Hunt List
8,547 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-45568 |
9.9 | 0.0054 | NET NO AUTH LOW CX NO UI | zrok is software for sharing web services, files, and network resources. Prior t | |
|
80
|
CVE-2026-7415 |
9.8 | 0.0054 | NET NO AUTH LOW CX NO UI | The MQTT broker embedded in Yarbo firmware v2.3.9 is configured to allow anonymo | |
|
80
|
CVE-2026-41497 |
9.8 | 0.0054 | NET NO AUTH LOW CX NO UI | PraisonAI is a multi-agent teams system. Prior to version 4.6.9, the fix for Pra | |
|
80
|
CVE-2026-43779 |
9.8 | 0.0054 | NET NO AUTH LOW CX NO UI | A logic issue was addressed with improved restrictions. This issue is fixed in m | |
|
80
|
CVE-2026-64702 |
9.8 | 0.0054 | NET NO AUTH LOW CX NO UI | An access issue was addressed with additional sandbox restrictions. This issue i | |
|
80
|
CVE-2026-1114 |
9.8 | 0.0054 | NET NO AUTH LOW CX NO UI | In parisneo/lollms version 2.1.0, the application's session management is vulner | |
|
79
|
CVE-2026-63190 |
9.4 | 0.0054 | NET NO AUTH LOW CX NO UI | FearlessCMS is a flat-file `content` management system centered on simplicity an | |
|
79
|
CVE-2026-120209 |
9.3 | 0.0054 | NET NO AUTH LOW CX NO UI | AJ-Report through 1.7.1 signs share tokens with a hard-coded JWT secret, allowin | |
|
79
|
CVE-2026-7166 |
9.2 | 0.0054 | NET NO AUTH LOW CX NO UI | Vulnerability involving the exposure of sensitive data provided without adequate | |
|
79
|
CVE-2026-12819 |
9.3 | 0.0054 | NET NO AUTH LOW CX NO UI | Delta Electronics DVP12SE PLC exposes a Modbus TCP service over a specified port | |
|
79
|
CVE-2026-67341 |
9.3 | 0.0054 | NET NO AUTH LOW CX NO UI | ArcadeDB versions before 26.7.2 fail to enforce scripting authorization checks o | |
|
79
|
CVE-2026-67342 |
9.3 | 0.0054 | NET NO AUTH LOW CX NO UI | ArcadeDB versions before 26.7.2 contain an authorization bypass vulnerability in | |
|
79
|
CVE-2026-49973 |
9.2 | 0.0054 | NET NO AUTH LOW CX NO UI | Hermes WebUI before version 0.51.358 contains an improper access control vulnera | |
|
78
|
CVE-2026-32688 |
8.7 | 0.0054 | NET NO AUTH LOW CX NO UI | Allocation of Resources Without Limits or Throttling vulnerability in elixir-plu | |
|
78
|
CVE-2026-16520 |
8.7 | 0.0054 | NET NO AUTH LOW CX NO UI | Improper input validation and Exposure of sensitive information through data que | |
|
78
|
CVE-2026-69079 |
8.7 | 0.0054 | NET NO AUTH LOW CX NO UI | CTI-Transmute contains an uncontrolled resource-consumption vulnerability in the | |
|
78
|
CVE-2026-47660 |
8.7 | 0.0054 | NET NO AUTH LOW CX NO UI | Pathling is a set of tools that make it easier to use FHIR and clinical terminol | |
|
78
|
CVE-2024-7952 |
8.7 | 0.0054 | NET NO AUTH LOW CX NO UI | A data exposure vulnerability exists in the affected product. There are hardcode | |
|
78
|
CVE-2025-40797 |
8.7 | 0.0054 | NET NO AUTH LOW CX NO UI | A vulnerability has been identified in SIMATIC PCS neo V4.1 (All versions), SIMA | |
|
78
|
CVE-2025-40798 |
8.7 | 0.0054 | NET NO AUTH LOW CX NO UI | A vulnerability has been identified in SIMATIC PCS neo V4.1 (All versions), SIMA | |
|
75
|
CVE-2026-52794 |
7.5 | 0.0054 | NET NO AUTH LOW CX NO UI | Sentry is an error tracking and performance monitoring tool. From 24.4.0 until 2 | |
|
75
|
CVE-2026-24255 |
7.5 | 0.0054 | NET NO AUTH LOW CX NO UI | NVIDIA Dynamo for Linux contains a vulnerability in the multimodal embedding cac | |
|
75
|
CVE-2026-30778 |
7.5 | 0.0054 | NET NO AUTH LOW CX NO UI | The SkyWalking OAP /debugging/config/dump endpoint may leak sensitive configurat | |
|
75
|
CVE-2026-33337 |
7.5 | 0.0054 | NET NO AUTH LOW CX NO UI | Firebird is an open-source relational database management system. In versions pr | |
|
75
|
CVE-2026-114613 |
