 | NET NO AUTH LOW CX NO UI | Aidot products Linkind Matter Smart Plug 1.01.32, OREiN Matter Smart Light Bulb | |
|
80
|
CVE-2026-17006 |
9.8 | 0.0077 | NET NO AUTH LOW CX NO UI | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to e | |
|
80
|
CVE-2026-17000 |
9.8 | 0.0077 | NET NO AUTH LOW CX NO UI | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to e | |
|
80
|
CVE-2026-65880 |
10.0 | 0.0077 | NET NO AUTH LOW CX NO UI | Joomla Extension - balbooa.com - Unauthenticated remote code execution in Balboo | |
|
80
|
CVE-2026-102785 |
10.0 | 0.0077 | NET NO AUTH LOW CX NO UI | Joomla Extension - yootheme.com - Unauthenticated remote code execution in YOOth | |
|
80
|
CVE-2026-15734 |
9.8 | 0.0077 | NET NO AUTH LOW CX NO UI | A Server-Side Template Injection (SSTI) vulnerability in WGDashboard version 4.3 | |
|
79
|
CVE-2026-34977 |
9.3 | 0.0077 | NET NO AUTH LOW CX NO UI | Aperi'Solve is an open-source steganalysis web platform. In versions 3.1.3 throu | |
|
78
|
CVE-2026-69223 |
9.1 | 0.0078 | NET NO AUTH LOW CX NO UI | Apache Allura's webhooks are vulnerable to Server-Side Request Forgery (SSRF). | |
|
78
|
CVE-2026-64609 |
9.1 | 0.0078 | NET NO AUTH LOW CX NO UI | Out-of-bounds read via sun.misc.Unsafe in Apache Fory. When out-of-band zero-cop | |
|
78
|
CVE-2026-94265 |
9.1 | 0.0078 | NET NO AUTH LOW CX NO UI | When processing an HTTP redirect to a URL containing userinfo (a `username:passw | |
|
78
|
CVE-2026-56811 |
8.7 | 0.0077 | NET NO AUTH LOW CX NO UI | Allocation of Resources Without Limits or Throttling vulnerability in phoenixfra | |
|
78
|
CVE-2024-58381 |
8.7 | 0.0077 | NET NO AUTH LOW CX NO UI | PocketMine-MP before 5.11.1 contains a denial of service vulnerability in LoginP | |
|
77
|
CVE-2026-59250 |
8.3 | 0.0078 | NET NO AUTH LOW CX NO UI | Classic buffer overflow in the Erlang/OTP megaco flex scanner C driver allows a | |
|
77
|
CVE-2026-62331 |
8.2 | 0.0078 | NET NO AUTH LOW CX NO UI | praktor is a multi-agent Claude Code orchestrator with Telegram input and output | |
|
77
|
CVE-2026-5260 |
8.2 | 0.0077 | NET NO AUTH LOW CX NO UI | A flaw was found in libgnutls. A remote attacker, by sending an extremely short | |
|
75
|
CVE-2026-11595 |
7.5 | 0.0078 | NET NO AUTH LOW CX NO UI | IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to o | |
|
75
|
CVE-2026-54399 |
7.5 | 0.0078 | NET NO AUTH LOW CX NO UI | Uncontrolled Resource Consumption vulnerability in the HTTP/1.1 message parser i | |
|
75
|
CVE-2026-67260 |
7.3 | 0.0078 | NET NO AUTH LOW CX NO UI | Apache Airflow 3.3.0 moved human-in-the-loop tasks from the triggerer to a new ` | |
|
75
|
CVE-2026-66257 |
7.5 | 0.0077 | NET NO AUTH LOW CX NO UI | A pre-authentication attacker could leverage unbounded symbol value caching to c | |
|
75
|
CVE-2026-66273 |
7.5 | 0.0077 | NET NO AUTH LOW CX NO UI | A pre-authentication attacker could leverage type size/count handling to cause e | |
|
75
|
CVE-2026-67465 |
7.5 | 0.0077 | NET NO AUTH LOW CX NO UI | A pre-authentication attacker could leverage unbounded symbol value caching to c | |
|
75
|
CVE-2026-67551 |
