Hunt List
8,534 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-104317 |
9.8 | 0.0059 | NET NO AUTH LOW CX NO UI | IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote attacker who could re | |
|
80
|
CVE-2026-48085 |
9.8 | 0.0059 | NET NO AUTH LOW CX NO UI | OpenReception's appointment booking software provides an end-to-end encrypted ap | |
|
79
|
CVE-2026-57580 |
9.4 | 0.0059 | NET NO AUTH LOW CX NO UI | authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, a | |
|
79
|
CVE-2026-111312 |
9.2 | 0.0059 | NET NO AUTH LOW CX NO UI | OpenHealth through 0.2.0 contains a missing authentication and authorization vul | |
|
78
|
CVE-2026-112400 |
8.7 | 0.0059 | NET NO AUTH LOW CX NO UI | Pillow is a Python imaging library. From 9.2.0 until 13.0.0, Pillow can retain a | |
|
78
|
CVE-2026-112402 |
8.7 | 0.0059 | NET NO AUTH LOW CX NO UI | Pillow is a Python imaging library. Prior to 13.0.0, Pillow can double free imag | |
|
78
|
CVE-2026-112405 |
8.7 | 0.0059 | NET NO AUTH LOW CX NO UI | Pillow is a Python imaging library. From 12.0.0 until 13.0.0, Pillow's Image.mer | |
|
78
|
CVE-2026-112894 |
8.7 | 0.0059 | NET NO AUTH LOW CX NO UI | Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow takes quadra | |
|
78
|
CVE-2026-112895 |
8.7 | 0.0059 | NET NO AUTH LOW CX NO UI | Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow can exhaust | |
|
78
|
CVE-2026-59708 |
8.7 | 0.0059 | NET NO AUTH LOW CX NO UI | The GET /api/v1/public/:accessId/portfolio endpoint in ghostfolio accepts privat | |
|
78
|
CVE-2026-33079 |
8.7 | 0.0059 | NET NO AUTH LOW CX NO UI | In versions 3.0.0a1 through 3.2.0 of Mistune, there is a ReDoS (Regular Expressi | |
|
78
|
CVE-2026-53869 |
8.7 | 0.0059 | NET NO AUTH LOW CX NO UI | Hermes Agent before 0.16.0 contains a DNS rebinding vulnerability in WebSocket e | |
|
78
|
CVE-2026-111613 |
8.7 | 0.0059 | NET NO AUTH LOW CX NO UI | AllData through 0.7.1 contains an unauthenticated JDBC injection vulnerability t | |
|
78
|
CVE-2026-6351 |
8.7 | 0.0059 | NET NO AUTH LOW CX NO UI | MailGates/MailAudit developed by Openfind has a CRLF Injection vulnerability, al | |
|
78
|
CVE-2026-57480 |
8.7 | 0.0059 | NET NO AUTH LOW CX NO UI | Parse Server is an open source backend that can be deployed to any infrastructur | |
|
78
|
CVE-2026-73413 |
8.7 | 0.0059 | NET NO AUTH LOW CX NO UI | Shescape is a simple shell escape library for JavaScript. From 2.1.11 until 2.1. | |
|
78
|
CVE-2026-20706 |
9.1 | 0.0059 | NET NO AUTH LOW CX NO UI | Gitea versions up to and including 1.26.1 allow repository archive downloads to | |
|
78
|
CVE-2026-48039 |
9.1 | 0.0059 | NET NO AUTH LOW CX NO UI | Meta Ads MCP is a Model Context Protocol (MCP) server that lets AI assistants ru | |
|
78
|
CVE-2026-35089 |
8.7 | 0.0059 | NET NO AUTH LOW CX NO UI | In Slican telephone exchanges secure key is generated in a predictable manner us | |
|
77
|
CVE-2026-15061 |
8.2 | 0.0059 | NET NO AUTH LOW CX NO UI | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 's nimesis registration service co | |
|
77
|
CVE-2026-112390 |
8.2 | 0.0059 | NET NO AUTH LOW CX NO UI | Pillow is a Python imaging library. From 7.2.0 until 13.0.0, Pillow can enter an | |
|
77
|
CVE-2026-112392 |
8.2 | 0.0059 | NET NO AUTH LOW CX NO UI | Pillow is a Python imaging library. Prior to 13.0.0, Pillow's rank-based filters | |
|
77
|
CVE-2026-45309 |
8.2 | 0.0059 | NET NO AUTH LOW CX NO UI | AsyncSSH is a Python package which provides an asynchronous client and server im | |
|
77
|
CVE-2026-47719 |
8.2 | 0.0059 | NET NO AUTH LOW CX NO UI | FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior | |
|
77
|
CVE-2026-57191 |
