Hunt List
13,069 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-18452 |
10.0 | 0.0063 | NET NO AUTH LOW CX NO UI | DMS+ (Non-Mobile) developed by Rich Source has a Use of Hard-coded Credentials v | |
|
80
|
CVE-2025-11367 |
10.0 | 0.0063 | NET NO AUTH LOW CX NO UI | The N-central Software Probe < 2025.4 is vulnerable to Remote Code Execution via | |
|
80
|
CVE-2026-40351 |
9.8 | 0.0063 | NET NO AUTH LOW CX NO UI | FastGPT is an AI Agent building platform. In versions prior to 4.14.9.5, the pas | |
|
79
|
CVE-2026-14162 |
9.3 | 0.0063 | NET NO AUTH LOW CX NO UI | Hospital Queuing Management developed by Advantech has a Sensitive Data Exposure | |
|
79
|
CVE-2026-34099 |
9.3 | 0.0063 | NET NO AUTH LOW CX NO UI | Guardian language-system passes the id GET parameter directly into an unsanitize | |
|
79
|
CVE-2026-53790 |
9.2 | 0.0063 | NET NO AUTH LOW CX NO UI | rsync before 3.5.0 contains multiple command and argument injection vulnerabilit | |
|
78
|
CVE-2026-7834 |
8.9 | 0.0063 | NET NO AUTH LOW CX NO UI | A security vulnerability has been detected in EFM ipTIME NAS1dual 1.5.24. This i | |
|
78
|
CVE-2026-112332 |
8.7 | 0.0063 | NET NO AUTH LOW CX NO UI | Motor.NET before 0.19.0 contains an uncaught exception vulnerability in JsonNetD | |
|
78
|
CVE-2026-50203 |
9.1 | 0.0063 | NET NO AUTH LOW CX NO UI | A path traversal in the SFTP provider (`SFTPHook.retrieve_directory` / `SFTPOper | |
|
78
|
CVE-2026-48031 |
9.1 | 0.0063 | NET NO AUTH LOW CX NO UI | go-base is a Go RESTful API Boilerplate template with JWT Authentication, backed | |
|
78
|
CVE-2026-45230 |
8.8 | 0.0063 | NET NO AUTH LOW CX NO UI | DumbAssets through 1.0.11 contains a path traversal vulnerability in the POST /a | |
|
77
|
CVE-2026-114397 |
8.3 | 0.0063 | NET NO AUTH LOW CX NO UI | Trudesk through 1.2.11 contains a missing authentication vulnerability in debug | |
|
76
|
CVE-2026-13762 |
7.9 | 0.0063 | NET NO AUTH LOW CX NO UI | Inconsistent interpretation of HTTP/2 requests in Amazon CloudFront with AWS WAF | |
|
75
|
CVE-2026-26307 |
7.5 | 0.0063 | NET NO AUTH LOW CX NO UI | Gitea versions before 1.25.5 do not enforce a timeout on git grep searches, allo | |
|
75
|
CVE-2026-46585 |
7.5 | 0.0063 | NET NO AUTH LOW CX NO UI | Improper Input Validation, Authorization Bypass Through User-Controlled Key vuln | |
|
75
|
CVE-2026-14895 |
7.5 | 0.0063 | NET NO AUTH LOW CX NO UI | String::Util versions before 1.36 for Perl are susceptible to a regular expressi | |
|
75
|
CVE-2026-49866 |
7.5 | 0.0063 | NET NO AUTH LOW CX NO UI | libp2p is a JavaScript Implementation of libp2p networking stack. Prior to 16.0. | |
|
75
|
CVE-2026-56669 |
7.5 | 0.0063 | NET NO AUTH LOW CX NO UI | Elysia is a Typescript framework for request validation, type inference, OpenAPI | |
|
75
|
CVE-2026-60081 |
7.5 | 0.0063 | NET NO AUTH LOW CX NO UI | DBI::ProfileData versions before 1.651 for Perl do not limit the path index. Th | |
|
75
|
CVE-2026-14741 |
7.5 | 0.0063 | NET NO AUTH LOW CX NO UI | HTTP::Date versions before 6.08 for Perl allow CPU exhaustion via polynomial reg | |
|
75
|
CVE-2026-54638 |
7.5 | 0.0063 | NET NO AUTH LOW CX NO UI | gotd/td is a T Telegram MTProto API client in Go. Prior to 0.145.1, proto.Unencr | |
|
75
|
CVE-2026-60074 |
7.5 | 0.0063 | NET NO AUTH LOW CX NO UI | Date::Manip versions through 7.00 for Perl return corrupted dates via non-ASCII | |
|
75
|
CVE-2026-69185 |
7.5 | 0.0063 | NET NO AUTH LOW CX NO UI | Socket.IO enables bidirectional and low-latency communication for every platform | |
|
75
|
CVE-2026-71488 |
7.5 | 0.0063 | NET NO AUTH LOW CX NO UI | league/commonmark is a PHP library for parsing and rendering CommonMark Markdown | |
