Hunt List
12,830 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
90
|
CVE-2026-76578 |
9.8 | 0.0121 | NET NO AUTH LOW CX NO UI | 1 PoC | A flaw was found in FreeIPA. The self-managed OTP token ACI does not require aut |
|
80
|
CVE-2026-42779 |
9.8 | 0.0123 | NET NO AUTH LOW CX NO UI | The fix for CVE-2026-41635 was not applied to the 2.1.X and 2.2.X branches. Here | |
|
80
|
CVE-2026-88131 |
9.8 | 0.0123 | NET NO AUTH LOW CX NO UI | Deserialization of untrusted data in Microsoft Dataverse allows an unauthorized | |
|
80
|
CVE-2026-55799 |
9.8 | 0.0122 | NET NO AUTH LOW CX NO UI | Remote Code Execution Vulnerability in GraalScriptEngineCreator in Apache Ranger | |
|
80
|
CVE-2026-8592 |
9.8 | 0.0120 | NET NO AUTH LOW CX NO UI | OS Command Injection vulnerability in the process_string action of Rapid7 Insigh | |
|
80
|
CVE-2026-8660 |
9.8 | 0.0120 | NET NO AUTH LOW CX NO UI | OS Command Injection vulnerability in the ping action of Rapid7 InsightConnect P | |
|
80
|
CVE-2026-8665 |
9.8 | 0.0120 | NET NO AUTH LOW CX NO UI | OS Command Injection vulnerability in the TR action of Rapid7 InsightConnect Tra | |
|
80
|
CVE-2026-8666 |
9.8 | 0.0120 | NET NO AUTH LOW CX NO UI | OS Command Injection vulnerability in the traceroute action of Rapid7 InsightCon | |
|
80
|
CVE-2026-110879 |
9.8 | 0.0120 | NET NO AUTH LOW CX NO UI | jackson-databind validates the outer class of a class-name type ID but accepts a | |
|
80
|
CVE-2026-97749 |
9.8 | 0.0120 | NET NO AUTH LOW CX NO UI | Double free in Microsoft Office Outlook allows an unauthorized attacker to execu | |
|
80
|
CVE-2025-63334 |
9.8 | 0.0118 | NET NO AUTH LOW CX NO UI | PocketVJ CP PocketVJ-CP-v3 pvj version 3.9.1 contains an unauthenticated remote | |
|
80
|
CVE-2025-50526 |
9.8 | 0.0118 | NET NO AUTH LOW CX NO UI | Netgear EX8000 V1.0.0.126 was discovered to contain a command injection vulnerab | |
|
80
|
CVE-2026-104252 |
9.8 | 0.0117 | NET NO AUTH LOW CX NO UI | Vitess is a database clustering system for horizontal scaling of MySQL. Prior to | |
|
79
|
CVE-2026-55450 |
9.3 | 0.0119 | NET NO AUTH LOW CX NO UI | Langflow is a tool for building and deploying AI-powered agents and workflows. P | |
|
79
|
CVE-2026-52715 |
9.3 | 0.0119 | NET NO AUTH LOW CX NO UI | Unauthenticated SQL Injection in GEO my WordPress <= 4.5.5 versions. | |
|
78
|
CVE-2026-43515 |
9.1 | 0.0122 | NET NO AUTH LOW CX NO UI | Improper Authorization vulnerability when multiple method constraints define an | |
|
75
|
CVE-2026-70181 |
7.5 | 0.0123 | NET NO AUTH LOW CX NO UI | Allocation of resources without limits or throttling in ASP.NET Core allows an u | |
|
75
|
CVE-2026-70163 |
7.5 | 0.0123 | NET NO AUTH LOW CX NO UI | Allocation of resources without limits or throttling in OpenSSH for Windows allo | |
|
75
|
CVE-2026-83645 |
7.5 | 0.0122 | NET NO AUTH LOW CX NO UI | Allocation of resources without limits or throttling in Active Directory Federat | |
|
75
|
CVE-2026-9181 |
7.5 | 0.0122 | NET NO AUTH LOW CX NO UI | Esri ArcGIS Server contains a directory traversal vulnerability. ArcGIS Enterpri | |
|
75
|
CVE-2026-96958 |
7.5 | 0.0120 | NET NO AUTH LOW CX NO UI | Inefficient algorithmic complexity in .NET allows an unauthorized attacker to de | |
|
75
|
CVE-2026-96960 |
7.5 | 0.0120 | NET NO AUTH LOW CX NO UI | Asymmetric resource consumption (amplification) in .NET allows an unauthorized a | |
|
75
|
CVE-2026-56170 |
7.5 | 0.0117 | NET NO AUTH LOW CX NO UI | Allocation of resources without limits or throttling in ASP.NET Core allows an u | |
|
75
|
CVE-2026-57108 |
7.5 | 0.0117 | NET NO AUTH LOW CX NO UI | Access of resource using incompatible type ('type confusion') in .NET Core allow | |
|
75
|
CVE-2026-47302 |
