Hunt List
8,540 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
89
|
CVE-2017-20251 |
9.3 | 0.0056 | NET NO AUTH LOW CX NO UI | 1 PoC | WordPress Insert PHP plugin versions before 3.3.1 contain a PHP code injection v |
|
80
|
CVE-2026-32563 |
9.8 | 0.0056 | NET NO AUTH LOW CX NO UI | Subscriber PHP Object Injection in ACPT (Pro) - Custom Post Types Plugin for Wor | |
|
80
|
CVE-2026-42869 |
10.0 | 0.0056 | NET NO AUTH LOW CX NO UI | SOCFortress CoPilot focuses on providing a single pane of glass for all your sec | |
|
80
|
CVE-2026-34208 |
10.0 | 0.0056 | NET NO AUTH LOW CX NO UI | SandboxJS is a JavaScript sandboxing library. Prior to 0.8.36, SandboxJS blocks | |
|
80
|
CVE-2026-64738 |
9.8 | 0.0056 | NET NO AUTH LOW CX NO UI | A permissions issue was addressed with additional restrictions. This issue is fi | |
|
80
|
CVE-2026-58663 |
9.8 | 0.0056 | NET NO AUTH LOW CX NO UI | An authentication bypass vulnerability exists in Apache IoTDB's Thrift RPC servi | |
|
79
|
CVE-2026-74880 |
9.3 | 0.0056 | NET NO AUTH LOW CX NO UI | openssl_encrypt versions before 1.4.0 accept refresh tokens as URL query paramet | |
|
79
|
CVE-2026-54203 |
9.2 | 0.0056 | NET NO AUTH LOW CX NO UI | Memory Leak to an Unauthorized Actor vulnerability in Tobit Laboratories AG Team | |
|
79
|
CVE-2026-77645 |
9.2 | 0.0056 | NET NO AUTH LOW CX NO UI | A critical remote code execution (RCE) vulnerability has been reported in PTC Wi | |
|
78
|
CVE-2026-16926 |
9.1 | 0.0056 | NET NO AUTH LOW CX NO UI | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to o | |
|
78
|
CVE-2026-49357 |
8.8 | 0.0056 | NET NO AUTH LOW CX NO UI | Line Desktop MCP is a project that, while unaffiliated with the official line-bo | |
|
78
|
CVE-2026-49048 |
8.7 | 0.0056 | NET NO AUTH LOW CX NO UI | The Joomla extension JoomCCK exposes a front-end controller task, that builds tw | |
|
78
|
CVE-2026-64319 |
9.1 | 0.0056 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: | |
|
78
|
CVE-2026-14809 |
8.7 | 0.0056 | NET NO AUTH LOW CX NO UI | Prog Management System developed by PROG MIS has a SQL Injection vulnerability, | |
|
78
|
CVE-2026-44383 |
8.7 | 0.0056 | NET NO AUTH LOW CX NO UI | Multiple connections to the backend using the same charging station ID are allo | |
|
78
|
CVE-2021-48015 |
8.7 | 0.0056 | NET NO AUTH LOW CX NO UI | JeeWMS before commit 0a610e8 contains an unauthenticated path traversal vulnerab | |
|
78
|
CVE-2026-25718 |
9.1 | 0.0056 | NET NO AUTH LOW CX NO UI | Gitea versions before 1.25.5 mishandle path resolution during template repositor | |
|
78
|
CVE-2026-113682 |
9.1 | 0.0056 | NET NO AUTH LOW CX NO UI | Networknt light-4j from 2.1.5 before 2.4.0 contains an authentication bypass vul | |
|
78
|
CVE-2026-62292 |
8.7 | 0.0056 | NET NO AUTH LOW CX NO UI | libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1. | |
|
78
|
CVE-2026-86249 |
9.1 | 0.0056 | NET NO AUTH LOW CX NO UI | On a brpc::Server that sets both ServerOptions.auth and ServerOptions.internal_p | |
|
78
|
CVE-2026-96252 |
9.1 | 0.0056 | NET NO AUTH LOW CX NO UI | Improper verification of cryptographic signature in Active Directory Federation | |
|
78
|
CVE-2026-58016 |
9.1 | 0.0056 | NET NO AUTH LOW CX NO UI | A flaw was found in GLib. A state confusion issue exists in g_dbus_node_info_new | |
|
78
|
CVE-2026-55100 |
8.7 | 0.0056 | NET NO AUTH LOW CX NO UI | hashi-vault-js is a Node.js module for interacting with the HashiCorp Vault API. | |
|
78
|
CVE-2026-98549 |
9.1 | 0.0056 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: tcp: preven | |
|
78
|
CVE-2026-10130 |
8.8 | 0.0056 | NET NO AUTH LOW CX NO UI | QueryWeaver contains an authentication bypass vulnerability that allows unauthen | |
