Hunt List
8,518 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-6264 |
9.8 | 0.0074 | NET NO AUTH LOW CX NO UI | A critical vulnerability in the Talend JobServer and Talend Runtime allows unaut | |
|
80
|
CVE-2026-72098 |
9.8 | 0.0074 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: dm-verity: | |
|
80
|
CVE-2026-17145 |
9.8 | 0.0073 | NET NO AUTH LOW CX NO UI | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to e | |
|
80
|
CVE-2026-15435 |
9.8 | 0.0073 | NET NO AUTH LOW CX NO UI | IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0. | |
|
80
|
CVE-2026-47627 |
9.8 | 0.0073 | NET NO AUTH LOW CX NO UI | NVIDIA Triton Inference Server for Linux contains a vulnerability where an attac | |
|
80
|
CVE-2026-26083 |
9.8 | 0.0073 | NET NO AUTH LOW CX NO UI | A missing authorization vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0 | |
|
80
|
CVE-2026-48204 |
9.8 | 0.0073 | NET NO AUTH LOW CX NO UI | Improper Input Validation, Improper Access Control vulnerability in Apache Camel | |
|
80
|
CVE-2026-40920 |
9.8 | 0.0073 | NET NO AUTH LOW CX NO UI | Privilege Escalation via URL Parameter is reported in Apache Ranger versions <= | |
|
80
|
CVE-2025-49901 |
9.8 | 0.0073 | NET NO AUTH LOW CX NO UI | Authentication Bypass Using an Alternate Path or Channel vulnerability in quantu | |
|
79
|
CVE-2026-67531 |
9.3 | 0.0073 | NET NO AUTH LOW CX NO UI | FrontMCP is a TypeScript-first framework for the Model Context Protocol (MCP). P | |
|
79
|
CVE-2026-75885 |
9.3 | 0.0073 | NET NO AUTH LOW CX NO UI | A flaw was found in the OpenShift console. Unauthenticated access to the `/api/d | |
|
78
|
CVE-2026-47606 |
9.1 | 0.0074 | NET NO AUTH LOW CX NO UI | NVIDIA Triton Inference Server for Linux contains a vulnerability where an attac | |
|
78
|
CVE-2026-9190 |
9.1 | 0.0074 | NET NO AUTH LOW CX NO UI | An HTTP request smuggling vulnerability in the HTTP App Server of Progress MarkL | |
|
78
|
CVE-2026-72569 |
9.1 | 0.0074 | NET NO AUTH LOW CX NO UI | A path traversal vulnerability in cube-root/directory-serve through 1.3.7 allows | |
|
78
|
CVE-2021-48013 |
8.7 | 0.0074 | NET NO AUTH LOW CX NO UI | Weaver E-cology 8.0 contains a path traversal vulnerability that allows unauthen | |
|
78
|
CVE-2019-25765 |
8.7 | 0.0074 | NET NO AUTH LOW CX NO UI | ASP-CMS contains a SQL injection vulnerability in the commentList.asp endpoint t | |
|
78
|
CVE-2026-28368 |
9.1 | 0.0073 | NET NO AUTH LOW CX NO UI | A flaw was found in Undertow. This vulnerability allows a remote attacker to con | |
|
78
|
CVE-2026-86413 |
9.1 | 0.0073 | NET NO AUTH LOW CX NO UI | When using an *ambient user* in a first transfer doing Negotiate authentication | |
|
77
|
CVE-2026-16616 |
8.6 | 0.0073 | NET NO AUTH LOW CX NO UI | The Simple File List WordPress plugin through 6.3.11 does not validate the sourc | |
|
75
|
CVE-2026-24012 |
7.5 | 0.0074 | NET NO AUTH LOW CX NO UI | Uncontrolled Resource Consumption vulnerability in Apache IoTDB. Some interfac | |
|
75
|
CVE-2026-59870 |
7.5 | 0.0074 | NET NO AUTH LOW CX NO UI | js-yaml is a JavaScript YAML parser and dumper. Prior to 3.15.1, 4.3.1, and 5.2. | |
|
75
|
CVE-2026-59173 |
7.5 | 0.0074 | NET NO AUTH LOW CX NO UI | Uncontrolled Resource Consumption vulnerability in Apache Traffic Server. This | |
|
75
|
CVE-2026-66142 |
7.5 | 0.0074 | NET NO AUTH LOW CX NO UI | Apache Neethi is vulnerable to uncontrolled recursion when parsing policies that | |
|
75
|
CVE-2026-66144 |
7.5 | 0.0074 | NET NO AUTH LOW CX NO UI | Although remote policy references are not retrieved during policy normalization, | |
|
75
|
CVE-2026-67592 |
7.5 | 0.0074 | NET NO AUTH LOW CX NO UI | It was not possible to govern the maximum number of transfer frames per incoming | |
