Hunt List
8,554 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-20184 |
9.8 | 0.0052 | NET NO AUTH LOW CX NO UI | A vulnerability in the integration of single sign-on (SSO) with Control Hub in C | |
|
80
|
CVE-2026-7663 |
9.8 | 0.0052 | NET NO AUTH LOW CX NO UI | IBM Langflow OSS 1.0.0 through 1.9.6 could allow unauthenticated attackers to ac | |
|
80
|
CVE-2026-109220 |
9.8 | 0.0052 | NET NO AUTH LOW CX NO UI | The PDF Invoice for WooCommerce + Drag and Drop Template Builder plugin for Word | |
|
80
|
CVE-2026-46807 |
9.8 | 0.0052 | NET NO AUTH LOW CX NO UI | Vulnerability in the Identity Manager product of Oracle Fusion Middleware (compo | |
|
80
|
CVE-2026-58081 |
9.8 | 0.0052 | NET NO AUTH LOW CX NO UI | Several encoding modules, including HZ, UTF-7, VIQR, and ZW, did not properly ch | |
|
80
|
CVE-2026-58082 |
9.8 | 0.0052 | NET NO AUTH LOW CX NO UI | The ISO-2022 encoding module used a stack buffer sized to MB_LEN_MAX (6 bytes) f | |
|
80
|
CVE-2026-76934 |
9.8 | 0.0052 | NET NO AUTH LOW CX NO UI | Stack-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System | |
|
80
|
CVE-2026-76939 |
9.8 | 0.0052 | NET NO AUTH LOW CX NO UI | Heap-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System | |
|
80
|
CVE-2026-82118 |
9.8 | 0.0052 | NET NO AUTH LOW CX NO UI | Stack-based Buffer Overflow Vulnerability in HiRDB. This issue affects HiRDB S | |
|
80
|
CVE-2026-86574 |
9.8 | 0.0052 | NET NO AUTH LOW CX NO UI | Heap-based Buffer Overflow Vulnerability in JP1/Base. This issue affects JP1/Ba | |
|
80
|
CVE-2026-105781 |
10.0 | 0.0052 | NET NO AUTH LOW CX NO UI | Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Specia | |
|
80
|
CVE-2026-35312 |
9.8 | 0.0052 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Virtual Directory product of Oracle Fusion Middlewar | |
|
80
|
CVE-2026-46773 |
9.8 | 0.0052 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middlewar | |
|
80
|
CVE-2026-46774 |
9.8 | 0.0052 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middlewar | |
|
79
|
CVE-2026-119660 |
9.3 | 0.0052 | NET NO AUTH LOW CX NO UI | MuseBot before 2.0.0 contains an authentication bypass vulnerability that allows | |
|
79
|
CVE-2026-27843 |
9.2 | 0.0052 | NET NO AUTH LOW CX NO UI | A vulnerability exists in SenseLive X3050's web management interface that allows | |
|
78
|
CVE-2026-63230 |
9.1 | 0.0052 | NET NO AUTH LOW CX NO UI | A pre-authentication error-based SQL injection vulnerability in Koollab LMS allo | |
|
78
|
CVE-2026-103603 |
8.7 | 0.0052 | NET NO AUTH LOW CX NO UI | Memory allocation with excessive size value in the HSS/LMS signature code (HssPu | |
|
78
|
CVE-2026-31908 |
9.1 | 0.0052 | NET NO AUTH LOW CX NO UI | Header injection vulnerability in Apache APISIX. The attacker can take advantag | |
|
78
|
CVE-2026-48544 |
8.7 | 0.0052 | NET NO AUTH LOW CX NO UI | Taipy 4.1.1, fixed in commit 129fd40, contains a path traversal vulnerability in | |
|
78
|
CVE-2026-49851 |
8.7 | 0.0052 | NET NO AUTH LOW CX NO UI | Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, | |
|
78
|
CVE-2026-63101 |
8.7 | 0.0052 | NET NO AUTH LOW CX NO UI | Open Event Server through 1.19.1 contains a missing authentication vulnerability | |
|
78
|
CVE-2026-60027 |
8.7 | 0.0052 | NET NO AUTH LOW CX NO UI | Joomla Extension - themexpert.com - Unauthenticated path traversal / file read i | |
|
77
|
CVE-2026-21045 |
8.3 | 0.0052 | NET NO AUTH LOW CX NO UI | Out-of-bounds write in parsing TIFF format in libimagecodec.media.quram.so prior | |
|
77
|
CVE-2026-21048 |
8.3 | 0.0052 | NET NO AUTH LOW CX NO UI | Out-of-bounds write in parsing DNG format in libimagecodec.media.quram.so prior | |
