Hunt List
8,525 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2023-0758 |
9.8 | 0.0061 | NET NO AUTH LOW CX NO UI | A vulnerability was found in glorylion JFinalOA 1.0.2 and classified as critical | |
|
80
|
CVE-2026-72550 |
9.8 | 0.0061 | NET NO AUTH LOW CX NO UI | An SQL injection vulnerability in Friendica through the 2026.08-dev branch allow | |
|
80
|
CVE-2026-72599 |
9.8 | 0.0061 | NET NO AUTH LOW CX NO UI | An SQL injection vulnerability in e107 2.4.0 allows unauthenticated remote attac | |
|
79
|
CVE-2026-65317 |
9.2 | 0.0061 | NET NO AUTH LOW CX NO UI | Verba RAG application version 2.1.3 contains a server-side request forgery vulne | |
|
78
|
CVE-2026-13207 |
8.7 | 0.0061 | NET NO AUTH LOW CX NO UI | FUXA versions 1.3.1 and prior contain an authentication bypass vulnerability via | |
|
78
|
CVE-2026-71980 |
8.7 | 0.0061 | NET NO AUTH LOW CX NO UI | Belledonne Communications bcg729 through 1.1.2 contains an out-of-bounds read vu | |
|
78
|
CVE-2026-75935 |
8.7 | 0.0061 | NET NO AUTH LOW CX NO UI | Uncontrolled memory allocation in the binary Ion stream cursor in Amazon ion-jav | |
|
78
|
CVE-2026-75936 |
8.7 | 0.0061 | NET NO AUTH LOW CX NO UI | Improper handling of highly compressed data in the GZIP auto-decompression handl | |
|
78
|
CVE-2026-13084 |
8.7 | 0.0061 | NET NO AUTH LOW CX NO UI | A null pointer dereference vulnerability in WatchGuard Fireware OS may allow a r | |
|
78
|
CVE-2026-11404 |
8.7 | 0.0061 | NET NO AUTH LOW CX NO UI | Cesanta Mongoose before 7.22 contains an out-of-bounds read in the built-in TLS | |
|
78
|
CVE-2026-67184 |
8.7 | 0.0061 | NET NO AUTH LOW CX NO UI | TinyWeb through 0.0.8 contains a null pointer dereference vulnerability that all | |
|
77
|
CVE-2026-50528 |
8.2 | 0.0061 | NET NO AUTH LOW CX NO UI | Incorrect authorization in .NET allows an unauthorized attacker to bypass a secu | |
|
77
|
CVE-2026-15352 |
8.2 | 0.0061 | NET NO AUTH LOW CX NO UI | A vulnerability exists in the Health & Safety (HS) application of NASA's Core Fl | |
|
77
|
CVE-2026-18064 |
8.2 | 0.0061 | NET NO AUTH LOW CX NO UI | An incomplete fix for CVE-2026-15352 in the NASA core Flight System (cFS) Healt | |
|
75
|
CVE-2026-46601 |
7.5 | 0.0061 | NET NO AUTH LOW CX NO UI | The webp decoder can panic when processing a VP8 chunk with dimensions that do n | |
|
75
|
CVE-2026-46602 |
7.5 | 0.0061 | NET NO AUTH LOW CX NO UI | The TIFF decoder does not set a limit on the size of tiles in tiled images, perm | |
|
75
|
CVE-2026-46604 |
7.5 | 0.0061 | NET NO AUTH LOW CX NO UI | The TIFF decoder can panic when decoding an invalid image with an out-of-bounds | |
|
75
|
CVE-2026-56018 |
7.5 | 0.0061 | NET NO AUTH LOW CX NO UI | JavaScript::Minifier::XS versions before 0.16 for Perl leak memory on every call | |
|
75
|
CVE-2026-13708 |
7.5 | 0.0061 | NET NO AUTH LOW CX NO UI | Imager::File::JPEG versions before 1.003 for Perl leak heap memory when reading | |
|
75
|
CVE-2026-49146 |
7.5 | 0.0061 | NET NO AUTH LOW CX NO UI | App::Ack versions before 3.10.0 for Perl allow memory exhaustion via an unbounde | |
|
75
|
CVE-2026-59724 |
7.5 | 0.0061 | NET NO AUTH LOW CX NO UI | Socket.IO enables bidirectional and low-latency communication for every platform | |
|
75
|
CVE-2026-13397 |
7.5 | 0.0061 | NET NO AUTH LOW CX NO UI | HTML::Bare versions through 0.04 for Perl will hang in an infinite loop when par | |
|
75
|
CVE-2026-13401 |
7.5 | 0.0061 | NET NO AUTH LOW CX NO UI | XML::Bare versions through 0.53 for Perl will hang in an infinite loop when pars | |
|
75
|
CVE-2026-52856 |
