Hunt List
13,244 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2023-1357 |
9.8 | 0.0055 | NET NO AUTH LOW CX NO UI | A vulnerability, which was classified as critical, has been found in SourceCodes | |
|
80
|
CVE-2024-53177 |
9.8 | 0.0055 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: smb: preven | |
|
80
|
CVE-2026-48056 |
10.0 | 0.0055 | NET NO AUTH LOW CX NO UI | Streambert is a cross-platform Electron Desktop App to stream and download video | |
|
80
|
CVE-2026-84295 |
10.0 | 0.0055 | NET NO AUTH LOW CX NO UI | Improper authentication in Progress Software WS_FTP Server versions prior to 202 | |
|
80
|
CVE-2026-16235 |
9.8 | 0.0055 | NET NO AUTH LOW CX NO UI | Crypt::Password versions through 0.28 for Perl generate insecure random values f | |
|
80
|
CVE-2026-59147 |
9.8 | 0.0055 | NET NO AUTH LOW CX NO UI | Data::DisjointSet::Shared versions before 0.02 for Perl allow out-of-bounds read | |
|
80
|
CVE-2026-71254 |
9.8 | 0.0055 | NET NO AUTH LOW CX NO UI | nanoMODBUS through v1.23.0 contains an out-of-bounds write in the Modbus server- | |
|
80
|
CVE-2026-71256 |
9.8 | 0.0055 | NET NO AUTH LOW CX NO UI | nanoMODBUS through v1.23.0 contains an out-of-bounds stack read leading to a wil | |
|
80
|
CVE-2026-71267 |
9.8 | 0.0055 | NET NO AUTH LOW CX NO UI | microtar's mtar_write_file_header and mtar_write_dir_header functions (src/micro | |
|
80
|
CVE-2026-106013 |
9.8 | 0.0055 | NET NO AUTH LOW CX NO UI | The Jupiter X Core plugin for WordPress is vulnerable to Authentication Bypass v | |
|
80
|
CVE-2026-99153 |
9.8 | 0.0055 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: scsi: libis | |
|
80
|
CVE-2026-89633 |
9.8 | 0.0055 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: smb: client | |
|
80
|
CVE-2026-44277 |
9.8 | 0.0055 | NET NO AUTH LOW CX NO UI | A improper access control vulnerability in Fortinet FortiAuthenticator 8.0.2, Fo | |
|
80
|
CVE-2026-16388 |
9.8 | 0.0055 | NET NO AUTH LOW CX NO UI | Sandbox escape in the DOM: Networking component. This vulnerability was fixed in | |
|
80
|
CVE-2026-16410 |
9.8 | 0.0055 | NET NO AUTH LOW CX NO UI | JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability w | |
|
79
|
CVE-2026-42882 |
9.4 | 0.0055 | NET NO AUTH LOW CX NO UI | oxyno-zeta/s3-proxy is an aws s3 proxy written in go. Prior to 5.0.0, s3-proxy c | |
|
79
|
CVE-2026-6074 |
9.3 | 0.0055 | NET NO AUTH LOW CX NO UI | Intrado 911 Emergency Gateway (EGW) 5.x, 6.x, and 7.x contain a path traversal v | |
|
79
|
CVE-2026-65318 |
9.2 | 0.0055 | NET NO AUTH LOW CX NO UI | Verba RAG application version 2.1.3 contains an unauthenticated server-side requ | |
|
79
|
CVE-2026-64639 |
9.3 | 0.0055 | NET NO AUTH LOW CX NO UI | Incorrect database cloning process in Plesk from 18.0.52 before 18.0.79.6 and 18 | |
|
79
|
CVE-2026-65886 |
9.2 | 0.0055 | NET NO AUTH LOW CX NO UI | Joomla Extension - balbooa.com - Unauthenticated arbitrary file read in Gridbox | |
|
78
|
CVE-2026-54078 |
8.7 | 0.0056 | NET NO AUTH LOW CX NO UI | veraPDF validation model is an implementation of the veraPDF validation model. F | |
|
78
|
CVE-2026-54079 |
8.7 | 0.0056 | NET NO AUTH LOW CX NO UI | veraPDF validation provides PDF/A and PDF/UA validation, feature reporting, and | |
|
78
|
CVE-2026-55629 |
8.7 | 0.0055 | NET NO AUTH LOW CX NO UI | Whistle is an HTTP, HTTP2, HTTPS, and WebSocket debugging proxy. Prior to 2.10.3 | |
|
78
|
CVE-2026-60007 |
9.1 | 0.0055 | NET NO AUTH LOW CX NO UI | In Eclipse Milo versions 0.6.0 through 1.1.4, username-token processing returns | |
|
78
|
CVE-2026-56122 |
8.7 | 0.0055 | NET NO AUTH LOW CX NO UI | Winstone Servlet Engine through 0.9.10 contains a path traversal vulnerability t | |
