Hunt List
8,519 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-57807 |
9.8 | 0.0073 | NET NO AUTH LOW CX NO UI | Authentication Bypass Using an Alternate Path or Channel vulnerability in miniOr | |
|
80
|
CVE-2026-64695 |
9.8 | 0.0073 | NET NO AUTH LOW CX NO UI | The issue was addressed with improved memory handling. This issue is fixed in iO | |
|
80
|
CVE-2026-42846 |
9.8 | 0.0073 | NET NO AUTH LOW CX NO UI | ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - | |
|
80
|
CVE-2026-52656 |
9.8 | 0.0073 | NET NO AUTH LOW CX NO UI | An issue in SJCAM AllWinner Tech products SJ4000-Air V1.4C and before and Whitel | |
|
80
|
CVE-2026-73211 |
9.8 | 0.0073 | NET NO AUTH LOW CX NO UI | PeerTube is an ActivityPub-federated video streaming platform. Prior to 8.1.6, A | |
|
80
|
CVE-2026-16770 |
9.8 | 0.0073 | NET NO AUTH LOW CX NO UI | PDF::WebKit versions through 1.2 for Perl allow argument injection into wkhtmlto | |
|
80
|
CVE-2026-73649 |
9.8 | 0.0073 | NET NO AUTH LOW CX NO UI | Velocity.js is a JavaScript implementation of the Apache Velocity template engin | |
|
80
|
CVE-2026-67960 |
9.8 | 0.0073 | NET NO AUTH LOW CX NO UI | An issue in PbootCMS v.3.2.15 allows an attacker to execute arbitrary code via t | |
|
80
|
CVE-2026-16656 |
9.8 | 0.0072 | NET NO AUTH LOW CX NO UI | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to g | |
|
80
|
CVE-2026-43682 |
9.8 | 0.0072 | NET NO AUTH LOW CX NO UI | The issue was addressed with improved memory handling. This issue is fixed in ma | |
|
80
|
CVE-2026-64696 |
9.8 | 0.0072 | NET NO AUTH LOW CX NO UI | The issue was addressed with improved memory handling. This issue is fixed in ma | |
|
80
|
CVE-2026-72494 |
9.8 | 0.0072 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: | |
|
80
|
CVE-2026-74269 |
9.8 | 0.0072 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: bnxt: fix h | |
|
80
|
CVE-2026-80634 |
9.8 | 0.0072 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: netfilter: | |
|
80
|
CVE-2026-89654 |
9.8 | 0.0072 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: ceph: fix U | |
|
80
|
CVE-2026-90048 |
9.8 | 0.0072 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: f | |
|
80
|
CVE-2026-9072 |
9.8 | 0.0072 | NET NO AUTH LOW CX NO UI | IBM WebSphere Application Server and IBM WebSphere Application Server Liberty - | |
|
80
|
CVE-2026-77900 |
9.8 | 0.0072 | NET NO AUTH LOW CX NO UI | Missing authentication for critical function in Azure App Service allows an unau | |
|
80
|
CVE-2026-12481 |
9.8 | 0.0072 | NET NO AUTH LOW CX NO UI | A vulnerability in keras-team/keras version 3.14.0 allows for arbitrary code exe | |
|
79
|
CVE-2026-40630 |
9.3 | 0.0073 | NET NO AUTH LOW CX NO UI | A vulnerability in SenseLive X3050’s web management interface allows unauthor | |
|
79
|
CVE-2026-50161 |
9.3 | 0.0072 | NET NO AUTH LOW CX NO UI | libre is a generic library for real-time communications with asynchronous input | |
|
79
|
CVE-2025-40795 |
9.3 | 0.0072 | NET NO AUTH LOW CX NO UI | A vulnerability has been identified in SIMATIC PCS neo V4.1 (All versions), SIMA | |
|
78
|
CVE-2026-64834 |
8.7 | 0.0073 | NET NO AUTH LOW CX NO UI | FFmpeg versions 0.6.3 through 8.1.2 contain an infinite loop vulnerability in th | |
|
78
|
CVE-2026-53984 |
8.8 | 0.0073 | NET NO AUTH LOW CX NO UI | Ground Station prior to 0.6.0 contains an unauthenticated database-destruction a | |
|
78
|
CVE-2026-69219 |
8.7 | 0.0073 | NET NO AUTH LOW CX NO UI | The RabbitMQ Java client library allows Java and JVM-based applications to conne | |
|
78
|
CVE-2026-69220 |
