Hunt List
8,531 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-49352 |
9.8 | 0.0060 | NET NO AUTH LOW CX NO UI | 9Router is an AI router & token saver. From 0.2.21 until 0.4.44, 9Router used th | |
|
80
|
CVE-2026-70200 |
10.0 | 0.0060 | NET NO AUTH LOW CX NO UI | Improper limitation of a pathname to a restricted directory ('path traversal') i | |
|
80
|
CVE-2026-43414 |
9.8 | 0.0060 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: scsi: qla2x | |
|
80
|
CVE-2026-12485 |
10.0 | 0.0060 | NET NO AUTH LOW CX NO UI | GV-I/O Box 4E is a smart embedded device with 4 input and 4 relays output that c | |
|
80
|
CVE-2026-12846 |
10.0 | 0.0060 | NET NO AUTH LOW CX NO UI | GV-I/O Box 4E is a smart embedded device with 4 input and 4 relays output that c | |
|
80
|
CVE-2026-12847 |
10.0 | 0.0060 | NET NO AUTH LOW CX NO UI | GV-I/O Box 4E is a smart embedded device with 4 input and 4 relays output that c | |
|
80
|
CVE-2026-12848 |
10.0 | 0.0060 | NET NO AUTH LOW CX NO UI | GV-I/O Box 4E is a smart embedded device with 4 input and 4 relays output that c | |
|
80
|
CVE-2026-5442 |
9.8 | 0.0060 | NET NO AUTH LOW CX NO UI | A heap buffer overflow vulnerability exists in the DICOM image decoder. Dimensio | |
|
80
|
CVE-2026-59144 |
9.8 | 0.0060 | NET NO AUTH LOW CX NO UI | Data::RingBuffer::Shared versions before 0.04 for Perl allow a stack buffer over | |
|
80
|
CVE-2024-26011 |
9.8 | 0.0060 | NET NO AUTH LOW CX NO UI | A missing authentication for critical function vulnerability in Fortinet FortiMa | |
|
80
|
CVE-2026-40050 |
9.8 | 0.0060 | NET NO AUTH LOW CX NO UI | CrowdStrike has released security updates to address a critical unauthenticated | |
|
80
|
CVE-2026-40008 |
9.8 | 0.0060 | NET NO AUTH LOW CX NO UI | Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection | |
|
80
|
CVE-2026-10697 |
9.8 | 0.0060 | NET NO AUTH LOW CX NO UI | Improper Authentication vulnerability in Progress MOVEit Transfer. This issue a | |
|
80
|
CVE-2026-16350 |
9.8 | 0.0060 | NET NO AUTH LOW CX NO UI | Incorrect boundary conditions in the Audio/Video: cubeb component. This vulnerab | |
|
80
|
CVE-2026-16353 |
9.8 | 0.0060 | NET NO AUTH LOW CX NO UI | Invalid pointer in the DOM: Bindings (WebIDL) component. This vulnerability was | |
|
80
|
CVE-2026-16355 |
9.8 | 0.0060 | NET NO AUTH LOW CX NO UI | JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability w | |
|
80
|
CVE-2026-16357 |
9.8 | 0.0060 | NET NO AUTH LOW CX NO UI | Incorrect boundary conditions in the Graphics component. This vulnerability was | |
|
79
|
CVE-2026-117564 |
9.3 | 0.0060 | NET NO AUTH LOW CX NO UI | nest-admin before 1.0.1 contains an authentication bypass vulnerability that all | |
|
79
|
CVE-2026-64625 |
9.3 | 0.0060 | NET NO AUTH LOW CX NO UI | AVideo before 29.0 contains an incomplete fix for CVE-2026-45578 where execAsync | |
|
79
|
CVE-2026-118633 |
9.2 | 0.0060 | NET NO AUTH LOW CX NO UI | A path traversal vulnerability allows a remote unauthenticated attacker to execu | |
|
78
|
CVE-2026-48203 |
9.1 | 0.0060 | NET NO AUTH LOW CX NO UI | Improper Neutralization of Special Elements in Output Used by a Downstream Compo | |
|
78
|
CVE-2026-48205 |
9.1 | 0.0060 | NET NO AUTH LOW CX NO UI | Improper Input Validation, Server-Side Request Forgery (SSRF) vulnerability in A | |
|
78
|
CVE-2026-43083 |
9.1 | 0.0060 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: net: ioam6: | |
|
78
|
CVE-2026-37637 |
9.1 | 0.0060 | NET NO AUTH LOW CX NO UI | An issue in Alexantr filemanager v.1.0 allows a remote attacker to execute arbit | |
|
78
|
CVE-2019-25776 |
