Hunt List
8,585 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-42933 |
10.0 | 0.0051 | NET NO AUTH LOW CX NO UI | Pronetiqs IntraVUE versions 3.2.1a14 and prior have an unintended proxy or inter | |
|
80
|
CVE-2026-64796 |
9.8 | 0.0051 | NET NO AUTH LOW CX NO UI | Joomla Extension - regularlabs.com - various code injection vectors in Sourcerer | |
|
80
|
CVE-2026-65879 |
9.8 | 0.0051 | NET NO AUTH LOW CX NO UI | Joomla Extension - joomshaper.com - Unauthenticated mail relay via a hardcoded, | |
|
80
|
CVE-2026-2346 |
9.8 | 0.0051 | NET NO AUTH LOW CX NO UI | Authorization bypass through User-Controlled key vulnerability in Menulux Softwa | |
|
80
|
CVE-2026-18749 |
9.8 | 0.0051 | NET NO AUTH LOW CX NO UI | The type=track branch authorises on _is_my_case(t_attach.case) only and never ch | |
|
80
|
CVE-2026-35431 |
10.0 | 0.0051 | NET NO AUTH LOW CX NO UI | Server-side request forgery (ssrf) in Microsoft Entra ID Entitlement Management | |
|
80
|
CVE-2026-61997 |
9.8 | 0.0051 | NET NO AUTH LOW CX NO UI | Unauthenticated PHP Object Injection in Legal Stone <= 1.2.11 versions. | |
|
80
|
CVE-2026-62002 |
9.8 | 0.0051 | NET NO AUTH LOW CX NO UI | Unauthenticated PHP Object Injection in Meals & Wheels <= 1.1.13 versions. | |
|
80
|
CVE-2026-42380 |
9.8 | 0.0051 | NET NO AUTH LOW CX NO UI | Unauthenticated PHP Object Injection in AI Lab < 5.4.2 versions. | |
|
80
|
CVE-2025-11708 |
9.8 | 0.0051 | NET NO AUTH LOW CX NO UI | Use-after-free in MediaTrackGraphImpl::GetInstance(). This vulnerability was fix | |
|
79
|
CVE-2024-58307 |
9.3 | 0.0051 | NET NO AUTH LOW CX NO UI | CSZCMS 1.3.0 contains an authenticated SQL injection vulnerability in the member | |
|
79
|
CVE-2026-56261 |
9.2 | 0.0051 | NET NO AUTH LOW CX NO UI | Crawl4AI before 0.8.7 contains a server-side request forgery (SSRF) vulnerabilit | |
|
79
|
CVE-2023-53969 |
9.3 | 0.0051 | NET NO AUTH LOW CX NO UI | Screen SFT DAB 600/C firmware 1.9.3 contains a session management vulnerability | |
|
79
|
CVE-2026-114087 |
9.2 | 0.0051 | NET NO AUTH LOW CX NO UI | Trigger.dev before 4.5.6 self-hosted Docker Compose deployments using the defaul | |
|
79
|
CVE-2026-53690 |
9.3 | 0.0051 | NET NO AUTH LOW CX NO UI | An SQL Injection vulnerability exists in Redeight CMS version 1.0 via the "userE | |
|
79
|
CVE-2026-58473 |
9.3 | 0.0051 | NET NO AUTH LOW CX NO UI | Cognee before 1.2.0 contains an improper access control vulnerability that allow | |
|
79
|
CVE-2026-61740 |
9.3 | 0.0051 | NET NO AUTH LOW CX NO UI | LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.4 | |
|
79
|
CVE-2026-93866 |
9.2 | 0.0051 | NET NO AUTH LOW CX NO UI | An integer overflow vulnerability in the WebSocket connection handling used by W | |
|
78
|
CVE-2026-49268 |
8.8 | 0.0051 | NET NO AUTH LOW CX NO UI | A remote attacker can inject LDAP special characters into the Distinguished Name | |
|
78
|
CVE-2026-53431 |
9.1 | 0.0051 | NET NO AUTH LOW CX NO UI | Authentication Bypass by Capture-replay vulnerability in malach-it Boruta allows | |
|
78
|
CVE-2026-58477 |
8.8 | 0.0051 | NET NO AUTH LOW CX NO UI | Sustainable Irrigation Platform (SIP) through version 5.2.16 contains a mass ass | |
|
78
|
CVE-2026-114142 |
8.8 | 0.0051 | NET NO AUTH LOW CX NO UI | toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.par | |
|
78
|
CVE-2026-87866 |
9.1 | 0.0051 | NET NO AUTH LOW CX NO UI | When built with wolfSSL, curl can successfully validate a pinned public key hash | |
|
78
|
CVE-2026-114139 |
9.1 | 0.0051 | NET NO AUTH LOW CX NO UI | Sentry-Javascript is an official Sentry SDKs for JavaScript. From 9.36.0 until 9 | |
|
78
|
CVE-2026-49127 |
