Hunt List
13,340 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-54803 |
9.8 | 0.0045 | NET NO AUTH LOW CX NO UI | Subscriber Privilege Escalation in SMS Alert Order Notifications <= 3.9.4 versio | |
|
80
|
CVE-2026-64523 |
9.8 | 0.0045 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: net/handsha | |
|
80
|
CVE-2026-91495 |
9.8 | 0.0045 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middlewar | |
|
80
|
CVE-2026-11561 |
9.8 | 0.0045 | NET NO AUTH LOW CX NO UI | Improper neutralization of special elements used in an expression language state | |
|
80
|
CVE-2026-114196 |
9.8 | 0.0045 | NET NO AUTH LOW CX NO UI | Deserialization of Untrusted Data vulnerability in paytiumsupport Paytium paytiu | |
|
80
|
CVE-2026-94075 |
9.8 | 0.0045 | NET NO AUTH LOW CX NO UI | Deserialization of Untrusted Data vulnerability in Tribulant Software Newsletter | |
|
80
|
CVE-2026-62013 |
9.8 | 0.0045 | NET NO AUTH LOW CX NO UI | Unauthenticated PHP Object Injection in Edge Decor <= 2.9 versions. | |
|
80
|
CVE-2026-62018 |
9.8 | 0.0045 | NET NO AUTH LOW CX NO UI | Unauthenticated PHP Object Injection in Gunslinger <= 1.11 versions. | |
|
79
|
CVE-2026-6284 |
9.3 | 0.0045 | NET NO AUTH LOW CX NO UI | An attacker with network access to the PLC is able to brute force discover passw | |
|
78
|
CVE-2026-44597 |
9.1 | 0.0045 | NET NO AUTH LOW CX NO UI | Tor before 0.4.9.7 has an out-of-bounds read when an END, a TRUNCATE, or a TRUNC | |
|
78
|
CVE-2026-60208 |
9.1 | 0.0045 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware | |
|
77
|
CVE-2024-35585 |
8.6 | 0.0045 | NET NO AUTH LOW CX NO UI | Oxford Nanopore MinKNOW before 24.06 relies on a client's source IP address for | |
|
77
|
CVE-2026-3329 |
8.7 | 0.0045 | NET NO AUTH LOW CX NO UI | A remote unauthenticated attacker may be able to conduct credential-guessing att | |
|
77
|
CVE-2026-74904 |
8.7 | 0.0045 | NET NO AUTH LOW CX NO UI | SiYuan before v3.7.4 is missing authorization checks in 17 block metadata/conten | |
|
77
|
CVE-2026-116693 |
8.7 | 0.0045 | NET NO AUTH LOW CX NO UI | dd-trace is the Datadog APM client for Node.js. From 2.0.0 until 5.131.1 and 6.2 | |
|
76
|
CVE-2026-99131 |
8.2 | 0.0045 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: xfs: fix ca | |
|
75
|
CVE-2026-30912 |
7.5 | 0.0045 | NET NO AUTH LOW CX NO UI | In case of SQL errors, exception/stack trace of errors was exposed in API even i | |
|
75
|
CVE-2026-9836 |
7.5 | 0.0045 | NET NO AUTH LOW CX NO UI | IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 is affected by an in | |
|
75
|
CVE-2026-24451 |
7.5 | 0.0045 | NET NO AUTH LOW CX NO UI | Gitea 1.26.2 allows fork synchronization to continue after a parent repository c | |
|
70
|
CVE-2025-62047 |
9.9 | 0.0045 | NET LOW CX NO UI | Unrestricted Upload of File with Dangerous Type vulnerability in Case-Themes Cas | |
|
70
|
CVE-2026-39589 |
9.9 | 0.0045 | NET LOW CX NO UI | Subscriber Arbitrary File Upload in Webenvo <= 0.0.6 versions. | |
|
69
|
CVE-2026-57625 |
9.6 | 0.0045 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in Admin and Site Enhancements (ASE) | |
|
69
|
CVE-2026-48360 |
9.6 | 0.0045 | NET NO AUTH LOW CX | Adobe Connect is affected by an Improper Control of Generation of Code ('Code In | |
|
69
|
CVE-2026-62668 |
9.4 | 0.0045 | NET LOW CX NO UI | Grav API Plugin is a RESTful API for Grav CMS that provides full headless access | |
|
69
|
CVE-2026-54725 |
9.6 | 0.0045 | NET LOW CX NO UI | vault-secrets-webhook is a Kubernetes mutating webhook that makes direct secret | |