8.7 | 0.0073 | NET NO AUTH LOW CX NO UI | The RabbitMQ Java client library allows Java and JVM-based applications to conne | |
|
78
|
CVE-2026-28367 |
9.1 | 0.0072 | NET NO AUTH LOW CX NO UI | A flaw was found in Undertow. A remote attacker can exploit this vulnerability b | |
|
77
|
CVE-2026-33602 |
8.2 | 0.0073 | NET NO AUTH LOW CX NO UI | A rogue backend can send a crafted UDP response with a query ID off by one relat | |
|
75
|
CVE-2026-28846 |
7.5 | 0.0073 | NET NO AUTH LOW CX NO UI | A buffer overflow was addressed with improved bounds checking. This issue is fix | |
|
75
|
CVE-2026-45799 |
7.5 | 0.0073 | NET NO AUTH LOW CX NO UI | Wire provides gRPC and protocol buffers for Android, Kotlin, Swift, and Java. Pr | |
|
75
|
CVE-2024-25183 |
7.5 | 0.0073 | NET NO AUTH LOW CX NO UI | givanz VvvebJs 1.7.2 is vulnerable to Directory Traversal via scan.php. | |
|
75
|
CVE-2026-57875 |
7.5 | 0.0073 | NET NO AUTH LOW CX NO UI | An unauthenticated NULL pointer dereference vulnerability exists in the HTTP req | |
|
75
|
CVE-2026-49329 |
7.5 | 0.0072 | NET NO AUTH LOW CX NO UI | A flaw was found in openshift/oauth-server. The OAuth login and error page endpo | |
|
75
|
CVE-2022-43767 |
7.5 | 0.0072 | NET NO AUTH LOW CX NO UI | A vulnerability has been identified in SIMATIC CP 1242-7 V2 (6GK7242-7KX31-0XE0) | |
|
75
|
CVE-2026-48929 |
7.5 | 0.0072 | NET NO AUTH LOW CX NO UI | Rocket.Chat in versions <8.5.1, <8.4.4, <8.3.6, <8.2.6, <8.1.6, <8.0.7, <7.13.9, | |
|
75
|
CVE-2026-24264 |
7.5 | 0.0072 | NET NO AUTH LOW CX NO UI | NVIDIA Triton Inference Server for Linux contains a vulnerability where an attac | |
|
75
|
CVE-2026-20348 |
7.5 | 0.0072 | NET NO AUTH LOW CX NO UI | A vulnerability in the XAR file format parser of ClamAV could allow an unauthent | |
|
69
|
CVE-2026-33976 |
9.6 | 0.0072 | NET NO AUTH LOW CX | Notesnook is a note-taking app. Prior to version 3.3.11 on Web/Desktop and 3.3.1 | |
|
69
|
CVE-2026-58370 |
9.2 | 0.0072 | NET NO AUTH NO UI | Woodpecker before 3.15.0 matches the ApprovalAllowedUsers bypass list against pi | |
|
68
|
CVE-2026-116738 |
8.7 | 0.0073 | NET NO AUTH LOW CX | VMime through 0.9.2 contains an integer underflow in the uuEncoder::decode funct | |
|
68
|
CVE-2026-85817 |
8.8 | 0.0072 | NET NO AUTH LOW CX | Reliance on untrusted inputs in a security decision in Windows PowerShell allows | |
|
68
|
CVE-2026-47897 |
8.9 | 0.0072 | NET NO AUTH NO UI | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') v | |
|
68
|
CVE-2026-102235 |
8.8 | 0.0072 | NET NO AUTH LOW CX | Improper encoding or escaping of output in Visual Studio Code allows an unauthor | |
|
68
|
CVE-2023-28176 |
8.8 | 0.0072 | NET NO AUTH LOW CX | Memory safety bugs present in Firefox 110 and Firefox ESR 102.8. Some of these b | |
|
67
|
CVE-2026-72970 |
8.3 | 0.0073 | NET NO AUTH LOW CX | Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthor | |
|
66
|
CVE-2026-70175 |
8.1 | 0.0073 | NET NO AUTH NO UI | Improper authentication in ASP.NET Core allows an unauthorized attacker to eleva | |
|
66
|
CVE-2026-39253 |
8.1 | 0.0072 | NET NO AUTH NO UI | An issue in Pivotal CRM v.6.6.04.08 allows a remote attacker to execute arbitrar | |
|
66
|
CVE-2026-50758 |
8.1 | 0.0072 | NET NO AUTH LOW CX | Cross Site Scripting vulnerability in DayuanJiang next-ai-draw-io 0.4.13 allows | |
|
66
|
CVE-2026-92389 |
8.1 | 0.0072 | NET NO AUTH NO UI | libcurl's TFTP state machine fails to validate state transitions against the req | |
|
65
|
CVE-2026-57985 |
7.6 | 0.0072 | NET NO AUTH LOW CX | Improper input validation in Microsoft Edge (Chromium-based) allows an unauthori |