Hunt List
8,611 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-17111 |
9.8 | 0.0045 | NET NO AUTH LOW CX NO UI | IBM i 7.6, 7.5, 7.4, and 7.3 s vulnerable to SQL injection. A remote attacker co | |
|
80
|
CVE-2026-54803 |
9.8 | 0.0045 | NET NO AUTH LOW CX NO UI | Subscriber Privilege Escalation in SMS Alert Order Notifications <= 3.9.4 versio | |
|
80
|
CVE-2026-11561 |
9.8 | 0.0045 | NET NO AUTH LOW CX NO UI | Improper neutralization of special elements used in an expression language state | |
|
80
|
CVE-2026-114196 |
9.8 | 0.0045 | NET NO AUTH LOW CX NO UI | Deserialization of Untrusted Data vulnerability in paytiumsupport Paytium paytiu | |
|
80
|
CVE-2026-94075 |
9.8 | 0.0045 | NET NO AUTH LOW CX NO UI | Deserialization of Untrusted Data vulnerability in Tribulant Software Newsletter | |
|
80
|
CVE-2026-62013 |
9.8 | 0.0045 | NET NO AUTH LOW CX NO UI | Unauthenticated PHP Object Injection in Edge Decor <= 2.9 versions. | |
|
79
|
CVE-2026-6886 |
9.3 | 0.0045 | NET NO AUTH LOW CX NO UI | Borg SPM 2007 (Sales Ended in 2008) developed by BorG Technology Corporation has | |
|
78
|
CVE-2026-17423 |
9.1 | 0.0045 | NET NO AUTH LOW CX NO UI | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to o | |
|
78
|
CVE-2026-44597 |
9.1 | 0.0045 | NET NO AUTH LOW CX NO UI | Tor before 0.4.9.7 has an out-of-bounds read when an END, a TRUNCATE, or a TRUNC | |
|
77
|
CVE-2026-118694 |
8.7 | 0.0045 | NET NO AUTH LOW CX NO UI | python-markdown2 through 2.5.5 contains a denial of service vulnerability that a | |
|
77
|
CVE-2026-54407 |
8.6 | 0.0045 | NET NO AUTH LOW CX NO UI | A malicious actor with access to the network could exploit an Improper Access Co | |
|
77
|
CVE-2026-26061 |
8.7 | 0.0045 | NET NO AUTH LOW CX NO UI | Fleet is open source device management software. Prior to 4.81.0, Fleet containe | |
|
77
|
CVE-2026-41636 |
8.7 | 0.0045 | NET NO AUTH LOW CX NO UI | Uncontrolled Recursion vulnerability in Apache Thrift Node.js bindings This iss | |
|
77
|
CVE-2026-25863 |
8.7 | 0.0045 | NET NO AUTH LOW CX NO UI | Conditional Fields for Contact Form 7 WordPress plugin through version 2.7.2 con | |
|
77
|
CVE-2026-48854 |
8.7 | 0.0045 | NET NO AUTH LOW CX NO UI | Allocation of Resources Without Limits or Throttling vulnerability in elixir-grp | |
|
77
|
CVE-2026-70559 |
8.7 | 0.0045 | NET NO AUTH LOW CX NO UI | Dinky's SysConfigController.getAll() handler for GET /api/sysConfig/getAll carri | |
|
77
|
CVE-2024-35585 |
8.6 | 0.0045 | NET NO AUTH LOW CX NO UI | Oxford Nanopore MinKNOW before 24.06 relies on a client's source IP address for | |
|
76
|
CVE-2026-63567 |
8.2 | 0.0045 | NET NO AUTH LOW CX NO UI | Observable discrepancy in IesEngine.DecryptBlock in Legion of the Bouncy Castle | |
|
76
|
CVE-2026-102555 |
8.2 | 0.0045 | NET NO AUTH LOW CX NO UI | A flaw was found in libsoup. The soup_uri_decode_data_uri() function incorrectly | |
|
76
|
CVE-2026-99131 |
8.2 | 0.0045 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: xfs: fix ca | |
|
75
|
CVE-2026-40303 |
7.5 | 0.0045 | NET NO AUTH LOW CX NO UI | zrok is software for sharing web services, files, and network resources. Prior t | |
|
75
|
CVE-2026-14528 |
7.5 | 0.0045 | NET NO AUTH LOW CX NO UI | IBM WebSphere Application Server 9.0, and 8.5 traditional could allow a remote a | |
|
75
|
CVE-2026-104591 |
7.5 | 0.0045 | NET NO AUTH LOW CX NO UI | libosmocore through 1.14.1 contains a buffer overflow in osmo_iuup_compute_paylo | |
|
75
|
CVE-2026-62264 |
7.5 | 0.0045 | NET NO AUTH LOW CX NO UI | PDF Reader MCP is a Model Context Protocol server for reading PDF documents. In | |
|
75
|
CVE-2026-24690 |