7.5 | 0.0077 | NET NO AUTH LOW CX NO UI | pre-authentication attacker could leverage type size/count handling to cause exc | |
|
75
|
CVE-2026-67588 |
7.5 | 0.0077 | NET NO AUTH LOW CX NO UI | A pre-authentication attacker could leverage unbounded symbol value caching to c | |
|
75
|
CVE-2026-67589 |
7.5 | 0.0077 | NET NO AUTH LOW CX NO UI | A pre-authentication attacker could leverage type size/count handling to cause e | |
|
75
|
CVE-2026-68060 |
7.5 | 0.0077 | NET NO AUTH LOW CX NO UI | A pre-authentication attacker could leverage type size/count handling to cause e | |
|
75
|
CVE-2026-68074 |
7.5 | 0.0077 | NET NO AUTH LOW CX NO UI | A pre-authentication attacker could leverage unbounded symbol value caching to c | |
|
75
|
CVE-2026-66274 |
7.5 | 0.0077 | NET NO AUTH LOW CX NO UI | A pre-authentication attacker could leverage type nesting to cause a StackOverfl | |
|
75
|
CVE-2026-67552 |
7.5 | 0.0077 | NET NO AUTH LOW CX NO UI | A pre-authentication attacker could leverage type nesting to cause a StackOverfl | |
|
75
|
CVE-2026-67590 |
7.5 | 0.0077 | NET NO AUTH LOW CX NO UI | A pre-authentication attacker could leverage type nesting to cause a StackOverfl | |
|
75
|
CVE-2026-68073 |
7.5 | 0.0077 | NET NO AUTH LOW CX NO UI | A pre-authentication attacker could leverage type nesting to cause a StackOverfl | |
|
75
|
CVE-2026-56452 |
7.5 | 0.0077 | NET NO AUTH LOW CX NO UI | Path traversal in the sshd-scp component of Apache MINA SSHD. Apache MINA SSHD i | |
|
75
|
CVE-2026-47427 |
7.5 | 0.0077 | NET NO AUTH LOW CX NO UI | GitHub MCP Server is GitHub's official MCP Server. Prior to 1.1.0, the Completio | |
|
75
|
CVE-2026-33034 |
7.5 | 0.0077 | NET NO AUTH LOW CX NO UI | An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4 | |
|
68
|
CVE-2026-32157 |
8.8 | 0.0078 | NET NO AUTH LOW CX | Use after free in Remote Desktop Client allows an unauthorized attacker to execu | |
|
68
|
CVE-2026-102855 |
8.8 | 0.0078 | NET NO AUTH LOW CX | Heap-based buffer overflow in Microsoft Office Visio allows an unauthorized atta | |
|
68
|
CVE-2026-102849 |
8.8 | 0.0077 | NET NO AUTH LOW CX | Heap-based buffer overflow in Microsoft Office Access allows an unauthorized att | |
|
68
|
CVE-2026-102850 |
8.8 | 0.0077 | NET NO AUTH LOW CX | Heap-based buffer overflow in Microsoft Office Access allows an unauthorized att | |
|
66
|
CVE-2026-88185 |
8.1 | 0.0078 | NET NO AUTH NO UI | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attac | |
|
66
|
CVE-2026-70187 |
8.1 | 0.0078 | NET NO AUTH NO UI | Use after free in Remote Desktop Gateway Service allows an unauthorized attacker | |
|
66
|
CVE-2026-13308 |
8.1 | 0.0078 | NET NO AUTH NO UI | Autel MaxiCharger AC Elite Home WebSockets Integer Underflow Remote Code Executi | |
|
66
|
CVE-2023-25734 |
8.1 | 0.0077 | NET NO AUTH LOW CX | After downloading a Windows <code>.url</code> shortcut from the local filesystem | |
|
66
|
CVE-2026-47619 |
8.1 | 0.0077 | NET NO AUTH NO UI | NVIDIA Dynamo for Linux examples and recipes contain a vulnerability where an at | |
|
66
|
CVE-2026-70062 |
8.1 | 0.0077 | NET NO AUTH NO UI | Double free in Windows Libarchive allows an unauthorized attacker to execute cod |