Hunt List
7,769 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
81
|
CVE-2026-53753 |
10.0 | 0.0290 | NET NO AUTH LOW CX NO UI | Crawl4AI is an open-source LLM friendly web crawler & scraper. Prior to 0.8.7, t | |
|
81
|
CVE-2026-46339 |
10.0 | 0.0276 | NET NO AUTH LOW CX NO UI | 9Router is an AI router & token saver. From 0.4.30 until 0.4.37, 9Router's src/p | |
|
80
|
CVE-2026-8153 |
9.8 | 0.0285 | NET NO AUTH LOW CX NO UI | OS command injection in Dashboard Server interface in Universal Robots PolyScope | |
|
80
|
CVE-2026-20896 |
9.8 | 0.0276 | NET NO AUTH LOW CX NO UI | Gitea Docker image versions up to and including 1.26.2 use REVERSE_PROXY_TRUSTED | |
|
80
|
CVE-2026-38709 |
9.8 | 0.0275 | NET NO AUTH LOW CX NO UI | TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, W | |
|
80
|
CVE-2026-38711 |
9.8 | 0.0275 | NET NO AUTH LOW CX NO UI | TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, W | |
|
80
|
CVE-2026-38708 |
9.8 | 0.0275 | NET NO AUTH LOW CX NO UI | TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, W | |
|
80
|
CVE-2026-38713 |
9.8 | 0.0275 | NET NO AUTH LOW CX NO UI | TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, W | |
|
80
|
CVE-2026-28672 |
9.8 | 0.0263 | NET NO AUTH LOW CX NO UI | Improper Neutralization of Special Elements used in a Command ('Command Injectio | |
|
80
|
CVE-2026-16766 |
9.8 | 0.0257 | NET NO AUTH LOW CX NO UI | Catalyst::View::Wkhtmltopdf versions before 0.6.1 for Perl allow shell command i | |
|
80
|
CVE-2026-4408 |
9.8 | 0.0250 | NET NO AUTH LOW CX NO UI | A flaw was found in Samba. A remote attacker can exploit a misconfiguration in S | |
|
80
|
CVE-2026-61808 |
9.8 | 0.0250 | NET NO AUTH LOW CX NO UI | LightRAG provides simple and fast retrieval-augmented generation. Through versio | |
|
80
|
CVE-2026-62392 |
9.8 | 0.0248 | NET NO AUTH LOW CX NO UI | Improper Neutralization of Special Elements used in an OS Command ('OS Command I | |
|
80
|
CVE-2023-23080 |
9.8 | 0.0246 | NET NO AUTH LOW CX NO UI | Certain Tenda products are vulnerable to command injection. This affects Tenda C | |
|
79
|
CVE-2026-58457 |
9.3 | 0.0294 | NET NO AUTH LOW CX NO UI | Shenzhen Aitemi M300 Wi-Fi Repeater (hardware model MT02) contains an unauthenti | |
|
79
|
CVE-2026-110640 |
9.3 | 0.0273 | NET NO AUTH LOW CX NO UI | Whisper-node through 1.1.1 contains an OS command injection vulnerability that a | |
|
79
|
CVE-2026-7840 |
9.3 | 0.0263 | NET NO AUTH LOW CX NO UI | UltraVNC repeater through 1.8.2.2 contains a global buffer overflow in its embed | |
|
79
|
CVE-2026-46725 |
9.2 | 0.0262 | NET NO AUTH LOW CX NO UI | The extension passes an attacker-controlled cookie directly to PHP's unserialize | |
|
79
|
CVE-2026-59801 |
9.3 | 0.0262 | NET NO AUTH LOW CX NO UI | 9Router through version 0.4.41 contains an unauthenticated access vulnerability | |
|
79
|
CVE-2026-53976 |
9.3 | 0.0261 | NET NO AUTH LOW CX NO UI | OpenChamber 1.11.7 contains a path traversal vulnerability in the file-serving e | |
|
79
|
CVE-2026-110635 |
9.3 | 0.0252 | NET NO AUTH LOW CX NO UI | webp-converter before 3.0.0 contains an OS command injection vulnerability in sr | |
|
79
|
CVE-2026-65008 |
9.3 | 0.0249 | NET NO AUTH LOW CX NO UI | Grav 2.0.4 (fixed in 2.0.7) contains a remote code execution vulnerability in Bl | |
|
79
|
CVE-2026-71983 |
9.3 | 0.0246 | NET NO AUTH LOW CX NO UI | MSI Radix AXE6600 router firmware version v781521 contains a command injection v | |
|
79
|
CVE-2026-71984 |
9.3 | 0.0246 | NET NO AUTH LOW CX NO UI | MSI Radix AXE6600 router firmware version v781521 contains a command injection v | |
|
79
|
CVE-2026-71985 |
9.3 | 0.0246 | NET NO AUTH LOW CX NO UI | MSI Radix AXE6600 router firmware version v781521 contains a command injection v | |
