Hunt List
8,546 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-59147 |
9.8 | 0.0055 | NET NO AUTH LOW CX NO UI | Data::DisjointSet::Shared versions before 0.02 for Perl allow out-of-bounds read | |
|
80
|
CVE-2026-71254 |
9.8 | 0.0055 | NET NO AUTH LOW CX NO UI | nanoMODBUS through v1.23.0 contains an out-of-bounds write in the Modbus server- | |
|
80
|
CVE-2026-71256 |
9.8 | 0.0055 | NET NO AUTH LOW CX NO UI | nanoMODBUS through v1.23.0 contains an out-of-bounds stack read leading to a wil | |
|
80
|
CVE-2026-71267 |
9.8 | 0.0055 | NET NO AUTH LOW CX NO UI | microtar's mtar_write_file_header and mtar_write_dir_header functions (src/micro | |
|
80
|
CVE-2026-106013 |
9.8 | 0.0055 | NET NO AUTH LOW CX NO UI | The Jupiter X Core plugin for WordPress is vulnerable to Authentication Bypass v | |
|
80
|
CVE-2026-99153 |
9.8 | 0.0055 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: scsi: libis | |
|
80
|
CVE-2026-89633 |
9.8 | 0.0055 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: smb: client | |
|
80
|
CVE-2026-16367 |
10.0 | 0.0055 | NET NO AUTH LOW CX NO UI | Sandbox escape due to invalid pointer in the Disability Access APIs component. T | |
|
80
|
CVE-2026-44277 |
9.8 | 0.0055 | NET NO AUTH LOW CX NO UI | A improper access control vulnerability in Fortinet FortiAuthenticator 8.0.2, Fo | |
|
80
|
CVE-2026-16388 |
9.8 | 0.0055 | NET NO AUTH LOW CX NO UI | Sandbox escape in the DOM: Networking component. This vulnerability was fixed in | |
|
80
|
CVE-2026-16410 |
9.8 | 0.0055 | NET NO AUTH LOW CX NO UI | JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability w | |
|
80
|
CVE-2026-13766 |
9.8 | 0.0055 | NET NO AUTH LOW CX NO UI | DBIx::QuickORM versions before 0.000026 for Perl allow SQL injection via unquote | |
|
80
|
CVE-2026-60264 |
9.8 | 0.0055 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (compo | |
|
80
|
CVE-2026-115806 |
9.8 | 0.0055 | NET NO AUTH LOW CX NO UI | The Prime Mover – Backup and Migration plugin for WordPress is vulnerable to PHP | |
|
79
|
CVE-2026-64639 |
9.3 | 0.0055 | NET NO AUTH LOW CX NO UI | Incorrect database cloning process in Plesk from 18.0.52 before 18.0.79.6 and 18 | |
|
79
|
CVE-2026-65886 |
9.2 | 0.0055 | NET NO AUTH LOW CX NO UI | Joomla Extension - balbooa.com - Unauthenticated arbitrary file read in Gridbox | |
|
79
|
CVE-2026-1496 |
9.3 | 0.0055 | NET NO AUTH LOW CX NO UI | Vulnerable versions of Coverity Connect lack an error handler in the authenticat | |
|
79
|
CVE-2023-54344 |
9.3 | 0.0055 | NET NO AUTH LOW CX NO UI | Eclipse Equinox OSGi 3.7.2 and earlier contains a remote code execution vulnerab | |
|
79
|
CVE-2026-48777 |
9.3 | 0.0055 | NET NO AUTH LOW CX NO UI | FileBrowser Quantum is a free, self-hosted, web-based file manager. Versions pri | |
|
79
|
CVE-2026-59106 |
9.3 | 0.0055 | NET NO AUTH LOW CX NO UI | A security vulnerability has been identified in the WolfProt interface implement | |
|
79
|
CVE-2026-101986 |
9.3 | 0.0055 | NET NO AUTH LOW CX NO UI | An Improper Authentication vulnerability in J-Web of Juniper Networks Junos OS | |
|
78
|
CVE-2026-60007 |
9.1 | 0.0055 | NET NO AUTH LOW CX NO UI | In Eclipse Milo versions 0.6.0 through 1.1.4, username-token processing returns | |
|
78
|
CVE-2026-56122 |
8.7 | 0.0055 | NET NO AUTH LOW CX NO UI | Winstone Servlet Engine through 0.9.10 contains a path traversal vulnerability t | |
|
78
|
CVE-2010-20125 |
8.7 | 0.0055 | NET NO AUTH LOW CX NO UI | DedeCMS before 5.7 contains a file inclusion vulnerability in plus/carbuyaction. | |
|
78
|
CVE-2026-73381 |
9.1 | 0.0055 | NET NO AUTH LOW CX NO UI | Unauthenticated Broken Authentication in Popup by Supsystic <= 1.13.0 versions. | |
|
78
|
