Hunt List
8,540 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-48836 |
10.0 | 0.0057 | NET NO AUTH LOW CX NO UI | Unauthenticated Remote Code Execution (RCE) in Easy Invoice <= 2.1.19 versions. | |
|
80
|
CVE-2026-42996 |
10.0 | 0.0057 | NET NO AUTH LOW CX NO UI | JS8Call through 2.3.1 and JS8Call-improved before 3.0 have a stack-based buffer | |
|
80
|
CVE-2026-42854 |
9.8 | 0.0057 | NET NO AUTH LOW CX NO UI | arduino-esp32 is an Arduino core for the ESP32, ESP32-S2, ESP32-S3, ESP32-C3, ES | |
|
80
|
CVE-2026-5443 |
9.8 | 0.0057 | NET NO AUTH LOW CX NO UI | A heap buffer overflow vulnerability exists during the decoding of `PALETTE COLO | |
|
80
|
CVE-2026-16361 |
9.8 | 0.0057 | NET NO AUTH LOW CX NO UI | Memory safety bugs present in Thunderbird ESR 140.12. Some of these bugs showed | |
|
80
|
CVE-2026-16368 |
9.8 | 0.0057 | NET NO AUTH LOW CX NO UI | Incorrect boundary conditions in the JavaScript: WebAssembly component. This vul | |
|
80
|
CVE-2026-74989 |
9.8 | 0.0057 | NET NO AUTH LOW CX NO UI | Internally found bugs present in Firefox 153. Some of these bugs showed evidence | |
|
80
|
CVE-2026-64703 |
9.8 | 0.0057 | NET NO AUTH LOW CX NO UI | A use after free issue was addressed with improved memory management. This issue | |
|
80
|
CVE-2026-59562 |
9.8 | 0.0057 | NET NO AUTH LOW CX NO UI | Missing authentication for critical function vulnerability in Apache IoTDB. T | |
|
80
|
CVE-2026-16377 |
9.8 | 0.0057 | NET NO AUTH LOW CX NO UI | Mitigation bypass in the PDF Viewer component. This vulnerability was fixed in F | |
|
80
|
CVE-2026-16383 |
9.8 | 0.0057 | NET NO AUTH LOW CX NO UI | Mitigation bypass in the DOM: Networking component. This vulnerability was fixed | |
|
79
|
CVE-2026-101990 |
9.3 | 0.0057 | NET NO AUTH LOW CX NO UI | A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) | |
|
78
|
CVE-2026-75111 |
8.7 | 0.0057 | NET NO AUTH LOW CX NO UI | Evidently UI fails to properly validate the filename parameter in the dataset ma | |
|
78
|
CVE-2026-40525 |
9.1 | 0.0057 | NET NO AUTH LOW CX NO UI | OpenViking prior to version 0.3.9 contains an authentication bypass vulnerabilit | |
|
78
|
CVE-2026-70461 |
8.8 | 0.0057 | NET NO AUTH LOW CX NO UI | rsync 3.2.5 before 3.5.0 contains a heap out-of-bounds write vulnerability that | |
|
78
|
CVE-2026-6947 |
8.7 | 0.0057 | NET NO AUTH LOW CX NO UI | DWM-222W USB Wi-Fi Adapter developed by D-Link has a Brute-Force Protection Bypa | |
|
78
|
CVE-2026-54722 |
8.7 | 0.0057 | NET NO AUTH LOW CX NO UI | DSSRF is a Node.js library that provides a wide range of utilities and advanced | |
|
78
|
CVE-2026-11373 |
9.1 | 0.0057 | NET NO AUTH LOW CX NO UI | Net::Statsite::Client versions through 1.1.0 for Perl allow metric injections. | |
|
78
|
CVE-2026-72320 |
9.1 | 0.0057 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: netfilter: | |
|
78
|
CVE-2026-55471 |
8.7 | 0.0057 | NET NO AUTH LOW CX NO UI | HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare i | |
|
77
|
CVE-2026-13577 |
8.2 | 0.0057 | NET NO AUTH LOW CX NO UI | Dancer2 versions before 2.2.0 for Perl generate insecure session ids when requir | |
|
76
|
CVE-2026-54204 |
7.7 | 0.0057 | NET NO AUTH LOW CX NO UI | Tobit Laboratories AG TeamDavid's Webbox 's search functionality accepts a “path | |
|
76
|
CVE-2026-43946 |
7.7 | 0.0057 | NET NO AUTH LOW CX NO UI | FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Versio | |
|
75
|
CVE-2026-20216 |
7.5 | 0.0057 | NET NO AUTH LOW CX NO UI | A vulnerability in the InstallShield file format parser of ClamAV could allow an | |
|
75
|
CVE-2026-20217 |
7.5 | 0.0057 | NET NO AUTH LOW CX NO UI | A vulnerability in the PESpin file format parser of ClamAV could allow an unauth | |
