Hunt List
8,523 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-18452 |
10.0 | 0.0063 | NET NO AUTH LOW CX NO UI | DMS+ (Non-Mobile) developed by Rich Source has a Use of Hard-coded Credentials v | |
|
80
|
CVE-2025-11367 |
10.0 | 0.0063 | NET NO AUTH LOW CX NO UI | The N-central Software Probe < 2025.4 is vulnerable to Remote Code Execution via | |
|
80
|
CVE-2026-40351 |
9.8 | 0.0063 | NET NO AUTH LOW CX NO UI | FastGPT is an AI Agent building platform. In versions prior to 4.14.9.5, the pas | |
|
80
|
CVE-2026-53483 |
9.8 | 0.0063 | NET NO AUTH LOW CX NO UI | Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release ver | |
|
79
|
CVE-2026-14162 |
9.3 | 0.0063 | NET NO AUTH LOW CX NO UI | Hospital Queuing Management developed by Advantech has a Sensitive Data Exposure | |
|
79
|
CVE-2026-34099 |
9.3 | 0.0063 | NET NO AUTH LOW CX NO UI | Guardian language-system passes the id GET parameter directly into an unsanitize | |
|
79
|
CVE-2026-53790 |
9.2 | 0.0063 | NET NO AUTH LOW CX NO UI | rsync before 3.5.0 contains multiple command and argument injection vulnerabilit | |
|
79
|
CVE-2026-35030 |
9.4 | 0.0063 | NET NO AUTH LOW CX NO UI | LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) fo | |
|
79
|
CVE-2026-35090 |
9.3 | 0.0063 | NET NO AUTH LOW CX NO UI | In Slican telephone exchanges it is possible to manage the control panel remotel | |
|
78
|
CVE-2026-7834 |
8.9 | 0.0063 | NET NO AUTH LOW CX NO UI | A security vulnerability has been detected in EFM ipTIME NAS1dual 1.5.24. This i | |
|
78
|
CVE-2026-112332 |
8.7 | 0.0063 | NET NO AUTH LOW CX NO UI | Motor.NET before 0.19.0 contains an uncaught exception vulnerability in JsonNetD | |
|
78
|
CVE-2026-50203 |
9.1 | 0.0063 | NET NO AUTH LOW CX NO UI | A path traversal in the SFTP provider (`SFTPHook.retrieve_directory` / `SFTPOper | |
|
78
|
CVE-2026-48031 |
9.1 | 0.0063 | NET NO AUTH LOW CX NO UI | go-base is a Go RESTful API Boilerplate template with JWT Authentication, backed | |
|
78
|
CVE-2026-45230 |
8.8 | 0.0063 | NET NO AUTH LOW CX NO UI | DumbAssets through 1.0.11 contains a path traversal vulnerability in the POST /a | |
|
78
|
CVE-2026-108358 |
8.8 | 0.0063 | NET NO AUTH LOW CX NO UI | PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. | |
|
77
|
CVE-2026-114397 |
8.3 | 0.0063 | NET NO AUTH LOW CX NO UI | Trudesk through 1.2.11 contains a missing authentication vulnerability in debug | |
|
76
|
CVE-2026-13762 |
7.9 | 0.0063 | NET NO AUTH LOW CX NO UI | Inconsistent interpretation of HTTP/2 requests in Amazon CloudFront with AWS WAF | |
|
75
|
CVE-2026-26307 |
7.5 | 0.0063 | NET NO AUTH LOW CX NO UI | Gitea versions before 1.25.5 do not enforce a timeout on git grep searches, allo | |
|
75
|
CVE-2026-46585 |
7.5 | 0.0063 | NET NO AUTH LOW CX NO UI | Improper Input Validation, Authorization Bypass Through User-Controlled Key vuln | |
|
75
|
CVE-2026-14895 |
7.5 | 0.0063 | NET NO AUTH LOW CX NO UI | String::Util versions before 1.36 for Perl are susceptible to a regular expressi | |
|
75
|
CVE-2026-49866 |
7.5 | 0.0063 | NET NO AUTH LOW CX NO UI | libp2p is a JavaScript Implementation of libp2p networking stack. Prior to 16.0. | |
|
75
|
CVE-2026-56669 |
7.5 | 0.0063 | NET NO AUTH LOW CX NO UI | Elysia is a Typescript framework for request validation, type inference, OpenAPI | |
|
75
|
CVE-2026-60081 |
7.5 | 0.0063 | NET NO AUTH LOW CX NO UI | DBI::ProfileData versions before 1.651 for Perl do not limit the path index. Th | |
|
75
|
CVE-2026-14741 |
7.5 | 0.0063 | NET NO AUTH LOW CX NO UI | HTTP::Date versions before 6.08 for Perl allow CPU exhaustion via polynomial reg | |
|
75
|
CVE-2026-54638 |