|
79
|
CVE-2026-71986 |
9.3 | 0.0246 | NET NO AUTH LOW CX NO UI | MSI Radix AXE6600 router firmware version v781521 contains a command injection v | |
|
79
|
CVE-2026-71987 |
9.3 | 0.0246 | NET NO AUTH LOW CX NO UI | MSI Radix AXE6600 router firmware version v781521 contains a command injection v | |
|
79
|
CVE-2026-71988 |
9.3 | 0.0246 | NET NO AUTH LOW CX NO UI | MSI Radix AXE6600 router firmware version v781521 contains a command injection v | |
|
79
|
CVE-2026-71989 |
9.3 | 0.0246 | NET NO AUTH LOW CX NO UI | MSI Radix AXE6600 router firmware version v781521 contains a command injection v | |
|
79
|
CVE-2026-71990 |
9.3 | 0.0246 | NET NO AUTH LOW CX NO UI | MSI Radix AXE6600 router firmware version v781521 contains a command injection v | |
|
79
|
CVE-2026-71991 |
9.3 | 0.0246 | NET NO AUTH LOW CX NO UI | MSI Radix AXE6600 router firmware version v781521 contains a command injection v | |
|
79
|
CVE-2026-71992 |
9.3 | 0.0246 | NET NO AUTH LOW CX NO UI | MSI Radix AXE6600 router firmware version v781521 contains a command injection v | |
|
79
|
CVE-2026-71993 |
9.3 | 0.0246 | NET NO AUTH LOW CX NO UI | MSI Radix AXE6600 router firmware version v781521 contains a command injection v | |
|
79
|
CVE-2026-61515 |
9.3 | 0.0244 | NET NO AUTH LOW CX NO UI | Puwell IP Camera firmware versions 2.x through 4.x contains an unauthenticated c | |
|
79
|
CVE-2026-40047 |
9.1 | 0.0243 | NET NO AUTH LOW CX NO UI | Improper Neutralization of Argument Delimiters in a Command ('Argument Injection | |
|
78
|
CVE-2026-6027 |
8.9 | 0.0250 | NET NO AUTH LOW CX NO UI | A weakness has been identified in Totolink A7100RU 7.4cu.2313_b20191024. This is | |
|
78
|
CVE-2026-7242 |
8.9 | 0.0245 | NET NO AUTH LOW CX NO UI | A vulnerability was determined in Totolink A8000RU 7.1cu.643_b20200521. Impacted | |
|
78
|
CVE-2026-7241 |
8.9 | 0.0245 | NET NO AUTH LOW CX NO UI | A vulnerability was found in Totolink A8000RU 7.1cu.643_b20200521. This issue af | |
|
78
|
CVE-2026-7243 |
8.9 | 0.0245 | NET NO AUTH LOW CX NO UI | A vulnerability was identified in Totolink A8000RU 7.1cu.643_b20200521. The affe | |
|
78
|
CVE-2026-7240 |
8.9 | 0.0243 | NET NO AUTH LOW CX NO UI | A vulnerability has been found in Totolink A8000RU 7.1cu.643_b20200521. This vul | |
|
78
|
CVE-2026-7244 |
8.9 | 0.0242 | NET NO AUTH LOW CX NO UI | A security flaw has been discovered in Totolink A8000RU 7.1cu.643_b20200521. The | |
|
76
|
CVE-2023-29180 |
7.5 | 0.0280 | NET NO AUTH LOW CX NO UI | A null pointer dereference vulnerability in Fortinet FortiOS 7.2.0 through 7.2.4 | |
|
76
|
CVE-2023-52356 |
7.5 | 0.0251 | NET NO AUTH LOW CX NO UI | A segment fault (SEGV) flaw was found in libtiff that could be triggered by pass | |
|
75
|
CVE-2026-55957 |
7.3 | 0.0285 | NET NO AUTH LOW CX NO UI | Missing Critical Step in Authentication vulnerability in Apache Tomcat when the | |
|
75
|
CVE-2023-28319 |
7.5 | 0.0249 | NET NO AUTH LOW CX NO UI | A use after free vulnerability exists in curl <v8.1.0 in the way libcurl offers | |
|
75
|
CVE-2023-2911 |
7.5 | 0.0243 | NET NO AUTH LOW CX NO UI | If the `recursive-clients` quota is reached on a BIND 9 resolver configured with | |
|
68
|
CVE-2026-57219 |
8.7 | 0.0284 | NET NO AUTH LOW CX | RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20, 4.1.11, | |
|
68
|
CVE-2026-56766 |
8.6 | 0.0244 | NET NO AUTH LOW CX | Hydra through 9.7, fixed in commit 9cc84c2, contains a stack buffer overflow in | |
|
67
|
CVE-2026-55173 |
8.1 | 0.0268 | NET NO AUTH NO UI | WWBN AVideo is an open source video platform. Versions 29.0 and below remain vul | |
|
65
|
CVE-2026-59867 |
7.1 | 0.0239 | NET NO AUTH LOW CX | Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5 |