Hunt List
13,282 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-78846 |
9.8 | 0.0045 | NET NO AUTH LOW CX NO UI | Multiple AiDot devices are vulnerable to a heap-based buffer overflow via SSDP l | |
|
80
|
CVE-2026-61424 |
10.0 | 0.0044 | NET NO AUTH LOW CX NO UI | Joomla Extension - dj-extensions.com - Unauthenticated arbitrary file upload in | |
|
80
|
CVE-2026-61900 |
10.0 | 0.0044 | NET NO AUTH LOW CX NO UI | Joomla Extension - dj-extensions.com - Unauthenticated arbitrary file upload in | |
|
80
|
CVE-2026-10757 |
9.8 | 0.0044 | NET NO AUTH LOW CX NO UI | There is a SQL injection vulnerability in Esri ArcGIS Server versions 12.1 and e | |
|
79
|
CVE-2026-76311 |
9.4 | 0.0045 | NET NO AUTH LOW CX NO UI | In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unaut | |
|
79
|
CVE-2026-5482 |
9.3 | 0.0044 | NET NO AUTH LOW CX NO UI | Responsive FileManager's allows an unauthenticated attacker to upload files of a | |
|
78
|
CVE-2026-62415 |
9.1 | 0.0045 | NET NO AUTH LOW CX NO UI | Joomla Extension - joomdonation.com - Insecure default configuration Membership | |
|
78
|
CVE-2026-42278 |
8.8 | 0.0045 | NET NO AUTH LOW CX NO UI | UltraDAG is a minimal DAG-BFT blockchain in Rust. Prior to commit fb6ef59, the U | |
|
78
|
CVE-2026-48814 |
9.1 | 0.0044 | NET NO AUTH LOW CX NO UI | Network-AI is a TypeScript/Node.js multi-agent orchestrator. In versions 5.7.1 a | |
|
78
|
CVE-2026-61666 |
8.9 | 0.0044 | NET NO AUTH LOW CX NO UI | websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0. | |
|
77
|
CVE-2026-67427 |
8.6 | 0.0045 | NET NO AUTH LOW CX NO UI | Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior | |
|
77
|
CVE-2026-46410 |
8.7 | 0.0044 | NET NO AUTH LOW CX NO UI | FileBrowser Quantum is a free, self-hosted, web-based file manager. Versions pri | |
|
77
|
CVE-2026-6924 |
8.7 | 0.0044 | NET NO AUTH LOW CX NO UI | A bug in the entropy initialization for SiWx917 causes the DRBG to use a predict | |
|
77
|
CVE-2026-57573 |
8.6 | 0.0044 | NET NO AUTH LOW CX NO UI | Crawl4AI is an open-source LLM-friendly web crawler and scraper. Prior to 0.9.0, | |
|
77
|
CVE-2026-12983 |
8.6 | 0.0044 | NET NO AUTH LOW CX NO UI | The Dinatur WordPress plugin through 1.18 does not sanitize and escape user inpu | |
|
76
|
CVE-2026-59197 |
8.2 | 0.0044 | NET NO AUTH LOW CX NO UI | Pillow is a Python imaging library. Prior to 12.3.0, Pillow's public rank-filter | |
|
75
|
CVE-2026-50196 |
7.5 | 0.0045 | NET NO AUTH LOW CX NO UI | Steeltoe is an open source project that provides a collection of libraries that | |
|
75
|
CVE-2026-115482 |
7.5 | 0.0045 | NET NO AUTH LOW CX NO UI | In lsquic before 4.9.0, the HTTP/3 implementation can use an excessive amount of | |
|
69
|
CVE-2026-53943 |
9.6 | 0.0045 | NET NO AUTH LOW CX | Ghost is a Node.js content management system. From until 6.37.0, when Ghost is | |
|
68
|
CVE-2026-35050 |
8.8 | 0.0045 | NET LOW CX NO UI | text-generation-webui is an open-source web interface for running Large Language | |
|
68
|
CVE-2026-116868 |
8.8 | 0.0045 | NET LOW CX NO UI | Subscriber PHP Object Injection in BuddyPress Xprofile Custom Field Types <= 1.3 | |
|
68
|
CVE-2026-118090 |
8.8 | 0.0045 | NET LOW CX NO UI | Subscriber PHP Object Injection in MasterStudy LMS <= 3.7.55 versions. | |
|
68
|
CVE-2026-99083 |
8.8 | 0.0044 | NET LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix | |
|
67
|
CVE-2026-75912 |
8.3 | 0.0045 | NET NO AUTH LOW CX | CodeWhale versions before 0.8.64 contain an argument injection vulnerability in | |
|
67
|
CVE-2026-6281 |