|
78
|
CVE-2010-20125 |
8.7 | 0.0055 | NET NO AUTH LOW CX NO UI | DedeCMS before 5.7 contains a file inclusion vulnerability in plus/carbuyaction. | |
|
77
|
CVE-2026-48448 |
8.6 | 0.0056 | NET NO AUTH LOW CX NO UI | Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Specia | |
|
77
|
CVE-2026-120135 |
8.2 | 0.0055 | NET NO AUTH LOW CX NO UI | Uncontrolled Recursion vulnerability in Apache Thrift Java bindings. This iss | |
|
76
|
CVE-2026-67363 |
7.7 | 0.0056 | NET NO AUTH LOW CX NO UI | Joomla Extension - balbooa.com - Pre-auth Payment Amount Tampering in Balbooa Fo | |
|
75
|
CVE-2026-118779 |
7.5 | 0.0056 | NET NO AUTH LOW CX NO UI | Forge (also called node-forge) is a native implementation of Transport Layer Sec | |
|
70
|
CVE-2026-34047 |
9.9 | 0.0055 | NET LOW CX NO UI | Coolify is an open-source and self-hostable tool for managing servers, applicati | |
|
70
|
CVE-2026-70496 |
9.9 | 0.0055 | NET LOW CX NO UI | A flaw was found in search-v2-operator. The operator's ClusterRole has permissio | |
|
69
|
CVE-2026-6296 |
9.6 | 0.0056 | NET NO AUTH LOW CX | Heap buffer overflow in ANGLE in Google Chrome prior to 147.0.7727.101 allowed a | |
|
69
|
CVE-2025-65200 |
9.6 | 0.0055 | NET NO AUTH LOW CX | An issue was discovered in localstack 4.9.2 allowing attackers to execute arbitr | |
|
68
|
CVE-2026-40370 |
8.8 | 0.0056 | NET LOW CX NO UI | External control of file name or path in SQL Server allows an authorized attacke | |
|
68
|
CVE-2026-112659 |
8.8 | 0.0056 | NET NO AUTH LOW CX | A type confusion issue was addressed with improved memory handling. This issue i | |
|
68
|
CVE-2026-67351 |
8.7 | 0.0056 | NET LOW CX NO UI | Serendipity before 2.6.1 contains an authentication context confusion vulnerabil | |
|
68
|
CVE-2026-54526 |
8.9 | 0.0055 | NET LOW CX NO UI | Argo Workflows is an open source container-native workflow engine for orchestrat | |
|
68
|
CVE-2026-6912 |
8.7 | 0.0055 | NET LOW CX NO UI | Improperly controlled modification of dynamically-determined object attributes i | |
|
68
|
CVE-2026-55249 |
8.8 | 0.0055 | NET NO AUTH LOW CX | @rtk-ai/rtk-rewrite transparently rewrites shell commands executed via OpenClaw' | |
|
68
|
CVE-2026-84579 |
8.8 | 0.0055 | NET NO AUTH LOW CX | A logic issue was addressed with improved checks. This issue is fixed in macOS G | |
|
67
|
CVE-2026-9585 |
8.6 | 0.0055 | NET NO AUTH LOW CX | An unauthenticated reflected cross-site scripting (XSS) vulnerability exists in | |
|
66
|
CVE-2025-40158 |
8.1 | 0.0056 | NET NO AUTH NO UI | In the Linux kernel, the following vulnerability has been resolved: ipv6: use R | |
|
66
|
CVE-2026-79891 |
8.1 | 0.0055 | NET NO AUTH NO UI | A buffer overflow vulnerability exists in the command line interface of AOS-8 th | |
|
65
|
CVE-2026-66745 |
7.5 | 0.0055 | NET NO AUTH LOW CX | Artica Proxy before 4.50.000000 Service Pack 7 (fixed in hotfix 20260724-02) con | |
|
65
|
CVE-2026-58170 |
7.2 | 0.0055 | NET LOW CX NO UI | Vibe-Trading before 0.1.10 builds the proposal file path by joining a caller-sup | |
|
65
|
CVE-2026-73624 |
7.2 | 0.0055 | NET LOW CX NO UI | GitPython versions before 3.1.54 contain an arbitrary file overwrite vulnerabili | |
|
64
|
CVE-2026-74039 |
7.1 | 0.0056 | NET LOW CX NO UI | Wazuh 4.0.0 before 4.14.7 and 5.0.0-beta2 contain a denial of service vulnerabil | |
|
64
|
CVE-2025-71391 |
7.1 | 0.0056 | NET LOW CX NO UI | SurrealDB versions before 2.2.2 contain an uncaught exception vulnerability in t | |
|
60
|
CVE-2026-23820 |
7.2 | 0.0056 | NET LOW CX NO UI | A vulnerability in the command line interface of Access Points running AOS-10 an |