Hunt List
8,538 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-47393 |
9.8 | 0.0058 | NET NO AUTH LOW CX NO UI | PraisonAI is a multi-agent teams system. CVE-2026-44338 (GHSA-6rmh-7xcm-cpxj) do | |
|
80
|
CVE-2025-65719 |
9.8 | 0.0058 | NET NO AUTH LOW CX NO UI | An issue in Open Source Kubectl MCP Server v1.1.1 allows attackers to execute ar | |
|
80
|
CVE-2026-16351 |
9.8 | 0.0058 | NET NO AUTH LOW CX NO UI | Sandbox escape due to use-after-free in the DOM: Navigation component. This vuln | |
|
80
|
CVE-2026-16352 |
9.8 | 0.0058 | NET NO AUTH LOW CX NO UI | Sandbox escape due to use-after-free in the Disability Access APIs component. Th | |
|
80
|
CVE-2026-16356 |
9.8 | 0.0058 | NET NO AUTH LOW CX NO UI | Sandbox escape due to use-after-free in the Disability Access APIs component. Th | |
|
80
|
CVE-2026-7413 |
9.8 | 0.0058 | NET NO AUTH LOW CX NO UI | A hidden, persistent backdoor was found in Yarbo firmware v2.3.9 that provides r | |
|
80
|
CVE-2026-5801 |
9.8 | 0.0058 | NET NO AUTH LOW CX NO UI | Improper neutralization of special elements used in an SQL command ('SQL injecti | |
|
80
|
CVE-2025-56563 |
9.8 | 0.0058 | NET NO AUTH LOW CX NO UI | A Server-Side Request Forgery vulnerability exists in sat_proxy.php in Zenith Sa | |
|
80
|
CVE-2024-53095 |
9.8 | 0.0058 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: smb: client | |
|
80
|
CVE-2026-101521 |
9.8 | 0.0058 | NET NO AUTH LOW CX NO UI | Vulnerability in Oracle APEX (component: General). Supported versions that are | |
|
80
|
CVE-2026-67429 |
10.0 | 0.0057 | NET NO AUTH LOW CX NO UI | Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior | |
|
80
|
CVE-2026-109516 |
9.8 | 0.0057 | NET NO AUTH LOW CX NO UI | The Bot for Telegram on WooCommerce plugin for WordPress is vulnerable to Authen | |
|
80
|
CVE-2026-118636 |
9.8 | 0.0057 | NET NO AUTH LOW CX NO UI | **UNSUPPORTED WHEN ASSIGNED** JavaNativeMessageDecoder in the MINA 3.0 codec m | |
|
80
|
CVE-2026-48087 |
9.8 | 0.0057 | NET NO AUTH LOW CX NO UI | OpenReception's appointment booking software provides an end-to-end encrypted ap | |
|
80
|
CVE-2026-24178 |
9.8 | 0.0057 | NET NO AUTH LOW CX NO UI | NVIDIA NVFlare Dashboard contains a vulnerability in the user management and aut | |
|
80
|
CVE-2026-20272 |
9.8 | 0.0057 | NET NO AUTH LOW CX NO UI | As part of Cisco's ongoing commitment to proactive security and product quality, | |
|
79
|
CVE-2026-78403 |
9.3 | 0.0058 | NET NO AUTH LOW CX NO UI | Stack-based buffer overflow and missing authorization vulnerability in Thales Se | |
|
79
|
CVE-2026-53983 |
9.2 | 0.0057 | NET NO AUTH LOW CX NO UI | Ground Station prior to 0.6.0 contains an unauthenticated blind server-side requ | |
|
78
|
CVE-2026-64825 |
9.0 | 0.0058 | NET NO AUTH LOW CX NO UI | Home Assistant Core before 2026.6.0 contains a path traversal vulnerability that | |
|
78
|
CVE-2026-65702 |
8.8 | 0.0058 | NET NO AUTH LOW CX NO UI | Vanna through 2.0.2 contains a path traversal vulnerability in the FileSystemCon | |
|
78
|
CVE-2026-10672 |
9.1 | 0.0058 | NET NO AUTH LOW CX NO UI | subsys/net/lib/lwm2m/lwm2m_pull_context.c copied the firmware-update Package URI | |
|
78
|
CVE-2026-71979 |
8.7 | 0.0058 | NET NO AUTH LOW CX NO UI | INDI (Instrument Neutral Distributed Interface) indiserver through 2.2.4.2, fixe | |
|
78
|
CVE-2026-12087 |
9.1 | 0.0057 | NET NO AUTH LOW CX NO UI | Socket versions before 2.041 for Perl have an out-of-bounds heap read. In Socke | |
|
78
|
CVE-2026-53224 |
9.1 | 0.0057 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: sctp: valid | |
|
78
|
CVE-2026-58226 |
8.7 | 0.0057 | NET NO AUTH LOW CX NO UI | Inefficient Algorithmic Complexity vulnerability in elixir-mint hpax allows unau | |
