Hunt List
12,862 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-58231 |
10.0 | 0.0086 | NET NO AUTH LOW CX NO UI | SAP Commerce Cloud allows an unauthenticated attacker to abuse a default authent | |
|
80
|
CVE-2026-107656 |
9.8 | 0.0085 | NET NO AUTH LOW CX NO UI | An authentication bypass using an alternate path or channel vulnerability in For | |
|
80
|
CVE-2025-13204 |
9.8 | 0.0085 | NET NO AUTH LOW CX NO UI | npm package `expr-eval` is vulnerable to Prototype Pollution. An attacker with a | |
|
80
|
CVE-2026-12118 |
9.8 | 0.0085 | NET NO AUTH LOW CX NO UI | IBM webMethods Integration (on prem) 10.15, 10.11 could allow an unauthenticated | |
|
80
|
CVE-2026-13019 |
9.8 | 0.0085 | NET NO AUTH LOW CX NO UI | Esri Portal for ArcGIS versions 12.1 and earlier on Windows, Linux and Kubernete | |
|
79
|
CVE-2026-44128 |
9.3 | 0.0085 | NET NO AUTH LOW CX NO UI | SEPPmail Secure Email Gateway before version 15.0.2.1 allows unauthenticated rem | |
|
78
|
CVE-2026-58166 |
8.8 | 0.0085 | NET NO AUTH LOW CX NO UI | OpenBMB ChatDev through 2.2.0, fixed in commit 4fd4da6, contains a path traversa | |
|
78
|
CVE-2026-107328 |
8.8 | 0.0085 | NET LOW CX NO UI | 1 PoC | IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacke |
|
78
|
CVE-2026-107329 |
8.8 | 0.0085 | NET LOW CX NO UI | 1 PoC | IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacke |
|
78
|
CVE-2026-67200 |
8.7 | 0.0085 | NET NO AUTH LOW CX NO UI | Perspective 5.0.0 contains a path traversal vulnerability that allows unauthenti | |
|
77
|
CVE-2026-64641 |
8.2 | 0.0086 | NET NO AUTH LOW CX NO UI | Next.js is a React framework for building full-stack web applications. In versio | |
|
77
|
CVE-2026-41432 |
8.2 | 0.0085 | NET NO AUTH LOW CX NO UI | New API is a large language mode (LLM) gateway and artificial intelligence (AI) | |
|
75
|
CVE-2026-66143 |
7.5 | 0.0085 | NET NO AUTH LOW CX NO UI | It is possible to bypass the maximum number of normalized policy alternatives th | |
|
75
|
CVE-2026-23904 |
7.3 | 0.0085 | NET NO AUTH LOW CX NO UI | Kyuubi Engine UI proxy accepts a host and port from the request path and proxies | |
|
75
|
CVE-2026-15561 |
7.5 | 0.0085 | NET NO AUTH LOW CX NO UI | A flaw was found in EAP's undertow http/1.1 chunked-transfer decoder. missing li | |
|
68
|
CVE-2026-72831 |
8.7 | 0.0086 | NET LOW CX NO UI | The Flex Objects plugin (through 1.4.6, tested with Grav 2.0.11) contains an inc | |
|
68
|
CVE-2026-85931 |
8.8 | 0.0085 | NET LOW CX NO UI | Heap-based buffer overflow in Windows Distributed File System (DFS) allows an au | |
|
68
|
CVE-2026-88142 |
8.8 | 0.0085 | NET LOW CX NO UI | Use after free in Windows Background Intelligent Transfer Service (BITS) allows | |
|
68
|
CVE-2026-88165 |
8.8 | 0.0085 | NET LOW CX NO UI | Out-of-bounds write in Active Directory Domain Services allows an authorized att | |
|
68
|
CVE-2026-64831 |
8.7 | 0.0085 | NET NO AUTH LOW CX | FFmpeg versions 8.0 through 8.1.2 contains a stack buffer overflow vulnerability | |
|
68
|
CVE-2026-103575 |
8.8 | 0.0085 | NET NO AUTH LOW CX | Use after free in Remote Desktop Client allows an unauthorized attacker to execu | |
|
68
|
CVE-2026-105007 |
8.8 | 0.0085 | NET NO AUTH LOW CX | An elevation of privilege vulnerability exists in the Network Driver Interface S | |
|
68
|
CVE-2026-108458 |
8.8 | 0.0085 | NET NO AUTH LOW CX | Use after free in Remote Desktop Client allows an unauthorized attacker to execu | |
|
68
|
CVE-2026-83789 |
8.8 | 0.0085 | NET NO AUTH LOW CX | Heap-based buffer overflow in Windows SMB Client allows an unauthorized attacker | |
|
68
|
CVE-2026-83797 |
