Hunt List
12,825 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
90
|
CVE-2026-110264 |
10.0 | 0.0131 | NET NO AUTH LOW CX NO UI | 12 PoC | An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 bef |
|
80
|
CVE-2026-48323 |
10.0 | 0.0137 | NET NO AUTH LOW CX NO UI | Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Specia | |
|
80
|
CVE-2026-42221 |
9.8 | 0.0134 | NET NO AUTH LOW CX NO UI | Nginx UI is a web user interface for the Nginx web server. From version 2.0.0 to | |
|
80
|
CVE-2026-70291 |
9.8 | 0.0133 | NET NO AUTH LOW CX NO UI | Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized at | |
|
80
|
CVE-2026-43512 |
9.8 | 0.0133 | NET NO AUTH LOW CX NO UI | DEPRECATED: Authentication Bypass Issues vulnerability in digest authentication | |
|
80
|
CVE-2026-48277 |
10.0 | 0.0129 | NET NO AUTH LOW CX NO UI | ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Inpu | |
|
80
|
CVE-2026-42537 |
9.8 | 0.0129 | NET NO AUTH LOW CX NO UI | Remote Code Execution via JDBC URL Injection in Apache Ranger <= 2.8.0 Users are | |
|
79
|
CVE-2026-97854 |
9.3 | 0.0137 | NET NO AUTH LOW CX NO UI | Yamaha wireless LAN router NWR100 provided by Yamaha Corporation contains an OS | |
|
79
|
CVE-2026-47103 |
9.3 | 0.0136 | NET NO AUTH LOW CX NO UI | Python StateMachine versions 3.0.0 before 3.2.0 contains a remote code execution | |
|
79
|
CVE-2026-58449 |
9.3 | 0.0135 | NET NO AUTH LOW CX NO UI | txtai through 9.10.0, fixed in commit 11b32da, exposes an API /reindex endpoint | |
|
79
|
CVE-2026-54836 |
9.3 | 0.0134 | NET NO AUTH LOW CX NO UI | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti | |
|
79
|
CVE-2026-59864 |
9.3 | 0.0133 | NET NO AUTH LOW CX NO UI | Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5 | |
|
79
|
CVE-2026-42647 |
9.3 | 0.0132 | NET NO AUTH LOW CX NO UI | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti | |
|
79
|
CVE-2026-112900 |
9.2 | 0.0130 | NET NO AUTH LOW CX NO UI | Pillow is a Python imaging library. From 2.6.0 until 13.0.0, Pillow is vulnerabl | |
|
79
|
CVE-2026-63385 |
9.2 | 0.0129 | NET NO AUTH LOW CX NO UI | Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libe | |
|
78
|
CVE-2026-39339 |
9.1 | 0.0135 | NET NO AUTH LOW CX NO UI | ChurchCRM is an open-source church management system. Prior to 7.1.0, a critica | |
|
78
|
CVE-2026-112352 |
9.1 | 0.0132 | NET NO AUTH LOW CX NO UI | Sunhillo SureLine before 9.1.5 contains an authentication bypass vulnerability t | |
|
78
|
CVE-2026-2332 |
9.1 | 0.0131 | NET NO AUTH LOW CX NO UI | In Eclipse Jetty, the HTTP/1.1 parser is vulnerable to request smuggling when ch | |
|
78
|
CVE-2026-33765 |
8.9 | 0.0130 | NET NO AUTH LOW CX NO UI | Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level | |
|
75
|
CVE-2026-67918 |
7.5 | 0.0136 | NET NO AUTH LOW CX NO UI | Directory Traversal vulnerability in hermes-studio v.0.6.26 allows a remote atta | |
|
75
|
CVE-2026-42009 |
7.5 | 0.0134 | NET NO AUTH LOW CX NO UI | A flaw was found in gnutls. A remote attacker could exploit an issue in the Data | |
|
75
|
CVE-2026-70058 |
7.5 | 0.0133 | NET NO AUTH LOW CX NO UI | Out-of-bounds write in Windows DHCP Server allows an unauthorized attacker to ex | |
|
75
|
CVE-2026-70082 |
7.5 | 0.0133 | NET NO AUTH LOW CX NO UI | Uncaught exception in Windows DNS allows an unauthorized attacker to deny servic | |
|
75
|
CVE-2026-70155 |
7.5 | 0.0133 | NET NO AUTH LOW CX NO UI | Missing release of memory after effective lifetime in Windows DNS allows an unau | |
|
75
|
CVE-2026-83516 |
7.5 | 0.0133 | NET NO AUTH LOW CX NO UI | Out-of-bounds read in Windows Local Security Authority Subsystem Service (LSASS) | |