8.2 | 0.0059 | NET NO AUTH LOW CX NO UI | Asterisk is an open source private branch exchange and telephony toolkit. Prior | |
|
77
|
CVE-2026-114092 |
8.3 | 0.0059 | NET NO AUTH LOW CX NO UI | Trigger.dev before 4.5.0 performs no authentication or organization check in the | |
|
75
|
CVE-2026-56741 |
7.5 | 0.0060 | NET NO AUTH LOW CX NO UI | JLine is a Java library for handling console input. Prior to 3.30.14, 4.0.16, an | |
|
75
|
CVE-2026-98401 |
7.5 | 0.0060 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: net: iptunn | |
|
75
|
CVE-2026-56387 |
7.5 | 0.0060 | NET NO AUTH LOW CX NO UI | The RTMP AMF parser in Apache bRPC accepts AMF string lengths and array counts d | |
|
75
|
CVE-2026-114138 |
7.5 | 0.0060 | NET NO AUTH LOW CX NO UI | Django REST framework is a toolkit for building Web APIs. Prior to 3.18.2, Defau | |
|
75
|
CVE-2026-29169 |
7.5 | 0.0059 | NET NO AUTH LOW CX NO UI | A NULL pointer dereference in mod_dav_lock in Apache HTTP Server 2.4.66 and earl | |
|
75
|
CVE-2026-56740 |
7.5 | 0.0059 | NET NO AUTH LOW CX NO UI | JLine is a Java library for handling console input. Prior to 3.30.14, 4.0.16, an | |
|
75
|
CVE-2026-93446 |
7.5 | 0.0059 | NET NO AUTH LOW CX NO UI | Incomplete cleanup vulnerability in Apache Tomcat could cause TLS 1.3 connection | |
|
75
|
CVE-2024-27686 |
7.5 | 0.0059 | NET NO AUTH LOW CX NO UI | Mikrotik RouterOS (x86) 6.40.5 through 6.49.10 (fixed in 7) allows a remote atta | |
|
75
|
CVE-2026-44630 |
7.5 | 0.0059 | NET NO AUTH LOW CX NO UI | Improper validation of length fields in the Apache IoTDB RPC service may allow a | |
|
75
|
CVE-2026-65942 |
7.5 | 0.0059 | NET NO AUTH LOW CX NO UI | TLS hostname verification issue in Apache Ranger Client Code in versions <= 2.8. | |
|
75
|
CVE-2026-92390 |
7.5 | 0.0059 | NET NO AUTH LOW CX NO UI | When invoked with `--remote-header-name` (`-J`), curl fails to preserve its docu | |
|
75
|
CVE-2026-36590 |
7.5 | 0.0059 | NET NO AUTH LOW CX NO UI | An issue in EMQ NanoMQ v.0.24.9 allows a remote attacker to cause a denial of se | |
|
68
|
CVE-2026-14534 |
8.8 | 0.0059 | NET NO AUTH LOW CX | Trail of Bits fickling versions up to and including 0.1.10 do not include the Py | |
|
68
|
CVE-2026-83929 |
8.8 | 0.0059 | NET NO AUTH LOW CX | Out-of-bounds write in Windows GDI allows an unauthorized attacker to execute co | |
|
68
|
CVE-2026-112655 |
8.8 | 0.0059 | NET NO AUTH LOW CX | A use-after-free issue was addressed with improved memory management. This issue | |
|
68
|
CVE-2026-86055 |
8.7 | 0.0059 | NET NO AUTH LOW CX | Part-DB is an open source inventory management system for electronic components. | |
|
68
|
CVE-2026-97758 |
8.8 | 0.0059 | NET NO AUTH LOW CX | Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized atta | |
|
66
|
CVE-2026-79887 |
8.1 | 0.0059 | NET NO AUTH NO UI | A vulnerability in the web interface of AOS-8 could allow an unauthenticated rem | |
|
66
|
CVE-2026-89682 |
8.1 | 0.0059 | NET NO AUTH NO UI | In the Linux kernel, the following vulnerability has been resolved: nfsd: fix f | |
|
66
|
CVE-2026-89709 |
8.1 | 0.0059 | NET NO AUTH NO UI | In the Linux kernel, the following vulnerability has been resolved: lockd, nfsd | |
|
66
|
CVE-2026-90301 |
8.1 | 0.0059 | NET NO AUTH NO UI | In the Linux kernel, the following vulnerability has been resolved: ocfs2: o2hb | |
|
66
|
CVE-2025-58214 |
8.1 | 0.0059 | NET NO AUTH NO UI | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP | |
|
65
|
CVE-2026-73030 |
7.2 | 0.0059 | NET NO AUTH LOW CX | unearth through 0.18.2, fixed in commit 6c78164, contains a path traversal vulne | |
|
55
|
CVE-2026-88207 |
7.5 | 0.0059 | NET NO AUTH | Heap-based buffer overflow in Microsoft Office PowerPoint allows an unauthorized |