Hunt List
8,650 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-57216 |
10.0 | 0.0050 | NET NO AUTH LOW CX NO UI | RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20, 4.1.11, | |
|
80
|
CVE-2026-26354 |
9.8 | 0.0050 | NET NO AUTH LOW CX NO UI | Dell PowerProtect Data Domain with Domain Operating System (DD OS) of Feature Re | |
|
80
|
CVE-2026-9202 |
9.8 | 0.0050 | NET NO AUTH LOW CX NO UI | IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to create | |
|
80
|
CVE-2025-70520 |
9.8 | 0.0050 | NET NO AUTH LOW CX NO UI | The websocket handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce | |
|
80
|
CVE-2026-89702 |
9.8 | 0.0050 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: nfsd: size | |
|
79
|
CVE-2026-41274 |
9.3 | 0.0050 | NET NO AUTH LOW CX NO UI | Flowise is a drag & drop user interface to build a customized large language mod | |
|
79
|
CVE-2026-114595 |
9.3 | 0.0050 | NET NO AUTH LOW CX NO UI | In EPICS Base release 7.0.10 and prior, an integer overflow in network request p | |
|
79
|
CVE-2026-114358 |
9.3 | 0.0050 | NET NO AUTH LOW CX NO UI | This vulnerability exists in the Radius Xenia M2M Platform due to insufficient v | |
|
79
|
CVE-2026-65890 |
9.2 | 0.0050 | NET NO AUTH LOW CX NO UI | Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20 | |
|
78
|
CVE-2026-9390 |
9.1 | 0.0050 | NET NO AUTH LOW CX NO UI | XML::Sig versions before 0.71 for Perl allow XPath injection in ID lookup. veri | |
|
78
|
CVE-2026-45177 |
9.1 | 0.0050 | NET NO AUTH LOW CX NO UI | Idira Secrets Manager SaaS Edge versions prior to 1.8 exhibit improper access co | |
|
78
|
CVE-2026-112892 |
8.7 | 0.0050 | NET NO AUTH LOW CX NO UI | Pillow is a Python imaging library. From 4.1.0 until 13.0.0, Pillow's MSP RLE de | |
|
78
|
CVE-2026-40582 |
9.1 | 0.0050 | NET NO AUTH LOW CX NO UI | ChurchCRM is an open-source church management system. In versions prior to 7.2.0 | |
|
78
|
CVE-2026-103090 |
8.8 | 0.0050 | NET NO AUTH LOW CX NO UI | Missing Authentication for Critical Function (CWE-306) and Insufficiently Protec | |
|
78
|
CVE-2025-40796 |
8.7 | 0.0050 | NET NO AUTH LOW CX NO UI | A vulnerability has been identified in SIMATIC PCS neo V4.1 (All versions), SIMA | |
|
78
|
CVE-2026-71263 |
9.1 | 0.0050 | NET NO AUTH LOW CX NO UI | The LINUXTCP port of FreeModbus contains an off-by-one bounds check in xMBPortTC | |
|
78
|
CVE-2026-53791 |
9.1 | 0.0050 | NET NO AUTH LOW CX NO UI | rsync daemon before 3.5.0 contains an IP address spoofing vulnerability that all | |
|
78
|
CVE-2026-93228 |
9.1 | 0.0050 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: svcrdma: Re | |
|
78
|
CVE-2026-34543 |
8.7 | 0.0050 | NET NO AUTH LOW CX NO UI | OpenEXR provides the specification and reference implementation of the EXR file | |
|
77
|
CVE-2026-16686 |
8.2 | 0.0050 | NET NO AUTH LOW CX NO UI | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to a | |
|
77
|
CVE-2026-56675 |
8.3 | 0.0050 | NET NO AUTH LOW CX NO UI | 9Router is an AI router & token saver. Prior to 0.5.2, 9router treats loopback r | |
|
77
|
CVE-2026-58013 |
8.2 | 0.0050 | NET NO AUTH LOW CX NO UI | A flaw was found in GLib. A buffer over-read can occur in g_io_channel_read_line | |
|
76
|
CVE-2026-67346 |
7.7 | 0.0051 | NET NO AUTH LOW CX NO UI | Swarms through 6.8.1, fixed in commit 8b0fc9e, contains a server-side request fo | |
|
75
|
CVE-2026-67872 |
7.5 | 0.0050 | NET NO AUTH LOW CX NO UI | An issue in Systerel S2OPC 1.7.3 allows a remote attacker to cause a denial of s | |
|
75
|
CVE-2026-28212 |
7.5 | 0.0050 | NET NO AUTH LOW CX NO UI | Firebird is an open-source relational database management system. In versions pr | |