8.7 | 0.0060 | NET NO AUTH LOW CX NO UI | Weaver E-cology contains an unauthenticated SQL injection vulnerability that all | |
|
78
|
CVE-2026-41041 |
9.1 | 0.0060 | NET NO AUTH LOW CX NO UI | URL path injection via unencoded user-supplied identifiers vulnerability in Apac | |
|
78
|
CVE-2026-39912 |
9.1 | 0.0060 | NET NO AUTH LOW CX NO UI | V2Board 1.6.1 through 1.7.4 and Xboard through 0.1.9 expose authentication token | |
|
78
|
CVE-2026-89672 |
9.1 | 0.0060 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: nfsd: gate | |
|
77
|
CVE-2026-16857 |
8.2 | 0.0060 | NET NO AUTH LOW CX NO UI | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to m | |
|
75
|
CVE-2026-8650 |
7.5 | 0.0060 | NET NO AUTH LOW CX NO UI | Relative path traversal vulnerability in Progress MOVEit Transfer (Admin Setting | |
|
75
|
CVE-2026-58208 |
7.5 | 0.0060 | NET NO AUTH LOW CX NO UI | NATS Server is a high-performance server for NATS.io, the cloud and edge native | |
|
75
|
CVE-2026-75507 |
7.5 | 0.0060 | NET NO AUTH LOW CX NO UI | GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3 | |
|
75
|
CVE-2025-14874 |
7.5 | 0.0060 | NET NO AUTH LOW CX NO UI | A flaw was found in Nodemailer. This vulnerability allows a denial of service (D | |
|
75
|
CVE-2026-13369 |
7.5 | 0.0060 | NET NO AUTH LOW CX NO UI | The Ninja Forms - File Uploads plugin for WordPress is vulnerable to Arbitrary F | |
|
75
|
CVE-2026-12413 |
7.5 | 0.0060 | NET NO AUTH LOW CX NO UI | An invalidly formatted IKEv2 fragment causes the Libreswan pluto daemon to crash | |
|
75
|
CVE-2026-73246 |
7.5 | 0.0060 | NET NO AUTH LOW CX NO UI | Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0-rc | |
|
75
|
CVE-2026-51367 |
7.5 | 0.0060 | NET NO AUTH LOW CX NO UI | An issue in Bottinelli Informatica Vedo Suite v.1.2.5 allows a remote attacker t | |
|
75
|
CVE-2026-90885 |
7.5 | 0.0060 | NET NO AUTH LOW CX NO UI | Improper Restriction of XML External Entity Reference vulnerability in Apache Ca | |
|
75
|
CVE-2026-3366 |
7.5 | 0.0060 | NET NO AUTH LOW CX NO UI | IBM InfoSphere Optim Test Data Fabrication 1.0.0, 1.0.0.1, 1.0.0.2, 1.0.2, 1.0.2 | |
|
69
|
CVE-2026-8178 |
9.2 | 0.0060 | NET NO AUTH NO UI | An issue exists in Amazon Redshift JDBC Driver versions prior to 2.2.2. Under ce | |
|
68
|
CVE-2026-96943 |
8.8 | 0.0060 | NET NO AUTH LOW CX | Integer overflow or wraparound in Windows Raw Image Extension allows an unauthor | |
|
68
|
CVE-2026-97767 |
8.8 | 0.0060 | NET NO AUTH LOW CX | Double free in Microsoft Office Excel allows an unauthorized attacker to execute | |
|
68
|
CVE-2026-97778 |
8.8 | 0.0060 | NET NO AUTH LOW CX | Integer overflow or wraparound in Microsoft Office Excel allows an unauthorized | |
|
68
|
CVE-2026-109440 |
8.7 | 0.0060 | NET NO AUTH LOW CX | LangAlpha through 2026.09.07 contains an indirect prompt injection vulnerability | |
|
68
|
CVE-2026-25707 |
8.8 | 0.0060 | NET NO AUTH LOW CX | A relative path traversal bug problem when processing repository metadata in lib | |
|
68
|
CVE-2026-28940 |
8.8 | 0.0060 | NET NO AUTH LOW CX | The issue was addressed with improved memory handling. This issue is fixed in iO | |
|
68
|
CVE-2026-9863 |
8.8 | 0.0060 | NET NO AUTH LOW CX | Fortra BoKS Manager contains an OS command injection vulnerability in the client | |
|
66
|
CVE-2026-119977 |
8.1 | 0.0060 | NET NO AUTH NO UI | WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7. | |
|
65
|
CVE-2026-10665 |
7.4 | 0.0060 | NET NO AUTH NO UI | In Zephyr's WireGuard subsystem (subsys/net/lib/wireguard), wg_process_data_mess | |
|
65
|
CVE-2026-84003 |
7.4 | 0.0060 | NET NO AUTH NO UI | Authentication bypass by capture-replay in Microsoft Authentication Library (MSA |