Hunt List
8,546 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-60366 |
10.0 | 0.0055 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion | |
|
80
|
CVE-2026-49767 |
9.8 | 0.0055 | NET NO AUTH LOW CX NO UI | Unauthenticated Broken Authentication in wpForo Forum <= 3.1.0 versions. | |
|
80
|
CVE-2026-60367 |
9.8 | 0.0055 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion | |
|
80
|
CVE-2026-60372 |
9.8 | 0.0055 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion | |
|
80
|
CVE-2026-66662 |
9.8 | 0.0055 | NET NO AUTH LOW CX NO UI | Unauthenticated Privilege Escalation in Frontend Admin by DynamiApps <= 3.29.10 | |
|
80
|
CVE-2026-42370 |
9.8 | 0.0055 | NET NO AUTH LOW CX NO UI | A stack overflow vulnerability exists in the WebCam Server Login functionality o | |
|
80
|
CVE-2026-44887 |
9.8 | 0.0054 | NET NO AUTH LOW CX NO UI | Pi.Alert is a WIFI / LAN intruder detector with web service monitoring. Prior to | |
|
80
|
CVE-2026-60024 |
9.8 | 0.0054 | NET NO AUTH LOW CX NO UI | Joomla Extension - joomdonation.com - Insecure default configuration Events Book | |
|
80
|
CVE-2026-17032 |
9.8 | 0.0054 | NET NO AUTH LOW CX NO UI | Multiple Supsystic Pro plugins were distributed with malicious code through the | |
|
79
|
CVE-2026-35503 |
9.3 | 0.0055 | NET NO AUTH LOW CX NO UI | A vulnerability in SenseLive X3050’s web management interface allows authenticat | |
|
79
|
CVE-2026-59099 |
9.3 | 0.0055 | NET NO AUTH LOW CX NO UI | Apereo CAS 7.3.0 before 8.0.0-RC6 contains a cryptographic vulnerability that al | |
|
79
|
CVE-2026-40620 |
9.3 | 0.0055 | NET NO AUTH LOW CX NO UI | A vulnerability in SenseLive X3050’s embedded management service allows full adm | |
|
79
|
CVE-2026-22096 |
9.3 | 0.0055 | NET NO AUTH LOW CX NO UI | The webserver running on port 8090 does not require authentication. This allows | |
|
78
|
CVE-2023-54203 |
9.1 | 0.0055 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix | |
|
78
|
CVE-2026-57845 |
8.7 | 0.0055 | NET NO AUTH LOW CX | 1 PoC | Hugging Face Datasets through 5.1.0 contains an insecure deserialization vulnera |
|
78
|
CVE-2026-54309 |
8.8 | 0.0055 | NET NO AUTH LOW CX NO UI | n8n is an open source workflow automation platform. Prior to 2.25.7 and 2.26.2, | |
|
78
|
CVE-2026-67185 |
8.7 | 0.0055 | NET NO AUTH LOW CX NO UI | TinyWeb through 0.0.8 contains a path traversal vulnerability that allows unauth | |
|
78
|
CVE-2026-89671 |
9.1 | 0.0054 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: nfsd: gate | |
|
77
|
CVE-2026-48795 |
8.6 | 0.0055 | NET NO AUTH LOW CX NO UI | AdonisJS is a TypeScript-first web framework. From 10.1.3 until 10.1.5 and 11.0. | |
|
75
|
CVE-2026-46600 |
7.5 | 0.0055 | NET NO AUTH LOW CX NO UI | Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value | |
|
75
|
CVE-2026-16308 |
7.5 | 0.0055 | NET NO AUTH LOW CX NO UI | IBM Enterprise Build of Quarkus 3.27.1 through 3.27.4.SP2, and 3.33.1 through 3. | |
|
75
|
CVE-2026-16931 |
7.5 | 0.0055 | NET NO AUTH LOW CX NO UI | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of | |
|
75
|
CVE-2026-17271 |
7.5 | 0.0055 | NET NO AUTH LOW CX NO UI | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of | |
|
75
|
CVE-2026-71675 |
7.5 | 0.0055 | NET NO AUTH LOW CX NO UI | An issue in Open5GS v.2.7.0 allows a remote attacker to cause a denial of servic | |
|
75
|
CVE-2026-16690 |