|
75
|
CVE-2026-19566 |
7.5 | 0.0063 | NET NO AUTH LOW CX NO UI | Net::CIDR::Set versions before 0.23 for Perl allow memory exhaustion and malform | |
|
75
|
CVE-2026-73493 |
7.5 | 0.0063 | NET NO AUTH LOW CX NO UI | Http4s (http4s-blaze-server) is a minimal, idiomatic Scala interface for HTTP se | |
|
75
|
CVE-2026-74757 |
7.5 | 0.0063 | NET NO AUTH LOW CX NO UI | Uncontrolled resource allocation in the mcpack2pb component in Apache bRPC (vers | |
|
75
|
CVE-2026-78048 |
7.5 | 0.0063 | NET NO AUTH LOW CX NO UI | A reachable-assertion flaw in the HPACK header-compression decoder of the HTTP/2 | |
|
75
|
CVE-2026-72203 |
7.5 | 0.0063 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: ntfs: skip | |
|
75
|
CVE-2026-16323 |
7.5 | 0.0063 | NET NO AUTH LOW CX NO UI | Execution after redirect (EAR) vulnerability in FuyaWeb Internet and Informatics | |
|
75
|
CVE-2026-29168 |
7.3 | 0.0063 | NET NO AUTH LOW CX NO UI | Allocation of Resources Without Limits or Throttling vulnerability in Apache HTT | |
|
75
|
CVE-2023-22839 |
7.5 | 0.0063 | NET NO AUTH LOW CX NO UI | On BIG-IP versions 17.0.x before 17.0.0.2, 16.1.x before 16.1.3.3, 15.1.x before | |
|
75
|
CVE-2023-36521 |
7.5 | 0.0063 | NET NO AUTH LOW CX NO UI | A vulnerability has been identified in SIMATIC MV540 H (All versions < V3.3.4), | |
|
70
|
CVE-2026-93577 |
9.9 | 0.0063 | NET LOW CX NO UI | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 | |
|
70
|
CVE-2026-84502 |
9.9 | 0.0063 | NET LOW CX NO UI | A flaw was found in Red Hat Ansible Automation Platform's automation- controller | |
|
69
|
CVE-2026-71319 |
9.6 | 0.0063 | NET NO AUTH LOW CX | Nuxt is an open-source web development framework for Vue.js. Prior to 3.3.1, Nux | |
|
68
|
CVE-2026-18824 |
8.8 | 0.0063 | NET LOW CX NO UI | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote authenticated | |
|
68
|
CVE-2026-57301 |
8.8 | 0.0063 | NET LOW CX NO UI | Jenkins OWASP ZAP Plugin 1.0.7 and earlier performs build operations on the Jenk | |
|
68
|
CVE-2026-119408 |
8.7 | 0.0063 | NET LOW CX NO UI | n8n before 2.42.6, 2.43.x before 2.43.3, and 3.x before 3.0.1 contains a remote | |
|
68
|
CVE-2026-83526 |
8.8 | 0.0063 | NET LOW CX NO UI | The FV Player 8 plugin for WordPress is vulnerable to Arbitrary File Upload in a | |
|
66
|
CVE-2026-63909 |
8.1 | 0.0063 | NET LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: ksmbd: OOB | |
|
66
|
CVE-2026-69802 |
8.1 | 0.0063 | NET NO AUTH NO UI | Weak authentication in Network Device Enrollment Service (NDES) allows an unauth | |
|
66
|
CVE-2026-73267 |
7.7 | 0.0063 | NET LOW CX NO UI | A flaw was found in the clusterclaims-controller component of multicluster engin | |
|
64
|
CVE-2026-114659 |
7.1 | 0.0063 | NET LOW CX NO UI | Grav Flex Objects plugin 1.4.0 before 1.4.17 contains an authorization bypass be | |
|
62
|
CVE-2026-54223 |
8.6 | 0.0063 | NET LOW CX NO UI | UBB.threads is vulnerable to Path traversal, allowing attackers with privilege t | |
|
55
|
CVE-2026-69998 |
7.5 | 0.0063 | NET NO AUTH | Use after free in Remote Desktop Client allows an unauthorized attacker to execu | |
|
55
|
CVE-2026-70004 |
7.5 | 0.0063 | NET NO AUTH | Use after free in Remote Desktop Client allows an unauthorized attacker to execu | |
|
55
|
CVE-2026-70012 |
7.5 | 0.0063 | NET NO AUTH | Use after free in Remote Desktop Client allows an unauthorized attacker to execu | |
|
55
|
CVE-2026-83856 |
7.5 | 0.0063 | NET NO AUTH | Out-of-bounds read in Windows Event Logging Service allows an unauthorized attac | |
|
55
|
CVE-2026-70179 |
7.5 | 0.0063 | NET NO UI | Authentication bypass by spoofing in ASP.NET Core allows an authorized attacker |