Hunt List
12,959 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-36669 |
9.8 | 0.0066 | NET NO AUTH LOW CX NO UI | An unauthenticated arbitrary file upload vulnerability in ck_upload_handler.php | |
|
80
|
CVE-2026-115915 |
9.8 | 0.0066 | NET NO AUTH LOW CX NO UI | vLLM is an inference and serving engine for large language models. Prior to 0.32 | |
|
80
|
CVE-2026-65906 |
10.0 | 0.0066 | NET NO AUTH LOW CX NO UI | In JetBrains TeamCity before 2026.1.2, 2025.11.6 сode execution via Kotlin DSL s | |
|
80
|
CVE-2026-96639 |
9.8 | 0.0066 | NET NO AUTH LOW CX NO UI | Pillow is a Python imaging library. From 11.0.0 until 13.0.0, multi-frame loader | |
|
80
|
CVE-2026-96096 |
9.8 | 0.0066 | NET NO AUTH LOW CX NO UI | Heap-based buffer overflow in Windows Media Player allows an unauthorized attack | |
|
80
|
CVE-2026-42778 |
9.8 | 0.0066 | NET NO AUTH LOW CX NO UI | The fix for CVE-2026-41409 was not applied to the 2.1.X and 2.2.X branches. Here | |
|
80
|
CVE-2026-14454 |
9.8 | 0.0066 | NET NO AUTH LOW CX NO UI | Imager versions before 1.033 for Perl treat unsigned EXIF IFD entry counts as si | |
|
80
|
CVE-2026-63244 |
9.8 | 0.0066 | NET NO AUTH LOW CX NO UI | An authentication bypass vulnerability in WizLearn Technologies' Learning Manage | |
|
80
|
CVE-2026-10666 |
9.8 | 0.0065 | NET NO AUTH LOW CX NO UI | parse_ipv4() in subsys/net/ip/utils.c (reached via net_ipaddr_parse() for string | |
|
79
|
CVE-2026-63146 |
9.3 | 0.0066 | NET NO AUTH LOW CX NO UI | Omnispace Agora Project before 26.10.0 contains a code injection vulnerability w | |
|
79
|
CVE-2026-56271 |
9.3 | 0.0066 | NET NO AUTH LOW CX NO UI | Flowise before 3.1.0 (affected versions 3.0.13 and earlier) uses weak hardcoded | |
|
78
|
CVE-2026-93471 |
8.7 | 0.0066 | NET NO AUTH LOW CX NO UI | Improper Handling of Highly Compressed Data (Data Amplification) in esaml_bindin | |
|
78
|
CVE-2026-108359 |
8.7 | 0.0066 | NET NO AUTH LOW CX NO UI | PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. | |
|
78
|
CVE-2023-54357 |
8.7 | 0.0066 | NET NO AUTH LOW CX NO UI | Joomla com_booking component 2.4.9 contains an information disclosure vulnerabil | |
|
78
|
CVE-2026-59235 |
8.7 | 0.0066 | NET NO AUTH LOW CX NO UI | Missing Authorization (CWE-862) in BankAccountListController (app/Http/Controlle | |
|
78
|
CVE-2026-35469 |
8.7 | 0.0066 | NET NO AUTH LOW CX NO UI | spdystream is a Go library for multiplexing streams over SPDY connections. In ve | |
|
78
|
CVE-2026-7839 |
9.1 | 0.0066 | NET NO AUTH LOW CX NO UI | UltraVNC repeater through 1.8.2.2 initializes the HTTP administration server wit | |
|
78
|
CVE-2026-59161 |
8.7 | 0.0066 | NET NO AUTH LOW CX NO UI | Excelize is a Go language library for reading and writing Microsoft Excel spread | |
|
77
|
CVE-2026-86696 |
8.2 | 0.0066 | NET NO AUTH LOW CX NO UI | Allocation of Resources Without Limits or Throttling vulnerability in esaml in d | |
|
77
|
CVE-2026-22620 |
8.6 | 0.0066 | NET NO AUTH LOW CX NO UI | Improper input validation in the authentication component of Eaton's Tripp Lite | |
|
75
|
CVE-2026-12844 |
7.5 | 0.0066 | NET NO AUTH LOW CX NO UI | List::SomeUtils::XS versions before 0.59 for Perl have a heap buffer overflow in | |
|
75
|
CVE-2026-46457 |
7.5 | 0.0066 | NET NO AUTH LOW CX NO UI | Improper Input Validation vulnerability in Apache Camel NATS component. The cam | |
|
75
|
CVE-2026-28814 |
7.5 | 0.0066 | NET NO AUTH LOW CX NO UI | Arbitrary Wiki Markup rendering due to lack of authentication in Apache JSPWiki | |
|
75
|
CVE-2026-55814 |
7.5 | 0.0066 | NET NO AUTH LOW CX NO UI | Missing Authentication in Apache Ranger Download APIs on versions <= 2.8.0. User | |
