Hunt List
8,520 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-48055 |
10.0 | 0.0070 | NET NO AUTH LOW CX NO UI | Streambert is a cross-platform Electron Desktop App to stream and download any v | |
|
80
|
CVE-2026-79848 |
10.0 | 0.0070 | NET NO AUTH LOW CX NO UI | Vulnerabilities in the affected interface of AOS-8 could allow an unauthenticate | |
|
80
|
CVE-2026-79849 |
10.0 | 0.0070 | NET NO AUTH LOW CX NO UI | Vulnerabilities in the affected interface of AOS-8 could allow an unauthenticate | |
|
80
|
CVE-2026-8457 |
9.8 | 0.0070 | NET NO AUTH LOW CX NO UI | The WooCommerce - Social Login plugin for WordPress is vulnerable to Authenticat | |
|
80
|
CVE-2026-111183 |
9.8 | 0.0070 | NET NO AUTH LOW CX NO UI | GStreamer rtpL16depay Heap-based Buffer Overflow Remote Code Execution Vulnerabi | |
|
80
|
CVE-2026-116692 |
9.8 | 0.0070 | NET NO AUTH LOW CX NO UI | MLflow is an open source AI engineering platform for agents, large language mode | |
|
80
|
CVE-2026-105944 |
10.0 | 0.0070 | NET NO AUTH LOW CX NO UI | Apache Pulsar Manager is a web console for administering Apache Pulsar clusters. | |
|
80
|
CVE-2026-46652 |
9.8 | 0.0070 | NET NO AUTH LOW CX NO UI | The Goobi viewer is a web application that allows digitised material to be displ | |
|
80
|
CVE-2026-12116 |
9.8 | 0.0070 | NET NO AUTH LOW CX NO UI | A vulnerability in the Xerte Online Tools allows for RCE through the antivirus b | |
|
80
|
CVE-2026-66902 |
9.8 | 0.0070 | NET NO AUTH LOW CX NO UI | Google::Auth versions before 0.06 for Perl run a command named in an external_ac | |
|
80
|
CVE-2026-3031 |
9.8 | 0.0070 | NET NO AUTH LOW CX NO UI | Image::EPEG versions through 0.15 for Perl embeds an unsupported version of the | |
|
80
|
CVE-2026-74350 |
9.8 | 0.0070 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: ocfs2: vali | |
|
80
|
CVE-2026-74401 |
9.8 | 0.0070 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: dlm: fix ad | |
|
80
|
CVE-2026-54806 |
9.8 | 0.0070 | NET NO AUTH LOW CX NO UI | Unauthenticated PHP Object Injection in WP Activity Log <= 5.6.3.1 versions. | |
|
80
|
CVE-2026-111057 |
10.0 | 0.0070 | NET NO AUTH LOW CX NO UI | Mercury is a Python framework for sharing Jupyter notebooks as web applications | |
|
80
|
CVE-2026-79853 |
9.8 | 0.0070 | NET NO AUTH LOW CX NO UI | Sensitive information disclosure vulnerabilities in the affected interface of AO | |
|
80
|
CVE-2026-76604 |
10.0 | 0.0070 | NET NO AUTH LOW CX NO UI | Joomla Extension - fabrikar.com - Unauthenticated remote code execution via PHP | |
|
80
|
CVE-2026-76605 |
10.0 | 0.0070 | NET NO AUTH LOW CX NO UI | Joomla Extension - fabrikar.com - Remote code execution via image element in Fab | |
|
79
|
CVE-2026-13014 |
9.2 | 0.0070 | NET NO AUTH LOW CX NO UI | A vulnerability in Thales CERT "Suspicious" application =< 1.3.4 allows a remote | |
|
79
|
CVE-2026-26210 |
9.3 | 0.0070 | NET NO AUTH LOW CX NO UI | KTransformers through 0.5.3 contains an unsafe deserialization vulnerability in | |
|
79
|
CVE-2026-109444 |
9.3 | 0.0070 | NET NO AUTH LOW CX NO UI | OpenSRE through 0.1.2026.10.19 contains an approval gate bypass vulnerability th | |
|
79
|
CVE-2026-114403 |
9.2 | 0.0070 | NET NO AUTH LOW CX NO UI | PHPOffice PHPPresentation through 1.2.0 contains an insecure deserialization vul | |
|
79
|
CVE-2026-75143 |
9.3 | 0.0070 | NET NO AUTH LOW CX NO UI | FFmpeg before commit 1c10bcc contains a heap buffer overflow in the RIST protoco | |
|
79
|
CVE-2026-115727 |
9.2 | 0.0070 | NET NO AUTH LOW CX NO UI | AgenticSeek before commit 409840c contains a remote code execution vulnerability | |
|
79
|
CVE-2026-43629 |
