Hunt List
12,918 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
89
|
CVE-2026-116366 |
9.5 | 0.0040 | NET NO AUTH LOW CX NO UI | 1 PoC | An issue has been discovered in ClickHouse Server that, under certain conditions |
|
80
|
CVE-2026-62015 |
9.8 | 0.0040 | NET NO AUTH LOW CX NO UI | Unauthenticated PHP Object Injection in Gamezone <= 1.1.11 versions. | |
|
80
|
CVE-2026-62016 |
9.8 | 0.0040 | NET NO AUTH LOW CX NO UI | Unauthenticated PHP Object Injection in Gamic <= 1.19 versions. | |
|
79
|
CVE-2026-73090 |
9.3 | 0.0040 | NET NO AUTH LOW CX NO UI | PeerTube is an ActivityPub-federated video streaming platform. Prior to 8.2.2, p | |
|
78
|
CVE-2026-46892 |
9.1 | 0.0040 | NET NO AUTH LOW CX NO UI | Vulnerability in the JD Edwards EnterpriseOne Human Resources Management product | |
|
78
|
CVE-2026-91490 |
9.1 | 0.0040 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion | |
|
78
|
CVE-2026-70456 |
8.8 | 0.0040 | NET NO AUTH LOW CX NO UI | rsync 3.0.1 before 3.5.0 contains an out-of-bounds write vulnerability in the re | |
|
78
|
CVE-2026-70458 |
8.8 | 0.0040 | NET NO AUTH LOW CX NO UI | rsync 3.0.0 before 3.5.0 contains an out-of-bounds write vulnerability that allo | |
|
77
|
CVE-2026-73500 |
8.7 | 0.0040 | NET NO AUTH LOW CX NO UI | etcd is a distributed key-value store for the data of a distributed system. Prio | |
|
77
|
CVE-2026-111733 |
8.7 | 0.0040 | NET NO AUTH LOW CX NO UI | P-Net before 1.0.3 dereferences a NULL AR pointer when handling an implicit read | |
|
77
|
CVE-2026-111736 |
8.7 | 0.0040 | NET NO AUTH LOW CX NO UI | P-Net before 1.0.3 dereferences a NULL AR pointer in pf_fspm_cm_read_ind() when | |
|
77
|
CVE-2026-115793 |
8.7 | 0.0040 | NET NO AUTH LOW CX NO UI | P-Net before 1.0.3 does not release the RPC session allocated for an RPC request | |
|
77
|
CVE-2026-62333 |
8.7 | 0.0040 | NET NO AUTH LOW CX NO UI | OpenVM is a performant and modular zkVM framework built for customization and ex | |
|
77
|
CVE-2026-91217 |
8.6 | 0.0040 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (compo | |
|
77
|
CVE-2026-41927 |
8.3 | 0.0040 | NET NO AUTH LOW CX NO UI | WDR201A WiFi Extender (HW V2.1, FW LFMZX28040922V1.02) contains a stack-based bu | |
|
77
|
CVE-2026-40850 |
8.7 | 0.0040 | NET NO AUTH LOW CX NO UI | An unauthenticated remote attacker can exploit an unauthenticated SQL Injection | |
|
77
|
CVE-2026-112309 |
8.7 | 0.0040 | NET NO AUTH LOW CX NO UI | @rvf/set-get before 7.0.4 contains a prototype pollution vulnerability in setPat | |
|
77
|
CVE-2026-53920 |
8.7 | 0.0040 | NET NO AUTH LOW CX NO UI | odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. F | |
|
77
|
CVE-2026-24222 |
8.6 | 0.0040 | NET NO AUTH LOW CX NO UI | NVIDIA NeMoClaw contains a vulnerability in the sandbox environment initializati | |
|
77
|
CVE-2026-59835 |
8.6 | 0.0040 | NET NO AUTH LOW CX NO UI | A exposure of resource to wrong sphere vulnerability in Fortinet FortiSandbox 5. | |
|
76
|
CVE-2026-42268 |
8.2 | 0.0040 | NET NO AUTH LOW CX NO UI | ModSecurity is an open source, cross platform web application firewall (WAF) eng | |
|
76
|
CVE-2026-116539 |
8.2 | 0.0040 | NET NO AUTH LOW CX NO UI | Netty netty-tcnative before 2.0.84.Final contains a heap buffer overflow vulnera | |
|
76
|
CVE-2026-72753 |
8.2 | 0.0040 | NET NO AUTH LOW CX NO UI | When Routinator encounters an RRDP notification file with gaps in the delta entr | |
|
76
|
CVE-2026-42272 |
7.8 | 0.0040 | NET NO AUTH LOW CX NO UI | Heimdall is a cloud native Identity Aware Proxy and Access Control Decision serv | |
|
76
|
CVE-2026-67607 |
