Hunt List
12,917 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-2053 |
10.0 | 0.0039 | NET NO AUTH LOW CX NO UI | The WSO2 API Manager's message flow component, when processing WS-Addressing hea | |
|
80
|
CVE-2026-107249 |
9.8 | 0.0039 | NET NO AUTH LOW CX NO UI | Improperly Controlled Modification of Dynamically-Determined Object Attributes v | |
|
78
|
CVE-2026-18716 |
9.1 | 0.0039 | NET NO AUTH LOW CX NO UI | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote authenticated | |
|
78
|
CVE-2026-93895 |
9.1 | 0.0039 | NET NO AUTH LOW CX NO UI | IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could all | |
|
78
|
CVE-2026-89270 |
9.1 | 0.0039 | NET NO AUTH LOW CX NO UI | The Popup Builder – Create highly converting, mobile friendly marketing popups. | |
|
77
|
CVE-2026-9220 |
8.7 | 0.0039 | NET NO AUTH LOW CX NO UI | Setracker2 Android Companion App com.tgelec.setracker versions 3.1.5 and prior e | |
|
77
|
CVE-2026-48801 |
8.7 | 0.0039 | NET NO AUTH LOW CX NO UI | linkify-it is a links recognition library with full Unicode support. Prior to 5. | |
|
77
|
CVE-2026-40430 |
8.7 | 0.0039 | NET NO AUTH LOW CX NO UI | Pronetiqs IntraVUE Versions 3.2.1a14 and prior have a plaintext storage of a pas | |
|
77
|
CVE-2026-40967 |
8.6 | 0.0039 | NET NO AUTH LOW CX NO UI | In Spring AI, various FilterExpressionConverter implementations accept a filter | |
|
77
|
CVE-2026-64814 |
8.6 | 0.0039 | NET NO AUTH LOW CX NO UI | In JetBrains IntelliJ IDEA before 2026.2 unauthorized file access was possible i | |
|
77
|
CVE-2026-14869 |
8.6 | 0.0039 | NET NO AUTH LOW CX NO UI | The terraform-mcp-server before version 1.1.0 is vulnerable to a server-side req | |
|
77
|
CVE-2026-16328 |
8.6 | 0.0039 | NET NO AUTH LOW CX NO UI | In consul-mcp-server, versions 0.1.0 up to 0.1.3 did not restrict how the Consul | |
|
77
|
CVE-2026-59505 |
8.6 | 0.0039 | NET NO AUTH LOW CX NO UI | : Improper Access Control vulnerability in Priority Portal Generator addon to Pr | |
|
77
|
CVE-2026-115924 |
8.6 | 0.0039 | NET NO AUTH LOW CX NO UI | Rembg is a tool to remove images background. Prior to 2.0.82, the public /api/re | |
|
75
|
CVE-2024-9684 |
7.5 | 0.0040 | NET NO AUTH LOW CX NO UI | FreyrSCADA/IEC-60870-5-104 server v21.06.008 allows remote attackers to cause a | |
|
75
|
CVE-2026-40863 |
7.5 | 0.0040 | NET NO AUTH LOW CX NO UI | PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. | |
|
75
|
CVE-2026-40902 |
7.5 | 0.0040 | NET NO AUTH LOW CX NO UI | PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. | |
|
75
|
CVE-2026-11721 |
7.5 | 0.0040 | NET NO AUTH LOW CX NO UI | It is possible for an attacker's zone to respond to a query with an RRSIG that h | |
|
75
|
CVE-2026-12947 |
7.5 | 0.0040 | NET NO AUTH LOW CX NO UI | IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0. | |
|
75
|
CVE-2026-34059 |
7.5 | 0.0039 | NET NO AUTH LOW CX NO UI | Buffer Over-read vulnerability in Apache HTTP Server. This issue affects Apache | |
|
75
|
CVE-2026-43646 |
7.5 | 0.0039 | NET NO AUTH LOW CX NO UI | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apac | |
|
75
|
CVE-2026-54837 |
7.5 | 0.0039 | NET NO AUTH LOW CX NO UI | Unauthenticated Broken Access Control in Intranet & Private Site – All | |
|
75
|
CVE-2026-54839 |
7.5 | 0.0039 | NET NO AUTH LOW CX NO UI | Unauthenticated Sensitive Data Exposure in Trinity Backup – Backup, Migrat | |
|
75
|
CVE-2026-54846 |
7.5 | 0.0039 | NET NO AUTH LOW CX NO UI | Unauthenticated Broken Access Control in Syncee Premium Dropshipping & Whole | |
|
75
|
CVE-2026-54847 |