|
75
|
CVE-2026-50142 |
7.5 | 0.0066 | NET NO AUTH LOW CX NO UI | libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1. | |
|
70
|
CVE-2026-33821 |
9.9 | 0.0066 | NET LOW CX NO UI | Improper privilege management in Microsoft Dynamics 365 Customer Insights allows | |
|
70
|
CVE-2026-56843 |
9.9 | 0.0066 | NET LOW CX NO UI | Incorrect authorization in the XML-RPC API of WebPros Plesk before 18.0.78.4 all | |
|
69
|
CVE-2026-9195 |
9.3 | 0.0065 | NET NO AUTH LOW CX | A cross-site scripting vulnerability in the Query Console of Progress MarkLogic | |
|
68
|
CVE-2026-42200 |
8.8 | 0.0066 | NET LOW CX NO UI | Coolify is an open-source and self-hostable tool for managing servers, applicati | |
|
68
|
CVE-2026-70619 |
8.7 | 0.0066 | NET LOW CX NO UI | Odysseus before commit bf325f6 contains a missing authorization vulnerability th | |
|
68
|
CVE-2026-78314 |
8.8 | 0.0066 | NET LOW CX NO UI | SQL Injection in Delta DIAEnergie v1.11.00.002 allows attacker to remote code e | |
|
67
|
CVE-2026-12195 |
8.5 | 0.0066 | NET LOW CX NO UI | myVesta is affected by an authenticated remote code execution vulnerability. Low | |
|
66
|
CVE-2026-115346 |
8.1 | 0.0066 | NET NO AUTH NO UI | The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is v | |
|
66
|
CVE-2026-85799 |
8.1 | 0.0066 | NET NO AUTH NO UI | Use after free in Network Policy Server (NPS) allows an unauthorized attacker to | |
|
66
|
CVE-2026-85926 |
8.1 | 0.0066 | NET NO AUTH NO UI | Use after free in Windows Secure Socket Tunneling Protocol (SSTP) allows an unau | |
|
66
|
CVE-2026-70013 |
8.1 | 0.0066 | NET NO AUTH NO UI | Use after free in Windows iSCSI allows an unauthorized attacker to execute code | |
|
65
|
CVE-2026-7031 |
7.4 | 0.0066 | NET LOW CX NO UI | A vulnerability was detected in Tenda F456 1.0.0.5. This impacts the function fr | |
|
65
|
CVE-2026-7054 |
7.4 | 0.0066 | NET LOW CX NO UI | A weakness has been identified in Tenda F456 1.0.0.5. This vulnerability affects | |
|
64
|
CVE-2026-59206 |
7.1 | 0.0066 | NET LOW CX NO UI | n8n is an open source workflow automation platform. Prior to 1.123.61, 2.27.4, a | |
|
64
|
CVE-2026-56171 |
7.1 | 0.0066 | NET NO AUTH LOW CX | Exposure of private personal information to an unauthorized actor in Windows RDP | |
|
63
|
CVE-2026-90863 |
9.1 | 0.0066 | NET LOW CX NO UI | Missing authorization in the administrative interface of Progress Software WS_FT | |
|
63
|
CVE-2026-73069 |
9.1 | 0.0066 | NET LOW CX NO UI | Twenty is an open-source CRM (customer relationship management) platform. Prior | |
|
62
|
CVE-2026-104068 |
8.6 | 0.0066 | NET LOW CX NO UI | JetBackup plugin for WordPress before 3.1.24.10 contains a symlink-based arbitra | |
|
60
|
CVE-2026-44914 |
7.5 | 0.0066 | NET LOW CX NO UI | Apache NiFi 1.12.0 through 2.9.0 are missing authorization when replacing Proces | |
|
60
|
CVE-2023-45583 |
7.2 | 0.0066 | NET LOW CX NO UI | A use of externally-controlled format string vulnerability in Fortinet FortiOS 7 | |
|
60
|
CVE-2026-95704 |
7.2 | 0.0066 | NET LOW CX NO UI | A vulnerability in the web-based management interface of wireless network manage | |
|
59
|
CVE-2026-12045 |
9.4 | 0.0066 | NET LOW CX | Read-only transaction bypass in the pgAdmin 4 AI Assistant allows an attacker wh | |
|
57
|
CVE-2026-74860 |
8.5 | 0.0066 | NET NO UI | A flaw was found in libxml2 with Python bindings enabled. A remote attacker coul | |
|
55
|
CVE-2026-116167 |
7.6 | 0.0066 | NET NO AUTH | SiYuan from 2.9.0 before 3.8.7 contains a cross-site scripting vulnerability in | |
|
44
|
CVE-2026-69452 |
7.1 | 0.0066 | NET | Use after free in Windows Enterprise App Management allows an authorized attacke |