7.5 | 0.0117 | NET NO AUTH LOW CX NO UI | Allocation of resources without limits or throttling in .NET allows an unauthori | |
|
75
|
CVE-2026-50525 |
7.5 | 0.0117 | NET NO AUTH LOW CX NO UI | Allocation of resources without limits or throttling in .NET allows an unauthori | |
|
75
|
CVE-2026-50527 |
7.5 | 0.0117 | NET NO AUTH LOW CX NO UI | Stack-based buffer overflow in .NET Framework allows an unauthorized attacker to | |
|
75
|
CVE-2026-50648 |
7.5 | 0.0117 | NET NO AUTH LOW CX NO UI | Allocation of resources without limits or throttling in .NET Framework allows an | |
|
75
|
CVE-2026-50651 |
7.5 | 0.0117 | NET NO AUTH LOW CX NO UI | Allocation of resources without limits or throttling in .NET allows an unauthori | |
|
75
|
CVE-2026-65681 |
7.5 | 0.0117 | NET NO AUTH LOW CX NO UI | Null pointer dereference in Windows iSCSI Target Service allows an unauthorized | |
|
75
|
CVE-2026-40378 |
7.5 | 0.0117 | NET NO AUTH LOW CX NO UI | Memory allocation with excessive size value in Windows Local Security Authority | |
|
70
|
CVE-2026-42898 |
9.9 | 0.0119 | NET LOW CX NO UI | Improper control of generation of code ('code injection') in Microsoft Dynamics | |
|
68
|
CVE-2026-41876 |
8.7 | 0.0123 | NET LOW CX NO UI | R-SOFT DMS is vulnerable to OS Command Injection in konwertujAction() function. | |
|
68
|
CVE-2026-44871 |
8.8 | 0.0123 | NET LOW CX NO UI | Command injection vulnerabilities exist in the command line interface (CLI) serv | |
|
68
|
CVE-2024-58312 |
8.7 | 0.0120 | NET LOW CX NO UI | xbtitFM 4.1.18 contains a path traversal vulnerability that allows unauthenticat | |
|
68
|
CVE-2026-67195 |
8.7 | 0.0119 | NET LOW CX NO UI | Perspective 5.0.0 contains a remote code execution vulnerability that allows una | |
|
68
|
CVE-2026-103403 |
8.8 | 0.0118 | NET LOW CX NO UI | An Improper Neutralization of Special Elements used in an OS Command ('OS Comman | |
|
68
|
CVE-2026-106079 |
8.8 | 0.0118 | NET LOW CX NO UI | An Improper Neutralization of Special Elements used in an OS Command ('OS Comman | |
|
67
|
CVE-2026-75779 |
8.6 | 0.0120 | NET NO AUTH LOW CX | Improper Neutralization of Special Elements used in an OS Command (“OS Command I | |
|
66
|
CVE-2026-93479 |
8.1 | 0.0120 | NET NO AUTH NO UI | A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive | |
|
64
|
CVE-2026-3183 |
7.1 | 0.0121 | NET LOW CX NO UI | Zohocorp ManageEngine ADSelfService Plus versions before 6524 are vulnerable to | |
|
64
|
CVE-2026-22599 |
9.3 | 0.0118 | NET LOW CX NO UI | Strapi is an open source headless content management system. In versions on the | |
|
63
|
CVE-2026-71471 |
9.0 | 0.0122 | NET LOW CX NO UI | A flaw was found in acm-search-v2-rhel9. An attacker with administrative privile | |
|
62
|
CVE-2026-23698 |
8.6 | 0.0123 | NET LOW CX NO UI | Vtiger CRM through 8.4.0 contains an authenticated remote code execution vulnera | |
|
62
|
CVE-2026-21719 |
8.6 | 0.0120 | NET LOW CX NO UI | An OS command injection vulnerability exists in CubeCart prior to 6.6.0, which m | |
|
62
|
CVE-2026-61523 |
8.6 | 0.0119 | NET LOW CX NO UI | WebsiteBaker CMS before 2.13.10 contains a code injection vulnerability in the D | |
|
60
|
CVE-2026-24506 |
7.2 | 0.0119 | NET LOW CX NO UI | Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2025 release ver | |
|
60
|
CVE-2026-26943 |
7.2 | 0.0119 | NET LOW CX NO UI | Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2025 release ver | |
|
60
|
CVE-2026-3120 |
7.2 | 0.0118 | NET LOW CX NO UI | Improper Control of Generation of Code ('Code Injection') vulnerability in Profe | |
|
58
|
CVE-2026-14371 |
8.8 | 0.0123 | NET LOW CX | The Lenovo XClarity Integrator for Windows Admin Center plugin version 5.1.1 and |