Hunt List
8,519 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-68503 |
9.8 | 0.0075 | NET NO AUTH LOW CX NO UI | LazyOwn RedTeam/APT Framework is an AI-powered C2 and red-team operations framew | |
|
80
|
CVE-2026-79855 |
9.8 | 0.0075 | NET NO AUTH LOW CX NO UI | An authentication bypass vulnerability in the SSH daemon of AOS-8 allows an unau | |
|
80
|
CVE-2026-63071 |
9.8 | 0.0075 | NET NO AUTH LOW CX NO UI | Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An | |
|
80
|
CVE-2026-54159 |
10.0 | 0.0075 | NET NO AUTH LOW CX NO UI | PrestaShop ps_facetedsearch is a module that adds layered navigation filters. Fr | |
|
80
|
CVE-2026-26035 |
9.8 | 0.0075 | NET NO AUTH LOW CX NO UI | An Improper Authentication vulnerability [CWE-287] vulnerability in Fortinet For | |
|
80
|
CVE-2024-31026 |
9.8 | 0.0075 | NET NO AUTH LOW CX NO UI | An issue in Greek Universities Network (GUnet) Open eClass Platform v.3.15 allow | |
|
80
|
CVE-2026-61991 |
10.0 | 0.0075 | NET NO AUTH LOW CX NO UI | Unauthenticated Remote Code Execution (RCE) in AjaxLoadMore Cache <= 3.1.1 versi | |
|
80
|
CVE-2026-104339 |
9.8 | 0.0075 | NET NO AUTH LOW CX NO UI | IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote attacker to execute a | |
|
80
|
CVE-2026-53405 |
9.8 | 0.0075 | NET NO AUTH LOW CX NO UI | Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An | |
|
80
|
CVE-2025-49710 |
9.8 | 0.0074 | NET NO AUTH LOW CX NO UI | An integer overflow was present in `OrderedHashTable` used by the JavaScript eng | |
|
80
|
CVE-2026-79860 |
9.8 | 0.0074 | NET NO AUTH LOW CX NO UI | Buffer overflow vulnerabilities exist in an underlying service of AOS-8 that cou | |
|
80
|
CVE-2026-118235 |
9.8 | 0.0074 | NET NO AUTH LOW CX NO UI | The SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifica | |
|
79
|
CVE-2024-26828 |
9.4 | 0.0075 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: cifs: fix u | |
|
79
|
CVE-2026-16462 |
9.3 | 0.0075 | NET NO AUTH LOW CX NO UI | In PROCON-WEB SCADA the endpoint 'GetGridData' is not properly sanitized. This a | |
|
79
|
CVE-2026-63359 |
9.3 | 0.0075 | NET NO AUTH LOW CX NO UI | The Appriss Insights (Equifax) Victim Information Notification Exchange (VINE) a | |
|
79
|
CVE-2026-112408 |
9.4 | 0.0074 | NET NO AUTH LOW CX NO UI | Missing verification of source of a communication channel in the default_bucket( | |
|
78
|
CVE-2026-7546 |
8.9 | 0.0075 | NET NO AUTH LOW CX NO UI | A security vulnerability has been detected in Totolink NR1800X 9.1.0u.6279_B2021 | |
|
78
|
CVE-2026-16756 |
8.7 | 0.0075 | NET NO AUTH LOW CX NO UI | Missing connection and header-read timeouts and the absence of a concurrent-conn | |
|
78
|
CVE-2026-53486 |
9.1 | 0.0075 | NET NO AUTH LOW CX NO UI | The decompress package for Node.js extracts archives. Prior to 10.2.1 and 11.1.3 | |
|
78
|
CVE-2026-58319 |
9.1 | 0.0075 | NET NO AUTH LOW CX NO UI | Certain Apache Doris FE HTTP REST administrative APIs were accessible without pr | |
|
78
|
CVE-2026-54003 |
9.1 | 0.0074 | NET NO AUTH LOW CX NO UI | Kirby is an open-source content management system. Prior to 4.9.4 and from 5.4.4 | |
|
78
|
CVE-2026-44307 |
8.7 | 0.0074 | NET NO AUTH LOW CX NO UI | Mako is a template library written in Python. Prior to 1.3.12, on Windows, a URI | |
|
78
|
CVE-2026-59803 |
8.7 | 0.0074 | NET NO AUTH LOW CX NO UI | rpcx through 1.9.3, fixed in commit 047aec1, contains a denial-of-service vulner | |
|
78
|
CVE-2026-66046 |
8.7 | 0.0074 | NET NO AUTH LOW CX NO UI | Expat through 2.8.3 contains a denial of service vulnerability caused by quadrat | |
|
78
|
CVE-2026-72818 |
8.7 | 0.0074 | NET NO AUTH LOW CX NO UI | The URLS regular expression in nltk/tokenize/casual.py, compiled into TweetToken | |
