Hunt List
12,995 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
90
|
CVE-2026-97785 |
10.0 | 0.0065 | NET NO AUTH LOW CX NO UI | 1 PoC | Improper authentication in AAD App Proxy allows an unauthorized attacker to elev |
|
80
|
CVE-2026-41553 |
10.0 | 0.0065 | NET NO AUTH LOW CX NO UI | PDF Export Module used in DHTMLX's products Gantt and Scheduler is vulnerable to | |
|
80
|
CVE-2026-8507 |
9.8 | 0.0065 | NET NO AUTH LOW CX NO UI | Crypt::OpenSSL::PKCS12 versions through 1.94 for Perl have out-of-bounds (OOB) w | |
|
80
|
CVE-2026-33943 |
9.8 | 0.0065 | NET NO AUTH LOW CX NO UI | Happy DOM is a JavaScript implementation of a web browser without its graphical | |
|
80
|
CVE-2026-10025 |
9.8 | 0.0065 | NET NO AUTH LOW CX NO UI | IBM QRadar 7.6.0.0 through 7.6.0.1, and 7.5.0 through 7.5.0 UP 15 Interim Fix 00 | |
|
80
|
CVE-2026-40911 |
10.0 | 0.0065 | NET NO AUTH LOW CX NO UI | WWBN AVideo is an open source video platform. In versions 29.0 and prior, the YP | |
|
80
|
CVE-2026-35278 |
9.8 | 0.0064 | NET NO AUTH LOW CX NO UI | Vulnerability in the PeopleSoft Enterprise PT PeopleTools product of Oracle Peop | |
|
80
|
CVE-2026-7803 |
9.8 | 0.0064 | NET NO AUTH LOW CX NO UI | IBM Langflow OSS 1.0.0 through 1.10.0 could allow arbitrary code execution due t | |
|
80
|
CVE-2026-12692 |
9.8 | 0.0064 | NET NO AUTH LOW CX NO UI | Unverified password change vulnerability in Vimesoft Inc. Enterprise Video Platf | |
|
80
|
CVE-2026-59243 |
9.8 | 0.0064 | NET NO AUTH LOW CX NO UI | The FAB auth manager's Azure AD OAuth login defaulted `verify_signature=False` w | |
|
80
|
CVE-2026-15706 |
9.8 | 0.0064 | NET NO AUTH LOW CX NO UI | Missing authentication for critical function vulnerability in Baylan Measuring I | |
|
80
|
CVE-2026-76938 |
9.8 | 0.0064 | NET NO AUTH LOW CX NO UI | Authentication Bypass Vulnerability in JP1/Automatic Job Management System 3. | |
|
80
|
CVE-2026-82117 |
9.8 | 0.0064 | NET NO AUTH LOW CX NO UI | Authentication Bypass by Spoofing Vulnerability in HiRDB. This issue affects Hi | |
|
80
|
CVE-2026-109218 |
9.8 | 0.0064 | NET NO AUTH LOW CX NO UI | The Contact Manager plugin for WordPress is vulnerable to Arbitrary File Upload | |
|
79
|
CVE-2026-52830 |
9.4 | 0.0065 | NET NO AUTH LOW CX NO UI | fast-mcp-telegram is a Telegram MCP Server. Prior to 0.19.1, fast-mcp-telegram v | |
|
79
|
CVE-2026-40702 |
9.3 | 0.0065 | NET NO AUTH LOW CX NO UI | WebSocket endpoints lack proper authentication mechanisms, enabling attackers to | |
|
79
|
CVE-2026-19425 |
9.3 | 0.0064 | NET NO AUTH LOW CX NO UI | Travel Agency Management System developed by Win Men Intermational has a SQL Inj | |
|
78
|
CVE-2026-71479 |
9.1 | 0.0065 | NET NO AUTH LOW CX NO UI | New API is a large language mode (LLM) gateway and artificial intelligence (AI) | |
|
78
|
CVE-2026-42786 |
8.7 | 0.0065 | NET NO AUTH LOW CX NO UI | Allocation of Resources Without Limits or Throttling vulnerability in mtrudel ba | |
|
78
|
CVE-2026-35505 |
8.7 | 0.0065 | NET NO AUTH LOW CX NO UI | An unauthenticated remote attacker can repeatedly send crafted connection reques | |
|
78
|
CVE-2026-50254 |
8.7 | 0.0065 | NET NO AUTH LOW CX NO UI | An unauthenticated remote attacker can repeatedly send a single crafted connecti | |
|
77
|
CVE-2026-56111 |
8.3 | 0.0065 | NET NO AUTH LOW CX NO UI | Marlin Firmware through 2.1.2.7, fixed in commit 1f255d1, when built with MESH_B | |
|
77
|
CVE-2026-67216 |
8.2 | 0.0065 | NET NO AUTH LOW CX NO UI | cJSON through 1.7.19 contains an inefficient algorithmic complexity flaw in cJSO | |
|
75
|
CVE-2026-20191 |
7.5 | 0.0065 | NET NO AUTH LOW CX NO UI | A vulnerability in Cisco Catalyst Center could allow an unauthenticated, remote | |
