Hunt List
8,661 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-64391 |
9.8 | 0.0049 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: ksmbd: use | |
|
80
|
CVE-2026-68381 |
9.8 | 0.0049 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: ksmbd: pin | |
|
80
|
CVE-2026-74611 |
9.8 | 0.0049 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: tls: rx: re | |
|
80
|
CVE-2026-74723 |
9.8 | 0.0049 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: btrfs: lzo: | |
|
80
|
CVE-2026-80694 |
9.8 | 0.0049 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: net: ethern | |
|
80
|
CVE-2026-89530 |
9.8 | 0.0049 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: svcrdma: Re | |
|
80
|
CVE-2026-89550 |
9.8 | 0.0049 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: SUNRPC: svc | |
|
80
|
CVE-2026-89676 |
9.8 | 0.0049 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: nfsd: fix s | |
|
80
|
CVE-2026-76473 |
9.8 | 0.0049 | NET NO AUTH LOW CX NO UI | As part of Cisco's ongoing commitment to proactive security and product quality, | |
|
80
|
CVE-2026-54856 |
9.8 | 0.0049 | NET NO AUTH LOW CX NO UI | Unauthenticated PHP Object Injection in RexCoin <= 1.2.6 versions. | |
|
80
|
CVE-2026-54857 |
9.8 | 0.0049 | NET NO AUTH LOW CX NO UI | Unauthenticated PHP Object Injection in Quirky <= 1.23 versions. | |
|
80
|
CVE-2026-54858 |
9.8 | 0.0049 | NET NO AUTH LOW CX NO UI | Unauthenticated PHP Object Injection in Printy <= 1.13.0 versions. | |
|
80
|
CVE-2026-54860 |
9.8 | 0.0049 | NET NO AUTH LOW CX NO UI | Unauthenticated PHP Object Injection in Ozisti <= 1.1.10 versions. | |
|
80
|
CVE-2025-58963 |
10.0 | 0.0049 | NET NO AUTH LOW CX NO UI | Unrestricted Upload of File with Dangerous Type vulnerability in 7oroof Medcity | |
|
80
|
CVE-2026-111813 |
10.0 | 0.0049 | NET NO AUTH LOW CX NO UI | Apache Traffic Server's experimental magick plugin lets an unauthenticated clien | |
|
80
|
CVE-2026-113399 |
9.8 | 0.0049 | NET NO AUTH LOW CX NO UI | Incorrect boundary conditions in the SVG component. This vulnerability was fixed | |
|
79
|
CVE-2026-40621 |
9.3 | 0.0049 | NET NO AUTH LOW CX NO UI | ELECOM wireless LAN access point devices do not require authentication to access | |
|
78
|
CVE-2026-45688 |
9.1 | 0.0049 | NET NO AUTH LOW CX NO UI | Rocket.Chat is an open-source, secure, fully customizable communications platfor | |
|
78
|
CVE-2026-48713 |
9.1 | 0.0049 | NET NO AUTH LOW CX NO UI | Versions prior to 2.6.6 are vulnerable to prototype pollution via crafted missin | |
|
78
|
CVE-2026-48714 |
9.1 | 0.0049 | NET NO AUTH LOW CX NO UI | i18next-http-middleware is a middleware to be used with Node.js web frameworks l | |
|
78
|
CVE-2026-52868 |
8.8 | 0.0049 | NET NO AUTH LOW CX NO UI | An unauthenticated attacker can read worklist records from a directory outside t | |
|
78
|
CVE-2017-20266 |
8.8 | 0.0049 | NET NO AUTH LOW CX NO UI | Joomla SP Movie Database 1.3 contains an SQL injection vulnerability that allows | |
|
78
|
CVE-2026-89631 |
9.1 | 0.0049 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: smb: client | |
|
78
|
CVE-2026-34000 |
9.1 | 0.0049 | NET NO AUTH LOW CX NO UI | A flaw was found in the X.Org X server. This out-of-bounds read vulnerability in | |
|
77
|
CVE-2026-58469 |
8.7 | 0.0049 | NET NO AUTH LOW CX NO UI | GNU Wget through 1.25.0, fixed in commit 37a40fc, contains a heap buffer underre | |
|
77
|
CVE-2026-59644 |
8.7 | 0.0049 | NET NO AUTH LOW CX NO UI | In Bouncy Castle for Java before 1.85, MLS hash-ratchet honours arbitrary 32-bit | |
