Hunt List
13,226 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
89
|
CVE-2017-20251 |
9.3 | 0.0056 | NET NO AUTH LOW CX NO UI | 1 PoC | WordPress Insert PHP plugin versions before 3.3.1 contain a PHP code injection v |
|
80
|
CVE-2026-61738 |
10.0 | 0.0056 | NET NO AUTH LOW CX NO UI | SOCFortress CoPilot focuses on providing a single pane of glass for all your sec | |
|
80
|
CVE-2026-28982 |
9.8 | 0.0056 | NET NO AUTH LOW CX NO UI | A race condition was addressed with improved locking. This issue is fixed in mac | |
|
80
|
CVE-2026-45336 |
10.0 | 0.0056 | NET NO AUTH LOW CX NO UI | HireFlow is a web-based interview management system for managing candidates, sch | |
|
80
|
CVE-2026-27429 |
9.8 | 0.0056 | NET NO AUTH LOW CX NO UI | Unauthenticated PHP Object Injection in Nifty <= 1.4.1 versions. | |
|
80
|
CVE-2026-16382 |
9.8 | 0.0056 | NET NO AUTH LOW CX NO UI | Mitigation bypass in the DOM: Service Workers component. This vulnerability was | |
|
79
|
CVE-2026-54203 |
9.2 | 0.0056 | NET NO AUTH LOW CX NO UI | Memory Leak to an Unauthorized Actor vulnerability in Tobit Laboratories AG Team | |
|
79
|
CVE-2026-77645 |
9.2 | 0.0056 | NET NO AUTH LOW CX NO UI | A critical remote code execution (RCE) vulnerability has been reported in PTC Wi | |
|
79
|
CVE-2026-93857 |
9.2 | 0.0056 | NET NO AUTH LOW CX NO UI | A stack-based buffer overflow vulnerability in Fireware OS's SIP proxy allows a | |
|
79
|
CVE-2026-79872 |
9.4 | 0.0056 | NET NO AUTH LOW CX NO UI | A buffer overflow vulnerability exists in the underlying operating system of AOS | |
|
79
|
CVE-2026-61884 |
9.3 | 0.0056 | NET NO AUTH LOW CX NO UI | The Tycon Systems TPDIN-Monitor-WEB2 ships without HTTP credentials configured, | |
|
79
|
CVE-2025-34522 |
9.2 | 0.0056 | NET NO AUTH LOW CX NO UI | A heap-based buffer overflow vulnerability exists in the input parsing logic of | |
|
78
|
CVE-2026-98549 |
9.1 | 0.0056 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: tcp: preven | |
|
78
|
CVE-2026-10130 |
8.8 | 0.0056 | NET NO AUTH LOW CX NO UI | QueryWeaver contains an authentication bypass vulnerability that allows unauthen | |
|
78
|
CVE-2026-48830 |
9.1 | 0.0056 | NET NO AUTH LOW CX NO UI | Improper authentication in Apache bRPC through 1.17.0 allows a remote unauthenti | |
|
78
|
CVE-2026-62184 |
8.7 | 0.0056 | NET NO AUTH LOW CX NO UI | luci-app-banip contains a log parsing vulnerability where the awk-based parser e | |
|
77
|
CVE-2026-58014 |
8.6 | 0.0056 | NET NO AUTH LOW CX NO UI | A flaw was found in GLib. An off-by-one error can occur in the g_key_file_get_lo | |
|
77
|
CVE-2026-28808 |
8.3 | 0.0056 | NET NO AUTH LOW CX NO UI | Incorrect Authorization vulnerability in Erlang OTP (inets modules) allows unaut | |
|
75
|
CVE-2026-20339 |
7.5 | 0.0056 | NET NO AUTH LOW CX NO UI | A vulnerability in the PESpin file format parser of ClamAV could allow an unauth | |
|
75
|
CVE-2026-20345 |
7.5 | 0.0056 | NET NO AUTH LOW CX NO UI | A vulnerability in the GPT file format parser of ClamAV could allow an unauthent | |
|
75
|
CVE-2026-20347 |
7.5 | 0.0056 | NET NO AUTH LOW CX NO UI | A vulnerability in the Mach-O file format parser of ClamAV could allow an unauth | |
|
75
|
CVE-2026-18828 |
7.5 | 0.0056 | NET NO AUTH LOW CX NO UI | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to c | |
|
75
|
CVE-2026-20338 |
7.5 | 0.0056 | NET NO AUTH LOW CX NO UI | A vulnerability in the zip archive parser of ClamAV could allow an unauthenticat | |
|
75
|
CVE-2026-48042 |
7.5 | 0.0056 | NET NO AUTH LOW CX NO UI | Envoy is an open source edge and service proxy designed for cloud-native applica | |
|
75
|
CVE-2026-59892 |
