Hunt List
13,097 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-11541 |
9.8 | 0.0042 | NET NO AUTH LOW CX NO UI | IBM CICS Transaction Gateway for Multiplatforms 9.1, 9.2, 9.3, and 10.1 IBM WebS | |
|
80
|
CVE-2026-76466 |
9.8 | 0.0042 | NET NO AUTH LOW CX NO UI | A vulnerability in the database service feature of Cisco Expressway Series could | |
|
79
|
CVE-2026-112296 |
9.3 | 0.0042 | NET NO AUTH LOW CX NO UI | FlyCms through commit edfdf724 contains a default credentials vulnerability that | |
|
78
|
CVE-2024-4457 |
9.1 | 0.0042 | NET NO AUTH LOW CX NO UI | The Management Console fails to properly validate input related to the configura | |
|
78
|
CVE-2026-35675 |
8.8 | 0.0042 | NET NO AUTH LOW CX NO UI | phpMyFAQ before 4.1.3 contains an authentication bypass vulnerability in the pas | |
|
77
|
CVE-2026-57960 |
8.3 | 0.0042 | NET NO AUTH LOW CX NO UI | Hi.Events through 1.9.0 public check-in list endpoints use short_id as sole acce | |
|
77
|
CVE-2026-62927 |
8.7 | 0.0042 | NET NO AUTH LOW CX NO UI | In Eclipse Milo versions 1.0.0 through 1.1.4, the Call service dispatches the or | |
|
77
|
CVE-2026-115723 |
8.3 | 0.0042 | NET NO AUTH LOW CX NO UI | Snap7 through 1.4.3 contains an out-of-bounds write vulnerability in the passive | |
|
76
|
CVE-2026-40193 |
8.2 | 0.0042 | NET NO AUTH LOW CX NO UI | maddy is a composable, all-in-one mail server. Versions prior to 0.9.3 contain a | |
|
76
|
CVE-2026-58071 |
8.2 | 0.0042 | NET NO AUTH LOW CX NO UI | A vulnerability in Veeam Service Provider Console allowing an unauthenticated at | |
|
76
|
CVE-2026-40892 |
8.1 | 0.0042 | NET NO AUTH LOW CX NO UI | PJSIP is a free and open source multimedia communication library written in C. I | |
|
76
|
CVE-2026-17544 |
8.1 | 0.0042 | NET NO AUTH LOW CX NO UI | Attacker-provided inputs to bccomp() could lead to an out-of-bounds write with s | |
|
76
|
CVE-2026-16315 |
8.1 | 0.0042 | NET NO AUTH LOW CX NO UI | OMICRON StationGuard before version 4.10 contains a cryptographic timing side-ch | |
|
75
|
CVE-2026-86415 |
7.5 | 0.0042 | NET NO AUTH LOW CX NO UI | libcurl's connection cache match function never considers the automatic client c | |
|
75
|
CVE-2026-42285 |
7.5 | 0.0042 | NET NO AUTH LOW CX NO UI | GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go P | |
|
75
|
CVE-2026-54060 |
7.5 | 0.0042 | NET NO AUTH LOW CX NO UI | Pillow is a Python imaging library. Prior to 12.3.0, PIL/FontFile.py FontFile.co | |
|
75
|
CVE-2026-5730 |
7.5 | 0.0042 | NET NO AUTH LOW CX NO UI | Authorization bypass through User-Controlled key vulnerability in Idvlabs Softwa | |
|
75
|
CVE-2026-5799 |
7.5 | 0.0042 | NET NO AUTH LOW CX NO UI | Authorization bypass through User-Controlled key vulnerability in Idvlabs Softwa | |
|
75
|
CVE-2026-14165 |
7.5 | 0.0042 | NET NO AUTH LOW CX NO UI | An Authorization Bypass Through User-Controlled Key vulnerability affecting Tule | |
|
75
|
CVE-2026-82231 |
7.5 | 0.0042 | NET NO AUTH LOW CX NO UI | A Thrift client in Apache bRPC (version < 1.18.0, built with WITH_THRIFT which i | |
|
75
|
CVE-2026-82425 |
7.5 | 0.0042 | NET NO AUTH LOW CX NO UI | A reachable assertion in Apache bRPC (version < 1.18.0) on all platforms allows | |
|
75
|
CVE-2026-116638 |
7.5 | 0.0042 | NET NO AUTH LOW CX NO UI | The Windows Recovery Environment (WinRE) in Windows 10 and 11 may allow an attac | |
|
74
|
CVE-2026-96767 |
7.2 | 0.0042 | NET NO AUTH LOW CX NO UI | The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vuln | |
|
68
|
CVE-2025-69035 |
8.8 | 0.0042 | NET LOW CX NO UI | Deserialization of Untrusted Data vulnerability in Strongholdthemes Dental Care | |