|
77
|
CVE-2026-12852 |
8.7 | 0.0049 | NET NO AUTH LOW CX NO UI | In Bouncy Castle for Java before 1.85, MLS wire decoder allocates attacker-decla | |
|
77
|
CVE-2026-116078 |
8.7 | 0.0049 | NET NO AUTH LOW CX NO UI | Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 | |
|
77
|
CVE-2026-88893 |
8.7 | 0.0049 | NET NO AUTH LOW CX NO UI | OpenPanel through 2.3.0 share lookup procedures fail to validate access controls | |
|
76
|
CVE-2026-116541 |
8.2 | 0.0049 | NET NO AUTH LOW CX NO UI | Netty netty-tcnative before 2.0.84.Final contains a denial of service vulnerabil | |
|
76
|
CVE-2026-58010 |
8.2 | 0.0049 | NET NO AUTH LOW CX NO UI | A flaw was found in GLib. An off-by-one error can occur in the gvs_tuple_is_norm | |
|
76
|
CVE-2026-58012 |
8.2 | 0.0049 | NET NO AUTH LOW CX NO UI | A flaw was found in GLib. A buffer over-read can occur in the g_regex_replace fu | |
|
75
|
CVE-2026-10699 |
7.5 | 0.0049 | NET NO AUTH LOW CX NO UI | Missing release of memory after effective lifetime vulnerability in Progress MOV | |
|
75
|
CVE-2026-44436 |
7.5 | 0.0049 | NET NO AUTH LOW CX NO UI | Quicly is an IETF QUIC protocol implementation intended primarily for use within | |
|
75
|
CVE-2026-39769 |
7.5 | 0.0049 | NET NO AUTH LOW CX NO UI | Authentication Bypass Using an Alternate Path or Channel vulnerability in Iqonic | |
|
75
|
CVE-2026-6656 |
7.5 | 0.0049 | NET NO AUTH LOW CX NO UI | Crypt::Password versions through 0.28 for Perl are susceptible to timing attacks | |
|
75
|
CVE-2026-101572 |
7.5 | 0.0049 | NET NO AUTH LOW CX NO UI | Vulnerability in the Helidon product of Oracle Fusion Middleware (component: hel | |
|
75
|
CVE-2026-87398 |
7.5 | 0.0049 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middl | |
|
75
|
CVE-2026-57146 |
7.5 | 0.0049 | NET NO AUTH LOW CX NO UI | PraisonAI is a multi-agent teams system. From version 4.5.115 to before version | |
|
75
|
CVE-2026-50787 |
7.5 | 0.0049 | NET NO AUTH LOW CX NO UI | e-SIC Livre (esiclivre) v0.2.2 and earlier contains an uncontrolled resource con | |
|
69
|
CVE-2026-17676 |
9.6 | 0.0049 | NET NO AUTH LOW CX | Inappropriate implementation in ANGLE in Google Chrome on Android prior to 151.0 | |
|
67
|
CVE-2026-59833 |
8.6 | 0.0049 | NET NO AUTH LOW CX | SiYuan is an open-source personal knowledge management system. Prior to 3.7.1, S | |
|
66
|
CVE-2026-52707 |
8.1 | 0.0049 | NET NO AUTH NO UI | Unauthenticated Local File Inclusion in Kastell <= 2.0 versions. | |
|
66
|
CVE-2026-54591 |
8.1 | 0.0049 | NET NO AUTH LOW CX | AsyncSSH is a Python package which provides an asynchronous client and server im | |
|
66
|
CVE-2026-72903 |
8.1 | 0.0049 | NET NO AUTH LOW CX | Tabby (formerly Terminus) is a highly configurable terminal emulator. Prior to 1 | |
|
66
|
CVE-2025-40075 |
8.1 | 0.0049 | NET NO AUTH NO UI | In the Linux kernel, the following vulnerability has been resolved: tcp_metrics | |
|
66
|
CVE-2026-119557 |
8.2 | 0.0049 | NET NO AUTH NO UI | n8n from 2.14.0 through 2.46.3 contains a path traversal vulnerability in the Da | |
|
64
|
CVE-2026-20779 |
7.1 | 0.0049 | NET NO AUTH LOW CX | Gitea versions from 1.5.0 before 1.26.3 have a TOTP single-use enforcement defec | |
|
57
|
CVE-2026-53413 |
8.3 | 0.0049 | NET NO AUTH | Missing bounds check in the annotator function of Zoom Clients allows buffer ove | |
|
57
|
CVE-2026-53415 |
8.3 | 0.0049 | NET NO AUTH | Use after Free in the annotator function of Zoom Clients may allow a meeting par |