8.7 | 0.0044 | NET LOW CX NO UI | A potential vulnerability was reported in some Lenovo Personal Cloud Storage dev | |
|
67
|
CVE-2026-44088 |
8.6 | 0.0044 | NET NO AUTH LOW CX | SzafirHost verifies the signature of the downloaded JAR file using class JarInpu | |
|
66
|
CVE-2026-23902 |
8.1 | 0.0045 | NET LOW CX NO UI | Incorrect Authorization vulnerability in Apache DolphinScheduler allows authenti | |
|
66
|
CVE-2026-63231 |
8.1 | 0.0045 | NET LOW CX NO UI | A post-authentication SQL injection vulnerability in Koollab LMS allowed an auth | |
|
66
|
CVE-2026-49402 |
8.1 | 0.0044 | NET NO AUTH NO UI | Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.7.10, Deno | |
|
65
|
CVE-2026-6198 |
7.4 | 0.0045 | NET LOW CX NO UI | A vulnerability has been found in Tenda F456 1.0.0.5. This issue affects the fun | |
|
65
|
CVE-2026-6200 |
7.4 | 0.0045 | NET LOW CX NO UI | A vulnerability was determined in Tenda F456 1.0.0.5. The affected element is th | |
|
65
|
CVE-2026-6630 |
7.4 | 0.0045 | NET LOW CX NO UI | A vulnerability was found in Tenda F451 1.0.0.7_cn_svn7958. This issue affects t | |
|
65
|
CVE-2026-6632 |
7.4 | 0.0045 | NET LOW CX NO UI | A vulnerability was identified in Tenda F451 1.0.0.7_cn_svn7958. The affected el | |
|
65
|
CVE-2026-7503 |
7.4 | 0.0045 | NET LOW CX NO UI | A vulnerability was detected in code-projects for Plugin 4.1.2cu.5137. The impac | |
|
65
|
CVE-2026-10646 |
7.4 | 0.0045 | NET NO AUTH NO UI | Zephyr's BSD-sockets getaddrinfo() implementation (subsys/net/lib/sockets/getadd | |
|
65
|
CVE-2026-93017 |
7.7 | 0.0045 | NET LOW CX NO UI | The `insights-operator-gather` ClusterRole grants the operator's service account | |
|
65
|
CVE-2026-13341 |
7.4 | 0.0045 | NET NO AUTH LOW CX | A vulnerability exists in the Kong Konnect Model Context Protocol (MCP) server p | |
|
65
|
CVE-2026-49853 |
7.7 | 0.0044 | NET LOW CX NO UI | Tornado is a Python web framework and asynchronous networking library. Prior to | |
|
64
|
CVE-2026-8919 |
7.2 | 0.0045 | NET NO AUTH LOW CX | Permissive Cross-domain Security Policy with Untrusted Domains in ASUS GameSDK a | |
|
64
|
CVE-2026-64816 |
7.1 | 0.0045 | NET NO AUTH LOW CX | RapidRAW before 1.6.0 does not validate the lutPath field in preset files before | |
|
59
|
CVE-2026-39434 |
7.2 | 0.0045 | NET LOW CX NO UI | Shop manager PHP Object Injection in CTX Feed <= 6.6.26 versions. | |
|
59
|
CVE-2026-39471 |
7.2 | 0.0045 | NET LOW CX NO UI | Author PHP Object Injection in ShortPixel Image Optimizer <= 6.4.3 versions. | |
|
59
|
CVE-2026-39472 |
7.2 | 0.0045 | NET LOW CX NO UI | Shop manager PHP Object Injection in WooCommerce PDF Invoices & Packing Slips < | |
|
59
|
CVE-2026-39481 |
7.2 | 0.0045 | NET LOW CX NO UI | Author PHP Object Injection in Modula Image Gallery <= 2.14.18 versions. | |
|
59
|
CVE-2026-39499 |
7.2 | 0.0045 | NET LOW CX NO UI | Shop manager PHP Object Injection in Advanced Product Fields (Product Addons) fo | |
|
55
|
CVE-2026-62914 |
7.3 | 0.0045 | NET LOW CX | Improper neutralization of input during web page generation ('cross-site scripti | |
|
55
|
CVE-2026-69402 |
7.3 | 0.0045 | NET LOW CX | Improper neutralization of input during web page generation ('cross-site scripti | |
|
55
|
CVE-2026-69417 |
7.3 | 0.0045 | NET LOW CX | Improper neutralization of input during web page generation ('cross-site scripti | |
|
55
|
CVE-2025-67521 |
7.5 | 0.0044 | NET NO UI | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP | |
|
55
|
CVE-2025-67525 |
7.5 | 0.0044 | NET NO UI | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP |