Hunt List
7,878 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-16812 |
10.0 | 0.0176 | NET NO AUTH LOW CX NO UI | KEV | Arista VeloCloud Orchestrator On-Prem contains an OS command injection vulnerabi |
|
80
|
CVE-2026-45748 |
9.8 | 0.0173 | NET NO AUTH LOW CX NO UI | Termix is a web-based server management platform with SSH terminal, tunneling, a | |
|
80
|
CVE-2026-65400 |
9.8 | 0.0172 | NET NO AUTH LOW CX NO UI | KEV | Apple macOS contains an improper authentication vulnerability that could allow a |
|
80
|
CVE-2026-66713 |
9.8 | 0.0172 | NET NO AUTH LOW CX NO UI | Deserialization of Untrusted Data (CWE-502) in the Tribes-based clustering compo | |
|
80
|
CVE-2026-47210 |
9.8 | 0.0172 | NET NO AUTH LOW CX NO UI | vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, a sandbox | |
|
80
|
CVE-2026-42076 |
9.8 | 0.0170 | NET NO AUTH LOW CX NO UI | Evolver is a GEP-powered self-evolving engine for AI agents. Prior to version 1. | |
|
80
|
CVE-2026-41293 |
9.8 | 0.0170 | NET NO AUTH LOW CX NO UI | Improper Input Validation vulnerability in Apache Tomcat. This issue affects Ap | |
|
80
|
CVE-2026-50746 |
10.0 | 0.0169 | NET NO AUTH LOW CX NO UI | A malicious actor with access to the network could exploit an Improper Access Co | |
|
80
|
CVE-2026-105016 |
9.8 | 0.0166 | NET NO AUTH LOW CX NO UI | Heap-based buffer overflow in Microsoft QUIC allows an unauthorized attacker to | |
|
80
|
CVE-2026-72580 |
9.8 | 0.0165 | NET NO AUTH LOW CX NO UI | An OS command injection vulnerability in duhow/xiaoai-patch through commit fb070 | |
|
80
|
CVE-2026-8500 |
9.8 | 0.0165 | NET NO AUTH LOW CX NO UI | Web::Passwd versions through 0.03 for Perl is vulnerable to RCE. Web::Passwd is | |
|
80
|
CVE-2026-33264 |
9.8 | 0.0165 | NET NO AUTH LOW CX NO UI | A bug in `BaseSerialization.deserialize()` allowed unrestricted `import_string() | |
|
80
|
CVE-2026-34159 |
9.8 | 0.0162 | NET NO AUTH LOW CX NO UI | llama.cpp is an inference of several LLM models in C/C++. Prior to version b8492 | |
|
80
|
CVE-2026-8054 |
10.0 | 0.0158 | NET NO AUTH LOW CX NO UI | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti | |
|
80
|
CVE-2026-49261 |
9.8 | 0.0158 | NET NO AUTH LOW CX NO UI | MariaDB server is a community developed fork of MySQL server. Versions 10.6.1 th | |
|
80
|
CVE-2026-69084 |
9.9 | 0.0157 | NET NO AUTH LOW CX NO UI | SiYuan versions <= v3.7.2 expose the /api/search/searchEmbedBlock endpoint, whic | |
|
80
|
CVE-2026-70242 |
9.8 | 0.0157 | NET NO AUTH LOW CX NO UI | Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized at | |
|
80
|
CVE-2026-79861 |
9.8 | 0.0156 | NET NO AUTH LOW CX NO UI | There is a command injection vulnerability in AOS-10 that could lead to unauthen | |
|
79
|
CVE-2026-66147 |
9.4 | 0.0176 | NET NO AUTH LOW CX NO UI | An unauthenticated command injection vulnerability was identified in the GMS Dis | |
|
79
|
CVE-2026-40887 |
9.1 | 0.0176 | NET NO AUTH LOW CX NO UI | Vendure is an open-source headless commerce platform. Starting in version 1.7.4 | |
|
79
|
CVE-2026-46364 |
9.3 | 0.0171 | NET NO AUTH LOW CX NO UI | phpMyFAQ before 4.1.2 contains an unauthenticated SQL injection vulnerability in | |
|
79
|
CVE-2026-53975 |
9.3 | 0.0168 | NET NO AUTH LOW CX NO UI | OpenChamber 1.11.7 contains an unauthenticated remote code execution vulnerabili | |
|
79
|
CVE-2026-5965 |
9.3 | 0.0164 | NET NO AUTH LOW CX NO UI | NewSoftOA developed by NewSoft has an OS Command Injection vulnerability, allowi | |
|
79
|
CVE-2026-42062 |
9.3 | 0.0163 | NET NO AUTH LOW CX NO UI | ELECOM wireless LAN access point devices contain an OS command injection in proc | |
|
79
|
CVE-2026-42281 |
9.2 | 0.0162 | NET NO AUTH LOW CX NO UI | MagicMirror² is an open source modular smart mirror platform. Prior to 2.36.0, a | |
|
79
|
CVE-2026-66914 |
9.2 | 0.0154 | NET NO AUTH LOW CX NO UI | Joomla Extension - seblod.com - Unauthenticated path traversal in SEBLOD < 3.30. | |
|
78
|
CVE-2026-7137 |
8.9 | 0.0177 | NET NO AUTH LOW CX NO UI | A security vulnerability has been detected in Totolink A8000RU 7.1cu.643_b202005 | |
|
78
|
CVE-2026-7138 |
8.9 | 0.0177 | NET NO AUTH LOW CX NO UI | A vulnerability was detected in Totolink A8000RU 7.1cu.643_b20200521. This vulne | |
|
78
|
CVE-2026-7139 |
8.9 | 0.0177 | NET NO AUTH LOW CX NO UI | A flaw has been found in Totolink A8000RU 7.1cu.643_b20200521. This issue affect | |
|
78
|
CVE-2026-7140 |
8.9 | 0.0177 | NET NO AUTH LOW CX NO UI | A vulnerability has been found in Totolink A8000RU 7.1cu.643_b20200521. Impacted | |
|
78
|
CVE-2026-7152 |
8.9 | 0.0177 | NET NO AUTH LOW CX NO UI | A vulnerability was identified in Totolink A8000RU 7.1cu.643_b20200521. The affe | |
|
78
|
CVE-2026-7153 |
8.9 | 0.0177 | NET NO AUTH LOW CX NO UI | A security flaw has been discovered in Totolink A8000RU 7.1cu.643_b20200521. The | |
|
78
|
CVE-2026-7155 |
8.9 | 0.0177 | NET NO AUTH LOW CX NO UI | A security vulnerability has been detected in Totolink A8000RU 7.1cu.643_b202005 | |
|
78
|
CVE-2026-116067 |
8.8 | 0.0169 | NET NO AUTH LOW CX NO UI | Paisa before 0.7.8 contains a path traversal vulnerability in the GetFile, GetSh | |
|
78
|
CVE-2026-41247 |
8.9 | 0.0157 | NET NO AUTH LOW CX NO UI | elFinder is an open-source file manager for web, written in JavaScript using jQu | |
|
78
|
CVE-2026-66733 |
8.7 | 0.0155 | NET NO AUTH LOW CX NO UI | Sonic 3 A.I.R. before commit 2492d18 contains an unbounded memory allocation vul | |
|
77
|
CVE-2026-58467 |
8.2 | 0.0173 | NET NO AUTH LOW CX NO UI | Cockpit CMS through 2.14.0 contains a path traversal and local file inclusion vu | |
|
75
|
CVE-2025-57231 |
7.5 | 0.0173 | NET NO AUTH LOW CX NO UI | Path Traversal in avatar attachments in Docmost v0.21.0 allows an unauthenticate | |
|
75
|
CVE-2026-50652 |
7.5 | 0.0173 | NET NO AUTH LOW CX NO UI | Deserialization of untrusted data in Azure Active Directory allows an unauthoriz | |
|
75
|
CVE-2023-22796 |
7.5 | 0.0171 | NET NO AUTH LOW CX NO UI | A regular expression based DoS vulnerability in Active Support <6.1.7.1 and <7.0 | |
|
75
|
CVE-2023-22792 |
7.5 | 0.0169 | NET NO AUTH LOW CX NO UI | A regular expression based DoS vulnerability in Action Dispatch <6.0.6.1,< 6.1.7 | |
|
75
|
CVE-2026-12609 |
7.5 | 0.0164 | NET NO AUTH LOW CX NO UI | In Eclipse Theia versions 1.66.0 and up until including 1.73.1, the `@theia/plug | |
|
75
|
CVE-2026-11801 |
7.5 | 0.0164 | NET NO AUTH LOW CX NO UI | The WPAdverts – Classifieds Plugin plugin for WordPress is vulnerable to authori | |
|
75
|
CVE-2026-18125 |
7.5 | 0.0159 | NET NO AUTH LOW CX NO UI | An out-of-bounds read in the Agent of Ivanti Endpoint Manager before version 202 | |
|
75
|
CVE-2026-53755 |
7.5 | 0.0158 | NET NO AUTH LOW CX NO UI | Crawl4AI is an open-source LLM friendly web crawler & scraper. Prior to 0.8.9, t | |
|
75
|
CVE-2026-23870 |
7.5 | 0.0153 | NET NO AUTH LOW CX NO UI | A denial of service vulnerability could be triggered by sending specially crafte | |
|
75
|
CVE-2024-1394 |
7.5 | 0.0153 | NET NO AUTH LOW CX NO UI | A memory leak flaw was found in Golang in the RSA encrypting/decrypting code, wh | |
|
69
|
CVE-2026-63304 |
9.2 | 0.0173 | NET NO AUTH NO UI | AVideo through 29.0 contains an OS command injection vulnerability in plugin/API | |
|
69
|
CVE-2026-56379 |
9.2 | 0.0164 | NET NO AUTH NO UI | ImageMagick before 7.1.2-15 and 6.9.13-40 contains a command injection vulnerabi | |
|
69
|
CVE-2026-44225 |
9.3 | 0.0154 | NET NO AUTH LOW CX | Pulpy is a lightweight, cross-platform desktop application packager for web apps |