Hunt List
8,520 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
90
|
CVE-2026-83938 |
10.0 | 0.0071 | NET NO AUTH LOW CX NO UI | 1 PoC | Missing authentication for critical function in Azure Kubernetes Configuration S |
|
80
|
CVE-2026-39337 |
10.0 | 0.0072 | NET NO AUTH LOW CX NO UI | ChurchCRM is an open-source church management system. Prior to 7.1.0, critical p | |
|
80
|
CVE-2026-42288 |
10.0 | 0.0072 | NET NO AUTH LOW CX NO UI | ChurchCRM is an open-source church management system. Prior to 7.3.2, The fix fo | |
|
80
|
CVE-2026-44180 |
9.8 | 0.0072 | NET NO AUTH LOW CX NO UI | Jupyter Enterprise Gateway launches remote Jupyter Notebook kernels across distr | |
|
80
|
CVE-2026-74987 |
9.8 | 0.0072 | NET NO AUTH LOW CX NO UI | Internally found bugs present in Firefox ESR 140.13, Firefox ESR 153.0 and Firef | |
|
80
|
CVE-2026-74990 |
9.8 | 0.0072 | NET NO AUTH LOW CX NO UI | Internally found bugs present in Firefox ESR 115.38, Firefox ESR 140.13, Firefox | |
|
80
|
CVE-2026-33591 |
10.0 | 0.0071 | NET NO AUTH LOW CX NO UI | A vulnerability in Wapt Server before version 2.6.1.17813 allows a remote unaut | |
|
80
|
CVE-2026-63922 |
9.8 | 0.0071 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: ipv6: exthd | |
|
80
|
CVE-2026-63924 |
9.8 | 0.0071 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: ipv6: exthd | |
|
80
|
CVE-2026-89492 |
9.8 | 0.0071 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: ocfs2: vali | |
|
80
|
CVE-2026-89972 |
9.8 | 0.0071 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: nvme: add m | |
|
80
|
CVE-2026-63912 |
9.8 | 0.0071 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: xfrm: esp: | |
|
80
|
CVE-2025-67066 |
9.8 | 0.0071 | NET NO AUTH LOW CX NO UI | SQL Injection vulnerability in oasys sysoa version 1.0 allows a remote attacker | |
|
80
|
CVE-2026-89686 |
9.8 | 0.0071 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: nfsd: fix B | |
|
80
|
CVE-2026-63886 |
9.8 | 0.0071 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: scsi: targe | |
|
80
|
CVE-2026-26332 |
10.0 | 0.0071 | NET NO AUTH LOW CX NO UI | vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.0, Suppresse | |
|
80
|
CVE-2026-110799 |
9.8 | 0.0071 | NET NO AUTH LOW CX NO UI | Vvveb is a powerful and easy to use CMS with page builder to build websites, blo | |
|
80
|
CVE-2026-77264 |
9.8 | 0.0071 | NET NO AUTH LOW CX NO UI | The Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Co | |
|
79
|
CVE-2026-18667 |
9.3 | 0.0072 | NET NO AUTH LOW CX NO UI | A vulnerability in Tenable Sensor Proxy allows a remote attacker to execute code | |
|
79
|
CVE-2026-112780 |
9.3 | 0.0072 | NET NO AUTH LOW CX NO UI | Grav from 2.0.15 before 2.2.2 contains an allowlist bypass vulnerability that al | |
|
79
|
CVE-2026-54213 |
9.2 | 0.0071 | NET NO AUTH LOW CX NO UI | Tobit Laboratories AG TeamDavid's Webbox application exposes a functionality tha | |
|
79
|
CVE-2026-63087 |
9.3 | 0.0071 | NET NO AUTH LOW CX NO UI | Grafana OnCall through 1.16.11 contains an unauthenticated access vulnerability | |
|
79
|
CVE-2026-56786 |
9.3 | 0.0071 | NET NO AUTH LOW CX NO UI | RTKLIB through 2.4.3 contains an out-of-bounds write vulnerability in decode_typ | |
|
78
|
CVE-2026-29145 |
9.1 | 0.0072 | NET NO AUTH LOW CX NO UI | CLIENT_CERT authentication does not fail as expected for some scenarios when sof | |
|
78
|
CVE-2026-61466 |
9.1 | 0.0071 | NET NO AUTH LOW CX NO UI | In Apache CXF's OAuth2 Dynamic Client Registration endpoint, the authorization s | |
|
78
|
CVE-2026-1840 |