7.5 | 0.0045 | NET NO AUTH LOW CX NO UI | Gitea versions before 1.25.5 have insufficient permission checks for updating or | |
|
75
|
CVE-2026-27657 |
7.5 | 0.0045 | NET NO AUTH LOW CX NO UI | Gitea versions before 1.25.5 allow a user to change another user's primary email | |
|
75
|
CVE-2026-27660 |
7.5 | 0.0045 | NET NO AUTH LOW CX NO UI | Gitea versions before 1.25.5 allow draft release data or attachments to be acces | |
|
75
|
CVE-2026-116581 |
7.5 | 0.0045 | NET NO AUTH LOW CX NO UI | Seroval facilitates JavaScript value stringification, including complex structur | |
|
75
|
CVE-2025-68321 |
7.5 | 0.0045 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: page_pool: | |
|
75
|
CVE-2026-31557 |
7.5 | 0.0045 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: nvmet: move | |
|
69
|
CVE-2026-14973 |
9.3 | 0.0045 | NET NO AUTH LOW CX | IBM Aspera Desktop App 1.0.5 through 1.0.19 IBM Aspera for desktop can allow fil | |
|
69
|
CVE-2026-113211 |
9.6 | 0.0045 | NET NO AUTH LOW CX | Memory corruption in ServiceWorker in Google Chrome prior to 156.0.8078.47 allow | |
|
69
|
CVE-2026-57625 |
9.6 | 0.0045 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in Admin and Site Enhancements (ASE) | |
|
69
|
CVE-2026-48360 |
9.6 | 0.0045 | NET NO AUTH LOW CX | Adobe Connect is affected by an Improper Control of Generation of Code ('Code In | |
|
68
|
CVE-2026-16396 |
8.8 | 0.0045 | NET NO AUTH LOW CX | Privilege escalation in WebExtensions. This vulnerability was fixed in Firefox 1 | |
|
68
|
CVE-2026-113088 |
8.8 | 0.0045 | NET NO AUTH LOW CX | Memory corruption in Mobile in Google Chrome on on Android prior to 156.0.8078.4 | |
|
68
|
CVE-2026-113107 |
8.8 | 0.0045 | NET NO AUTH LOW CX | Use after free in Media in Google Chrome on on Android prior to 156.0.8078.47 al | |
|
68
|
CVE-2026-113145 |
8.8 | 0.0045 | NET NO AUTH LOW CX | Memory corruption in Messages in Google Chrome on on Android prior to 156.0.8078 | |
|
68
|
CVE-2026-113156 |
8.8 | 0.0045 | NET NO AUTH LOW CX | Use after free in Messages in Google Chrome on on Android prior to 156.0.8078.47 | |
|
68
|
CVE-2026-15132 |
8.8 | 0.0045 | NET NO AUTH LOW CX | Uninitialized Use in V8 in Google Chrome prior to 150.0.7871.115 allowed a remot | |
|
68
|
CVE-2026-17725 |
8.8 | 0.0045 | NET NO AUTH LOW CX | Type Confusion in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote at | |
|
68
|
CVE-2026-17989 |
8.8 | 0.0045 | NET NO AUTH LOW CX | Type Confusion in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote at | |
|
68
|
CVE-2026-76038 |
8.8 | 0.0045 | NET NO AUTH LOW CX | Type confusion in V8 in Google Chrome prior to 151.0.7922.169 allowed a remote a | |
|
68
|
CVE-2026-76047 |
8.8 | 0.0045 | NET NO AUTH LOW CX | Type confusion in V8 in Google Chrome prior to 151.0.7922.169 allowed a remote a | |
|
68
|
CVE-2026-64759 |
8.8 | 0.0045 | NET NO AUTH LOW CX | An integer overflow was addressed with improved input validation. This issue is | |
|
66
|
CVE-2026-98130 |
8.1 | 0.0045 | NET NO AUTH NO UI | In the Linux kernel, the following vulnerability has been resolved: sctp: fix a | |
|
65
|
CVE-2026-65219 |
7.4 | 0.0045 | NET NO AUTH NO UI | A flaw in the BMC RAKP+ implementation may allow an attacker to send a request f | |
|
64
|
CVE-2026-55192 |
7.2 | 0.0045 | NET NO AUTH LOW CX | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0 | |
|
57
|
CVE-2026-57268 |
8.3 | 0.0045 | NET NO AUTH | GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Playe | |
|
55
|
CVE-2026-100208 |
7.5 | 0.0045 | NET NO AUTH | Integer overflow or wraparound in Microsoft Office Outlook allows an unauthorize |