|
77
|
CVE-2023-53705 |
8.2 | 0.0056 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix o | |
|
77
|
CVE-2026-97200 |
8.2 | 0.0056 | NET NO AUTH LOW CX NO UI | Allocation of Resources Without Limits or Throttling vulnerability in hackney_co | |
|
77
|
CVE-2026-55117 |
8.6 | 0.0056 | NET NO AUTH LOW CX NO UI | A malicious actor with access to the network could exploit a Path Traversal vuln | |
|
75
|
CVE-2026-44248 |
7.5 | 0.0056 | NET NO AUTH LOW CX NO UI | Netty is an asynchronous, event-driven network application framework. Prior to 4 | |
|
75
|
CVE-2026-34645 |
7.5 | 0.0056 | NET NO AUTH LOW CX NO UI | Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2 | |
|
75
|
CVE-2026-47613 |
7.5 | 0.0056 | NET NO AUTH LOW CX NO UI | NVIDIA Dynamo for Linux contains a vulnerability where an attacker may cause imp | |
|
75
|
CVE-2026-47614 |
7.5 | 0.0056 | NET NO AUTH LOW CX NO UI | NVIDIA Dynamo for Linux contains a vulnerability where an attacker may cause ser | |
|
75
|
CVE-2026-47615 |
7.5 | 0.0056 | NET NO AUTH LOW CX NO UI | NVIDIA Dynamo for Linux contains a vulnerability where an attacker may cause ser | |
|
75
|
CVE-2026-47616 |
7.5 | 0.0056 | NET NO AUTH LOW CX NO UI | NVIDIA Dynamo for Linux contains a vulnerability in the multimodal media fetcher | |
|
75
|
CVE-2026-47617 |
7.5 | 0.0056 | NET NO AUTH LOW CX NO UI | NVIDIA Dynamo for Linux contains a vulnerability in the multimodal media fetcher | |
|
75
|
CVE-2026-47618 |
7.5 | 0.0056 | NET NO AUTH LOW CX NO UI | NVIDIA Dynamo for Linux contains a vulnerability in the Rust multimodal media fe | |
|
75
|
CVE-2026-85783 |
7.5 | 0.0056 | NET NO AUTH LOW CX NO UI | Crypt::Age versions before 0.004 for Perl allow CPU exhaustion via an unbounded | |
|
75
|
CVE-2026-97638 |
7.5 | 0.0056 | NET NO AUTH LOW CX NO UI | The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin f | |
|
75
|
CVE-2026-28991 |
7.5 | 0.0056 | NET NO AUTH LOW CX NO UI | An out-of-bounds read was addressed with improved bounds checking. This issue is | |
|
75
|
CVE-2026-20339 |
7.5 | 0.0056 | NET NO AUTH LOW CX NO UI | A vulnerability in the PESpin file format parser of ClamAV could allow an unauth | |
|
75
|
CVE-2026-20345 |
7.5 | 0.0056 | NET NO AUTH LOW CX NO UI | A vulnerability in the GPT file format parser of ClamAV could allow an unauthent | |
|
75
|
CVE-2026-20347 |
7.5 | 0.0056 | NET NO AUTH LOW CX NO UI | A vulnerability in the Mach-O file format parser of ClamAV could allow an unauth | |
|
68
|
CVE-2026-54232 |
8.8 | 0.0056 | NET NO AUTH LOW CX | vLLM is an inference and serving engine for large language models (LLMs). Prior | |
|
68
|
CVE-2026-58195 |
8.8 | 0.0056 | NET NO AUTH LOW CX | Agentic-Flow is an AI agent orchestration platform. Prior to 2.0.14, agentic-flo | |
|
68
|
CVE-2026-5272 |
8.8 | 0.0056 | NET NO AUTH LOW CX | Heap buffer overflow in GPU in Google Chrome prior to 146.0.7680.178 allowed a r | |
|
68
|
CVE-2026-113161 |
8.8 | 0.0056 | NET NO AUTH LOW CX | Use after free in WebRTC in Google Chrome prior to 156.0.8078.47 allowed a remot | |
|
68
|
CVE-2026-113202 |
8.8 | 0.0056 | NET NO AUTH LOW CX | Use after free in BrowserTag in Google Chrome prior to 156.0.8078.47 allowed a r | |
|
66
|
CVE-2026-11816 |
8.1 | 0.0056 | NET NO AUTH LOW CX | Keras versions prior to 3.14.0 are vulnerable to a path traversal issue in the a | |
|
64
|
CVE-2026-118485 |
7.0 | 0.0056 | NET NO AUTH LOW CX | Axel Download Accelerator 2.17.14 and earlier performs URL percent-decoding (htt | |
|
57
|
CVE-2026-58284 |
8.3 | 0.0056 | NET NO AUTH | Improper authorization in Microsoft Edge (Chromium-based) allows an unauthorized |