Hunt List
7,790 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-57827 |
10.0 | 0.0233 | NET NO AUTH LOW CX NO UI | Joomla Extension - rsjoomla.com - Unauthenticated file upload in RSFiles compone | |
|
80
|
CVE-2026-67261 |
9.8 | 0.0232 | NET NO AUTH LOW CX NO UI | Dell Virtual Storage Integrator for VMware vSphere Client, versions prior to 10. | |
|
80
|
CVE-2026-10134 |
10.0 | 0.0232 | NET NO AUTH LOW CX NO UI | IBM Langflow OSS 1.0.0 through 1.9.3 allows an attacker to read every secret ava | |
|
80
|
CVE-2022-44276 |
9.8 | 0.0230 | NET NO AUTH LOW CX NO UI | In Responsive Filemanager < 9.12.0, an attacker can bypass upload restrictions r | |
|
80
|
CVE-2026-77647 |
9.8 | 0.0229 | NET NO AUTH LOW CX NO UI | SPIP before 4.4.20 allows unauthenticated remote attackers to execute arbitrary | |
|
80
|
CVE-2026-114575 |
10.0 | 0.0221 | NET NO AUTH LOW CX NO UI | A flaw has been found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected by thi | |
|
80
|
CVE-2026-10768 |
9.8 | 0.0213 | NET NO AUTH LOW CX NO UI | Missing Authorization vulnerability in Drupal LocalGov Workflows allows Forceful | |
|
80
|
CVE-2026-49869 |
10.0 | 0.0209 | NET NO AUTH LOW CX NO UI | KEV | Kestra OSS contains an OS command injection vulnerability that could allow an un |
|
80
|
CVE-2026-34976 |
10.0 | 0.0207 | NET NO AUTH LOW CX NO UI | Dgraph is an open source distributed GraphQL database. Prior to 25.3.1, the rest | |
|
80
|
CVE-2026-72590 |
9.8 | 0.0204 | NET NO AUTH LOW CX NO UI | An OS command injection vulnerability in alseambusher/crontab-ui through 0.4.2 a | |
|
80
|
CVE-2026-46420 |
9.8 | 0.0201 | NET NO AUTH LOW CX NO UI | setup-php is a GitHub action to set up PHP with extensions, php.ini configuratio | |
|
80
|
CVE-2026-72589 |
9.8 | 0.0195 | NET NO AUTH LOW CX NO UI | An OS command injection vulnerability in alseambusher/crontab-ui through 0.4.2 a | |
|
79
|
CVE-2026-40047 |
9.1 | 0.0243 | NET NO AUTH LOW CX NO UI | Improper Neutralization of Argument Delimiters in a Command ('Argument Injection | |
|
79
|
CVE-2026-61459 |
9.3 | 0.0236 | NET NO AUTH LOW CX NO UI | MCP Server Kubernetes before 3.9.0 contains an argument injection vulnerability | |
|
79
|
CVE-2026-116485 |
9.3 | 0.0235 | NET NO AUTH LOW CX NO UI | danmu_api before 1.21.7 contains an authentication bypass vulnerability that all | |
|
79
|
CVE-2026-63766 |
9.3 | 0.0215 | NET NO AUTH LOW CX NO UI | GPT-SoVITS through 20250606v2pro contains an OS command injection vulnerability | |
|
79
|
CVE-2026-59800 |
9.2 | 0.0208 | NET NO AUTH LOW CX NO UI | 9Router before 0.4.44 contains an OS command injection vulnerability in the unau | |
|
79
|
CVE-2026-33845 |
9.1 | 0.0207 | NET NO AUTH LOW CX NO UI | A flaw in GnuTLS DTLS handshake parsing allows malformed fragments with zero len | |
|
79
|
CVE-2021-48014 |
9.3 | 0.0203 | NET NO AUTH LOW CX NO UI | FineReport 9.0 contains a path traversal vulnerability in the /WebReport/ReportS | |
|
79
|
CVE-2026-6349 |
9.3 | 0.0203 | NET NO AUTH LOW CX NO UI | The iSherlock developed by HGiga has an OS Command Injection vulnerability, al | |
|
79
|
CVE-2026-53595 |
9.4 | 0.0194 | NET NO AUTH LOW CX NO UI | FreeScout is a free help desk and shared inbox built with PHP's Laravel framewor | |
|
79
|
CVE-2026-49772 |
9.3 | 0.0194 | NET NO AUTH LOW CX NO UI | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti | |
|
79
|
CVE-2026-53519 |
9.1 | 0.0193 | NET NO AUTH LOW CX NO UI | Nezha Monitoring is a self-hostable, lightweight, servers and websites monitorin | |
|
79
|
CVE-2026-6942 |
9.3 | 0.0192 | NET NO AUTH LOW CX NO UI | radare2-mcp version 1.6.0 and earlier contains an os command injection vulnerabi | |
|
79
|
CVE-2026-61500 |