|
68
|
CVE-2026-15767 |
8.8 | 0.0042 | NET NO AUTH LOW CX | Heap buffer overflow in libyuv in Google Chrome on Windows prior to 150.0.7871.1 | |
|
68
|
CVE-2026-91407 |
8.8 | 0.0042 | NET LOW CX NO UI | Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware | |
|
68
|
CVE-2026-56008 |
8.8 | 0.0042 | NET LOW CX NO UI | Contributor Privilege Escalation in Fusion Builder <= 3.15.4 versions. | |
|
68
|
CVE-2026-56010 |
8.8 | 0.0042 | NET LOW CX NO UI | Subscriber Privilege Escalation in Abandoned Cart Pro for WooCommerce <= 10.4.0 | |
|
68
|
CVE-2026-56038 |
8.8 | 0.0042 | NET LOW CX NO UI | Contributor Privilege Escalation in Frisbii Pay <= 1.8.2 versions. | |
|
67
|
CVE-2026-118254 |
8.6 | 0.0042 | NET LOW CX NO UI | Highcharts JS is a JavaScript charting library based on SVG. From 2.0.0 until 3. | |
|
67
|
CVE-2024-32011 |
8.7 | 0.0042 | NET LOW CX NO UI | A vulnerability has been identified in Spectrum Power 4 (All versions < V4.70 SP | |
|
67
|
CVE-2026-45696 |
8.3 | 0.0042 | NET LOW CX NO UI | OpenEXR is the reference implementation and specification for the EXR image form | |
|
66
|
CVE-2026-58282 |
8.1 | 0.0042 | NET NO AUTH NO UI | Improper access control in Microsoft Edge (Chromium-based) allows an unauthorize | |
|
66
|
CVE-2026-58286 |
8.1 | 0.0042 | NET NO AUTH NO UI | Improper access control in Microsoft Edge (Chromium-based) allows an unauthorize | |
|
66
|
CVE-2026-44019 |
8.1 | 0.0042 | NET NO AUTH LOW CX | Docling Core defines core data types and transformations for the document proces | |
|
66
|
CVE-2026-18499 |
8.1 | 0.0042 | NET LOW CX NO UI | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is vulnerab | |
|
66
|
CVE-2026-10653 |
8.1 | 0.0042 | NET NO AUTH NO UI | The Zephyr net_buf library (lib/net_buf/buf.c) manipulated both of its reference | |
|
65
|
CVE-2026-47829 |
7.7 | 0.0042 | NET NO AUTH LOW CX | Argument Injection in bosh-cli allows a compromised BOSH Director to inject arbi | |
|
65
|
CVE-2026-58169 |
7.7 | 0.0042 | NET NO AUTH LOW CX | Vibe-Trading before 0.1.10 contains a DNS rebinding authentication bypass vulner | |
|
65
|
CVE-2026-49227 |
7.6 | 0.0042 | NET LOW CX NO UI | Vvveb is a powerful and easy to use CMS with page builder to build websites, blo | |
|
65
|
CVE-2026-49222 |
7.6 | 0.0042 | NET LOW CX NO UI | Vvveb is a powerful and easy to use CMS with page builder to build websites, blo | |
|
65
|
CVE-2026-49223 |
7.6 | 0.0042 | NET LOW CX NO UI | Vvveb is a powerful and easy to use CMS with page builder to build websites, blo | |
|
64
|
CVE-2026-119553 |
7.1 | 0.0042 | NET LOW CX NO UI | Moodle 5.3.0, 5.2.0 through 5.2.4, 5.1.0 through 5.1.8, 5.0.0 through 5.0.11, an | |
|
64
|
CVE-2026-60034 |
9.4 | 0.0042 | NET LOW CX NO UI | Joomla Extension - themexpert.com - Authenticated stored XSS in JMedia Extension | |
|
64
|
CVE-2026-48806 |
7.1 | 0.0042 | NET LOW CX NO UI | Twig is a template language for PHP. Prior to 3.27.0, ArrayExpression does not g | |
|
62
|
CVE-2026-60028 |
8.6 | 0.0042 | NET LOW CX NO UI | Joomla Extension - themexpert.com - Authenticated stored XSS in Quix Page Builde | |
|
62
|
CVE-2026-78077 |
8.6 | 0.0042 | NET LOW CX NO UI | Joomla Extension - joomshaper.com - Stored Cross-Site Scripting (XSS) in MegaMe | |
|
57
|
CVE-2026-118252 |
8.4 | 0.0042 | NET LOW CX | Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until 4. | |
|
57
|
CVE-2026-118253 |
8.4 | 0.0042 | NET LOW CX | Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until 4. | |
|
55
|
CVE-2026-119120 |
7.7 | 0.0042 | NET NO UI | Crawl4AI from 0.9.0 before 0.9.5 fails to filter the CosineStrategy model_name f |