Hunt List
8,520 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-56004 |
10.0 | 0.0066 | NET NO AUTH LOW CX NO UI | A shellcode injection in the mercurial handler of the obs tar_scm source service | |
|
80
|
CVE-2026-36669 |
9.8 | 0.0066 | NET NO AUTH LOW CX NO UI | An unauthenticated arbitrary file upload vulnerability in ck_upload_handler.php | |
|
80
|
CVE-2026-115915 |
9.8 | 0.0066 | NET NO AUTH LOW CX NO UI | vLLM is an inference and serving engine for large language models. Prior to 0.32 | |
|
80
|
CVE-2026-65906 |
10.0 | 0.0066 | NET NO AUTH LOW CX NO UI | In JetBrains TeamCity before 2026.1.2, 2025.11.6 сode execution via Kotlin DSL s | |
|
80
|
CVE-2026-96639 |
9.8 | 0.0066 | NET NO AUTH LOW CX NO UI | Pillow is a Python imaging library. From 11.0.0 until 13.0.0, multi-frame loader | |
|
80
|
CVE-2026-96096 |
9.8 | 0.0066 | NET NO AUTH LOW CX NO UI | Heap-based buffer overflow in Windows Media Player allows an unauthorized attack | |
|
80
|
CVE-2026-42778 |
9.8 | 0.0066 | NET NO AUTH LOW CX NO UI | The fix for CVE-2026-41409 was not applied to the 2.1.X and 2.2.X branches. Here | |
|
80
|
CVE-2026-14454 |
9.8 | 0.0066 | NET NO AUTH LOW CX NO UI | Imager versions before 1.033 for Perl treat unsigned EXIF IFD entry counts as si | |
|
80
|
CVE-2026-63244 |
9.8 | 0.0066 | NET NO AUTH LOW CX NO UI | An authentication bypass vulnerability in WizLearn Technologies' Learning Manage | |
|
79
|
CVE-2026-54414 |
9.3 | 0.0066 | NET NO AUTH LOW CX NO UI | FileRise before 3.16.0 is vulnerable to path traversal in the shared-folder uplo | |
|
79
|
CVE-2026-50003 |
9.3 | 0.0066 | NET NO AUTH LOW CX NO UI | A malicious or compromised server can make a DCMTK client using bit-preserving C | |
|
79
|
CVE-2026-75110 |
9.3 | 0.0066 | NET NO AUTH LOW CX NO UI | MemOS is a memory operating system for LLMs and AI agents. In deployments where | |
|
79
|
CVE-2026-75852 |
9.3 | 0.0066 | NET NO AUTH LOW CX NO UI | ArcadeDB versions before 26.8.1 fail to enforce SASL authentication on data comm | |
|
79
|
CVE-2026-35087 |
9.3 | 0.0066 | NET NO AUTH LOW CX NO UI | Slican telephone exchanges allow administrative protocol authentication bypass. | |
|
79
|
CVE-2026-63146 |
9.3 | 0.0066 | NET NO AUTH LOW CX NO UI | Omnispace Agora Project before 26.10.0 contains a code injection vulnerability w | |
|
79
|
CVE-2026-56271 |
9.3 | 0.0066 | NET NO AUTH LOW CX NO UI | Flowise before 3.1.0 (affected versions 3.0.13 and earlier) uses weak hardcoded | |
|
78
|
CVE-2026-52199 |
9.1 | 0.0066 | NET NO AUTH LOW CX NO UI | An issue in Generic OEM UZ801_v2.1 4G LTE Router V3.4.3 allows a remote attacker | |
|
78
|
CVE-2026-66145 |
9.1 | 0.0066 | NET NO AUTH LOW CX NO UI | An unauthenticated remote code execution vulnerability was identified in GMS 9.5 | |
|
78
|
CVE-2026-78334 |
9.1 | 0.0066 | NET NO AUTH LOW CX NO UI | Missing authentication in the streaming RPC path of Apache bRPC (version < 1.18. | |
|
78
|
CVE-2026-70636 |
8.7 | 0.0066 | NET NO AUTH LOW CX NO UI | Flowise through 3.1.4 contains an authentication bypass vulnerability that allow | |
|
78
|
CVE-2026-43637 |
8.8 | 0.0066 | NET NO AUTH LOW CX NO UI | Cornac before 2.6.0 contains a path traversal (Tar Slip) vulnerability that allo | |
|
78
|
CVE-2026-65894 |
8.7 | 0.0066 | NET NO AUTH LOW CX NO UI | This vulnerability exists in CP PLUS EZ-P21 IP Camera due to improper authentica | |
|
78
|
CVE-2026-14740 |
9.1 | 0.0066 | NET NO AUTH LOW CX NO UI | DBI versions before 1.650 for Perl read one byte out-of-bounds in preparse when | |
|
78
|
CVE-2026-93471 |
8.7 | 0.0066 | NET NO AUTH LOW CX NO UI | Improper Handling of Highly Compressed Data (Data Amplification) in esaml_bindin | |
|
78
|
CVE-2026-108359 |
