Hunt List
8,454 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
90
|
CVE-2026-69836 |
10.0 | 0.0153 | NET NO AUTH LOW CX NO UI | 2 PoC | Deserialization of untrusted data in Microsoft Entra ID allows an unauthorized a |
|
90
|
CVE-2026-55944 |
9.8 | 0.0153 | NET NO AUTH LOW CX NO UI | 1 PoC | Deserialization of untrusted data in Microsoft Dynamics NAV allows an unauthoriz |
|
80
|
CVE-2026-59124 |
9.8 | 0.0153 | NET NO AUTH LOW CX NO UI | Deserialization of untrusted data in Microsoft High Performance Computing (HPC) | |
|
80
|
CVE-2026-54117 |
9.8 | 0.0153 | NET NO AUTH LOW CX NO UI | Deserialization of untrusted data in SQL Server allows an unauthorized attacker | |
|
80
|
CVE-2026-54118 |
9.8 | 0.0153 | NET NO AUTH LOW CX NO UI | Deserialization of untrusted data in SQL Server allows an unauthorized attacker | |
|
80
|
CVE-2025-63706 |
9.8 | 0.0152 | NET NO AUTH LOW CX NO UI | NPM package next-npm-version1.0.1 is vulnerable to Command injection. | |
|
80
|
CVE-2023-31039 |
9.8 | 0.0152 | NET NO AUTH LOW CX NO UI | Security vulnerability in Apache bRPC <1.5.0 on all platforms allows attackers t | |
|
80
|
CVE-2026-48168 |
10.0 | 0.0150 | NET NO AUTH LOW CX NO UI | PraisonAI is a multi-agent teams system. In versions prior to 4.6.40, the bundle | |
|
80
|
CVE-2026-47391 |
9.8 | 0.0150 | NET NO AUTH LOW CX NO UI | PraisonAI is a multi-agent teams system. Prior to version 4.6.40, PraisonAI's fi | |
|
80
|
CVE-2021-25827 |
9.8 | 0.0150 | NET NO AUTH LOW CX NO UI | Emby Server < 4.7.12.0 is vulnerable to a login bypass attack by setting the X-F | |
|
80
|
CVE-2026-64193 |
9.8 | 0.0144 | NET NO AUTH LOW CX NO UI | Net::DNS versions through 1.55 for Perl allow remote execution injection via EDN | |
|
80
|
CVE-2026-48281 |
10.0 | 0.0142 | NET NO AUTH LOW CX NO UI | ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Inpu | |
|
80
|
CVE-2026-79857 |
9.8 | 0.0141 | NET NO AUTH LOW CX NO UI | There is a command injection vulnerability in the PAPI protocol (Aruba's access | |
|
80
|
CVE-2026-69085 |
9.9 | 0.0139 | NET NO AUTH LOW CX NO UI | SiYuan before v3.7.3 contains a SQL injection vulnerability in the /api/filetree | |
|
80
|
CVE-2026-31843 |
10.0 | 0.0138 | NET NO AUTH LOW CX NO UI | The goodoneuz/pay-uz Laravel package (<= 2.2.24) contains a critical vulnerabili | |
|
79
|
CVE-2026-66914 |
9.2 | 0.0154 | NET NO AUTH LOW CX NO UI | Joomla Extension - seblod.com - Unauthenticated path traversal in SEBLOD < 3.30. | |
|
79
|
CVE-2026-0650 |
9.3 | 0.0152 | NET NO AUTH LOW CX NO UI | OpenFlagr versions prior to and including 1.1.18 contain an authentication bypas | |
|
79
|
CVE-2026-65700 |
9.3 | 0.0152 | NET NO AUTH LOW CX NO UI | h2oGPT through 0.2.1 contains a path traversal vulnerability in the OpenAI-compa | |
|
79
|
CVE-2026-41042 |
9.1 | 0.0151 | NET NO AUTH LOW CX NO UI | Unauthenticated callers can supply a malicious H2 JDBC URL through the testConne | |
|
79
|
CVE-2026-8398 |
9.3 | 0.0146 | NET NO AUTH LOW CX NO UI | KEV | Daemon Tools contains an unspecified vulnerability that has a high impact on con |
|
79
|
CVE-2026-56062 |
9.3 | 0.0144 | NET NO AUTH LOW CX NO UI | Unauthenticated SQL Injection in Quotes llama <= 3.1.5 versions. | |
|
79
|
CVE-2026-56070 |
9.3 | 0.0144 | NET NO AUTH LOW CX NO UI | Unauthenticated SQL Injection in Advance Product Search <= 1.4.4 versions. | |
|
79
|
CVE-2026-6875 |
9.5 | 0.0143 | NET NO AUTH LOW CX NO UI | ServiceNow has addressed a remote code execution vulnerability that was identifi | |
|
79
|
CVE-2026-59866 |
9.3 | 0.0141 | NET NO AUTH LOW CX NO UI | Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5 | |
|
79
|
CVE-2026-56121 |