|
75
|
CVE-2026-41642 |
7.5 | 0.0050 | NET NO AUTH LOW CX NO UI | GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go P | |
|
75
|
CVE-2026-43513 |
7.5 | 0.0050 | NET NO AUTH LOW CX NO UI | Improper Handling of Case Sensitivity vulnerability in LockOutRealm in Apache To | |
|
75
|
CVE-2026-55111 |
7.5 | 0.0050 | NET NO AUTH LOW CX NO UI | A malicious actor with access to the network could exploit a Path Traversal vuln | |
|
75
|
CVE-2026-57815 |
7.5 | 0.0050 | NET NO AUTH LOW CX NO UI | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') v | |
|
75
|
CVE-2026-65754 |
7.5 | 0.0050 | NET NO AUTH LOW CX NO UI | Joomla Extension - regularlabs.com - Insecure path handling in ReReplacer Pro ex | |
|
75
|
CVE-2026-15280 |
7.5 | 0.0050 | NET NO AUTH LOW CX NO UI | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 ND Collecti | |
|
75
|
CVE-2026-61980 |
7.5 | 0.0050 | NET NO AUTH LOW CX NO UI | Unauthenticated Arbitrary File Download in OMGF Pro <= 5.2.7 versions. | |
|
75
|
CVE-2026-15585 |
7.5 | 0.0050 | NET NO AUTH LOW CX NO UI | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') v | |
|
75
|
CVE-2026-73181 |
7.5 | 0.0050 | NET NO AUTH LOW CX NO UI | Unauthenticated Arbitrary File Download in Extra Product Options & Add-Ons for W | |
|
75
|
CVE-2026-28167 |
7.5 | 0.0050 | NET NO AUTH LOW CX NO UI | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') v | |
|
75
|
CVE-2026-102834 |
7.5 | 0.0050 | NET NO AUTH LOW CX NO UI | JavaCV provides Java interfaces to OpenCV, FFmpeg, and other multimedia librarie | |
|
75
|
CVE-2026-114136 |
7.5 | 0.0050 | NET NO AUTH LOW CX NO UI | Django REST framework is a toolkit for building Web APIs. From 3.6.4 until 3.18. | |
|
75
|
CVE-2026-59158 |
7.5 | 0.0050 | NET NO AUTH LOW CX NO UI | Nuxt Ollama integrates the official Ollama JavaScript library into Nuxt applicat | |
|
69
|
CVE-2026-14405 |
9.6 | 0.0050 | NET NO AUTH LOW CX | Uninitialized Use in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote | |
|
69
|
CVE-2026-8338 |
9.2 | 0.0050 | NET NO AUTH NO UI | A Spring Security authentication and authorization bypass exists in Coverity Con | |
|
68
|
CVE-2026-16617 |
8.8 | 0.0050 | NET NO AUTH LOW CX | The Simple File List WordPress plugin through 6.3.11 does not properly sanitise | |
|
68
|
CVE-2026-44829 |
8.8 | 0.0050 | NET NO AUTH LOW CX | Gotenberg is a Docker-powered stateless API for PDF files. In 8.32.0 and earlier | |
|
68
|
CVE-2026-83596 |
8.8 | 0.0050 | NET NO AUTH LOW CX | A flaw was found in WebKitGTK. Processing malicious web content can cause memory | |
|
66
|
CVE-2026-88173 |
8.1 | 0.0051 | NET NO AUTH NO UI | Use after free in Windows Background Intelligent Transfer Service (BITS) allows | |
|
66
|
CVE-2026-110205 |
7.7 | 0.0051 | NET NO AUTH LOW CX | Roo Code through 3.54.0 contains a command approval bypass vulnerability in pars | |
|
66
|
CVE-2026-99059 |
7.7 | 0.0051 | NET NO AUTH NO UI | In the Linux kernel, the following vulnerability has been resolved: wireguard: | |
|
66
|
CVE-2026-13190 |
8.1 | 0.0050 | NET NO AUTH NO UI | In Progress® Telerik® UI for AJAX prior to v2026.2.708, a deserialization vulner | |
|
66
|
CVE-2026-82891 |
8.1 | 0.0050 | NET NO AUTH NO UI | IBM Guardium Data Protection 12.1, and 12.2 could allow a remote attacker to obt | |
|
65
|
CVE-2026-98096 |
7.4 | 0.0050 | NET NO AUTH NO UI | In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: r | |
|
55
|
CVE-2026-106765 |
7.5 | 0.0050 | NET NO AUTH | An issue in @rog0x/mcp-docker-tools 1.0.1 allows a remote attacker to execute ar |