Hunt List
8,525 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
89
|
CVE-2026-54390 |
9.3 | 0.0060 | NET NO AUTH LOW CX NO UI | 1 PoC | JTL Shop versions 5.2.0 through 5.7.1 contains a server-side template injection |
|
80
|
CVE-2026-98959 |
9.8 | 0.0061 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: btrfs: fix | |
|
80
|
CVE-2026-56188 |
9.8 | 0.0061 | NET NO AUTH LOW CX NO UI | Concurrent execution using shared resource with improper synchronization ('race | |
|
80
|
CVE-2026-4767 |
9.8 | 0.0061 | NET NO AUTH LOW CX NO UI | Missing authentication for critical function vulnerability in TR7 Cyber Defens | |
|
80
|
CVE-2026-9695 |
9.8 | 0.0061 | NET NO AUTH LOW CX NO UI | An Improper Authentication vulnerability affecting DELMIA Apriso from Release 20 | |
|
80
|
CVE-2026-62873 |
9.8 | 0.0061 | NET NO AUTH LOW CX NO UI | Improper verification of cryptographic signature in Microsoft 365 Admin Center a | |
|
80
|
CVE-2026-28008 |
9.8 | 0.0061 | NET NO AUTH LOW CX NO UI | Unauthenticated Broken Authentication in OAuth Single Sign On – SSO (OAuth Clien | |
|
80
|
CVE-2026-66465 |
9.8 | 0.0061 | NET NO AUTH LOW CX NO UI | Unauthenticated Broken Authentication in Cartify <= 1.3.0.1 versions. | |
|
80
|
CVE-2026-74001 |
9.8 | 0.0061 | NET NO AUTH LOW CX NO UI | Unauthenticated Broken Authentication in User Registration & Membership Pro <= 5 | |
|
80
|
CVE-2026-82116 |
9.8 | 0.0061 | NET NO AUTH LOW CX NO UI | Missing Authentication for Critical Function Vulnerability in HiRDB. This issu | |
|
80
|
CVE-2026-59555 |
10.0 | 0.0060 | NET NO AUTH LOW CX NO UI | Unauthenticated Arbitrary File Deletion in Participants Database <= 2.7.8.3 vers | |
|
80
|
CVE-2026-59792 |
9.8 | 0.0060 | NET NO AUTH LOW CX NO UI | In JetBrains IntelliJ IDEA before 2026.1.4, 2026.2 code execution via path trav | |
|
80
|
CVE-2026-65431 |
9.8 | 0.0060 | NET NO AUTH LOW CX NO UI | Joomla Extension - regularlabs.com - Zipslip in GeoIP extension - Geo IP databas | |
|
80
|
CVE-2026-43757 |
9.8 | 0.0060 | NET NO AUTH LOW CX NO UI | An out-of-bounds read was addressed with improved bounds checking. This issue is | |
|
80
|
CVE-2026-43802 |
9.8 | 0.0060 | NET NO AUTH LOW CX NO UI | An out-of-bounds write issue was addressed with improved bounds checking. This i | |
|
80
|
CVE-2026-43809 |
9.8 | 0.0060 | NET NO AUTH LOW CX NO UI | An out-of-bounds read was addressed with improved bounds checking. This issue is | |
|
80
|
CVE-2026-64633 |
10.0 | 0.0060 | NET NO AUTH LOW CX NO UI | A vulnerability allowing remote unauthenticated code execution on the agent host | |
|
79
|
CVE-2023-53982 |
9.3 | 0.0061 | NET NO AUTH LOW CX NO UI | PMB 7.4.6 contains a SQL injection vulnerability in the id parameter of the stor | |
|
79
|
CVE-2026-120201 |
9.3 | 0.0060 | NET NO AUTH LOW CX NO UI | Jpom 2.10.0 through 2.11.12 contains an authentication bypass vulnerability that | |
|
79
|
CVE-2026-69255 |
9.2 | 0.0060 | NET NO AUTH LOW CX NO UI | Flowise is a drag & drop user interface to build a customized large language mod | |
|
78
|
CVE-2026-55276 |
9.1 | 0.0061 | NET NO AUTH LOW CX NO UI | Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat mean | |
|
78
|
CVE-2026-7747 |
8.9 | 0.0061 | NET NO AUTH LOW CX NO UI | A security flaw has been discovered in Totolink N300RH 3.2.4-B20220812. Affected | |
|
78
|
CVE-2026-53995 |
8.8 | 0.0060 | NET NO AUTH LOW CX NO UI | MLflow 3.17.1 and earlier contains a path traversal vulnerability in the FileSto | |
|
78
|
CVE-2026-42608 |
8.8 | 0.0060 | NET NO AUTH LOW CX NO UI | Grav is a file-based Web platform. Prior to 2.0.0-beta.2, there is a Path Traver | |
|
78
|
CVE-2026-53424 |