9.2 | 0.0070 | NET NO AUTH LOW CX NO UI | llama.cpp builds b4882 through b9058 contain a heap buffer overflow vulnerabilit | |
|
79
|
CVE-2026-12257 |
9.3 | 0.0070 | NET NO AUTH LOW CX NO UI | Versions of Mura CMS prior to 10.0.712 contain a critical remote code execution | |
|
79
|
CVE-2026-112398 |
9.2 | 0.0070 | NET NO AUTH LOW CX NO UI | Pillow is a Python imaging library. Prior to 13.0.0, Pillow's FlashPix JPEG-tile | |
|
78
|
CVE-2019-25654 |
8.7 | 0.0070 | NET NO AUTH LOW CX NO UI | Core FTP/SFTP Server 1.2 contains a buffer overflow vulnerability that allows at | |
|
78
|
CVE-2026-51346 |
9.1 | 0.0070 | NET NO AUTH LOW CX NO UI | SQL Injection vulnerability in StudIP 6.0.x before 6.0.3 and 5.4.x before 5.4.12 | |
|
78
|
CVE-2026-89537 |
9.1 | 0.0070 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Rej | |
|
78
|
CVE-2021-47802 |
8.7 | 0.0070 | NET NO AUTH LOW CX NO UI | Tenda D151 and D301 routers contain an unauthenticated configuration download vu | |
|
78
|
CVE-2026-67215 |
8.7 | 0.0070 | NET NO AUTH LOW CX NO UI | cJSON through 1.7.19 is vulnerable to uncontrolled recursion leading to stack ex | |
|
78
|
CVE-2017-20287 |
8.7 | 0.0070 | NET NO AUTH LOW CX NO UI | Javo Spot theme for WordPress before 3.0.0 contains a path traversal vulnerabili | |
|
78
|
CVE-2026-92388 |
9.1 | 0.0070 | NET NO AUTH LOW CX NO UI | When an FTP wildcard `LIST` operation fails, libcurl omits the restoration path | |
|
78
|
CVE-2026-63559 |
8.7 | 0.0070 | NET NO AUTH LOW CX NO UI | An integer overflow in the UA_Variant arrayDimensions product computation in op | |
|
75
|
CVE-2026-64612 |
7.5 | 0.0070 | NET NO AUTH LOW CX NO UI | A flaw was found in libcupsfilters and cups-filters. The PNG image reading funct | |
|
75
|
CVE-2026-55687 |
7.5 | 0.0070 | NET NO AUTH LOW CX NO UI | ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. Version | |
|
75
|
CVE-2026-57201 |
7.5 | 0.0070 | NET NO AUTH LOW CX NO UI | Asterisk is an open source private branch exchange and telephony toolkit. Prior | |
|
75
|
CVE-2026-43777 |
7.5 | 0.0070 | NET NO AUTH LOW CX NO UI | This issue was addressed with improved input validation. This issue is fixed in | |
|
75
|
CVE-2026-24880 |
7.5 | 0.0070 | NET NO AUTH LOW CX NO UI | Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') | |
|
69
|
CVE-2026-10789 |
9.6 | 0.0070 | NET NO AUTH LOW CX | A maliciously crafted webpage, when visited by a user with Autodesk Fusion Deskt | |
|
68
|
CVE-2026-88115 |
8.8 | 0.0070 | NET NO AUTH LOW CX | Out-of-bounds read in Windows Server for NFS allows an unauthorized attacker to | |
|
68
|
CVE-2026-88112 |
8.8 | 0.0070 | NET NO AUTH LOW CX | Untrusted pointer dereference in DNS Server allows an unauthorized attacker to e | |
|
68
|
CVE-2026-88114 |
8.8 | 0.0070 | NET NO AUTH LOW CX | Untrusted pointer dereference in DNS Server allows an unauthorized attacker to e | |
|
68
|
CVE-2026-85903 |
8.8 | 0.0070 | NET NO AUTH LOW CX | Untrusted pointer dereference in DNS Server allows an unauthorized attacker to e | |
|
68
|
CVE-2023-23605 |
8.8 | 0.0070 | NET NO AUTH LOW CX | Mozilla developers and the Mozilla Fuzzing Team reported memory safety bugs pres | |
|
68
|
CVE-2023-25737 |
8.8 | 0.0070 | NET NO AUTH LOW CX | An invalid downcast from <code>nsTextNode</code> to <code>SVGElement</code> coul | |
|
68
|
CVE-2023-28162 |
8.8 | 0.0070 | NET NO AUTH LOW CX | While implementing AudioWorklets, some code may have casted one type to another, | |
|
68
|
CVE-2023-29536 |
8.8 | 0.0070 | NET NO AUTH LOW CX | An attacker could cause the memory manager to incorrectly free a pointer that ad | |
|
65
|
CVE-2026-49987 |
7.5 | 0.0070 | NET NO AUTH LOW CX | Repomix is a tool that packs repositories into AI-friendly files. Prior to 1.14. |