CVE-2026-42856 |
8.7 | 0.0055 | NET NO AUTH LOW CX NO UI | Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to 5.1.3, the | |
|
78
|
CVE-2026-14161 |
8.7 | 0.0055 | NET NO AUTH LOW CX NO UI | Hospital Quening Management developed by Advantech has a Sensitive Data Exposure | |
|
78
|
CVE-2026-73523 |
8.7 | 0.0055 | NET NO AUTH LOW CX NO UI | COVESA Open1722 through 0.9.2 contains an integer truncation vulnerability in ac | |
|
77
|
CVE-2026-120135 |
8.2 | 0.0055 | NET NO AUTH LOW CX NO UI | Uncontrolled Recursion vulnerability in Apache Thrift Java bindings. This iss | |
|
77
|
CVE-2026-65832 |
8.2 | 0.0055 | NET NO AUTH LOW CX NO UI | Deskflow is a keyboard and mouse sharing app. Prior to continuous build 1.26.0.2 | |
|
77
|
CVE-2026-46591 |
8.2 | 0.0055 | NET NO AUTH LOW CX NO UI | Improper Neutralization of Special Elements in Data Query Logic vulnerability in | |
|
77
|
CVE-2026-112893 |
8.2 | 0.0055 | NET NO AUTH LOW CX NO UI | Pillow is a Python imaging library. From 10.0.0 until 13.0.0, Pillow can free an | |
|
75
|
CVE-2023-29105 |
7.5 | 0.0055 | NET NO AUTH LOW CX NO UI | A vulnerability has been identified in SIMATIC Cloud Connect 7 CC712 (All versio | |
|
75
|
CVE-2026-34148 |
7.5 | 0.0055 | NET NO AUTH LOW CX NO UI | Fedify is a TypeScript library for building federated server apps powered by Act | |
|
75
|
CVE-2026-55390 |
7.5 | 0.0055 | NET NO AUTH LOW CX NO UI | datamodel-code-generator generates Python data models from schema definitions. F | |
|
75
|
CVE-2026-111758 |
7.5 | 0.0055 | NET NO AUTH LOW CX NO UI | markdown-it is a Markdown parser. From versions 14.1.0 to before 14.3.3, and 15. | |
|
75
|
CVE-2026-82230 |
7.5 | 0.0055 | NET NO AUTH LOW CX NO UI | Uncontrolled recursion in the mcpack2pb component in Apache bRPC (version < 1.18 | |
|
75
|
CVE-2026-86146 |
7.5 | 0.0055 | NET NO AUTH LOW CX NO UI | Inconsistent interpretation of HTTP requests (HTTP request/response smuggling) i | |
|
75
|
CVE-2026-86147 |
7.5 | 0.0055 | NET NO AUTH LOW CX NO UI | External control of file name or path and uncontrolled resource consumption in A | |
|
75
|
CVE-2026-57876 |
7.5 | 0.0055 | NET NO AUTH LOW CX NO UI | An unauthenticated out-of-bounds write vulnerability exists in onvif.cgi in GeoV | |
|
75
|
CVE-2026-36478 |
7.5 | 0.0055 | NET NO AUTH LOW CX NO UI | An issue in Technitium DNS Server v.14.3 and before allows a remote attacker to | |
|
75
|
CVE-2026-9171 |
7.5 | 0.0055 | NET NO AUTH LOW CX NO UI | IBM WebSphere Application Server and WebSphere Application Server Liberty are vu | |
|
75
|
CVE-2026-14979 |
7.5 | 0.0055 | NET NO AUTH LOW CX NO UI | IBM Engineering Lifecycle Management 7.0.3 ( Interim Fix 001 through ) Interim F | |
|
69
|
CVE-2025-65200 |
9.6 | 0.0055 | NET NO AUTH LOW CX | An issue was discovered in localstack 4.9.2 allowing attackers to execute arbitr | |
|
68
|
CVE-2026-55249 |
8.8 | 0.0055 | NET NO AUTH LOW CX | @rtk-ai/rtk-rewrite transparently rewrites shell commands executed via OpenClaw' | |
|
68
|
CVE-2026-71851 |
9.0 | 0.0055 | NET NO AUTH NO UI | crypto-js is a JavaScript library of crypto standards. Versions of crypto-js pri | |
|
66
|
CVE-2026-79891 |
8.1 | 0.0055 | NET NO AUTH NO UI | A buffer overflow vulnerability exists in the command line interface of AOS-8 th | |
|
64
|
CVE-2026-53875 |
7.1 | 0.0055 | NET NO AUTH LOW CX | picklescan before 1.0.3 contains a scanning bypass vulnerability in the scan_pyt | |
|
58
|
CVE-2026-58592 |
8.9 | 0.0055 | NET NO AUTH | Ladybird before commit 2f9dc7e contains a dangling-reference memory-safety flaw | |
|
55
|
CVE-2026-57574 |
7.4 | 0.0055 | NET NO AUTH | Misskey is an open source, federated social media platform. Prior to 2026.6.0, M |