9.1 | 0.0060 | NET NO AUTH LOW CX NO UI | Authentication Bypass by Capture-replay vulnerability in dropbox samly allows an | |
|
78
|
CVE-2026-108525 |
8.7 | 0.0060 | NET NO AUTH LOW CX NO UI | Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 | |
|
78
|
CVE-2026-108529 |
8.7 | 0.0060 | NET NO AUTH LOW CX NO UI | Inefficient Algorithmic Complexity vulnerability in the HTTP/2 implementation of | |
|
78
|
CVE-2026-109584 |
8.7 | 0.0060 | NET NO AUTH LOW CX NO UI | Improper Handling of Highly Compressed Data (Data Amplification) vulnerability i | |
|
78
|
CVE-2026-110499 |
8.7 | 0.0060 | NET NO AUTH LOW CX NO UI | Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 | |
|
78
|
CVE-2026-111101 |
8.7 | 0.0060 | NET NO AUTH LOW CX NO UI | Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/1 | |
|
78
|
CVE-2026-113436 |
8.7 | 0.0060 | NET NO AUTH LOW CX NO UI | Inefficient Algorithmic Complexity vulnerability in the header integer parser of | |
|
78
|
CVE-2026-114213 |
8.7 | 0.0060 | NET NO AUTH LOW CX NO UI | Allocation of Resources Without Limits or Throttling vulnerability in the WebSoc | |
|
78
|
CVE-2026-115269 |
8.7 | 0.0060 | NET NO AUTH LOW CX NO UI | Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 | |
|
77
|
CVE-2026-96640 |
8.2 | 0.0060 | NET NO AUTH LOW CX NO UI | Pillow is a Python imaging library. From 5.1.0 until 13.0.0, PdfParser.linearize | |
|
76
|
CVE-2026-55488 |
7.7 | 0.0060 | NET NO AUTH LOW CX NO UI | motionEye (mEye) is an online interface for a piece of software called "motion," | |
|
76
|
CVE-2026-33267 |
7.7 | 0.0060 | NET NO AUTH LOW CX NO UI | Improper Input Validation vulnerability in Apache Traffic Server. This issue af | |
|
75
|
CVE-2026-54063 |
7.5 | 0.0061 | NET NO AUTH LOW CX NO UI | Excelize is a Go language library for reading and writing Microsoft Excel spread | |
|
75
|
CVE-2026-45713 |
7.5 | 0.0061 | NET NO AUTH LOW CX NO UI | Mailpit is an email testing tool and API for developers. Prior to version 1.30.0 | |
|
75
|
CVE-2026-33256 |
7.5 | 0.0061 | NET NO AUTH LOW CX NO UI | An attacker can send a web request that causes unlimited memory allocation in th | |
|
75
|
CVE-2026-28959 |
7.5 | 0.0060 | NET NO AUTH LOW CX NO UI | A buffer overflow was addressed with improved bounds checking. This issue is fix | |
|
75
|
CVE-2026-113811 |
7.5 | 0.0060 | NET NO AUTH LOW CX NO UI | Algorithm::UrataniTakeda versions from 0.1.5 before 0.1.7 for Perl allow memory | |
|
75
|
CVE-2026-40356 |
7.5 | 0.0060 | NET NO AUTH LOW CX NO UI | In MIT Kerberos 5 (aka krb5) before 1.22.3, there is an integer underflow and re | |
|
75
|
CVE-2026-20337 |
7.5 | 0.0060 | NET NO AUTH LOW CX NO UI | A vulnerability in the zip archive parser of ClamAV could allow an unauthenticat | |
|
75
|
CVE-2026-57186 |
7.5 | 0.0060 | NET NO AUTH LOW CX NO UI | Asterisk is an open source private branch exchange and telephony toolkit. From 2 | |
|
69
|
CVE-2026-104350 |
9.3 | 0.0060 | NET NO AUTH LOW CX | Adobe Campaign Classic (ACC) is affected by a reflected Cross-Site Scripting (XS | |
|
68
|
CVE-2026-55730 |
8.7 | 0.0061 | NET NO AUTH LOW CX | Reflected Cross-Site Scripting (CWE-79) in LWEB802 in Loytec LWEB-802 before 5.0 | |
|
68
|
CVE-2026-108426 |
8.8 | 0.0060 | NET NO AUTH LOW CX | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attac | |
|
65
|
CVE-2026-85922 |
7.4 | 0.0061 | NET NO AUTH NO UI | Weak authentication in Azure Key Vault allows an unauthorized attacker to bypass | |
|
65
|
CVE-2026-87865 |
7.4 | 0.0060 | NET NO AUTH NO UI | When libcurl uses libssh2 with a hashed `known_hosts` file, an unrelated initial | |
|
55
|
CVE-2026-77898 |
7.5 | 0.0061 | NET NO AUTH | Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker t |