Hunt List
8,661 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-66424 |
9.8 | 0.0048 | NET NO AUTH LOW CX NO UI | Unauthenticated Privilege Escalation in SMS Alert Order Notifications <= 3.9.7 v | |
|
80
|
CVE-2026-66691 |
9.8 | 0.0048 | NET NO AUTH LOW CX NO UI | Unauthenticated Broken Access Control in Nokri <= 1.6.6 versions. | |
|
80
|
CVE-2026-84999 |
9.8 | 0.0048 | NET NO AUTH LOW CX NO UI | The Pie Register Premium plugin for WordPress is vulnerable to Unrestricted File | |
|
80
|
CVE-2026-64815 |
9.8 | 0.0048 | NET NO AUTH LOW CX NO UI | In JetBrains IntelliJ IDEA before 2026.2 arbitrary code injection was possible v | |
|
80
|
CVE-2026-46752 |
10.0 | 0.0048 | NET NO AUTH LOW CX NO UI | Redis Lua HEAP overflow in cjson library vulnerability in Apache Kvrocks. This | |
|
80
|
CVE-2026-8982 |
10.0 | 0.0048 | NET NO AUTH LOW CX NO UI | Two undocumented privileged accounts exist in Autel Maxi Charger Single firmware | |
|
78
|
CVE-2026-61462 |
9.2 | 0.0048 | NET NO AUTH LOW CX NO UI | mcp-gitlab contains a path traversal vulnerability in the job_id parameter of bu | |
|
78
|
CVE-2026-33808 |
9.1 | 0.0048 | NET NO AUTH LOW CX NO UI | Impact@fastify/express v4.0.4 and earlier fails to normalize URLs before passing | |
|
78
|
CVE-2026-13739 |
8.8 | 0.0048 | NET NO AUTH LOW CX NO UI | A legacy endpoint in Command Center contained an unauthenticated server-side req | |
|
78
|
CVE-2026-42513 |
8.8 | 0.0048 | NET NO AUTH LOW CX NO UI | This vulnerability exists in e-Sushrut due to improper authentication logic that | |
|
78
|
CVE-2026-33117 |
9.1 | 0.0048 | NET NO AUTH LOW CX NO UI | The Java Key Vault Keys library in the Azure SDK for Java contains an issue in t | |
|
78
|
CVE-2026-68083 |
9.1 | 0.0048 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix | |
|
77
|
CVE-2022-4984 |
8.7 | 0.0048 | NET NO AUTH LOW CX NO UI | ZenTao Biz < 6.5, ZenTao Max < 3.0, ZenTao Open Source Edition < 16.5, and ZenTa | |
|
77
|
CVE-2026-35672 |
8.7 | 0.0048 | NET NO AUTH LOW CX NO UI | phpMyFAQ before 4.1.3 contains an authentication bypass vulnerability in API v4. | |
|
77
|
CVE-2026-74238 |
8.7 | 0.0048 | NET NO AUTH LOW CX NO UI | TIER IV Nebula through 1.2.0 contains an out-of-bounds read vulnerability in the | |
|
77
|
CVE-2026-55418 |
8.6 | 0.0048 | NET NO AUTH LOW CX NO UI | FastGPT is an open source AI knowledge base platform. Prior to v4.15.0-beta5, tw | |
|
77
|
CVE-2026-65623 |
8.7 | 0.0048 | NET NO AUTH LOW CX NO UI | Inefficient Algorithmic Complexity vulnerability in mtrudel bandit allows unauth | |
|
77
|
CVE-2026-54729 |
8.7 | 0.0048 | NET NO AUTH LOW CX NO UI | DSSRF is a Node.js library that provides a wide range of utilities and advanced | |
|
77
|
CVE-2026-112897 |
8.7 | 0.0048 | NET NO AUTH LOW CX NO UI | Pillow is a Python imaging library. From 5.3.0 until 13.0.0, Pillow can return u | |
|
77
|
CVE-2026-114052 |
8.7 | 0.0048 | NET NO AUTH LOW CX NO UI | vLLM after 0.24.0 and before 0.31.0 contains a memory exhaustion vulnerability i | |
|
76
|
CVE-2026-33748 |
8.2 | 0.0048 | NET NO AUTH LOW CX NO UI | BuildKit is a toolkit for converting source code to build artifacts in an effici | |
|
76
|
CVE-2026-55952 |
8.2 | 0.0048 | NET NO AUTH LOW CX NO UI | The Erlang/OTP ssl application does not validate that the PSK identity list and | |
|
76
|
CVE-2026-114644 |
8.2 | 0.0048 | NET NO AUTH LOW CX NO UI | The MongoDB C# Driver's BSON library contains an uncontrolled resource consumpti | |
|
76
|
CVE-2025-40337 |
8.2 | 0.0048 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: net: stmmac | |
|
75
|
CVE-2026-28908 |