|
75
|
CVE-2026-69152 |
7.5 | 0.0065 | NET NO AUTH LOW CX NO UI | The brace-expansion library generates arbitrary strings containing a common pref | |
|
75
|
CVE-2026-72691 |
7.5 | 0.0065 | NET NO AUTH LOW CX NO UI | An authentication bypass vulnerability in OpenSignLabs opensignserver through 2. | |
|
75
|
CVE-2026-59978 |
7.5 | 0.0065 | NET NO AUTH LOW CX NO UI | AdminNeo is a full-featured database management tool written in PHP. From 4.6.2 | |
|
75
|
CVE-2026-42498 |
7.3 | 0.0065 | NET NO AUTH LOW CX NO UI | Exposure of HTTP Authentication Header to unexpected hosts during WebSocket auth | |
|
75
|
CVE-2026-40355 |
7.5 | 0.0065 | NET NO AUTH LOW CX NO UI | In MIT Kerberos 5 (aka krb5) before 1.22.3, there is a NULL pointer dereference | |
|
75
|
CVE-2026-49293 |
7.5 | 0.0064 | NET NO AUTH LOW CX NO UI | js-toml is a TOML parser for JavaScript, fully compliant with the TOML 1.0.0 Spe | |
|
75
|
CVE-2026-59868 |
7.5 | 0.0064 | NET NO AUTH LOW CX NO UI | js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 before 5.2.0, when me | |
|
75
|
CVE-2026-59871 |
7.5 | 0.0064 | NET NO AUTH LOW CX NO UI | node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, nod | |
|
75
|
CVE-2026-59922 |
7.5 | 0.0064 | NET NO AUTH LOW CX NO UI | Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, | |
|
75
|
CVE-2026-59925 |
7.5 | 0.0064 | NET NO AUTH LOW CX NO UI | Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, | |
|
75
|
CVE-2026-49476 |
7.5 | 0.0064 | NET NO AUTH LOW CX NO UI | Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. | |
|
75
|
CVE-2026-49477 |
7.5 | 0.0064 | NET NO AUTH LOW CX NO UI | Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. | |
|
68
|
CVE-2026-72420 |
8.8 | 0.0065 | NET LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: md/raid5: a | |
|
68
|
CVE-2026-89601 |
8.8 | 0.0065 | NET LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: ext2: Fix l | |
|
68
|
CVE-2026-57983 |
8.7 | 0.0065 | NET NO AUTH NO UI | Improper authorization in Microsoft Edge (Chromium-based) allows an unauthorized | |
|
68
|
CVE-2026-62836 |
8.7 | 0.0065 | NET NO AUTH NO UI | Improper restriction of communication channel to intended endpoints in Azure SQL | |
|
68
|
CVE-2026-65617 |
8.8 | 0.0065 | NET LOW CX NO UI | A deserialization weakness in JFrog Artifactory package handling could allow a l | |
|
68
|
CVE-2026-64830 |
8.7 | 0.0065 | NET NO AUTH LOW CX | FFmpeg versions 2.1 through 8.1.2 contains a heap buffer overflow vulnerability | |
|
68
|
CVE-2026-56340 |
8.7 | 0.0064 | NET LOW CX NO UI | vLLM versions >= 0.10.2 and < 0.13.0 are missing sparse tensor validation in mul | |
|
65
|
CVE-2026-6134 |
7.4 | 0.0065 | NET LOW CX NO UI | A security flaw has been discovered in Tenda F451 1.0.0.7_cn_svn7958. This vulne | |
|
65
|
CVE-2026-4974 |
7.4 | 0.0064 | NET LOW CX NO UI | A flaw has been found in Tenda AC7 15.03.06.44. Affected by this issue is the fu | |
|
65
|
CVE-2026-4975 |
7.4 | 0.0064 | NET LOW CX NO UI | A vulnerability has been found in Tenda AC15 15.03.05.19. This affects the funct | |
|
60
|
CVE-2026-10698 |
7.2 | 0.0064 | NET LOW CX NO UI | Improper Neutralization of Special Elements in Data Query Logic vulnerability in | |
|
58
|
CVE-2026-107239 |
8.8 | 0.0065 | NET LOW CX | A vulnerability allowing a member of the Veeam Virtualization Extensions Users g | |
|
57
|
CVE-2026-59090 |
8.4 | 0.0065 | NET NO UI | A flaw was found in GIMP's PSD file format plugin. This vulnerability, an unsign | |
|
55
|
CVE-2026-55126 |
7.3 | 0.0065 | NET LOW CX | Improper neutralization of input during web page generation ('cross-site scripti |