|
77
|
CVE-2026-54058 |
8.3 | 0.0052 | NET NO AUTH LOW CX NO UI | Pillow is a Python imaging library. Prior to 12.3.0, when Pillow loads an uncomp | |
|
77
|
CVE-2025-15620 |
8.6 | 0.0052 | NET NO AUTH LOW CX NO UI | HiOS Switch Platform versions 09.1.00 through 09.4.04 and 10.0.00 through 10.3.0 | |
|
77
|
CVE-2026-70476 |
8.3 | 0.0052 | NET NO AUTH LOW CX NO UI | Flowise is a drag & drop user interface to build a customized large language mod | |
|
76
|
CVE-2026-8034 |
7.9 | 0.0052 | NET NO AUTH LOW CX NO UI | A server-side request forgery (SSRF) vulnerability was identified in the GitHub | |
|
75
|
CVE-2026-52196 |
7.5 | 0.0052 | NET NO AUTH LOW CX NO UI | Buffer Overflow vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows | |
|
75
|
CVE-2026-52195 |
7.5 | 0.0052 | NET NO AUTH LOW CX NO UI | Buffer Overflow vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows | |
|
75
|
CVE-2026-52190 |
7.5 | 0.0052 | NET NO AUTH LOW CX NO UI | Buffer Overflow vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows | |
|
75
|
CVE-2026-54405 |
7.5 | 0.0052 | NET NO AUTH LOW CX NO UI | A malicious actor with access to the network could exploit an Improper Input Val | |
|
75
|
CVE-2026-52187 |
7.5 | 0.0052 | NET NO AUTH LOW CX NO UI | Buffer Overflow vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows | |
|
75
|
CVE-2026-52189 |
7.5 | 0.0052 | NET NO AUTH LOW CX NO UI | Buffer Overflow vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows | |
|
75
|
CVE-2026-52191 |
7.5 | 0.0052 | NET NO AUTH LOW CX NO UI | Buffer Overflow vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows | |
|
75
|
CVE-2026-55379 |
7.5 | 0.0052 | NET NO AUTH LOW CX NO UI | Pillow is a Python imaging library. Prior to 12.3.0, PIL/BdfFontFile.py bdf_char | |
|
75
|
CVE-2026-113873 |
7.5 | 0.0052 | NET NO AUTH LOW CX NO UI | SmileCDR HAPI FHIR does not properly handle highly compressed data, allowing an | |
|
75
|
CVE-2026-87743 |
7.5 | 0.0052 | NET NO AUTH LOW CX NO UI | A flaw was found in Quarkus HTTP security. An unauthenticated attacker can explo | |
|
75
|
CVE-2026-56848 |
7.5 | 0.0052 | NET NO AUTH LOW CX NO UI | A flaw in Node.js HTTP/2 handling allows `nghttp2_session_mem_send()` to be call | |
|
75
|
CVE-2026-55677 |
7.5 | 0.0052 | NET NO AUTH LOW CX NO UI | Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, Echo's router and static | |
|
75
|
CVE-2026-24173 |
7.5 | 0.0052 | NET NO AUTH LOW CX NO UI | NVIDIA Triton Inference Server contains a vulnerability where an attacker could | |
|
75
|
CVE-2026-24174 |
7.5 | 0.0052 | NET NO AUTH LOW CX NO UI | NVIDIA Triton Inference Server contains a vulnerability where an attacker could | |
|
75
|
CVE-2026-55380 |
7.5 | 0.0052 | NET NO AUTH LOW CX NO UI | Pillow is a Python imaging library. Prior to 12.3.0, PIL/GdImageFile.py GdImageF | |
|
68
|
CVE-2026-41613 |
8.8 | 0.0052 | NET NO AUTH LOW CX | Session fixation in Visual Studio Code allows an unauthorized attacker to elevat | |
|
67
|
CVE-2026-54208 |
8.5 | 0.0052 | NET NO AUTH LOW CX | Tobit Laboratories AG TeamDavid's Webbox application is vulnerable to arbitrary | |
|
67
|
CVE-2026-62240 |
8.3 | 0.0052 | NET NO AUTH LOW CX | CrewAI before 1.15.1 contains a server-side request forgery vulnerability in the | |
|
66
|
CVE-2025-58955 |
8.1 | 0.0052 | NET NO AUTH NO UI | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP | |
|
66
|
CVE-2025-59550 |
8.1 | 0.0052 | NET NO AUTH NO UI | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP | |
|
55
|
CVE-2026-54499 |
7.5 | 0.0052 | NET NO AUTH | Stanza is a Stanford NLP Python library for tokenization, sentence segmentation, |