7.5 | 0.0048 | NET NO AUTH LOW CX NO UI | A denial of service issue was addressed by removing the vulnerable code. This is | |
|
75
|
CVE-2026-59834 |
7.5 | 0.0048 | NET NO AUTH LOW CX NO UI | SiYuan is an open-source personal knowledge management system. Prior to 3.7.1, t | |
|
75
|
CVE-2026-6507 |
7.5 | 0.0048 | NET NO AUTH LOW CX NO UI | A flaw was found in dnsmasq. A remote attacker could exploit an out-of-bounds wr | |
|
75
|
CVE-2026-25712 |
7.5 | 0.0048 | NET NO AUTH LOW CX NO UI | Gitea versions before 1.25.5 have insufficient visibility checks in organization | |
|
75
|
CVE-2026-42189 |
7.5 | 0.0048 | NET NO AUTH LOW CX NO UI | Russh is a Rust SSH client & server library. Prior to version 0.60.1, a pre-auth | |
|
75
|
CVE-2026-54283 |
7.5 | 0.0048 | NET NO AUTH LOW CX NO UI | Starlette is a lightweight ASGI framework/toolkit. From 0.4.1 until 1.3.1, reque | |
|
75
|
CVE-2026-53482 |
7.5 | 0.0048 | NET NO AUTH LOW CX NO UI | Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release ver | |
|
75
|
CVE-2026-72606 |
7.5 | 0.0048 | NET NO AUTH LOW CX NO UI | A server-side request forgery vulnerability in Pinry through 2.1.13 allows unaut | |
|
75
|
CVE-2026-47247 |
7.5 | 0.0048 | NET NO AUTH LOW CX NO UI | libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.2 | |
|
75
|
CVE-2026-65644 |
7.5 | 0.0048 | NET NO AUTH LOW CX NO UI | Rocket.Chat in versions before 8.8.0, 8.7.1, 8.6.2, 8.5.3, 8.4.6, 8.3.8, 8.2.8, | |
|
69
|
CVE-2026-46853 |
9.6 | 0.0048 | NET NO AUTH LOW CX | Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle E | |
|
69
|
CVE-2026-17691 |
9.6 | 0.0048 | NET NO AUTH LOW CX | Out of bounds write in ANGLE in Google Chrome on Windows prior to 151.0.7922.72 | |
|
69
|
CVE-2026-17695 |
9.6 | 0.0048 | NET NO AUTH LOW CX | Inappropriate implementation in ANGLE in Google Chrome on Mac prior to 151.0.792 | |
|
68
|
CVE-2026-14383 |
8.8 | 0.0048 | NET NO AUTH LOW CX | Inappropriate implementation in V8 in Google Chrome prior to 150.0.7871.46 allow | |
|
68
|
CVE-2026-5140 |
8.8 | 0.0048 | NET NO AUTH LOW CX | Improper neutralization of CRLF sequences ('CRLF injection') vulnerability in TU | |
|
68
|
CVE-2026-113204 |
8.8 | 0.0048 | NET NO AUTH LOW CX | Use after free in TrustedWebActivities in Google Chrome on on Android prior to 1 | |
|
68
|
CVE-2026-119418 |
9.2 | 0.0048 | NET NO AUTH NO UI | CakePHP through 5.4.3 contains an sql injection vulnerability that allows attack | |
|
68
|
CVE-2026-89091 |
8.8 | 0.0048 | NET NO AUTH LOW CX | A flaw was found in ansible-core. When installing a collection with `ansible-gal | |
|
68
|
CVE-2026-17677 |
8.8 | 0.0048 | NET NO AUTH LOW CX | Inappropriate implementation in ANGLE in Google Chrome on Android prior to 151.0 | |
|
67
|
CVE-2026-55193 |
8.7 | 0.0048 | NET NO AUTH LOW CX | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0 | |
|
66
|
CVE-2026-55388 |
8.1 | 0.0048 | NET NO AUTH NO UI | piscina is a node.js worker pool implementation. Prior to 6.0.0-rc.2, 5.2.0, and | |
|
66
|
CVE-2026-69830 |
8.1 | 0.0048 | NET NO AUTH NO UI | Concurrent execution using shared resource with improper synchronization ('race | |
|
65
|
CVE-2026-65695 |
7.6 | 0.0048 | NET NO AUTH LOW CX | Office-Word-MCP-Server through 1.1.11 contains a path traversal vulnerability in | |
|
65
|
CVE-2026-15554 |
7.4 | 0.0048 | NET NO AUTH NO UI | the Undertow AJP listener honours forged ssl_cert and is_ssl AJP attributes with | |
|
65
|
CVE-2026-73495 |
7.4 | 0.0048 | NET NO AUTH NO UI | blaze is a Scala library for building asynchronous pipelines, with a focus on ne | |
|
55
|
CVE-2026-58292 |
7.5 | 0.0048 | NET NO AUTH | Improper input validation in Microsoft Edge (Chromium-based) allows an unauthori |