8.7 | 0.0066 | NET NO AUTH LOW CX NO UI | PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. | |
|
78
|
CVE-2023-54357 |
8.7 | 0.0066 | NET NO AUTH LOW CX NO UI | Joomla com_booking component 2.4.9 contains an information disclosure vulnerabil | |
|
78
|
CVE-2026-59235 |
8.7 | 0.0066 | NET NO AUTH LOW CX NO UI | Missing Authorization (CWE-862) in BankAccountListController (app/Http/Controlle | |
|
78
|
CVE-2026-35469 |
8.7 | 0.0066 | NET NO AUTH LOW CX NO UI | spdystream is a Go library for multiplexing streams over SPDY connections. In ve | |
|
78
|
CVE-2026-7839 |
9.1 | 0.0066 | NET NO AUTH LOW CX NO UI | UltraVNC repeater through 1.8.2.2 initializes the HTTP administration server wit | |
|
78
|
CVE-2026-59161 |
8.7 | 0.0066 | NET NO AUTH LOW CX NO UI | Excelize is a Go language library for reading and writing Microsoft Excel spread | |
|
77
|
CVE-2026-86696 |
8.2 | 0.0066 | NET NO AUTH LOW CX NO UI | Allocation of Resources Without Limits or Throttling vulnerability in esaml in d | |
|
77
|
CVE-2026-22620 |
8.6 | 0.0066 | NET NO AUTH LOW CX NO UI | Improper input validation in the authentication component of Eaton's Tripp Lite | |
|
75
|
CVE-2026-64958 |
7.5 | 0.0066 | NET NO AUTH LOW CX NO UI | An incomplete fix for CVE-2026-50645 means that it is still possible to perform | |
|
75
|
CVE-2026-68481 |
7.5 | 0.0066 | NET NO AUTH LOW CX NO UI | In Apache CXF's DefaultEncryptingOAuthDataProvider, revoked access tokens still | |
|
75
|
CVE-2026-12844 |
7.5 | 0.0066 | NET NO AUTH LOW CX NO UI | List::SomeUtils::XS versions before 0.59 for Perl have a heap buffer overflow in | |
|
75
|
CVE-2026-46457 |
7.5 | 0.0066 | NET NO AUTH LOW CX NO UI | Improper Input Validation vulnerability in Apache Camel NATS component. The cam | |
|
75
|
CVE-2026-28814 |
7.5 | 0.0066 | NET NO AUTH LOW CX NO UI | Arbitrary Wiki Markup rendering due to lack of authentication in Apache JSPWiki | |
|
75
|
CVE-2026-55814 |
7.5 | 0.0066 | NET NO AUTH LOW CX NO UI | Missing Authentication in Apache Ranger Download APIs on versions <= 2.8.0. User | |
|
75
|
CVE-2026-50142 |
7.5 | 0.0066 | NET NO AUTH LOW CX NO UI | libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1. | |
|
69
|
CVE-2026-55447 |
9.6 | 0.0066 | NET NO AUTH LOW CX | Langflow is a tool for building and deploying AI-powered agents and workflows. P | |
|
68
|
CVE-2026-105008 |
9.0 | 0.0066 | NET NO AUTH NO UI | No cwe for this issue in Windows Schannel allows an unauthorized attacker to per | |
|
68
|
CVE-2026-16723 |
9.0 | 0.0066 | NET NO AUTH NO UI | A remote code execution (RCE) vulnerability exists in fastjson 1.2.68 through 1. | |
|
66
|
CVE-2026-115346 |
8.1 | 0.0066 | NET NO AUTH NO UI | The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is v | |
|
66
|
CVE-2026-85799 |
8.1 | 0.0066 | NET NO AUTH NO UI | Use after free in Network Policy Server (NPS) allows an unauthorized attacker to | |
|
66
|
CVE-2026-85926 |
8.1 | 0.0066 | NET NO AUTH NO UI | Use after free in Windows Secure Socket Tunneling Protocol (SSTP) allows an unau | |
|
66
|
CVE-2026-70013 |
8.1 | 0.0066 | NET NO AUTH NO UI | Use after free in Windows iSCSI allows an unauthorized attacker to execute code | |
|
65
|
CVE-2026-15563 |
7.4 | 0.0066 | NET NO AUTH NO UI | A flaw was found in EAP's IIOP. The listener's NameService would accept bind ope | |
|
64
|
CVE-2026-56171 |
7.1 | 0.0066 | NET NO AUTH LOW CX | Exposure of private personal information to an unauthorized actor in Windows RDP | |
|
55
|
CVE-2026-83754 |
7.5 | 0.0066 | NET NO AUTH | Heap-based buffer overflow in OpenSSH for Windows allows an unauthorized attacke | |
|
55
|
CVE-2026-116167 |
7.6 | 0.0066 | NET NO AUTH | SiYuan from 2.9.0 before 3.8.7 contains a cross-site scripting vulnerability in |