|
78
|
CVE-2026-70464 |
8.7 | 0.0057 | NET NO AUTH LOW CX NO UI | rsync daemon 2.0.0 before 3.5.0 contains a denial of service vulnerability that | |
|
78
|
CVE-2026-112397 |
8.7 | 0.0057 | NET NO AUTH LOW CX NO UI | Pillow is a Python imaging library. Prior to 13.0.0, Pillow's ImageMorph.MorphOp | |
|
78
|
CVE-2026-112406 |
8.7 | 0.0057 | NET NO AUTH LOW CX NO UI | Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow can enter an | |
|
77
|
CVE-2026-52854 |
8.6 | 0.0058 | NET NO AUTH LOW CX NO UI | Maps is a MediaWiki extension that enables visualization of geographic data thro | |
|
77
|
CVE-2026-14254 |
8.3 | 0.0058 | NET NO AUTH LOW CX NO UI | A race condition in the account lockout mechanism in Delphix Continous Data allo | |
|
77
|
CVE-2026-53571 |
8.2 | 0.0058 | NET NO AUTH LOW CX NO UI | Vite is a frontend tooling framework for JavaScript. Prior to 8.0.16, 7.3.5, and | |
|
77
|
CVE-2026-20263 |
8.6 | 0.0057 | NET NO AUTH LOW CX NO UI | A vulnerability in the Blocks Extensible Exchange Protocol (BEEP) feature of Cis | |
|
77
|
CVE-2026-72535 |
8.6 | 0.0057 | NET NO AUTH LOW CX NO UI | A missing authentication vulnerability in Chaskiq through commit 46dfdd1 allows | |
|
77
|
CVE-2026-72536 |
8.6 | 0.0057 | NET NO AUTH LOW CX NO UI | A missing authentication vulnerability in Chaskiq through commit 46dfdd1 allows | |
|
75
|
CVE-2025-52290 |
7.5 | 0.0058 | NET NO AUTH LOW CX NO UI | A NULL pointer dereference in the avpriv_h264_has_num_reorder_frames function of | |
|
75
|
CVE-2026-107020 |
7.5 | 0.0058 | NET NO AUTH LOW CX NO UI | An issue in the activity.LoadLinkLaterActivity component of FeedEx / Handy News | |
|
75
|
CVE-2026-48911 |
7.5 | 0.0057 | NET NO AUTH LOW CX NO UI | Insufficient Verification of Data Authenticity vulnerability in Apache Answer. | |
|
75
|
CVE-2026-59954 |
7.5 | 0.0057 | NET NO AUTH LOW CX NO UI | Apollo is a reliable configuration management system suitable for microservice c | |
|
75
|
CVE-2026-59955 |
7.5 | 0.0057 | NET NO AUTH LOW CX NO UI | Apollo is a reliable configuration management system suitable for microservice c | |
|
75
|
CVE-2026-48937 |
7.5 | 0.0057 | NET NO AUTH LOW CX NO UI | A flaw in Node.js HTTP/2 server API can cause servers to keep accepting data eve | |
|
75
|
CVE-2026-20213 |
7.5 | 0.0057 | NET NO AUTH LOW CX NO UI | A vulnerability in the PE file format parser of ClamAV could allow an unauthenti | |
|
75
|
CVE-2026-20214 |
7.5 | 0.0057 | NET NO AUTH LOW CX NO UI | A vulnerability in the FSG file format parser of ClamAV could allow an unauthent | |
|
69
|
CVE-2026-47428 |
9.6 | 0.0058 | NET NO AUTH LOW CX | Vitest is a testing framework powered by Vite. From 4.0.17 until 4.1.6 and 5.0.0 | |
|
69
|
CVE-2026-43631 |
9.2 | 0.0057 | NET NO AUTH NO UI | llama.cpp builds b7492 through the latest b9060 contains a use-after-free vulner | |
|
68
|
CVE-2026-6100 |
9.1 | 0.0058 | NET NO AUTH NO UI | Use-after-free (UAF) was possible in the `lzma.LZMADecompressor`, `bz2.BZ2Decomp | |
|
68
|
CVE-2026-114107 |
8.7 | 0.0058 | NET NO AUTH LOW CX | HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains an indirect prompt injection | |
|
68
|
CVE-2026-112626 |
8.8 | 0.0057 | NET NO AUTH LOW CX | A use-after-free issue was addressed with improved memory management. This issue | |
|
68
|
CVE-2026-76034 |
8.8 | 0.0057 | NET NO AUTH LOW CX | Buffer overflow in WebGL in Google Chrome prior to 151.0.7922.169 allowed a remo | |
|
65
|
CVE-2026-103577 |
7.5 | 0.0057 | NET NO AUTH NO UI | Insecure default variable initialization in Microsoft QUIC allows an unauthorize | |
|
64
|
CVE-2026-57977 |
7.1 | 0.0058 | NET NO AUTH LOW CX | Improper neutralization of input during web page generation ('cross-site scripti |