7.5 | 0.0063 | NET NO AUTH LOW CX NO UI | gotd/td is a T Telegram MTProto API client in Go. Prior to 0.145.1, proto.Unencr | |
|
75
|
CVE-2026-60074 |
7.5 | 0.0063 | NET NO AUTH LOW CX NO UI | Date::Manip versions through 7.00 for Perl return corrupted dates via non-ASCII | |
|
75
|
CVE-2026-69185 |
7.5 | 0.0063 | NET NO AUTH LOW CX NO UI | Socket.IO enables bidirectional and low-latency communication for every platform | |
|
75
|
CVE-2026-71488 |
7.5 | 0.0063 | NET NO AUTH LOW CX NO UI | league/commonmark is a PHP library for parsing and rendering CommonMark Markdown | |
|
75
|
CVE-2026-19566 |
7.5 | 0.0063 | NET NO AUTH LOW CX NO UI | Net::CIDR::Set versions before 0.23 for Perl allow memory exhaustion and malform | |
|
75
|
CVE-2026-73493 |
7.5 | 0.0063 | NET NO AUTH LOW CX NO UI | Http4s (http4s-blaze-server) is a minimal, idiomatic Scala interface for HTTP se | |
|
75
|
CVE-2026-74757 |
7.5 | 0.0063 | NET NO AUTH LOW CX NO UI | Uncontrolled resource allocation in the mcpack2pb component in Apache bRPC (vers | |
|
75
|
CVE-2026-78048 |
7.5 | 0.0063 | NET NO AUTH LOW CX NO UI | A reachable-assertion flaw in the HPACK header-compression decoder of the HTTP/2 | |
|
75
|
CVE-2026-72203 |
7.5 | 0.0063 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: ntfs: skip | |
|
75
|
CVE-2026-16323 |
7.5 | 0.0063 | NET NO AUTH LOW CX NO UI | Execution after redirect (EAR) vulnerability in FuyaWeb Internet and Informatics | |
|
75
|
CVE-2026-29168 |
7.3 | 0.0063 | NET NO AUTH LOW CX NO UI | Allocation of Resources Without Limits or Throttling vulnerability in Apache HTT | |
|
75
|
CVE-2023-22839 |
7.5 | 0.0063 | NET NO AUTH LOW CX NO UI | On BIG-IP versions 17.0.x before 17.0.0.2, 16.1.x before 16.1.3.3, 15.1.x before | |
|
75
|
CVE-2023-36521 |
7.5 | 0.0063 | NET NO AUTH LOW CX NO UI | A vulnerability has been identified in SIMATIC MV540 H (All versions < V3.3.4), | |
|
75
|
CVE-2026-46592 |
7.5 | 0.0063 | NET NO AUTH LOW CX NO UI | Improper Input Validation, Unintended Proxy or Intermediary ('Confused Deputy') | |
|
69
|
CVE-2026-71319 |
9.6 | 0.0063 | NET NO AUTH LOW CX | Nuxt is an open-source web development framework for Vue.js. Prior to 3.3.1, Nux | |
|
66
|
CVE-2026-69802 |
8.1 | 0.0063 | NET NO AUTH NO UI | Weak authentication in Network Device Enrollment Service (NDES) allows an unauth | |
|
66
|
CVE-2026-79889 |
8.1 | 0.0063 | NET NO AUTH NO UI | Vulnerabilities in multiple web interface endpoints of AOS-8 devices could allow | |
|
66
|
CVE-2026-66374 |
8.1 | 0.0062 | NET NO AUTH NO UI | Knot Resolver before 6.4.1 allows remote code execution via a heap-based buffer | |
|
55
|
CVE-2026-69995 |
7.5 | 0.0063 | NET NO AUTH | Use after free in Remote Desktop Client allows an unauthorized attacker to execu | |
|
55
|
CVE-2026-69996 |
7.5 | 0.0063 | NET NO AUTH | Use after free in Remote Desktop Client allows an unauthorized attacker to execu | |
|
55
|
CVE-2026-69997 |
7.5 | 0.0063 | NET NO AUTH | Use after free in Remote Desktop Client allows an unauthorized attacker to execu | |
|
55
|
CVE-2026-69998 |
7.5 | 0.0063 | NET NO AUTH | Use after free in Remote Desktop Client allows an unauthorized attacker to execu | |
|
55
|
CVE-2026-70004 |
7.5 | 0.0063 | NET NO AUTH | Use after free in Remote Desktop Client allows an unauthorized attacker to execu | |
|
55
|
CVE-2026-70012 |
7.5 | 0.0063 | NET NO AUTH | Use after free in Remote Desktop Client allows an unauthorized attacker to execu | |
|
55
|
CVE-2026-83856 |
7.5 | 0.0063 | NET NO AUTH | Out-of-bounds read in Windows Event Logging Service allows an unauthorized attac | |
|
55
|
CVE-2026-105599 |
7.5 | 0.0062 | NET NO AUTH | Heap-based buffer overflow in Microsoft Office PowerPoint allows an unauthorized |