Hunt List
13,080 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-53483 |
9.8 | 0.0063 | NET NO AUTH LOW CX NO UI | Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release ver | |
|
80
|
CVE-2026-113744 |
10.0 | 0.0062 | NET NO AUTH LOW CX NO UI | A security vulnerability has been detected in Tenda AC19 16.03.10.07. The impact | |
|
80
|
CVE-2026-16834 |
9.8 | 0.0062 | NET NO AUTH LOW CX NO UI | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to c | |
|
80
|
CVE-2026-110186 |
9.8 | 0.0062 | NET NO AUTH LOW CX NO UI | IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker to execute a | |
|
80
|
CVE-2026-49257 |
10.0 | 0.0062 | NET NO AUTH LOW CX NO UI | mcp-pinot is a Python-based Model Context Protocol (MCP) server for interacting | |
|
80
|
CVE-2026-50755 |
9.8 | 0.0062 | NET NO AUTH LOW CX NO UI | An issue in DayuanJiang next-ai-draw-io 0.4.13 allows a remote attacker to obtai | |
|
79
|
CVE-2026-35030 |
9.4 | 0.0063 | NET NO AUTH LOW CX NO UI | LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) fo | |
|
79
|
CVE-2026-35090 |
9.3 | 0.0063 | NET NO AUTH LOW CX NO UI | In Slican telephone exchanges it is possible to manage the control panel remotel | |
|
79
|
CVE-2026-116747 |
9.2 | 0.0062 | NET NO AUTH LOW CX NO UI | Kener 3.0.0 before 4.1.10 contains an authentication bypass vulnerability that a | |
|
79
|
CVE-2026-66794 |
9.3 | 0.0062 | NET NO AUTH LOW CX NO UI | A flaw was found in the `cluster-proxy-addon` component of Multicluster Engine f | |
|
78
|
CVE-2026-48031 |
9.1 | 0.0063 | NET NO AUTH LOW CX NO UI | go-base is a Go RESTful API Boilerplate template with JWT Authentication, backed | |
|
78
|
CVE-2026-45230 |
8.8 | 0.0063 | NET NO AUTH LOW CX NO UI | DumbAssets through 1.0.11 contains a path traversal vulnerability in the POST /a | |
|
78
|
CVE-2026-108358 |
8.8 | 0.0063 | NET NO AUTH LOW CX NO UI | PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. | |
|
78
|
CVE-2026-47659 |
8.7 | 0.0062 | NET NO AUTH LOW CX NO UI | Pathling is a set of tools that make it easier to use FHIR and clinical terminol | |
|
78
|
CVE-2026-47661 |
8.7 | 0.0062 | NET NO AUTH LOW CX NO UI | Pathling is a set of tools that make it easier to use FHIR and clinical terminol | |
|
78
|
CVE-2026-69109 |
8.7 | 0.0062 | NET NO AUTH LOW CX NO UI | A vulnerability has been identified in Siemens License Server (SLS) (All version | |
|
77
|
CVE-2026-114397 |
8.3 | 0.0063 | NET NO AUTH LOW CX NO UI | Trudesk through 1.2.11 contains a missing authentication vulnerability in debug | |
|
76
|
CVE-2026-13762 |
7.9 | 0.0063 | NET NO AUTH LOW CX NO UI | Inconsistent interpretation of HTTP/2 requests in Amazon CloudFront with AWS WAF | |
|
76
|
CVE-2026-65600 |
7.8 | 0.0062 | NET NO AUTH LOW CX NO UI | Traefik versions <= v2.11.51, >= v3.6.0 <= v3.6.22, and >= v3.7.0 <= v3.7.6 cont | |
|
75
|
CVE-2023-22839 |
7.5 | 0.0063 | NET NO AUTH LOW CX NO UI | On BIG-IP versions 17.0.x before 17.0.0.2, 16.1.x before 16.1.3.3, 15.1.x before | |
|
75
|
CVE-2023-36521 |
7.5 | 0.0063 | NET NO AUTH LOW CX NO UI | A vulnerability has been identified in SIMATIC MV540 H (All versions < V3.3.4), | |
|
75
|
CVE-2026-46592 |
7.5 | 0.0063 | NET NO AUTH LOW CX NO UI | Improper Input Validation, Unintended Proxy or Intermediary ('Confused Deputy') | |
|
75
|
CVE-2026-14519 |
7.5 | 0.0062 | NET NO AUTH LOW CX NO UI | IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0. | |
|
75
|
CVE-2026-12942 |
7.5 | 0.0062 | NET NO AUTH LOW CX NO UI | IBM Langflow OSS 1.0.0 through 1.10.1 could allow a remote attacker to traverse | |
|
75
|
CVE-2026-60023 |