8.8 | 0.0051 | NET NO AUTH LOW CX NO UI | Music Player Daemon (MPD) before version 0.24.11 contains a stack buffer overflo | |
|
77
|
CVE-2026-43970 |
8.2 | 0.0051 | NET NO AUTH LOW CX NO UI | Improper Handling of Highly Compressed Data (Data Amplification) vulnerability i | |
|
77
|
CVE-2026-71252 |
8.2 | 0.0051 | NET NO AUTH LOW CX NO UI | toner-management's admin state-changing handlers (add.php, edit.php, delete.php | |
|
77
|
CVE-2026-111280 |
8.3 | 0.0051 | NET NO AUTH LOW CX NO UI | snap7 through 1.4.3 contains an out-of-bounds write vulnerability in TSnap7Micro | |
|
76
|
CVE-2026-50197 |
7.8 | 0.0051 | NET NO AUTH LOW CX NO UI | Skipper is an HTTP router and reverse proxy for service composition. Prior to 0. | |
|
76
|
CVE-2026-63764 |
7.7 | 0.0051 | NET NO AUTH LOW CX NO UI | LMDeploy through 0.14.0, fixed in commit 03c3130, contains a server-side request | |
|
75
|
CVE-2026-101508 |
7.5 | 0.0051 | NET NO AUTH LOW CX NO UI | Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (compon | |
|
75
|
CVE-2026-54635 |
7.5 | 0.0051 | NET NO AUTH LOW CX NO UI | pytonapi is a Python SDK for TONAPI that provides REST API, streaming, and webho | |
|
75
|
CVE-2026-101520 |
7.5 | 0.0051 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Global Lifecycle Management NextGen OUI Framework pr | |
|
75
|
CVE-2026-79895 |
7.5 | 0.0051 | NET NO AUTH LOW CX NO UI | Vulnerabilities in the affected interface of AOS-10 could allow an unauthenticat | |
|
75
|
CVE-2023-54227 |
7.5 | 0.0051 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: blk-mq: fix | |
|
75
|
CVE-2026-52193 |
7.5 | 0.0051 | NET NO AUTH LOW CX NO UI | Buffer Overflow vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows | |
|
75
|
CVE-2026-54427 |
7.5 | 0.0051 | NET NO AUTH LOW CX NO UI | Uncontrolled recursion in the AMF parser in Apache bRPC < 1.18.0 allows a remote | |
|
75
|
CVE-2026-78066 |
7.5 | 0.0051 | NET NO AUTH LOW CX NO UI | Resource exhaustion in Apache bRPC (version < 1.18.0) on all platforms: multiple | |
|
75
|
CVE-2026-79704 |
7.5 | 0.0051 | NET NO AUTH LOW CX NO UI | An out-of-bounds read vulnerability exists in the streaming RPC client of Apache | |
|
69
|
CVE-2026-17671 |
9.6 | 0.0051 | NET NO AUTH LOW CX | Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 15 | |
|
69
|
CVE-2026-17682 |
9.6 | 0.0051 | NET NO AUTH LOW CX | Integer overflow in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remo | |
|
69
|
CVE-2026-17704 |
9.6 | 0.0051 | NET NO AUTH LOW CX | Use after free in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote | |
|
69
|
CVE-2026-17717 |
9.6 | 0.0051 | NET NO AUTH LOW CX | Integer overflow in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remo | |
|
68
|
CVE-2026-113947 |
8.8 | 0.0051 | NET NO AUTH LOW CX | This issue was addressed with improved access restrictions. This issue is fixed | |
|
68
|
CVE-2026-17678 |
8.8 | 0.0051 | NET NO AUTH LOW CX | Out of bounds read in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a re | |
|
67
|
CVE-2026-58525 |
8.2 | 0.0051 | NET NO AUTH LOW CX | Improper access control in Microsoft Edge (Chromium-based) allows an unauthorize | |
|
67
|
CVE-2026-81357 |
8.2 | 0.0051 | NET NO AUTH LOW CX | Server-side request forgery (ssrf) in Visual Studio Code allows an unauthorized | |
|
67
|
CVE-2026-48036 |
8.4 | 0.0051 | NET NO AUTH LOW CX | Hulumi is an open-source toolkit that ships secure-by-default cloud and platform | |
|
65
|
CVE-2026-50577 |
7.4 | 0.0051 | NET NO AUTH NO UI | ePA 3.x Integration implements the authorization workflow and writes Medical Inf | |
|
65
|
CVE-2026-114137 |
7.4 | 0.0051 | NET NO AUTH NO UI | Django REST framework is a toolkit for building Web APIs. From 3.12.0 until 3.18 |