7.5 | 0.0054 | NET NO AUTH LOW CX NO UI | MessagePack is the serializer implementation for Python msgpack.org. Prior to 1. | |
|
75
|
CVE-2026-41643 |
7.5 | 0.0054 | NET NO AUTH LOW CX NO UI | GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go P | |
|
75
|
CVE-2026-11622 |
7.5 | 0.0054 | NET NO AUTH LOW CX NO UI | A DNSSEC validating resolver that is under a random subdomain attack against a D | |
|
75
|
CVE-2026-28848 |
7.5 | 0.0054 | NET NO AUTH LOW CX NO UI | A buffer overflow was addressed with improved bounds checking. This issue is fix | |
|
75
|
CVE-2026-37453 |
7.5 | 0.0054 | NET NO AUTH LOW CX NO UI | Insecure Permissions vulnerability in MSI NBFoundation Service v.2.0.2506.1201 a | |
|
75
|
CVE-2026-67867 |
7.5 | 0.0054 | NET NO AUTH LOW CX NO UI | Buffer Overflow vulnerability in Systerel S2OPC 1.7.3 allows a remote attacker t | |
|
68
|
CVE-2026-85936 |
8.8 | 0.0054 | NET NO AUTH LOW CX | Double free in Windows Shell allows an unauthorized attacker to execute code ove | |
|
68
|
CVE-2026-112637 |
8.8 | 0.0054 | NET NO AUTH LOW CX | A use-after-free issue was addressed with improved memory management. This issue | |
|
68
|
CVE-2026-83943 |
8.7 | 0.0054 | NET NO AUTH NO UI | Exposure of sensitive information to an unauthorized actor in Azure API Center a | |
|
67
|
CVE-2026-47826 |
8.5 | 0.0054 | NET NO AUTH LOW CX | The blobs.yml path key traversal vulnerability in the BOSH CLI tool allows an at | |
|
67
|
CVE-2026-69306 |
8.2 | 0.0054 | NET NO AUTH LOW CX | Not failing securely ('failing open') in Visual Studio Code allows an unauthoriz | |
|
67
|
CVE-2026-81356 |
8.2 | 0.0054 | NET NO AUTH LOW CX | Inconsistent interpretation of http requests ('http request/response smuggling') | |
|
67
|
CVE-2026-81378 |
8.2 | 0.0054 | NET NO AUTH LOW CX | Interpretation conflict in Visual Studio Code allows an unauthorized attacker to | |
|
67
|
CVE-2026-81379 |
8.2 | 0.0054 | NET NO AUTH LOW CX | Not failing securely ('failing open') in Visual Studio Code allows an unauthoriz | |
|
66
|
CVE-2026-32623 |
7.7 | 0.0054 | NET NO AUTH LOW CX | xrdp is an open source RDP server. Versions through 0.10.5 contain a heap-based | |
|
66
|
CVE-2026-55729 |
7.7 | 0.0054 | NET NO AUTH LOW CX | Exposure of Sensitive Information (CWE-200) in LWEB802 browser `localStorage` in | |
|
66
|
CVE-2026-18781 |
8.1 | 0.0054 | NET NO AUTH NO UI | The Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin befor | |
|
66
|
CVE-2026-62778 |
8.1 | 0.0054 | NET NO AUTH NO UI | Use after free in Windows DNS allows an unauthorized attacker to elevate privile | |
|
66
|
CVE-2026-66802 |
8.1 | 0.0054 | NET NO AUTH NO UI | Concurrent execution using shared resource with improper synchronization ('race | |
|
66
|
CVE-2026-42900 |
8.1 | 0.0054 | NET NO AUTH NO UI | Concurrent execution using shared resource with improper synchronization ('race | |
|
66
|
CVE-2026-50460 |
8.1 | 0.0054 | NET NO AUTH NO UI | Concurrent execution using shared resource with improper synchronization ('race | |
|
66
|
CVE-2026-62820 |
8.1 | 0.0054 | NET NO AUTH NO UI | Concurrent execution using shared resource with improper synchronization ('race | |
|
66
|
CVE-2026-69782 |
8.1 | 0.0054 | NET NO AUTH NO UI | Concurrent execution using shared resource with improper synchronization ('race | |
|
66
|
CVE-2026-69827 |
8.1 | 0.0054 | NET NO AUTH NO UI | Concurrent execution using shared resource with improper synchronization ('race | |
|
64
|
CVE-2026-58296 |
7.1 | 0.0054 | NET NO AUTH LOW CX | Exposure of private personal information to an unauthorized actor in Microsoft E | |
|
64
|
CVE-2026-58297 |
7.1 | 0.0054 | NET NO AUTH LOW CX | Exposure of private personal information to an unauthorized actor in Microsoft E |