Hunt List
8,523 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-113744 |
10.0 | 0.0062 | NET NO AUTH LOW CX NO UI | A security vulnerability has been detected in Tenda AC19 16.03.10.07. The impact | |
|
80
|
CVE-2026-16834 |
9.8 | 0.0062 | NET NO AUTH LOW CX NO UI | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to c | |
|
80
|
CVE-2026-110186 |
9.8 | 0.0062 | NET NO AUTH LOW CX NO UI | IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker to execute a | |
|
80
|
CVE-2026-49257 |
10.0 | 0.0062 | NET NO AUTH LOW CX NO UI | mcp-pinot is a Python-based Model Context Protocol (MCP) server for interacting | |
|
80
|
CVE-2026-50755 |
9.8 | 0.0062 | NET NO AUTH LOW CX NO UI | An issue in DayuanJiang next-ai-draw-io 0.4.13 allows a remote attacker to obtai | |
|
80
|
CVE-2026-16395 |
9.8 | 0.0062 | NET NO AUTH LOW CX NO UI | Integer overflow in the Audio/Video component. This vulnerability was fixed in F | |
|
80
|
CVE-2026-16402 |
9.8 | 0.0062 | NET NO AUTH LOW CX NO UI | Integer overflow in the Graphics: ImageLib component. This vulnerability was fix | |
|
80
|
CVE-2026-16408 |
9.8 | 0.0062 | NET NO AUTH LOW CX NO UI | Integer overflow in the Audio/Video: Playback component. This vulnerability was | |
|
80
|
CVE-2026-54489 |
9.8 | 0.0062 | NET NO AUTH LOW CX NO UI | Dell Virtual Storage Integrator for VMware vSphere Client, versions prior to 10. | |
|
79
|
CVE-2026-116747 |
9.2 | 0.0062 | NET NO AUTH LOW CX NO UI | Kener 3.0.0 before 4.1.10 contains an authentication bypass vulnerability that a | |
|
79
|
CVE-2026-66794 |
9.3 | 0.0062 | NET NO AUTH LOW CX NO UI | A flaw was found in the `cluster-proxy-addon` component of Multicluster Engine f | |
|
78
|
CVE-2026-47659 |
8.7 | 0.0062 | NET NO AUTH LOW CX NO UI | Pathling is a set of tools that make it easier to use FHIR and clinical terminol | |
|
78
|
CVE-2026-47661 |
8.7 | 0.0062 | NET NO AUTH LOW CX NO UI | Pathling is a set of tools that make it easier to use FHIR and clinical terminol | |
|
78
|
CVE-2026-69109 |
8.7 | 0.0062 | NET NO AUTH LOW CX NO UI | A vulnerability has been identified in Siemens License Server (SLS) (All version | |
|
78
|
CVE-2026-59935 |
8.7 | 0.0062 | NET NO AUTH LOW CX NO UI | pypdf is a free and open-source pure-python PDF library. Prior to 6.14.2, an att | |
|
78
|
CVE-2026-59936 |
8.7 | 0.0062 | NET NO AUTH LOW CX NO UI | pypdf is a free and open-source pure-python PDF library. Prior to 6.14.1, an att | |
|
78
|
CVE-2026-7719 |
8.9 | 0.0062 | NET NO AUTH LOW CX NO UI | A security flaw has been discovered in Totolink WA300 5.2cu.7112_B20190227. The | |
|
78
|
CVE-2026-53918 |
8.8 | 0.0062 | NET NO AUTH LOW CX NO UI | odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. P | |
|
78
|
CVE-2026-40062 |
8.7 | 0.0062 | NET NO AUTH LOW CX NO UI | A path Traversal vulnerability exists in Ziostation2 v2.9.8.7 and earlier. A rem | |
|
77
|
CVE-2026-8468 |
8.2 | 0.0062 | NET NO AUTH LOW CX NO UI | Allocation of Resources Without Limits or Throttling vulnerability in plug_proje | |
|
76
|
CVE-2026-65600 |
7.8 | 0.0062 | NET NO AUTH LOW CX NO UI | Traefik versions <= v2.11.51, >= v3.6.0 <= v3.6.22, and >= v3.7.0 <= v3.7.6 cont | |
|
75
|
CVE-2026-14519 |
7.5 | 0.0062 | NET NO AUTH LOW CX NO UI | IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0. | |
|
75
|
CVE-2026-12942 |
7.5 | 0.0062 | NET NO AUTH LOW CX NO UI | IBM Langflow OSS 1.0.0 through 1.10.1 could allow a remote attacker to traverse | |
|
75
|
CVE-2026-60023 |
