Hunt List
8,543 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-61738 |
10.0 | 0.0056 | NET NO AUTH LOW CX NO UI | SOCFortress CoPilot focuses on providing a single pane of glass for all your sec | |
|
80
|
CVE-2026-28982 |
9.8 | 0.0056 | NET NO AUTH LOW CX NO UI | A race condition was addressed with improved locking. This issue is fixed in mac | |
|
80
|
CVE-2026-45336 |
10.0 | 0.0056 | NET NO AUTH LOW CX NO UI | HireFlow is a web-based interview management system for managing candidates, sch | |
|
80
|
CVE-2026-27429 |
9.8 | 0.0056 | NET NO AUTH LOW CX NO UI | Unauthenticated PHP Object Injection in Nifty <= 1.4.1 versions. | |
|
80
|
CVE-2026-16382 |
9.8 | 0.0056 | NET NO AUTH LOW CX NO UI | Mitigation bypass in the DOM: Service Workers component. This vulnerability was | |
|
80
|
CVE-2023-1357 |
9.8 | 0.0055 | NET NO AUTH LOW CX NO UI | A vulnerability, which was classified as critical, has been found in SourceCodes | |
|
80
|
CVE-2024-53177 |
9.8 | 0.0055 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: smb: preven | |
|
80
|
CVE-2026-48056 |
10.0 | 0.0055 | NET NO AUTH LOW CX NO UI | Streambert is a cross-platform Electron Desktop App to stream and download video | |
|
80
|
CVE-2026-84295 |
10.0 | 0.0055 | NET NO AUTH LOW CX NO UI | Improper authentication in Progress Software WS_FTP Server versions prior to 202 | |
|
80
|
CVE-2026-16235 |
9.8 | 0.0055 | NET NO AUTH LOW CX NO UI | Crypt::Password versions through 0.28 for Perl generate insecure random values f | |
|
79
|
CVE-2026-79872 |
9.4 | 0.0056 | NET NO AUTH LOW CX NO UI | A buffer overflow vulnerability exists in the underlying operating system of AOS | |
|
79
|
CVE-2026-61884 |
9.3 | 0.0056 | NET NO AUTH LOW CX NO UI | The Tycon Systems TPDIN-Monitor-WEB2 ships without HTTP credentials configured, | |
|
79
|
CVE-2025-34522 |
9.2 | 0.0056 | NET NO AUTH LOW CX NO UI | A heap-based buffer overflow vulnerability exists in the input parsing logic of | |
|
79
|
CVE-2026-42882 |
9.4 | 0.0055 | NET NO AUTH LOW CX NO UI | oxyno-zeta/s3-proxy is an aws s3 proxy written in go. Prior to 5.0.0, s3-proxy c | |
|
79
|
CVE-2026-35047 |
9.3 | 0.0055 | NET NO AUTH LOW CX NO UI | Brave CMS is an open-source CMS. Prior to 2.0.6, an Unrestricted File Upload vul | |
|
79
|
CVE-2026-6074 |
9.3 | 0.0055 | NET NO AUTH LOW CX NO UI | Intrado 911 Emergency Gateway (EGW) 5.x, 6.x, and 7.x contain a path traversal v | |
|
79
|
CVE-2026-65318 |
9.2 | 0.0055 | NET NO AUTH LOW CX NO UI | Verba RAG application version 2.1.3 contains an unauthenticated server-side requ | |
|
78
|
CVE-2026-48830 |
9.1 | 0.0056 | NET NO AUTH LOW CX NO UI | Improper authentication in Apache bRPC through 1.17.0 allows a remote unauthenti | |
|
78
|
CVE-2026-62184 |
8.7 | 0.0056 | NET NO AUTH LOW CX NO UI | luci-app-banip contains a log parsing vulnerability where the awk-based parser e | |
|
78
|
CVE-2026-54078 |
8.7 | 0.0056 | NET NO AUTH LOW CX NO UI | veraPDF validation model is an implementation of the veraPDF validation model. F | |
|
78
|
CVE-2026-54079 |
8.7 | 0.0056 | NET NO AUTH LOW CX NO UI | veraPDF validation provides PDF/A and PDF/UA validation, feature reporting, and | |
|
78
|
CVE-2026-55629 |
8.7 | 0.0055 | NET NO AUTH LOW CX NO UI | Whistle is an HTTP, HTTP2, HTTPS, and WebSocket debugging proxy. Prior to 2.10.3 | |
|
77
|
CVE-2026-58014 |
8.6 | 0.0056 | NET NO AUTH LOW CX NO UI | A flaw was found in GLib. An off-by-one error can occur in the g_key_file_get_lo | |
|
77
|
CVE-2026-28808 |
8.3 | 0.0056 | NET NO AUTH LOW CX NO UI | Incorrect Authorization vulnerability in Erlang OTP (inets modules) allows unaut | |
|
77
|
CVE-2026-48448 |