8.7 | 0.0071 | NET NO AUTH LOW CX NO UI | The Aclara Metrum Cellular Web Interface is vulnerable to unauthorized access du | |
|
78
|
CVE-2026-50176 |
8.7 | 0.0071 | NET NO AUTH LOW CX NO UI | The WebSocket Application Programming Interface lacks restrictions on the number | |
|
78
|
CVE-2026-17060 |
9.1 | 0.0071 | NET NO AUTH LOW CX NO UI | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to o | |
|
78
|
CVE-2026-13164 |
8.8 | 0.0071 | NET NO AUTH LOW CX NO UI | Missing Authentication for Critical Function (CWE-306) in the RegisterView (apps | |
|
78
|
CVE-2026-55685 |
8.7 | 0.0071 | NET NO AUTH LOW CX NO UI | React Router is a router for React. In versions 7.0.0 through 7.17.0, the manife | |
|
77
|
CVE-2026-11972 |
8.2 | 0.0072 | NET NO AUTH LOW CX NO UI | When using the "tarfile" module with a file opened in "streaming mode" (mode="r| | |
|
75
|
CVE-2023-29106 |
7.5 | 0.0072 | NET NO AUTH LOW CX NO UI | A vulnerability has been identified in SIMATIC Cloud Connect 7 CC712 (All versio | |
|
75
|
CVE-2026-61899 |
7.5 | 0.0071 | NET NO AUTH LOW CX NO UI | Vulnerability in tapestry-core in Apache Tapestry 5.5.0+ on all platforms allows | |
|
75
|
CVE-2026-45859 |
7.5 | 0.0071 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: netfilter: | |
|
75
|
CVE-2026-42402 |
7.5 | 0.0071 | NET NO AUTH LOW CX NO UI | Apache Neethi is vulnerable to a Denial of Service attack through algorithmic co | |
|
69
|
CVE-2026-41106 |
9.3 | 0.0072 | NET NO AUTH LOW CX | Url redirection to untrusted site ('open redirect') in M365 Copilot allows an un | |
|
69
|
CVE-2026-59118 |
9.3 | 0.0072 | NET NO AUTH LOW CX | Improper authorization in Copilot Cowork allows an unauthorized attacker to elev | |
|
68
|
CVE-2026-44827 |
8.8 | 0.0072 | NET NO AUTH LOW CX | Diffusers is the a library for pretrained diffusion models. Prior to 0.38.0, di | |
|
68
|
CVE-2026-88116 |
8.8 | 0.0072 | NET NO AUTH LOW CX | Untrusted pointer dereference in DNS Server allows an unauthorized attacker to e | |
|
68
|
CVE-2023-25735 |
8.8 | 0.0072 | NET NO AUTH LOW CX | Cross-compartment wrappers wrapping a scripted proxy could have caused objects f | |
|
68
|
CVE-2026-54653 |
8.8 | 0.0071 | NET NO AUTH LOW CX | datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, a | |
|
68
|
CVE-2023-29550 |
8.8 | 0.0071 | NET NO AUTH LOW CX | Memory safety bugs present in Firefox 111 and Firefox ESR 102.9. Some of these b | |
|
68
|
CVE-2026-67378 |
9.0 | 0.0071 | NET NO AUTH NO UI | Untrusted pointer dereference in SQL Server allows an unauthorized attacker to e | |
|
68
|
CVE-2026-67636 |
9.0 | 0.0071 | NET NO AUTH NO UI | Out-of-bounds read in SQL Server allows an unauthorized attacker to execute code | |
|
67
|
CVE-2026-52751 |
8.6 | 0.0071 | NET NO AUTH LOW CX | Ghidra before 12.1 contains an unsafe deserialization vulnerability in client-si | |
|
67
|
CVE-2026-13165 |
8.6 | 0.0071 | NET NO AUTH LOW CX | SzafirHost verifies the downloaded native library archive with one JarFile parse | |
|
66
|
CVE-2026-45062 |
8.1 | 0.0071 | NET NO AUTH NO UI | FrankenPHP is a modern application server for PHP. From version 1.11.2 to before | |
|
66
|
CVE-2026-83674 |
8.1 | 0.0071 | NET NO AUTH NO UI | Weak authentication in Active Directory Federation Services (AD FS) allows an un | |
|
66
|
CVE-2026-39861 |
7.7 | 0.0071 | NET NO AUTH LOW CX | Claude Code is an agentic coding tool. Prior to version 2.1.64, Claude Code's sa | |
|
66
|
CVE-2025-40135 |
8.1 | 0.0071 | NET NO AUTH NO UI | In the Linux kernel, the following vulnerability has been resolved: ipv6: use R |