Hunt List
8,520 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
90
|
CVE-2026-97785 |
10.0 | 0.0065 | NET NO AUTH LOW CX NO UI | 1 PoC | Improper authentication in AAD App Proxy allows an unauthorized attacker to elev |
|
80
|
CVE-2026-10666 |
9.8 | 0.0065 | NET NO AUTH LOW CX NO UI | parse_ipv4() in subsys/net/ip/utils.c (reached via net_ipaddr_parse() for string | |
|
80
|
CVE-2026-114383 |
10.0 | 0.0065 | NET NO AUTH LOW CX NO UI | A weakness has been identified in TOTOLINK EX200 5.2.3c.7200. This impacts the f | |
|
80
|
CVE-2026-25470 |
10.0 | 0.0065 | NET NO AUTH LOW CX NO UI | Unauthenticated Remote Code Execution (RCE) in ACPT (Pro) - Custom Post Types Pl | |
|
80
|
CVE-2026-26292 |
9.8 | 0.0065 | NET NO AUTH LOW CX NO UI | Gitea versions before 1.25.5 do not use the migration HTTP transport for LFS pus | |
|
80
|
CVE-2026-72472 |
9.8 | 0.0065 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: nfs: use nf | |
|
80
|
CVE-2026-89788 |
9.8 | 0.0065 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix | |
|
80
|
CVE-2026-57881 |
9.8 | 0.0065 | NET NO AUTH LOW CX NO UI | An unauthenticated stack-based buffer overflow vulnerability exists in vlsvr in | |
|
80
|
CVE-2026-58586 |
9.8 | 0.0065 | NET NO AUTH LOW CX NO UI | Image::WebP versions before 0.3.0 for Perl bundle a vulnerable version of libweb | |
|
80
|
CVE-2026-67967 |
9.8 | 0.0065 | NET NO AUTH LOW CX NO UI | Buffer Overflow vulnerability in Tenda W20E V16.01.0.6(2782) allows an attacker | |
|
80
|
CVE-2026-41553 |
10.0 | 0.0065 | NET NO AUTH LOW CX NO UI | PDF Export Module used in DHTMLX's products Gantt and Scheduler is vulnerable to | |
|
80
|
CVE-2026-8507 |
9.8 | 0.0065 | NET NO AUTH LOW CX NO UI | Crypt::OpenSSL::PKCS12 versions through 1.94 for Perl have out-of-bounds (OOB) w | |
|
80
|
CVE-2026-33943 |
9.8 | 0.0065 | NET NO AUTH LOW CX NO UI | Happy DOM is a JavaScript implementation of a web browser without its graphical | |
|
80
|
CVE-2026-10025 |
9.8 | 0.0065 | NET NO AUTH LOW CX NO UI | IBM QRadar 7.6.0.0 through 7.6.0.1, and 7.5.0 through 7.5.0 UP 15 Interim Fix 00 | |
|
80
|
CVE-2026-40911 |
10.0 | 0.0065 | NET NO AUTH LOW CX NO UI | WWBN AVideo is an open source video platform. In versions 29.0 and prior, the YP | |
|
79
|
CVE-2026-52830 |
9.4 | 0.0065 | NET NO AUTH LOW CX NO UI | fast-mcp-telegram is a Telegram MCP Server. Prior to 0.19.1, fast-mcp-telegram v | |
|
79
|
CVE-2026-40702 |
9.3 | 0.0065 | NET NO AUTH LOW CX NO UI | WebSocket endpoints lack proper authentication mechanisms, enabling attackers to | |
|
78
|
CVE-2026-43897 |
8.7 | 0.0065 | NET NO AUTH LOW CX NO UI | Link Preview JS extracts web links information. Prior to 4.0.1, the library did | |
|
78
|
CVE-2026-56015 |
9.1 | 0.0065 | NET NO AUTH LOW CX NO UI | Net::IP::LPM versions before 1.11 for Perl allow a heap out-of-bounds read via a | |
|
78
|
CVE-2026-60082 |
9.1 | 0.0065 | NET NO AUTH LOW CX NO UI | DBI versions before 1.651 for Perl do not enforce statement handle consistency w | |
|
78
|
CVE-2026-57073 |
9.1 | 0.0065 | NET NO AUTH LOW CX NO UI | HTML::Bare versions through 0.04 for Perl have an unbounded character lookahead. | |
|
78
|
CVE-2024-58368 |
8.7 | 0.0065 | NET NO AUTH LOW CX NO UI | SurrealDB versions before 1.1.0 fail to properly parse the ID, DB, and NS header | |
|
78
|
CVE-2026-71479 |
9.1 | 0.0065 | NET NO AUTH LOW CX NO UI | New API is a large language mode (LLM) gateway and artificial intelligence (AI) | |
|
78
|
CVE-2026-42786 |
8.7 | 0.0065 | NET NO AUTH LOW CX NO UI | Allocation of Resources Without Limits or Throttling vulnerability in mtrudel ba | |
|
78
|
CVE-2026-35505 |