7.5 | 0.0062 | NET NO AUTH LOW CX NO UI | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apac | |
|
75
|
CVE-2026-10595 |
7.5 | 0.0062 | NET NO AUTH LOW CX NO UI | A path traversal vulnerability exists in parisneo/lollms version 2.1.0, specific | |
|
70
|
CVE-2026-67567 |
9.9 | 0.0062 | NET LOW CX NO UI | A flaw was found in the multicloud-operators-subscription component. This vulner | |
|
69
|
CVE-2026-73483 |
9.4 | 0.0062 | NET LOW CX NO UI | Flowise (packages flowise and flowise-components) in versions <= 3.1.2 contain a | |
|
69
|
CVE-2026-41203 |
9.4 | 0.0062 | NET LOW CX NO UI | CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, mo | |
|
68
|
CVE-2026-83526 |
8.8 | 0.0063 | NET LOW CX NO UI | The FV Player 8 plugin for WordPress is vulnerable to Arbitrary File Upload in a | |
|
68
|
CVE-2026-61574 |
8.8 | 0.0062 | NET LOW CX NO UI | authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, t | |
|
68
|
CVE-2026-32955 |
8.7 | 0.0062 | NET LOW CX NO UI | SD-330AC and AMC Manager provided by silex technology, Inc. contain a stack-base | |
|
68
|
CVE-2026-6249 |
8.7 | 0.0062 | NET LOW CX NO UI | Vvveb CMS 1.0.8.2 contains a remote code execution vulnerability in its media up | |
|
68
|
CVE-2026-57510 |
8.7 | 0.0062 | NET LOW CX NO UI | SuperPlane before 0.27.0 contains a broken object-level authorization vulnerabil | |
|
68
|
CVE-2026-75103 |
8.7 | 0.0062 | NET LOW CX NO UI | Crawlab fails to verify user ownership or administrative role on the password-ch | |
|
68
|
CVE-2026-56142 |
8.8 | 0.0062 | NET LOW CX NO UI | In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.14812 | |
|
66
|
CVE-2026-73267 |
7.7 | 0.0063 | NET LOW CX NO UI | A flaw was found in the clusterclaims-controller component of multicluster engin | |
|
66
|
CVE-2026-79889 |
8.1 | 0.0063 | NET NO AUTH NO UI | Vulnerabilities in multiple web interface endpoints of AOS-8 devices could allow | |
|
66
|
CVE-2026-7872 |
8.1 | 0.0062 | NET LOW CX NO UI | IBM Langflow OSS 1.0.0 through 1.10.0 allows an authenticated attacker to read a | |
|
66
|
CVE-2026-66374 |
8.1 | 0.0062 | NET NO AUTH NO UI | Knot Resolver before 6.4.1 allows remote code execution via a heap-based buffer | |
|
65
|
CVE-2026-6135 |
7.4 | 0.0062 | NET LOW CX NO UI | A weakness has been identified in Tenda F451 1.0.0.7_cn_svn7958. This issue affe | |
|
65
|
CVE-2026-7056 |
7.4 | 0.0062 | NET LOW CX NO UI | A vulnerability was detected in Tenda F456 1.0.0.5. Impacted is the function fro | |
|
63
|
CVE-2026-10139 |
9.1 | 0.0062 | NET LOW CX NO UI | A stack-based buffer overflow vulnerability exists in the Mcli functionality of | |
|
63
|
CVE-2026-28314 |
9.1 | 0.0062 | NET LOW CX NO UI | SolarWinds Serv-U is affected by an insecure direct object reference vulnerabili | |
|
62
|
CVE-2026-41587 |
8.6 | 0.0062 | NET LOW CX NO UI | CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, mo | |
|
62
|
CVE-2026-11407 |
8.6 | 0.0062 | NET LOW CX NO UI | Pimcore CMS/DXP version 12.3.8 contains a sandbox bypass vulnerability that allo | |
|
60
|
CVE-2026-46737 |
7.2 | 0.0063 | NET LOW CX NO UI | Dell PowerProtect Data Manager, versions prior to 20.2.0.0, contain(s) an Improp | |
|
60
|
CVE-2026-63453 |
7.2 | 0.0062 | NET LOW CX NO UI | Buffer overflow vulnerabilities exist in the command line interface of AOS-CX. S | |
|
55
|
CVE-2026-88204 |
7.3 | 0.0063 | NET LOW CX | Improper neutralization of input during web page generation ('cross-site scripti | |
|
55
|
CVE-2026-105599 |
7.5 | 0.0062 | NET NO AUTH | Heap-based buffer overflow in Microsoft Office PowerPoint allows an unauthorized |