8.6 | 0.0056 | NET NO AUTH LOW CX NO UI | Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Specia | |
|
76
|
CVE-2026-67363 |
7.7 | 0.0056 | NET NO AUTH LOW CX NO UI | Joomla Extension - balbooa.com - Pre-auth Payment Amount Tampering in Balbooa Fo | |
|
75
|
CVE-2026-18828 |
7.5 | 0.0056 | NET NO AUTH LOW CX NO UI | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to c | |
|
75
|
CVE-2026-116690 |
7.5 | 0.0056 | NET NO AUTH LOW CX NO UI | MLflow is an open source AI engineering platform for agents, large language mode | |
|
75
|
CVE-2026-20338 |
7.5 | 0.0056 | NET NO AUTH LOW CX NO UI | A vulnerability in the zip archive parser of ClamAV could allow an unauthenticat | |
|
75
|
CVE-2026-48042 |
7.5 | 0.0056 | NET NO AUTH LOW CX NO UI | Envoy is an open source edge and service proxy designed for cloud-native applica | |
|
75
|
CVE-2026-59892 |
7.5 | 0.0056 | NET NO AUTH LOW CX NO UI | OpenTelemetry JavaScript is the OpenTelemetry JavaScript client. Prior to 2.9.0, | |
|
75
|
CVE-2026-59675 |
7.5 | 0.0056 | NET NO AUTH LOW CX NO UI | When API audit logging is enabled, the middleware reads the entire HTTP request | |
|
75
|
CVE-2026-41114 |
7.5 | 0.0056 | NET NO AUTH LOW CX NO UI | Uncontrolled Resource Consumption vulnerability in Apache IoTDB JDBC driver. | |
|
75
|
CVE-2026-28936 |
7.5 | 0.0056 | NET NO AUTH LOW CX NO UI | The issue was addressed with improved checks. This issue is fixed in iOS 18.7.9 | |
|
75
|
CVE-2026-46581 |
7.5 | 0.0056 | NET NO AUTH LOW CX NO UI | In Eclipse Mojarra versions 2.3 and following, URL handing in `DefaultFaceletFac | |
|
75
|
CVE-2026-94266 |
7.5 | 0.0056 | NET NO AUTH LOW CX NO UI | libcurl could accidentally return a URL for `curl_easy_getinfo()`'s `CURLINFO_EF | |
|
75
|
CVE-2026-118779 |
7.5 | 0.0056 | NET NO AUTH LOW CX NO UI | Forge (also called node-forge) is a native implementation of Transport Layer Sec | |
|
69
|
CVE-2026-47705 |
9.6 | 0.0056 | NET NO AUTH LOW CX | TypeBot is a chatbot builder tool. Version 3.16.1 has a CSV injection vulnerabil | |
|
69
|
CVE-2026-73032 |
9.4 | 0.0056 | NET NO AUTH LOW CX | PapersGPT for Zotero 0.6.1 contains a remote code execution vulnerability that a | |
|
69
|
CVE-2026-119717 |
9.2 | 0.0056 | NET NO AUTH NO UI | pybars4 through 0.9.13 contains a code injection vulnerability in pybars/_compil | |
|
69
|
CVE-2026-17687 |
9.6 | 0.0056 | NET NO AUTH LOW CX | Type Confusion in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote | |
|
69
|
CVE-2026-6296 |
9.6 | 0.0056 | NET NO AUTH LOW CX | Heap buffer overflow in ANGLE in Google Chrome prior to 147.0.7727.101 allowed a | |
|
68
|
CVE-2026-96275 |
8.8 | 0.0056 | NET NO AUTH LOW CX | A malicious or compromised Flatpak repository can write attacker-controlled cont | |
|
68
|
CVE-2026-112659 |
8.8 | 0.0056 | NET NO AUTH LOW CX | A type confusion issue was addressed with improved memory handling. This issue i | |
|
67
|
CVE-2026-9585 |
8.6 | 0.0055 | NET NO AUTH LOW CX | An unauthenticated reflected cross-site scripting (XSS) vulnerability exists in | |
|
66
|
CVE-2026-57743 |
8.1 | 0.0056 | NET NO AUTH NO UI | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP | |
|
66
|
CVE-2025-40158 |
8.1 | 0.0056 | NET NO AUTH NO UI | In the Linux kernel, the following vulnerability has been resolved: ipv6: use R | |
|
65
|
CVE-2026-41615 |
7.4 | 0.0056 | NET NO AUTH LOW CX | Exposure of sensitive information to an unauthorized actor in Microsoft Authenti | |
|
65
|
CVE-2026-66745 |
7.5 | 0.0055 | NET NO AUTH LOW CX | Artica Proxy before 4.50.000000 Service Pack 7 (fixed in hotfix 20260724-02) con | |
|
55
|
CVE-2026-97789 |
7.5 | 0.0056 | NET NO AUTH | Use after free in Remote Desktop Client allows an unauthorized attacker to execu |