|
68
|
CVE-2025-62035 |
8.8 | 0.0045 | NET LOW CX NO UI | Deserialization of Untrusted Data vulnerability in uxper Togo togo.This issue af | |
|
68
|
CVE-2026-59229 |
8.8 | 0.0045 | NET LOW CX NO UI | The Legacy Pipe receiver protocol (handshake / sendPipeData) uses a hardcoded SU | |
|
67
|
CVE-2026-12059 |
8.7 | 0.0045 | NET LOW CX NO UI | The SSH service of CelloOS developed by Cellopoint has an Improper Access Contro | |
|
67
|
CVE-2026-53453 |
8.7 | 0.0045 | NET LOW CX NO UI | Blueprint Studio is a VS Code-like file editor for Home Assistant configuration | |
|
67
|
CVE-2018-25308 |
8.7 | 0.0045 | NET LOW CX NO UI | BuddyPress Xprofile Custom Fields Type 2.6.3 contains an arbitrary file deletion | |
|
67
|
CVE-2026-41036 |
8.7 | 0.0045 | NET LOW CX NO UI | This vulnerability exists in Quantum Networks router due to inadequate sanitizat | |
|
67
|
CVE-2026-56305 |
8.7 | 0.0045 | NET LOW CX NO UI | Capgo before 12.128.2 contains an authentication bypass vulnerability in the pas | |
|
67
|
CVE-2026-115332 |
8.7 | 0.0045 | NET LOW CX NO UI | Lotus through 0.10.2 contains an sql injection vulnerability that allows authent | |
|
67
|
CVE-2026-107238 |
8.7 | 0.0045 | NET LOW CX NO UI | A vulnerability allowing an authenticated domain user to perform remote code exe | |
|
67
|
CVE-2026-42548 |
8.6 | 0.0045 | NET NO AUTH LOW CX | Flight is an extensible micro-framework for PHP. Prior to 3.18.1, Flight::jsonp( | |
|
67
|
CVE-2026-48034 |
8.5 | 0.0045 | NET LOW CX NO UI | Hulumi is an open-source toolkit that ships secure-by-default cloud and platform | |
|
65
|
CVE-2026-77079 |
7.4 | 0.0045 | NET LOW CX NO UI | n8n before 2.34.1 and 2.33.4 contains an authorization bypass in the custom proj | |
|
64
|
CVE-2026-55865 |
7.1 | 0.0045 | NET LOW CX NO UI | Python Liquid is a Python engine for the Liquid template language. Prior to 2.2. | |
|
64
|
CVE-2026-13064 |
7.1 | 0.0045 | NET LOW CX NO UI | Certain query operations involving deeply nested $jsonSchema constructs can trig | |
|
64
|
CVE-2026-48035 |
7.1 | 0.0045 | NET LOW CX NO UI | Hulumi is an open-source toolkit that ships secure-by-default cloud and platform | |
|
64
|
CVE-2026-72607 |
7.1 | 0.0045 | NET LOW CX NO UI | A stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.0 | |
|
64
|
CVE-2026-55192 |
7.2 | 0.0045 | NET NO AUTH LOW CX | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0 | |
|
64
|
CVE-2026-22104 |
7.1 | 0.0045 | NET LOW CX NO UI | Improper access control in Hashtopolis server web-interface chunk activity compo | |
|
64
|
CVE-2024-58357 |
7.1 | 0.0045 | NET LOW CX NO UI | SurrealDB versions before 2.1.0 contain an uncaught exception vulnerability in t | |
|
64
|
CVE-2024-58359 |
7.1 | 0.0045 | NET LOW CX NO UI | SurrealDB versions before 2.1.0 contain a denial of service vulnerability in the | |
|
64
|
CVE-2024-58361 |
7.1 | 0.0045 | NET LOW CX NO UI | SurrealDB versions before 2.0.4 contain an uncaught exception handling vulnerabi | |
|
64
|
CVE-2024-58364 |
7.1 | 0.0045 | NET LOW CX NO UI | SurrealDB versions before 1.2.1 contain an uncaught exception handling vulnerabi | |
|
64
|
CVE-2024-58365 |
7.1 | 0.0045 | NET LOW CX NO UI | SurrealDB versions before 1.2.0 contain an uncaught exception vulnerability in t | |
|
64
|
CVE-2024-58369 |
7.1 | 0.0045 | NET LOW CX NO UI | SurrealDB versions before 1.1.1 fail to properly validate invocation of custom p | |
|
64
|
CVE-2025-71395 |
7.1 | 0.0045 | NET LOW CX NO UI | SurrealDB versions before 2.2.2 contain a memory exhaustion vulnerability in the |