Hunt List
11,655 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
83
|
CVE-2026-61447 |
10.0 | 0.1524 | NET NO AUTH LOW CX NO UI | PraisonAI before 1.6.78 contains a remote code execution vulnerability in CodeAg | |
|
83
|
CVE-2026-45829 |
10.0 | 0.1515 | NET NO AUTH LOW CX NO UI | A pre-authentication, code injection vulnerability in version 1.0.0 or later of | |
|
83
|
CVE-2026-56291 |
10.0 | 0.1485 | NET NO AUTH LOW CX NO UI | KEV | Balbooa Forms contains an unrestricted upload of file with dangerous type vulner |
|
82
|
CVE-2026-45087 |
10.0 | 0.0873 | NET NO AUTH LOW CX NO UI | Dalfox is a powerful open-source XSS scanner and utility focused on automation. | |
|
81
|
CVE-2024-48884 |
9.1 | 0.1521 | NET NO AUTH LOW CX NO UI | A improper limitation of a pathname to a restricted directory ('path traversal') | |
|
81
|
CVE-2026-5850 |
8.9 | 0.1510 | NET NO AUTH LOW CX NO UI | A vulnerability was identified in Totolink A7100RU 7.4cu.2313_b20191024. This af | |
|
81
|
CVE-2026-5852 |
8.9 | 0.1351 | NET NO AUTH LOW CX NO UI | A weakness has been identified in Totolink A7100RU 7.4cu.2313_b20191024. Affecte | |
|
81
|
CVE-2026-5853 |
8.9 | 0.1351 | NET NO AUTH LOW CX NO UI | A security vulnerability has been detected in Totolink A7100RU 7.4cu.2313_b20191 | |
|
81
|
CVE-2026-6195 |
8.9 | 0.1351 | NET NO AUTH LOW CX NO UI | A security vulnerability has been detected in Totolink A7100RU 7.4cu.2313_b20191 | |
|
81
|
CVE-2026-110447 |
9.2 | 0.1163 | NET NO AUTH LOW CX NO UI | KEV | Collabora Collabora Online – Built-in CODE Server when used within the NextCloud |
|
81
|
CVE-2026-64849 |
9.3 | 0.1002 | NET NO AUTH LOW CX NO UI | KEV | MLflow contains a server-side request forgery vulnerability that can allow attac |
|
81
|
CVE-2025-6424 |
9.8 | 0.0796 | NET NO AUTH LOW CX NO UI | A use-after-free in FontFaceSet resulted in a potentially exploitable crash. Thi | |
|
81
|
CVE-2026-8985 |
10.0 | 0.0709 | NET NO AUTH LOW CX NO UI | Autel Maxi Charger Single firmware through V1.03.51 is vulnerable to OS command | |
|
81
|
CVE-2026-15409 |
10.0 | 0.0679 | NET NO AUTH LOW CX NO UI | KEV RW | SonicWall SMA1000 Appliances contain a server-side request forgery vulnerability |
|
80
|
CVE-2026-5851 |
8.9 | 0.1337 | NET NO AUTH LOW CX NO UI | A security flaw has been discovered in Totolink A7100RU 7.4cu.2313_b20191024. Th | |
|
80
|
CVE-2026-58138 |
9.3 | 0.0914 | NET NO AUTH LOW CX NO UI | Orkes Conductor 3.21.21 before 3.30.2 contains an unauthenticated remote code ex | |
|
80
|
CVE-2026-58455 |
9.2 | 0.0804 | NET NO AUTH LOW CX NO UI | Dockwatch through 0.6.567 contains an unauthenticated OS command injection vulne | |
|
80
|
CVE-2026-54069 |
9.2 | 0.0747 | NET NO AUTH LOW CX NO UI | SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, S | |
|
80
|
CVE-2026-67208 |
9.3 | 0.0722 | NET NO AUTH LOW CX NO UI | Juggle through 1.6.0 contains a remote code execution vulnerability that allows | |
|
80
|
CVE-2026-42530 |
9.2 | 0.0645 | NET NO AUTH LOW CX NO UI | NGINX Open Source has a vulnerability in the ngx_http_v3_module module. When NGI | |
|
79
|
CVE-2026-18577 |
8.2 | 0.1462 | NET NO AUTH LOW CX NO UI | KEV | N-able N-central contains an authentication bypass using an alternate path or ch |
|
79
|
CVE-2026-29205 |
8.6 | 0.0837 | NET NO AUTH LOW CX NO UI | Incorrect privileges management and insufficient path filtering allow to read ar | |
|
79
|
CVE-2026-65660 |
8.8 | 0.0819 | NET LOW CX NO UI | KEV 2 PoC | Microsoft SharePoint contains a code injection vulnerability which could allow a |
|
79
|
CVE-2026-55638 |
8.6 | 0.0658 | NET NO AUTH LOW CX NO UI | 9Router is an AI router & token saver. Prior to 0.5.2, 9router protects /v1, /v1 | |