9.3 | 0.0141 | NET NO AUTH LOW CX NO UI | Feast before 0.63.0 contains an unsafe deserialization vulnerability that allows | |
|
79
|
CVE-2026-22095 |
9.3 | 0.0139 | NET NO AUTH LOW CX NO UI | The network diagnosis endpoint on the web server at port 8090 is vulnerable to c | |
|
79
|
CVE-2026-22103 |
9.3 | 0.0139 | NET NO AUTH LOW CX NO UI | The NPC start endpoint on the web server at port 8090 is vulnerable to command i | |
|
79
|
CVE-2026-59707 |
9.2 | 0.0138 | NET NO AUTH LOW CX NO UI | LocalAI contains an unauthenticated server-side request forgery vulnerability in | |
|
79
|
CVE-2026-56292 |
9.2 | 0.0138 | NET NO AUTH LOW CX NO UI | Joomla Extension - acymailing.com - SQL Injection in AcyMailing extension < 10.1 | |
|
78
|
CVE-2026-66733 |
8.7 | 0.0155 | NET NO AUTH LOW CX NO UI | Sonic 3 A.I.R. before commit 2492d18 contains an unbounded memory allocation vul | |
|
77
|
CVE-2026-27771 |
8.2 | 0.0139 | NET NO AUTH LOW CX NO UI | Gitea versions up to and including 1.26.1 have insufficient permission checks fo | |
|
76
|
CVE-2026-60105 |
7.7 | 0.0151 | NET NO AUTH LOW CX NO UI | Monsta FTP before 2.14.5 contains a server-side request forgery vulnerability in | |
|
76
|
CVE-2026-119025 |
7.7 | 0.0145 | NET NO AUTH LOW CX | 1 PoC | open 7.2.0 before 11.0.0 contains an OS command injection vulnerability that all |
|
75
|
CVE-2026-23870 |
7.5 | 0.0153 | NET NO AUTH LOW CX NO UI | A denial of service vulnerability could be triggered by sending specially crafte | |
|
75
|
CVE-2024-1394 |
7.5 | 0.0153 | NET NO AUTH LOW CX NO UI | A memory leak flaw was found in Golang in the RSA encrypting/decrypting code, wh | |
|
75
|
CVE-2026-19446 |
7.5 | 0.0146 | NET NO AUTH LOW CX NO UI | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 allows a remote unauthenticated at | |
|
75
|
CVE-2026-57872 |
7.5 | 0.0145 | NET NO AUTH LOW CX NO UI | An unauthenticated directory traversal vulnerability exists in get_fcont.cgi in | |
|
75
|
CVE-2026-36045 |
7.3 | 0.0144 | NET NO AUTH LOW CX NO UI | picoclaw <=v0.1.2 and earlier is vulnerable to OS command injection via the Exec | |
|
75
|
CVE-2026-45332 |
7.5 | 0.0142 | NET NO AUTH LOW CX NO UI | Automad is a flat-file content management system and template engine. From 2.0.0 | |
|
69
|
CVE-2026-44225 |
9.3 | 0.0154 | NET NO AUTH LOW CX | Pulpy is a lightweight, cross-platform desktop application packager for web apps | |
|
69
|
CVE-2026-61736 |
9.3 | 0.0142 | NET NO AUTH LOW CX | LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.4 | |
|
69
|
CVE-2026-115995 |
9.4 | 0.0138 | NET NO AUTH LOW CX | A security vulnerability has been detected in Unitree Robotics Unitree Go2 up to | |
|
68
|
CVE-2026-70035 |
8.8 | 0.0143 | NET NO AUTH LOW CX | Deserialization of untrusted data in .NET Framework allows an unauthorized attac | |
|
68
|
CVE-2026-83520 |
8.8 | 0.0143 | NET NO AUTH LOW CX | Deserialization of untrusted data in .NET allows an unauthorized attacker to exe | |
|
68
|
CVE-2026-48732 |
8.8 | 0.0140 | NET NO AUTH LOW CX | Warp is an agentic development environment. From 0.2023.03.21.08.02.stable_00 un | |
|
68
|
CVE-2026-59859 |
8.7 | 0.0138 | NET NO AUTH LOW CX | Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.4 | |
|
68
|
CVE-2026-59860 |
8.7 | 0.0138 | NET NO AUTH LOW CX | Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.3 | |
|
67
|
CVE-2025-34108 |
8.6 | 0.0144 | NET NO AUTH LOW CX | A stack-based buffer overflow vulnerability exists in the login functionality of | |
|
66
|
CVE-2026-18129 |
8.1 | 0.0146 | NET NO AUTH NO UI | Cleartext transmission of sensitive information in the Core of Ivanti Endpoint M | |
|
66
|
CVE-2026-70571 |
8.1 | 0.0139 | NET NO AUTH NO UI | Stack-based buffer overflow in Microsoft Exchange Server allows an unauthorized |