|
75
|
CVE-2026-89680 |
7.5 | 0.0074 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: nfsd: fix n | |
|
75
|
CVE-2026-31987 |
7.5 | 0.0074 | NET NO AUTH LOW CX NO UI | JWT Tokens used by tasks were exposed in logs. This could allow UI users to act | |
|
75
|
CVE-2026-5057 |
7.5 | 0.0074 | NET NO AUTH LOW CX NO UI | ATEN Unizon RpcProvider Missing Authentication Denial-of-Service Vulnerability. | |
|
75
|
CVE-2026-110353 |
7.5 | 0.0074 | NET NO AUTH LOW CX NO UI | HAProxy 3.2 before 3.4.6 allows a remote unauthenticated attacker to cause a den | |
|
75
|
CVE-2026-71469 |
7.5 | 0.0074 | NET NO AUTH LOW CX NO UI | A flaw was found in search-v2-api. An unauthenticated attacker can exploit this | |
|
75
|
CVE-2025-61581 |
7.5 | 0.0074 | NET NO AUTH LOW CX NO UI | ** UNSUPPORTED WHEN ASSIGNED ** Inefficient Regular Expression Complexity vulner | |
|
75
|
CVE-2026-5757 |
7.5 | 0.0073 | NET NO AUTH LOW CX NO UI | Unauthenticated remote information disclosure vulnerability in Ollama's model qu | |
|
75
|
CVE-2026-81755 |
7.5 | 0.0073 | NET NO AUTH LOW CX NO UI | Uncontrolled resource consumption in the streaming RPC component of Apache bRPC | |
|
75
|
CVE-2026-97801 |
7.5 | 0.0073 | NET NO AUTH LOW CX NO UI | Improper validation of specified type of input in .NET Framework allows an unaut | |
|
75
|
CVE-2026-54225 |
7.5 | 0.0073 | NET NO AUTH LOW CX NO UI | Apache CXF allows to control the maximum attachment size via the "attachment-max | |
|
75
|
CVE-2026-57819 |
7.5 | 0.0073 | NET NO AUTH LOW CX NO UI | Apache CXF allows to set a limit on the number of form parameters in a JAX-RS me | |
|
75
|
CVE-2026-56386 |
7.5 | 0.0073 | NET NO AUTH LOW CX NO UI | Integer underflow and out-of-bounds read in the HTTP/2 server DATA frame parser | |
|
68
|
CVE-2026-88196 |
8.8 | 0.0074 | NET NO AUTH LOW CX | Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker t | |
|
68
|
CVE-2026-97012 |
8.8 | 0.0074 | NET NO AUTH LOW CX | Stack-based buffer overflow in Microsoft Office Outlook allows an unauthorized a | |
|
68
|
CVE-2023-25732 |
8.8 | 0.0074 | NET NO AUTH LOW CX | When encoding data from an <code>inputStream</code> in <code>xpcom</code> the si | |
|
68
|
CVE-2023-29539 |
8.8 | 0.0074 | NET NO AUTH LOW CX | When handling the filename directive in the Content-Disposition header, the file | |
|
68
|
CVE-2026-82814 |
8.8 | 0.0073 | NET NO AUTH LOW CX | The Duplicator and Duplicator Pro plugins for WordPress are vulnerable to PHP Ob | |
|
68
|
CVE-2023-32207 |
8.8 | 0.0073 | NET NO AUTH LOW CX | A missing delay in popup notifications could have made it possible for an attack | |
|
66
|
CVE-2026-58065 |
8.1 | 0.0074 | NET NO AUTH NO UI | The Apache Airflow Git provider runs its git-over-SSH operations with `StrictHos | |
|
66
|
CVE-2026-49286 |
8.1 | 0.0073 | NET NO AUTH NO UI | PhpWeasyPrint is a PHP library allowing PDF generation from a URL or an HTML pag | |
|
66
|
CVE-2026-83844 |
8.1 | 0.0073 | NET NO AUTH NO UI | Out-of-bounds read in Windows Paint allows an unauthorized attacker to execute c | |
|
66
|
CVE-2026-13181 |
8.1 | 0.0073 | NET NO AUTH NO UI | In Progress® Telerik® UI for AJAX prior to v2026.2.708, forged upload metadata c | |
|
66
|
CVE-2026-13186 |
8.1 | 0.0073 | NET NO AUTH NO UI | In Progress® Telerik® UI for AJAX prior to v2026.2.708, a path traversal vulnera | |
|
65
|
CVE-2026-7831 |
7.6 | 0.0074 | NET NO AUTH LOW CX | UltraVNC viewer through 1.8.2.2 contains an off-by-one stack buffer overflow in | |
|
65
|
CVE-2026-63720 |
7.5 | 0.0074 | NET NO AUTH LOW CX | datamodel-code-generator prior to version 0.70.0 contains a code injection vulne |