7.5 | 0.0061 | NET NO AUTH LOW CX NO UI | Wings is the server control plane for Pterodactyl, a free, open-source game serv | |
|
75
|
CVE-2026-17510 |
7.5 | 0.0061 | NET NO AUTH LOW CX NO UI | Crypt::OpenSSL::PKCS12 versions before 1.98 for Perl allow a NULL pointer derefe | |
|
75
|
CVE-2026-73561 |
7.5 | 0.0061 | NET NO AUTH LOW CX NO UI | Hub is a Node.js WebSocket server and client with added features. Prior to 0.2.1 | |
|
75
|
CVE-2026-52829 |
7.5 | 0.0061 | NET NO AUTH LOW CX NO UI | ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, an unauthenticat | |
|
75
|
CVE-2026-63495 |
7.5 | 0.0061 | NET NO AUTH LOW CX NO UI | Libevent is an event notification library. From 2.2.0-alpha-dev until 2.2.2-alph | |
|
75
|
CVE-2023-25747 |
7.5 | 0.0061 | NET NO AUTH LOW CX NO UI | A potential use-after-free in libaudio was fixed by disabling the AAudio backend | |
|
75
|
CVE-2026-67422 |
7.5 | 0.0061 | NET NO AUTH LOW CX NO UI | pymdown-extensions is a collection of extensions for the Python Markdown library | |
|
75
|
CVE-2026-72582 |
7.5 | 0.0061 | NET NO AUTH LOW CX NO UI | A NULL pointer dereference vulnerability in fastschema through v0.15.1 allows an | |
|
66
|
CVE-2026-58293 |
8.1 | 0.0061 | NET NO AUTH NO UI | External control of file name or path in Microsoft Edge (Chromium-based) allows | |
|
64
|
CVE-2026-66881 |
7.0 | 0.0061 | NET NO AUTH LOW CX | Relative Path Traversal vulnerability in livebook-dev livebook allows an attacke | |
|
57
|
CVE-2026-58285 |
8.3 | 0.0061 | NET NO AUTH | Access of resource using incompatible type ('type confusion') in Microsoft Edge | |
|
57
|
CVE-2026-58287 |
8.3 | 0.0061 | NET NO AUTH | Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacke | |
|
57
|
CVE-2026-58288 |
8.3 | 0.0061 | NET NO AUTH | Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacke | |
|
57
|
CVE-2026-58596 |
8.3 | 0.0061 | NET NO AUTH | Untrusted pointer dereference in Microsoft Edge (Chromium-based) allows an unaut | |
|
55
|
CVE-2026-57975 |
7.5 | 0.0061 | NET NO AUTH | Access of resource using incompatible type ('type confusion') in Microsoft Edge | |
|
55
|
CVE-2026-57984 |
7.5 | 0.0061 | NET NO AUTH | Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacke | |
|
55
|
CVE-2026-57986 |
7.5 | 0.0061 | NET NO AUTH | Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacke | |
|
55
|
CVE-2026-57992 |
7.5 | 0.0061 | NET NO AUTH | Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacke | |
|
55
|
CVE-2026-58276 |
7.5 | 0.0061 | NET NO AUTH | Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacke | |
|
55
|
CVE-2026-58294 |
7.5 | 0.0061 | NET NO AUTH | Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacke | |
|
55
|
CVE-2026-59117 |
7.5 | 0.0061 | NET NO AUTH | Integer overflow or wraparound in Windows Terminal allows an unauthorized attack | |
|
55
|
CVE-2026-66315 |
7.5 | 0.0061 | NET NO AUTH | Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacke | |
|
55
|
CVE-2026-105592 |
7.5 | 0.0061 | NET NO AUTH | Heap-based buffer overflow in Microsoft Office Access allows an unauthorized att | |
|
55
|
CVE-2026-105714 |
7.5 | 0.0061 | NET NO AUTH | Heap-based buffer overflow in Microsoft Office Access allows an unauthorized att | |
|
55
|
CVE-2026-105715 |
7.5 | 0.0061 | NET NO AUTH | Integer overflow or wraparound in Microsoft Office Word allows an unauthorized a | |
|
55
|
CVE-2026-69397 |
7.5 | 0.0061 | NET NO AUTH | Use after free in OpenSSH for Windows allows an unauthorized attacker to execute | |
|
55
|
CVE-2026-69607 |
7.5 | 0.0061 | NET NO AUTH | Use after free in Windows Deployment Services allows an unauthorized attacker to |