|
75
|
CVE-2026-20243 |
7.5 | 0.0057 | NET NO AUTH LOW CX NO UI | A vulnerability in the ALZ file format parser of ClamAV could allow an unauthent | |
|
75
|
CVE-2026-20244 |
7.5 | 0.0057 | NET NO AUTH LOW CX NO UI | A vulnerability in the DMG file format parser of ClamAV could allow an unauthent | |
|
75
|
CVE-2026-44909 |
7.5 | 0.0057 | NET NO AUTH LOW CX NO UI | Proxygen lacked a generalized slow-consumer detection mechanism in its core HTTP | |
|
75
|
CVE-2026-75508 |
7.5 | 0.0057 | NET NO AUTH LOW CX NO UI | GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3 | |
|
75
|
CVE-2026-57195 |
7.5 | 0.0057 | NET NO AUTH LOW CX NO UI | Asterisk is an open source private branch exchange and telephony toolkit. Prior | |
|
75
|
CVE-2026-5088 |
7.5 | 0.0057 | NET NO AUTH LOW CX NO UI | Apache::API::Password versions through 0.5.2 for Perl can generate insecure rand | |
|
75
|
CVE-2026-49855 |
7.5 | 0.0057 | NET NO AUTH LOW CX NO UI | Tornado is a Python web framework and asynchronous networking library. Prior to | |
|
75
|
CVE-2026-58064 |
7.5 | 0.0057 | NET NO AUTH LOW CX NO UI | The Redis protocol implementation in Apache bRPC allowed inline command parsing | |
|
75
|
CVE-2026-61916 |
7.5 | 0.0057 | NET NO AUTH LOW CX NO UI | Out-of-bounds reads in URL parsing and case-insensitive header lookup in Apache | |
|
75
|
CVE-2026-74755 |
7.5 | 0.0057 | NET NO AUTH LOW CX NO UI | An integer underflow in the mcpack2pb component of Apache bRPC (version < 1.18.0 | |
|
75
|
CVE-2026-80463 |
7.5 | 0.0057 | NET NO AUTH LOW CX NO UI | Unbounded memory accumulation in the stream message reassembly path of Apache bR | |
|
75
|
CVE-2026-19667 |
7.5 | 0.0057 | NET NO AUTH LOW CX NO UI | If an attacker-controlled authoritative server can produce a negative answer tha | |
|
75
|
CVE-2026-81563 |
7.5 | 0.0057 | NET NO AUTH LOW CX NO UI | A BIND resolver encountering an SVCB/HTTPS AliasMode record referencing 14 or mo | |
|
75
|
CVE-2026-81736 |
7.5 | 0.0057 | NET NO AUTH LOW CX NO UI | If a BIND resolver has cached a tree of SVCB/HTTPS AliasMode records, and is the | |
|
75
|
CVE-2026-19666 |
7.5 | 0.0057 | NET NO AUTH LOW CX NO UI | On a resolver configured to use ``dns64``, if an applicable answer from the auth | |
|
75
|
CVE-2026-76163 |
7.5 | 0.0057 | NET NO AUTH LOW CX NO UI | If BIND is loaded with a "`named.conf`" file that contains no global "`options`" | |
|
75
|
CVE-2026-80274 |
7.5 | 0.0057 | NET NO AUTH LOW CX NO UI | If a BIND resolver sends a query for a DNSSEC-signed authoritative zone, and the | |
|
75
|
CVE-2026-56862 |
7.5 | 0.0057 | NET NO AUTH LOW CX NO UI | Handshake messages, such as KeyUpdate, are always considered as state-advancing, | |
|
69
|
CVE-2026-15091 |
9.3 | 0.0057 | NET NO AUTH LOW CX | IBM Engineering AI Hub 1.0.0, 1.1.0, and 1.2.0 could allow a remote attacker to | |
|
69
|
CVE-2026-41265 |
9.2 | 0.0057 | NET NO AUTH NO UI | Flowise is a drag & drop user interface to build a customized large language mod | |
|
68
|
CVE-2026-96192 |
8.8 | 0.0057 | NET NO AUTH LOW CX | Use after free in Microsoft Edge for iOS allows an unauthorized attacker to exec | |
|
68
|
CVE-2026-81352 |
8.8 | 0.0057 | NET NO AUTH LOW CX | Heap-based buffer overflow in Microsoft Windows Codecs Library allows an unautho | |
|
68
|
CVE-2026-16420 |
8.8 | 0.0057 | NET NO AUTH LOW CX | Type Confusion in WebAudio in Google Chrome prior to 150.0.7871.182 allowed a re | |
|
65
|
CVE-2026-18733 |
7.5 | 0.0057 | NET NO AUTH LOW CX | A prompt injection vulnerability in the shell tool in Amazon Strands Agents Tool | |
|
55
|
CVE-2026-96280 |
7.5 | 0.0057 | NET NO AUTH | The OCI delta stream parser read sizes as guint64 but passed them to GLib I/O an |