9.3 | 0.0191 | NET NO AUTH LOW CX NO UI | Rejetto HFS 3.0.0 through 3.2.0 derives its session-cookie signing key from the | |
|
79
|
CVE-2026-58453 |
9.3 | 0.0190 | NET NO AUTH LOW CX NO UI | JAIOTlink C492A-W6 Wi-Fi IP cameras running firmware 4.8.30.57701411 contain a h | |
|
79
|
CVE-2026-58127 |
9.3 | 0.0188 | NET NO AUTH LOW CX NO UI | PACSgear MediaWriter 5.2.1 exposes a .NET Remoting TCP service on port 9000 via | |
|
78
|
CVE-2026-7240 |
8.9 | 0.0243 | NET NO AUTH LOW CX NO UI | A vulnerability has been found in Totolink A8000RU 7.1cu.643_b20200521. This vul | |
|
78
|
CVE-2026-7244 |
8.9 | 0.0242 | NET NO AUTH LOW CX NO UI | A security flaw has been discovered in Totolink A8000RU 7.1cu.643_b20200521. The | |
|
78
|
CVE-2026-41304 |
8.9 | 0.0222 | NET NO AUTH LOW CX NO UI | WWBN AVideo is an open source video platform. In versions 29.0 and below, the `c | |
|
78
|
CVE-2026-6140 |
8.9 | 0.0220 | NET NO AUTH LOW CX NO UI | A vulnerability was found in Totolink A7100RU 7.4cu.2313_b20191024. This impacts | |
|
78
|
CVE-2026-6132 |
8.9 | 0.0217 | NET NO AUTH LOW CX NO UI | A vulnerability was determined in Totolink A7100RU 7.4cu.2313_b20191024. Affecte | |
|
78
|
CVE-2026-7248 |
8.9 | 0.0215 | NET NO AUTH LOW CX NO UI | A vulnerability was found in D-Link DI-8100 16.07.26A1. This affects the functio | |
|
78
|
CVE-2026-5977 |
8.9 | 0.0211 | NET NO AUTH LOW CX NO UI | A weakness has been identified in Totolink A7100RU 7.4cu.2313_b20191024. This im | |
|
78
|
CVE-2026-7121 |
8.9 | 0.0195 | NET NO AUTH LOW CX NO UI | A flaw has been found in Totolink A8000RU 7.1cu.643_b20200521. This affects the | |
|
75
|
CVE-2023-2911 |
7.5 | 0.0243 | NET NO AUTH LOW CX NO UI | If the `recursive-clients` quota is reached on a BIND 9 resolver configured with | |
|
75
|
CVE-2023-42344 |
7.3 | 0.0234 | NET NO AUTH LOW CX NO UI | Alkacon OpenCms before 10.5.1 allows remote unauthenticated attackers to obtain | |
|
75
|
CVE-2025-60751 |
7.5 | 0.0228 | NET NO AUTH LOW CX NO UI | GeographicLib 2.5 is vulnerable to Buffer Overflow in GeoConvert DMS::InternalDe | |
|
75
|
CVE-2023-22795 |
7.5 | 0.0228 | NET NO AUTH LOW CX NO UI | A regular expression based DoS vulnerability in Action Dispatch <6.1.7.1 and <7. | |
|
75
|
CVE-2026-71209 |
7.5 | 0.0225 | NET NO AUTH LOW CX NO UI | audiobookshelf's authentication-exemption check (server/routers/Auth.js) matches | |
|
75
|
CVE-2023-23919 |
7.5 | 0.0221 | NET NO AUTH LOW CX NO UI | A cryptographic vulnerability exists in Node.js <19.2.0, <18.14.1, <16.19.1, <14 | |
|
75
|
CVE-2026-54066 |
7.5 | 0.0217 | NET NO AUTH LOW CX NO UI | SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, t | |
|
75
|
CVE-2025-60335 |
7.5 | 0.0213 | NET NO AUTH LOW CX NO UI | A NULL pointer dereference in the main function of TOTOLINK N600R v4.3.0cu.7866_ | |
|
75
|
CVE-2026-59861 |
7.5 | 0.0205 | NET NO AUTH LOW CX NO UI | Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.0 | |
|
75
|
CVE-2023-23918 |
7.5 | 0.0202 | NET NO AUTH LOW CX NO UI | A privilege escalation vulnerability exists in Node.js <19.6.1, <18.14.1, <16.19 | |
|
75
|
CVE-2026-48048 |
7.5 | 0.0201 | NET NO AUTH LOW CX NO UI | XWiki Platform is a generic wiki platform. XWiki discovered that the patch for G | |
|
75
|
CVE-2023-22974 |
7.5 | 0.0189 | NET NO AUTH LOW CX NO UI | A Path Traversal in setup.php in OpenEMR < 7.0.0 allows remote unauthenticated u | |
|
68
|
CVE-2026-58289 |
9.0 | 0.0199 | NET NO AUTH NO UI | Access of resource using incompatible type ('type confusion') in Microsoft Edge | |
|
65
|
CVE-2026-59867 |
7.1 | 0.0239 | NET NO AUTH LOW CX | Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5 | |
|
65
|
CVE-2026-48294 |
7.4 | 0.0191 | NET NO AUTH LOW CX | Adobe Acrobat PDF Extension (Chrome) versions 26.5.2.2 and earlier are affected |