|
75
|
CVE-2026-83635 |
7.5 | 0.0133 | NET NO AUTH LOW CX NO UI | Out-of-bounds read in DNS Server allows an unauthorized attacker to deny service | |
|
75
|
CVE-2026-83655 |
7.5 | 0.0133 | NET NO AUTH LOW CX NO UI | Out-of-bounds read in Network Policy Server (NPS) allows an unauthorized attacke | |
|
75
|
CVE-2026-83665 |
7.5 | 0.0133 | NET NO AUTH LOW CX NO UI | Null pointer dereference in Windows DHCP Server allows an unauthorized attacker | |
|
75
|
CVE-2026-83855 |
7.5 | 0.0133 | NET NO AUTH LOW CX NO UI | Integer underflow (wrap or wraparound) in Windows WLAN Service allows an unautho | |
|
75
|
CVE-2026-105723 |
7.5 | 0.0132 | NET NO AUTH LOW CX NO UI | Untrusted pointer dereference in Windows Distributed File System (DFS) allows an | |
|
75
|
CVE-2026-2100 |
7.5 | 0.0131 | NET NO AUTH LOW CX NO UI | A flaw was found in p11-kit. A remote attacker could exploit this vulnerability | |
|
70
|
CVE-2026-104353 |
9.9 | 0.0130 | NET LOW CX NO UI | Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Specia | |
|
70
|
CVE-2023-27407 |
9.9 | 0.0130 | NET LOW CX NO UI | A vulnerability has been identified in SCALANCE LPE9403 (All versions < V2.1). T | |
|
69
|
CVE-2026-21571 |
9.4 | 0.0135 | NET LOW CX NO UI | This Critical severity OS Command Injection vulnerability was introduced in vers | |
|
69
|
CVE-2026-70279 |
9.3 | 0.0129 | NET NO AUTH LOW CX | Improper neutralization of input during web page generation ('cross-site scripti | |
|
68
|
CVE-2026-41880 |
9.0 | 0.0133 | NET LOW CX NO UI | R-SOFT DMS is vulnerable to OS Command Injection in the Optical Character Recogn | |
|
68
|
CVE-2026-63722 |
8.7 | 0.0133 | NET LOW CX NO UI | ICEcoder 8.1 contains an unauthenticated remote code execution vulnerability tha | |
|
68
|
CVE-2026-33277 |
8.7 | 0.0132 | NET LOW CX NO UI | An OS command Injection issue exists in LogonTracer prior to v2.0.0. An arbitrar | |
|
68
|
CVE-2026-39981 |
8.8 | 0.0132 | NET LOW CX NO UI | AGiXT is a dynamic AI Agent Automation Platform. Prior to 1.9.2, the safe_join() | |
|
68
|
CVE-2026-34791 |
8.7 | 0.0129 | NET LOW CX NO UI | Endian Firewall version 3.3.25 and prior allow authenticated users to execute ar | |
|
68
|
CVE-2026-8659 |
8.8 | 0.0129 | NET LOW CX NO UI | OS Command Injection vulnerability in Rapid7 InsightConnect SQLmap Plugin on Lin | |
|
68
|
CVE-2026-8663 |
8.8 | 0.0129 | NET LOW CX NO UI | OS Command Injection vulnerability in Rapid7 InsightConnect RPM Plugin on Linux | |
|
68
|
CVE-2026-8664 |
8.8 | 0.0129 | NET LOW CX NO UI | OS Command Injection vulnerability in Rapid7 InsightConnect Finger Plugin on Lin | |
|
68
|
CVE-2026-8658 |
8.8 | 0.0129 | NET LOW CX NO UI | OS Command Injection vulnerability in Rapid7 InsightConnect Tcpdump Plugin on Li | |
|
68
|
CVE-2026-81385 |
8.8 | 0.0129 | NET NO AUTH LOW CX | Deserialization of untrusted data in Microsoft Office Publisher allows an unauth | |
|
62
|
CVE-2026-12104 |
8.6 | 0.0132 | NET LOW CX NO UI | OS command injection in the environment and tunnel configuration functionality i | |
|
62
|
CVE-2026-35506 |
8.6 | 0.0131 | NET LOW CX NO UI | ELECOM wireless LAN access point devices contain an OS command injection vulnera | |
|
60
|
CVE-2026-111461 |
7.5 | 0.0137 | NET LOW CX NO UI | An OS command injection vulnerability exists in OnCell G3150A-LTE Series. When t | |
|
56
|
CVE-2026-48719 |
8.0 | 0.0132 | NET LOW CX | Warp is an agentic development environment. From 0.2025.08.06.08.12.stable_00 un | |
|
51
|
CVE-2026-40711 |
8.0 | 0.0135 | NET NO UI | Dell Dell Container Storage Modules, version(s) csi-powerstore v2.16.0, csi-unit |