8.8 | 0.0085 | NET NO AUTH LOW CX | Out-of-bounds read in Windows Partition Management Driver allows an unauthorized | |
|
68
|
CVE-2026-102203 |
8.8 | 0.0085 | NET NO AUTH LOW CX | Access of resource using incompatible type ('type confusion') in RPC Runtime all | |
|
68
|
CVE-2026-88219 |
8.8 | 0.0085 | NET NO AUTH LOW CX | Untrusted pointer dereference in RPC Runtime allows an unauthorized attacker to | |
|
68
|
CVE-2026-83874 |
8.8 | 0.0085 | NET NO AUTH LOW CX | Heap-based buffer overflow in Windows Event Tracing allows an unauthorized attac | |
|
68
|
CVE-2026-63093 |
8.7 | 0.0085 | NET NO AUTH LOW CX | Cursor for Windows version 3.2.16 contains a binary planting vulnerability that | |
|
67
|
CVE-2026-75877 |
8.6 | 0.0085 | NET LOW CX NO UI | A flaw has been found in TRENDnet TV-IP751WIC 11.03.03. This vulnerability affec | |
|
67
|
CVE-2026-75976 |
8.6 | 0.0085 | NET LOW CX NO UI | A weakness has been identified in TRENDnet TEW-823DRU 1.1.02b01. Impacted is the | |
|
66
|
CVE-2026-41113 |
8.1 | 0.0085 | NET NO AUTH NO UI | sagredo qmail before 2026.04.07 allows tls_quit remote code execution because of | |
|
66
|
CVE-2026-70563 |
8.1 | 0.0085 | NET NO AUTH LOW CX | Improper link resolution before file access ('link following') in Windows Shell | |
|
65
|
CVE-2026-13515 |
7.4 | 0.0085 | NET LOW CX NO UI | A security vulnerability has been detected in Tenda JD12L 16.03.53.23. Impacted | |
|
65
|
CVE-2026-13516 |
7.4 | 0.0085 | NET LOW CX NO UI | A vulnerability was detected in Tenda JD12L 16.03.53.23. The affected element is | |
|
65
|
CVE-2026-13517 |
7.4 | 0.0085 | NET LOW CX NO UI | A flaw has been found in Tenda JD12L 16.03.53.23. The impacted element is the fu | |
|
65
|
CVE-2026-13518 |
7.4 | 0.0085 | NET LOW CX NO UI | A vulnerability has been found in Tenda JD12L 16.03.53.23. This affects the func | |
|
65
|
CVE-2026-13519 |
7.4 | 0.0085 | NET LOW CX NO UI | A vulnerability was found in Tenda JD12L 16.03.53.23. This impacts the function | |
|
65
|
CVE-2026-13539 |
7.4 | 0.0085 | NET LOW CX NO UI | A vulnerability was identified in Wavlink WL-NU516U1-A M16U1_V240425. The impact | |
|
65
|
CVE-2026-15543 |
7.4 | 0.0085 | NET LOW CX NO UI | A vulnerability was found in Tenda CH22 1.0.0.1. This impacts the function formC | |
|
65
|
CVE-2026-15691 |
7.4 | 0.0085 | NET LOW CX NO UI | A security flaw has been discovered in Tenda BE12 Pro 16.03.66.23. This affects | |
|
65
|
CVE-2026-15692 |
7.4 | 0.0085 | NET LOW CX NO UI | A weakness has been identified in Tenda BE12 Pro 16.03.66.23. This vulnerability | |
|
65
|
CVE-2026-15693 |
7.4 | 0.0085 | NET LOW CX NO UI | A security vulnerability has been detected in Tenda BE12 Pro 16.03.66.23. This i | |
|
65
|
CVE-2026-15694 |
7.4 | 0.0085 | NET LOW CX NO UI | A vulnerability was detected in Tenda BE12 Pro 16.03.66.23. Impacted is the func | |
|
65
|
CVE-2026-15695 |
7.4 | 0.0085 | NET LOW CX NO UI | A flaw has been found in Tenda BE12 Pro 16.03.66.23. The affected element is the | |
|
65
|
CVE-2026-15696 |
7.4 | 0.0085 | NET LOW CX NO UI | A vulnerability has been found in Tenda BE12 Pro 16.03.66.23. The impacted eleme | |
|
65
|
CVE-2026-16248 |
7.4 | 0.0085 | NET LOW CX NO UI | A vulnerability was found in Tenda AC10 16.03.10.09_multi_TDE01. This issue affe | |
|
64
|
CVE-2026-40076 |
9.4 | 0.0085 | NET LOW CX NO UI | OpenMRS Core is an open source electronic medical record system platform. In ver | |
|
60
|
CVE-2026-7829 |
7.2 | 0.0085 | NET LOW CX NO UI | UltraVNC repeater through 1.8.2.2 contains a post-authentication out-of-bounds w | |
|
60
|
CVE-2026-18901 |
7.3 | 0.0085 | NET LOW CX NO UI | A security vulnerability has been detected in H3C NX15 V100R017. Affected is the |