8.2 | 0.0040 | NET NO AUTH LOW CX NO UI | LightFTP 2.3.1 contains a residual race condition vulnerability (an incomplete f | |
|
75
|
CVE-2026-5086 |
7.5 | 0.0040 | NET NO AUTH LOW CX NO UI | Crypt::SecretBuffer versions before 0.019 for Perl is suseceptible to timing att | |
|
75
|
CVE-2026-58421 |
7.5 | 0.0040 | NET NO AUTH LOW CX NO UI | Unauthenticated ReDoS via CODEOWNERS pattern matching allows denial of service | |
|
75
|
CVE-2026-118650 |
7.5 | 0.0040 | NET NO AUTH LOW CX NO UI | Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, a globally mounted middle | |
|
75
|
CVE-2026-101421 |
7.5 | 0.0040 | NET NO AUTH LOW CX NO UI | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleS | |
|
75
|
CVE-2026-91237 |
7.5 | 0.0040 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (compo | |
|
69
|
CVE-2026-17349 |
9.3 | 0.0040 | NET LOW CX NO UI | /misc/workspace/adhoc_connect_server, part of the Workspaces feature introduced | |
|
68
|
CVE-2026-72537 |
8.8 | 0.0040 | NET LOW CX NO UI | A privilege escalation vulnerability in Authentik Security authentik through 202 | |
|
68
|
CVE-2026-12442 |
8.8 | 0.0040 | NET NO AUTH LOW CX | Use after free in Passwords in Google Chrome on Android prior to 149.0.7827.155 | |
|
68
|
CVE-2026-12148 |
8.8 | 0.0040 | NET LOW CX NO UI | IBM MQ Operator could allow an authenticated attacker to cause a denial of servi | |
|
67
|
CVE-2026-62195 |
8.7 | 0.0040 | NET LOW CX NO UI | OpenClaw versions 2026.5.20 before 2026.6.6 contain an authorization bypass vuln | |
|
67
|
CVE-2026-64631 |
8.6 | 0.0040 | NET LOW CX NO UI | A vulnerability allowing a low-privileged user to inject SQL and extract databas | |
|
67
|
CVE-2026-85613 |
8.4 | 0.0040 | NET NO AUTH LOW CX | OpenPanel before 2.3.0 contains a cross-site scripting vulnerability in the unau | |
|
67
|
CVE-2026-114081 |
8.3 | 0.0040 | NET LOW CX NO UI | Trigger.dev before 4.5.6 contains an SQL injection vulnerability in the TSQL que | |
|
67
|
CVE-2026-114084 |
8.3 | 0.0040 | NET LOW CX NO UI | Trigger.dev before 4.5.6 contains an SQL injection vulnerability in the /realtim | |
|
66
|
CVE-2026-65570 |
8.1 | 0.0040 | NET NO AUTH NO UI | Unauthenticated Bypass Vulnerability in Login with phone number <= 1.8.70 versio | |
|
66
|
CVE-2026-39545 |
8.1 | 0.0040 | NET NO AUTH NO UI | Unauthenticated PHP Object Injection in Zermatt <= 1.6.1 versions. | |
|
66
|
CVE-2026-39557 |
8.1 | 0.0040 | NET NO AUTH NO UI | Unauthenticated PHP Object Injection in NeoBeat <= 1.7 versions. | |
|
65
|
CVE-2026-35587 |
7.3 | 0.0040 | NET LOW CX NO UI | Glances is an open-source system cross-platform monitoring tool. Prior to versio | |
|
64
|
CVE-2026-54312 |
7.2 | 0.0040 | NET LOW CX NO UI | n8n is an open source workflow automation platform. Prior to 2.24.0, an authenti | |
|
64
|
CVE-2026-53795 |
7.2 | 0.0040 | NET NO AUTH LOW CX | rsync before 3.5.0 contains an arbitrary file write vulnerability that allows at | |
|
64
|
CVE-2023-7332 |
7.1 | 0.0040 | NET LOW CX NO UI | PocketMine-MP versions prior to 4.18.1 contain an improper input validation vuln | |
|
64
|
CVE-2026-64833 |
7.1 | 0.0040 | NET NO AUTH LOW CX | FFmpeg versions 0.7.1 through 8.1.2 contain an out-of-bounds read vulnerability | |
|
59
|
CVE-2026-27101 |
7.2 | 0.0040 | NET LOW CX NO UI | Dell Secure Connect Gateway (SCG) 5.0 Appliance and Application version(s) 5.28. | |
|
56
|
CVE-2026-71445 |
8.2 | 0.0040 | NET LOW CX | AIL Framework contained a reflected cross-site scripting vulnerability in the /t | |
|
55
|
CVE-2026-53958 |
7.6 | 0.0040 | NET LOW CX | 4gaBoards is a boards system for realtime project management. Prior to 3.3.9, 4g |