8.7 | 0.0065 | NET NO AUTH LOW CX NO UI | An unauthenticated remote attacker can repeatedly send crafted connection reques | |
|
78
|
CVE-2026-50254 |
8.7 | 0.0065 | NET NO AUTH LOW CX NO UI | An unauthenticated remote attacker can repeatedly send a single crafted connecti | |
|
77
|
CVE-2026-56111 |
8.3 | 0.0065 | NET NO AUTH LOW CX NO UI | Marlin Firmware through 2.1.2.7, fixed in commit 1f255d1, when built with MESH_B | |
|
77
|
CVE-2026-67216 |
8.2 | 0.0065 | NET NO AUTH LOW CX NO UI | cJSON through 1.7.19 contains an inefficient algorithmic complexity flaw in cJSO | |
|
75
|
CVE-2026-43866 |
7.3 | 0.0065 | NET NO AUTH LOW CX NO UI | Deserialization of Untrusted Data vulnerability in Apache Camel, Apache Camel JM | |
|
75
|
CVE-2026-65432 |
7.5 | 0.0065 | NET NO AUTH LOW CX NO UI | Apache CXF reads a top-level WSDL through its hardened StaxUtils path, which dis | |
|
75
|
CVE-2026-53404 |
7.3 | 0.0065 | NET NO AUTH LOW CX NO UI | Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat's re | |
|
75
|
CVE-2026-59928 |
7.5 | 0.0065 | NET NO AUTH LOW CX NO UI | Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, | |
|
75
|
CVE-2026-54425 |
7.5 | 0.0065 | NET NO AUTH LOW CX NO UI | Uncontrolled recursion in the HTTP/2 HPACK decoder in Apache bRPC before 1.18.0 | |
|
75
|
CVE-2023-25743 |
7.5 | 0.0065 | NET NO AUTH LOW CX NO UI | A lack of in app notification for entering fullscreen mode could have lead to a | |
|
75
|
CVE-2026-74758 |
7.5 | 0.0065 | NET NO AUTH LOW CX NO UI | A heap use-after-free in the RTMP protocol component of Apache bRPC (versions < | |
|
75
|
CVE-2026-20191 |
7.5 | 0.0065 | NET NO AUTH LOW CX NO UI | A vulnerability in Cisco Catalyst Center could allow an unauthenticated, remote | |
|
75
|
CVE-2026-69152 |
7.5 | 0.0065 | NET NO AUTH LOW CX NO UI | The brace-expansion library generates arbitrary strings containing a common pref | |
|
75
|
CVE-2026-72691 |
7.5 | 0.0065 | NET NO AUTH LOW CX NO UI | An authentication bypass vulnerability in OpenSignLabs opensignserver through 2. | |
|
75
|
CVE-2026-59978 |
7.5 | 0.0065 | NET NO AUTH LOW CX NO UI | AdminNeo is a full-featured database management tool written in PHP. From 4.6.2 | |
|
75
|
CVE-2026-42498 |
7.3 | 0.0065 | NET NO AUTH LOW CX NO UI | Exposure of HTTP Authentication Header to unexpected hosts during WebSocket auth | |
|
69
|
CVE-2026-9195 |
9.3 | 0.0065 | NET NO AUTH LOW CX | A cross-site scripting vulnerability in the Query Console of Progress MarkLogic | |
|
68
|
CVE-2026-86929 |
8.8 | 0.0065 | NET NO AUTH LOW CX | An out-of-bounds write issue was addressed with improved bounds checking. This i | |
|
68
|
CVE-2023-0698 |
8.8 | 0.0065 | NET NO AUTH LOW CX | Out of bounds read in WebRTC in Google Chrome prior to 110.0.5481.77 allowed a r | |
|
68
|
CVE-2026-57983 |
8.7 | 0.0065 | NET NO AUTH NO UI | Improper authorization in Microsoft Edge (Chromium-based) allows an unauthorized | |
|
68
|
CVE-2026-62836 |
8.7 | 0.0065 | NET NO AUTH NO UI | Improper restriction of communication channel to intended endpoints in Azure SQL | |
|
68
|
CVE-2026-64830 |
8.7 | 0.0065 | NET NO AUTH LOW CX | FFmpeg versions 2.1 through 8.1.2 contains a heap buffer overflow vulnerability | |
|
65
|
CVE-2026-34647 |
7.4 | 0.0065 | NET NO AUTH LOW CX | Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2 | |
|
65
|
CVE-2026-45539 |
7.4 | 0.0065 | NET NO AUTH LOW CX | Microsoft APM is an open-source, community-driven dependency manager for AI agen | |
|
65
|
CVE-2026-41107 |
7.4 | 0.0065 | NET NO AUTH LOW CX | External control of file name or path in Microsoft Edge (Chromium-based) allows | |
|
65
|
CVE-2026-83511 |
7.4 | 0.0065 | NET NO AUTH NO UI | Weak authentication in Active Directory Federation Services (AD FS) allows an un |