|
78
|
CVE-2026-34650 |
7.5 | 0.1508 | NET NO AUTH LOW CX NO UI | Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2 | |
|
78
|
CVE-2026-34649 |
7.5 | 0.1361 | NET NO AUTH LOW CX NO UI | Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2 | |
|
78
|
CVE-2023-4050 |
7.5 | 0.1258 | NET NO AUTH LOW CX NO UI | In some cases, an untrusted input stream was copied to a stack buffer without ch | |
|
78
|
CVE-2026-18556 |
8.2 | 0.0788 | NET NO AUTH LOW CX NO UI | KEV | N-able N-central contains an authentication bypass using an alternate path or ch |
|
77
|
CVE-2026-43825 |
7.3 | 0.1392 | NET NO AUTH LOW CX NO UI | Untrusted Java Deserialization in Apache OpenNLP SvmDoccatModel Versions Affect | |
|
77
|
CVE-2026-42018 |
7.5 | 0.0980 | NET NO AUTH LOW CX NO UI | KEV | JFrog Artifactory contains an improper authentication vulnerability that could r |
|
76
|
CVE-2026-77692 |
7.5 | 0.0656 | NET NO AUTH LOW CX NO UI | An attacker can cause `named` to abort by sending a crafted DNS-over-HTTPS reque | |
|
72
|
CVE-2026-23696 |
9.4 | 0.1358 | NET LOW CX NO UI | Windmill CE and EE versions 1.276.0 through 1.603.2 contain an SQL injection vul | |
|
72
|
CVE-2026-40933 |
9.9 | 0.1196 | NET LOW CX NO UI | Flowise is a drag & drop user interface to build a customized large language mod | |
|
72
|
CVE-2026-20147 |
9.9 | 0.1038 | NET LOW CX NO UI | A vulnerability in Cisco ISE and Cisco ISE-PIC could allow an authenticated, rem | |
|
71
|
CVE-2026-48030 |
9.9 | 0.0755 | NET LOW CX NO UI | Pheditor is a single-file editor and file manager written in PHP. From version 2 | |
|
70
|
CVE-2026-5786 |
8.8 | 0.1120 | NET LOW CX NO UI | An Improper Access Control vulnerability in Ivanti EPMM before versions 12.6.1.1 | |
|
70
|
CVE-2026-96951 |
8.8 | 0.0981 | NET NO AUTH LOW CX | KEV | Microsoft Windows Shell contains a command injection vulnerability that allows a |
|
70
|
CVE-2024-51092 |
9.1 | 0.0718 | NET LOW CX NO UI | LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via O | |
|
69
|
CVE-2026-42016 |
8.8 | 0.0864 | NET LOW CX NO UI | KEV | JFrog Artifactory contains an incorrect authorization vulnerability that leads t |
|
69
|
CVE-2026-7474 |
8.8 | 0.0816 | NET LOW CX NO UI | HashiCorp Nomad and Nomad Enterprise prior to 2.0.1 are vulnerable to code execu | |
|
64
|
CVE-2026-111226 |
8.6 | 0.0655 | NET LOW CX NO UI | pfSense CE 2.4.5 through 2.9.0 contains an OS command injection vulnerability th | |
|
62
|
CVE-2026-6483 |
7.3 | 0.1337 | NET LOW CX NO UI | A vulnerability was found in Wavlink WL-WN530H4 20220721. This vulnerability aff | |
|
62
|
CVE-2026-15410 |
7.2 | 0.1179 | NET LOW CX NO UI | KEV RW | SonicWall SMA1000 Appliances contain a code injection vulnerability which in spe |
|
62
|
CVE-2026-26026 |
7.2 | 0.1153 | NET LOW CX NO UI | GLPI is a free asset and IT management software package. From 11.0.0 to before 1 | |
|
61
|
CVE-2026-40871 |
7.2 | 0.0857 | NET LOW CX NO UI | mailcow: dockerized is an open source groupware/email suite based on docker. Ver | |
|
61
|
CVE-2026-6992 |
7.3 | 0.0815 | NET LOW CX NO UI | A vulnerability was identified in Linksys MR9600 2.0.6.206937. This affects the | |
|
58
|
CVE-2023-5009 |
8.2 | 0.0965 | NET NO UI | An issue has been discovered in GitLab EE affecting all versions starting from 1 | |
|
57
|
CVE-2026-8510 |
7.5 | 0.0995 | NET NO AUTH | Integer overflow in Skia in Google Chrome on Windows prior to 148.0.7778.168 all | |
|
57
|
CVE-2026-41276 |
7.7 | 0.0687 | NET NO AUTH | Flowise is a drag & drop user interface to build a customized large language mod | |
|
47
|
CVE-2026-40321 |
8.0 | 0.0641 | NET | DNN (formerly DotNetNuke) is an open-source web content management platform (CMS |