7.5 | 0.0039 | NET NO AUTH LOW CX NO UI | Unauthenticated Broken Access Control in Stylish Cost Calculator <= 8.3.9 versio | |
|
75
|
CVE-2026-57727 |
7.5 | 0.0039 | NET NO AUTH LOW CX NO UI | Missing Authorization vulnerability in Themeum Kirki kirki allows Exploiting Inc | |
|
75
|
CVE-2026-57729 |
7.5 | 0.0039 | NET NO AUTH LOW CX NO UI | Missing Authorization vulnerability in UX-themes Flatsome flatsome allows Exploi | |
|
75
|
CVE-2026-32807 |
7.5 | 0.0039 | NET NO AUTH LOW CX NO UI | dataCycle is a data management system for centrally storing, managing, searching | |
|
75
|
CVE-2026-32806 |
7.5 | 0.0039 | NET NO AUTH LOW CX NO UI | dataCycle is a data management system for centrally storing, managing, searching | |
|
75
|
CVE-2026-63047 |
7.5 | 0.0039 | NET NO AUTH LOW CX NO UI | Joomla Extension - joomdonation.com - Invoice data exfiltration via incorrect AC | |
|
75
|
CVE-2026-61943 |
7.5 | 0.0039 | NET NO AUTH LOW CX NO UI | Unauthenticated Broken Access Control in WPDM – Premium Packages <= 6.2.0 versio | |
|
75
|
CVE-2026-65500 |
7.5 | 0.0039 | NET NO AUTH LOW CX NO UI | Unauthenticated Broken Access Control in Manual - Documentation, Knowledge Base | |
|
75
|
CVE-2026-59529 |
7.5 | 0.0039 | NET NO AUTH LOW CX NO UI | Unauthenticated Sensitive Data Exposure in Ebook Store <= 6.19 versions. | |
|
69
|
CVE-2026-93327 |
9.4 | 0.0039 | NET LOW CX NO UI | A Deserialization of Untrusted Data vulnerability in the SubWorkflow task in Goo | |
|
68
|
CVE-2026-119419 |
9.2 | 0.0039 | NET NO AUTH NO UI | CakePHP through 5.4.3 contains an sql injection vulnerability that allows attack | |
|
68
|
CVE-2026-94267 |
9.0 | 0.0039 | NET NO AUTH NO UI | The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced C | |
|
68
|
CVE-2026-33755 |
8.8 | 0.0039 | NET LOW CX NO UI | Group-Office is an enterprise customer relationship management and groupware too | |
|
67
|
CVE-2026-119420 |
8.7 | 0.0039 | NET LOW CX NO UI | Lago through 1.55.0 contains an authentication bypass vulnerability that allows | |
|
67
|
CVE-2026-88890 |
8.4 | 0.0039 | NET LOW CX NO UI | OpenPanel through 2.3.0 contains an SQL injection vulnerability in the analytics | |
|
66
|
CVE-2026-39573 |
8.1 | 0.0040 | NET NO AUTH NO UI | Unauthenticated PHP Object Injection in Mildhill <= 1.5 versions. | |
|
66
|
CVE-2026-40735 |
8.1 | 0.0040 | NET NO AUTH NO UI | Unauthenticated PHP Object Injection in Reina <= 2.1 versions. | |
|
66
|
CVE-2026-39445 |
8.1 | 0.0040 | NET NO AUTH NO UI | Unauthenticated PHP Object Injection in Alukas < 3.0.0 versions. | |
|
66
|
CVE-2026-39576 |
8.1 | 0.0040 | NET NO AUTH NO UI | Unauthenticated PHP Object Injection in SingleMalt <= 1.5 versions. | |
|
65
|
CVE-2026-119027 |
7.7 | 0.0039 | NET NO AUTH LOW CX | oapi-codegen 2.5.0 before 2.8.1 contains a code injection vulnerability that all | |
|
64
|
CVE-2026-33872 |
7.1 | 0.0040 | NET LOW CX NO UI | elixir-nodejs provides an Elixir API for calling Node.js functions. A vulnerabil | |
|
62
|
CVE-2026-116236 |
8.6 | 0.0039 | NET LOW CX NO UI | A vulnerability has been found in Oray Pugongying X5 Pro 7.6.1. Affected by this | |
|
59
|
CVE-2026-33906 |
7.2 | 0.0040 | NET LOW CX NO UI | Ella Core is a 5G core designed for private networks. Prior to version 1.7.0, th | |
|
57
|
CVE-2026-57272 |
8.3 | 0.0039 | NET NO AUTH | GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Playe | |
|
55
|
CVE-2025-62066 |
7.5 | 0.0039 | NET NO UI | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP | |
|
40
|
CVE-2026-44763 |
7.6 | 0.0040 | NET | SAP Manufacturing Integration and Intelligence allows a privileged attacker to e |