7.5 | 0.0055 | NET NO AUTH LOW CX NO UI | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to c | |
|
75
|
CVE-2026-16706 |
7.5 | 0.0055 | NET NO AUTH LOW CX NO UI | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to c | |
|
75
|
CVE-2026-16817 |
7.5 | 0.0055 | NET NO AUTH LOW CX NO UI | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to c | |
|
75
|
CVE-2026-16818 |
7.5 | 0.0055 | NET NO AUTH LOW CX NO UI | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to c | |
|
75
|
CVE-2026-16824 |
7.5 | 0.0055 | NET NO AUTH LOW CX NO UI | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to c | |
|
75
|
CVE-2026-16831 |
7.5 | 0.0055 | NET NO AUTH LOW CX NO UI | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to c | |
|
75
|
CVE-2026-16836 |
7.5 | 0.0055 | NET NO AUTH LOW CX NO UI | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to c | |
|
75
|
CVE-2026-16852 |
7.5 | 0.0055 | NET NO AUTH LOW CX NO UI | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to c | |
|
75
|
CVE-2026-16924 |
7.5 | 0.0055 | NET NO AUTH LOW CX NO UI | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to c | |
|
75
|
CVE-2026-17121 |
7.5 | 0.0055 | NET NO AUTH LOW CX NO UI | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to c | |
|
75
|
CVE-2026-17159 |
7.5 | 0.0055 | NET NO AUTH LOW CX NO UI | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to c | |
|
75
|
CVE-2026-17163 |
7.5 | 0.0055 | NET NO AUTH LOW CX NO UI | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to c | |
|
75
|
CVE-2026-17165 |
7.5 | 0.0055 | NET NO AUTH LOW CX NO UI | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to c | |
|
75
|
CVE-2026-17170 |
7.5 | 0.0055 | NET NO AUTH LOW CX NO UI | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to c | |
|
75
|
CVE-2026-102486 |
7.5 | 0.0055 | NET NO AUTH LOW CX NO UI | Out-of-bounds read in NTS extension field parsing in NTPsec ntpd 1.1.4 through 1 | |
|
75
|
CVE-2026-57220 |
7.5 | 0.0055 | NET NO AUTH LOW CX NO UI | RabbitMQ is a messaging and streaming broker. Prior to 4.2.6, the RabbitMQ strea | |
|
75
|
CVE-2026-55389 |
7.5 | 0.0055 | NET NO AUTH LOW CX NO UI | datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, a | |
|
75
|
CVE-2026-57874 |
7.5 | 0.0055 | NET NO AUTH LOW CX NO UI | An unauthenticated buffer overflow vulnerability exists in IEEE8021x_upload.cgi | |
|
75
|
CVE-2026-16928 |
7.5 | 0.0055 | NET NO AUTH LOW CX NO UI | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to c | |
|
75
|
CVE-2026-17120 |
7.5 | 0.0055 | NET NO AUTH LOW CX NO UI | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to c | |
|
75
|
CVE-2026-17425 |
7.5 | 0.0055 | NET NO AUTH LOW CX NO UI | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to c | |
|
69
|
CVE-2026-17655 |
9.6 | 0.0055 | NET NO AUTH LOW CX | Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 15 | |
|
69
|
CVE-2026-17697 |
9.6 | 0.0054 | NET NO AUTH LOW CX | Type Confusion in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote | |
|
68
|
CVE-2026-85339 |
8.8 | 0.0054 | NET NO AUTH LOW CX | Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows | |
|
66
|
CVE-2026-17496 |
8.1 | 0.0055 | NET NO AUTH LOW CX | NoteGen before 0.32.0 renders AI chat responses with markdown-it configured with | |
|
64
|
CVE-2026-74038 |
7.0 | 0.0055 | NET NO AUTH LOW CX | Wazuh 4.0.0 before 4.14.6 contains a path traversal vulnerability that allows un |