|
78
|
CVE-2026-29009 |
8.8 | 0.0074 | NET NO AUTH LOW CX NO UI | U-Boot before 2026.07-rc2 contains a buffer overflow vulnerability in nfs_readli | |
|
76
|
CVE-2026-11940 |
7.8 | 0.0075 | NET NO AUTH LOW CX NO UI | tarfile.extractall() with the 'data' or 'tar' filter could be bypassed by a cra | |
|
76
|
CVE-2026-42845 |
7.7 | 0.0074 | NET NO AUTH LOW CX NO UI | The form plugin for Grav adds the ability to create and use forms. Prior to 9.1. | |
|
75
|
CVE-2026-85324 |
7.5 | 0.0075 | NET NO AUTH LOW CX NO UI | Memory allocation with excessive size value in Active Directory Federation Servi | |
|
75
|
CVE-2026-49451 |
7.5 | 0.0075 | NET NO AUTH LOW CX NO UI | The OpenAPI.NET SDK contains a useful object model for OpenAPI documents in .NET | |
|
75
|
CVE-2026-45736 |
7.5 | 0.0075 | NET NO AUTH LOW CX NO UI | ws is an open source WebSocket client and server for Node.js. Prior to 8.20.1, t | |
|
75
|
CVE-2025-60467 |
7.5 | 0.0074 | NET NO AUTH LOW CX NO UI | A use-after-free in the gf_filter_pid_inst_swap_delete_task function (/filter_co | |
|
75
|
CVE-2026-49835 |
7.5 | 0.0074 | NET NO AUTH LOW CX NO UI | Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Prior | |
|
75
|
CVE-2026-72602 |
7.5 | 0.0074 | NET NO AUTH LOW CX NO UI | A path traversal vulnerability in AsyncFuncAI deepwiki-open through commit 16f35 | |
|
75
|
CVE-2026-58210 |
7.5 | 0.0074 | NET NO AUTH LOW CX NO UI | NATS Server is a high-performance server for NATS.io, the cloud and edge native | |
|
75
|
CVE-2026-58250 |
7.5 | 0.0074 | NET NO AUTH LOW CX NO UI | NATS Server is a high-performance server for NATS.io, the cloud and edge native | |
|
69
|
CVE-2026-115904 |
9.6 | 0.0074 | NET NO AUTH LOW CX | Topluyo is a social networking platform. A vulnerability exists in Topluyo Deskt | |
|
68
|
CVE-2023-37202 |
8.8 | 0.0076 | NET NO AUTH LOW CX | Cross-compartment wrappers wrapping a scripted proxy could have caused objects f | |
|
68
|
CVE-2023-32213 |
8.8 | 0.0075 | NET NO AUTH LOW CX | When reading a file, an uninitialized value could have been used as read limit. | |
|
68
|
CVE-2023-37211 |
8.8 | 0.0075 | NET NO AUTH LOW CX | Memory safety bugs present in Firefox 114, Firefox ESR 102.12, and Thunderbird 1 | |
|
68
|
CVE-2023-41677 |
8.8 | 0.0075 | NET NO AUTH LOW CX | A insufficiently protected credentials vulnerability in Fortinet FortiOS 7.4.0 t | |
|
68
|
CVE-2026-88145 |
8.8 | 0.0074 | NET NO AUTH LOW CX | Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized atta | |
|
68
|
CVE-2026-97747 |
8.8 | 0.0074 | NET NO AUTH LOW CX | Use after free in Microsoft Office Excel allows an unauthorized attacker to exec | |
|
68
|
CVE-2026-97752 |
8.8 | 0.0074 | NET NO AUTH LOW CX | Use after free in Microsoft Office Excel allows an unauthorized attacker to exec | |
|
68
|
CVE-2026-97754 |
8.8 | 0.0074 | NET NO AUTH LOW CX | Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized atta | |
|
68
|
CVE-2026-97770 |
8.8 | 0.0074 | NET NO AUTH LOW CX | Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized att | |
|
68
|
CVE-2026-97771 |
8.8 | 0.0074 | NET NO AUTH LOW CX | Use after free in Microsoft Office Excel allows an unauthorized attacker to exec | |
|
66
|
CVE-2026-105005 |
8.1 | 0.0075 | NET NO AUTH NO UI | Out-of-bounds write in Windows Schannel allows an unauthorized attacker to execu | |
|
66
|
CVE-2026-70038 |
8.1 | 0.0075 | NET NO AUTH NO UI | Use after free in Windows iSCSI allows an unauthorized attacker to execute code | |
|
57
|
CVE-2026-17497 |
8.3 | 0.0075 | NET NO AUTH | NoteGen before 0.32.0 grants the Tauri shell plugin shell:allow-execute capabili |