7.5 | 0.0062 | NET NO AUTH LOW CX NO UI | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apac | |
|
75
|
CVE-2026-10595 |
7.5 | 0.0062 | NET NO AUTH LOW CX NO UI | A path traversal vulnerability exists in parisneo/lollms version 2.1.0, specific | |
|
75
|
CVE-2026-44160 |
7.5 | 0.0062 | NET NO AUTH LOW CX NO UI | Fluentd collects events from various data sources and writes them to files, RDBM | |
|
75
|
CVE-2026-52844 |
7.5 | 0.0062 | NET NO AUTH LOW CX NO UI | Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4 | |
|
75
|
CVE-2026-25038 |
7.5 | 0.0062 | NET NO AUTH LOW CX NO UI | Gitea 1.26.2 allows unauthorized users to access labels of private organizations | |
|
75
|
CVE-2026-60000 |
7.5 | 0.0062 | NET NO AUTH LOW CX NO UI | sshd in OpenSSH before 10.4 allows remote attackers to cause a denial of service | |
|
68
|
CVE-2026-55191 |
8.7 | 0.0062 | NET NO AUTH LOW CX | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0 | |
|
68
|
CVE-2026-55194 |
8.7 | 0.0062 | NET NO AUTH LOW CX | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0 | |
|
68
|
CVE-2026-108428 |
8.8 | 0.0062 | NET NO AUTH LOW CX | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attac | |
|
68
|
CVE-2026-108429 |
8.8 | 0.0062 | NET NO AUTH LOW CX | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attac | |
|
68
|
CVE-2026-108430 |
8.8 | 0.0062 | NET NO AUTH LOW CX | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attac | |
|
68
|
CVE-2026-108431 |
8.8 | 0.0062 | NET NO AUTH LOW CX | Stack-based buffer overflow in Microsoft Office Word allows an unauthorized atta | |
|
68
|
CVE-2026-108432 |
8.8 | 0.0062 | NET NO AUTH LOW CX | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attac | |
|
68
|
CVE-2026-108437 |
8.8 | 0.0062 | NET NO AUTH LOW CX | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attac | |
|
68
|
CVE-2026-108439 |
8.8 | 0.0062 | NET NO AUTH LOW CX | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attac | |
|
68
|
CVE-2026-108440 |
8.8 | 0.0062 | NET NO AUTH LOW CX | Stack-based buffer overflow in Microsoft Office Word allows an unauthorized atta | |
|
68
|
CVE-2026-108441 |
8.8 | 0.0062 | NET NO AUTH LOW CX | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attac | |
|
68
|
CVE-2026-108442 |
8.8 | 0.0062 | NET NO AUTH LOW CX | Use after free in Microsoft Office Word allows an unauthorized attacker to execu | |
|
68
|
CVE-2026-108443 |
8.8 | 0.0062 | NET NO AUTH LOW CX | Off-by-one error in Microsoft Office Word allows an unauthorized attacker to exe | |
|
68
|
CVE-2026-108444 |
8.8 | 0.0062 | NET NO AUTH LOW CX | Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker t | |
|
68
|
CVE-2026-108445 |
8.8 | 0.0062 | NET NO AUTH LOW CX | Stack-based buffer overflow in Microsoft Office Word allows an unauthorized atta | |
|
68
|
CVE-2026-108446 |
8.8 | 0.0062 | NET NO AUTH LOW CX | Use after free in Microsoft Office Excel allows an unauthorized attacker to exec | |
|
68
|
CVE-2026-108447 |
8.8 | 0.0062 | NET NO AUTH LOW CX | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attac | |
|
68
|
CVE-2026-108449 |
8.8 | 0.0062 | NET NO AUTH LOW CX | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attac | |
|
68
|
CVE-2026-108450 |
8.8 | 0.0062 | NET NO AUTH LOW CX | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attac | |
|
68
|
CVE-2026-108451 |
8.8 | 0.0062 | NET NO AUTH LOW CX | Numeric truncation error in Microsoft Office Word allows an unauthorized attacke | |
|
66
|
CVE-2026-63633 |
7.7 | 0.0062 | NET NO AUTH LOW CX | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0 |