7.5 | 0.0056 | NET NO AUTH LOW CX NO UI | OpenTelemetry JavaScript is the OpenTelemetry JavaScript client. Prior to 2.9.0, | |
|
75
|
CVE-2026-59675 |
7.5 | 0.0056 | NET NO AUTH LOW CX NO UI | When API audit logging is enabled, the middleware reads the entire HTTP request | |
|
75
|
CVE-2026-41114 |
7.5 | 0.0056 | NET NO AUTH LOW CX NO UI | Uncontrolled Resource Consumption vulnerability in Apache IoTDB JDBC driver. | |
|
75
|
CVE-2026-28936 |
7.5 | 0.0056 | NET NO AUTH LOW CX NO UI | The issue was addressed with improved checks. This issue is fixed in iOS 18.7.9 | |
|
75
|
CVE-2026-46581 |
7.5 | 0.0056 | NET NO AUTH LOW CX NO UI | In Eclipse Mojarra versions 2.3 and following, URL handing in `DefaultFaceletFac | |
|
75
|
CVE-2026-94266 |
7.5 | 0.0056 | NET NO AUTH LOW CX NO UI | libcurl could accidentally return a URL for `curl_easy_getinfo()`'s `CURLINFO_EF | |
|
75
|
CVE-2026-118779 |
7.5 | 0.0056 | NET NO AUTH LOW CX NO UI | Forge (also called node-forge) is a native implementation of Transport Layer Sec | |
|
69
|
CVE-2026-47705 |
9.6 | 0.0056 | NET NO AUTH LOW CX | TypeBot is a chatbot builder tool. Version 3.16.1 has a CSV injection vulnerabil | |
|
69
|
CVE-2026-73032 |
9.4 | 0.0056 | NET NO AUTH LOW CX | PapersGPT for Zotero 0.6.1 contains a remote code execution vulnerability that a | |
|
69
|
CVE-2026-119717 |
9.2 | 0.0056 | NET NO AUTH NO UI | Rejected reason: This CVE ID has been rejected as a duplicate. | |
|
69
|
CVE-2026-17687 |
9.6 | 0.0056 | NET NO AUTH LOW CX | Type Confusion in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote | |
|
69
|
CVE-2026-69435 |
9.6 | 0.0056 | NET LOW CX NO UI | Missing authorization in Azure SRE Agent allows an authorized attacker to elevat | |
|
68
|
CVE-2025-61196 |
8.8 | 0.0056 | NET LOW CX NO UI | An issue in BusinessNext CRMnext v.10.8.3.0 allows a remote attacker to execute | |
|
68
|
CVE-2026-72533 |
8.8 | 0.0056 | NET LOW CX NO UI | An authentication bypass vulnerability in Portainer CE through 2.44.0 allows aut | |
|
68
|
CVE-2026-112697 |
8.8 | 0.0056 | NET NO AUTH LOW CX | A use-after-free issue was addressed with improved memory management. This issue | |
|
67
|
CVE-2026-35438 |
8.3 | 0.0056 | NET LOW CX NO UI | Missing authorization in Windows Admin Center allows an authorized attacker to e | |
|
66
|
CVE-2026-30911 |
8.1 | 0.0056 | NET LOW CX NO UI | Apache Airflow versions 3.1.0 through 3.1.7 missing authorization vulnerability | |
|
66
|
CVE-2026-57743 |
8.1 | 0.0056 | NET NO AUTH NO UI | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP | |
|
65
|
CVE-2026-41615 |
7.4 | 0.0056 | NET NO AUTH LOW CX | Exposure of sensitive information to an unauthorized actor in Microsoft Authenti | |
|
64
|
CVE-2026-47704 |
7.1 | 0.0056 | NET LOW CX NO UI | TypeBot is a chatbot builder tool. Prior to version 3.17.0, an authenticated use | |
|
64
|
CVE-2026-15265 |
9.4 | 0.0056 | NET LOW CX NO UI | A path traversal vulnerability in Tenable Agent 11.2.0 and 11.1.3 and lower allo | |
|
57
|
CVE-2026-67625 |
8.5 | 0.0056 | NET NO UI | Heap-based buffer overflow in SQL Server allows an authorized attacker to execut | |
|
57
|
CVE-2026-68883 |
8.5 | 0.0056 | NET NO UI | Heap-based buffer overflow in SQL Server allows an authorized attacker to elevat | |
|
55
|
CVE-2026-63337 |
7.5 | 0.0056 | NET LOW CX | The RabbitMQ Java client library allows Java and JVM-based applications to conne | |
|
55
|
CVE-2026-97789 |
7.5 | 0.0056 | NET NO AUTH | Use after free in Remote Desktop Client allows an unauthorized attacker to execu | |
|
55
|
CVE-2026-58233 |
7.6 | 0.0056 | NET LOW CX | SAP Change and Transport System Attach Tool (ctsattach) allows an authenticated |