Hunt List
13,776 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-2031 |
10.0 | 0.0053 | NET NO AUTH LOW CX NO UI | An Improper Access Control vulnerability in several internal API endpoints for G | |
|
80
|
CVE-2026-7414 |
9.8 | 0.0053 | NET NO AUTH LOW CX NO UI | Yarbo firmware v2.3.9 contains hardcoded administrative credentials embedded in | |
|
80
|
CVE-2026-16280 |
9.8 | 0.0053 | NET NO AUTH LOW CX NO UI | An integer overflow when calculating physical offsets for sparse PMRs may result | |
|
80
|
CVE-2026-51599 |
9.8 | 0.0053 | NET NO AUTH LOW CX NO UI | An insufficient input validation vulnerability in the RTSP service of MERCURY MI | |
|
80
|
CVE-2026-92559 |
9.8 | 0.0053 | NET NO AUTH LOW CX NO UI | IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2 could allow a remote attack | |
|
79
|
CVE-2026-11720 |
9.3 | 0.0053 | NET NO AUTH LOW CX NO UI | A path traversal vulnerability exists in the HTTP tool URL builder of googleapis | |
|
79
|
CVE-2026-19677 |
9.3 | 0.0053 | NET NO AUTH LOW CX NO UI | An authentication bypass vulnerability in the public onPhase/ frevvo registratio | |
|
79
|
CVE-2026-22102 |
9.3 | 0.0053 | NET NO AUTH LOW CX NO UI | A POST request sent to a specific webserver endpoint can be used to write to arb | |
|
79
|
CVE-2026-57309 |
9.3 | 0.0053 | NET NO AUTH LOW CX NO UI | A Blind SQL injection vulnerability has been identified in Windu CMS. A remote u | |
|
79
|
CVE-2026-120447 |
9.2 | 0.0053 | NET NO AUTH LOW CX NO UI | HotGo 2.8.4 through 2.15.1 contains an authentication bypass vulnerability that | |
|
79
|
CVE-2026-41586 |
9.3 | 0.0053 | NET NO AUTH LOW CX NO UI | Hyperledger Fabric is an enterprise-grade permissioned distributed ledger framew | |
|
78
|
CVE-2026-57584 |
8.7 | 0.0053 | NET NO AUTH LOW CX NO UI | Phalcon is a high-performance, full-stack PHP framework. Prior to 5.15.0, every | |
|
78
|
CVE-2026-16392 |
9.1 | 0.0053 | NET NO AUTH LOW CX NO UI | JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability w | |
|
78
|
CVE-2026-97406 |
9.1 | 0.0053 | NET NO AUTH LOW CX NO UI | XERJ Console API bearer tokens can bypass the passkey‑only authentication requir | |
|
78
|
CVE-2026-105270 |
8.7 | 0.0053 | NET NO AUTH LOW CX NO UI | Allocation of Resources Without Limits or Throttling vulnerability in esaml_bind | |
|
78
|
CVE-2026-75859 |
8.7 | 0.0053 | NET NO AUTH LOW CX NO UI | CodeWhale versions before 0.8.64 fail to validate file paths in the project conf | |
|
78
|
CVE-2026-75914 |
8.7 | 0.0053 | NET NO AUTH LOW CX NO UI | CodeWhale versions before 0.8.64 contain a path traversal vulnerability in the i | |
|
77
|
CVE-2026-57389 |
8.6 | 0.0053 | NET NO AUTH LOW CX NO UI | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') v | |
|
77
|
CVE-2026-57709 |
8.6 | 0.0053 | NET NO AUTH LOW CX NO UI | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') v | |
|
77
|
CVE-2026-54650 |
8.6 | 0.0053 | NET NO AUTH LOW CX NO UI | openhole exposes localhost to the internet in one command. In 0.1.1 and earlier, | |
|
75
|
CVE-2026-11897 |
7.5 | 0.0053 | NET NO AUTH LOW CX NO UI | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is vulnerab | |
|
75
|
CVE-2026-61891 |
7.5 | 0.0053 | NET NO AUTH LOW CX NO UI | In Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` ba | |
|
75
|
CVE-2026-12523 |
7.5 | 0.0053 | NET NO AUTH LOW CX NO UI | Summary Cloudflare quiche's HTTP/3 layer was discovered to be vulnerable to r | |
|
75
|
CVE-2026-73566 |
7.5 | 0.0053 | NET NO AUTH LOW CX NO UI | node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.21, nod | |
|
74
|
CVE-2026-41920 |
7.0 | 0.0053 | NET NO AUTH LOW CX NO UI | Improper Access Control vulnerability in Apache Traffic Server. This issue affe | |
|
70
|
CVE-2026-63232 |
9.9 | 0.0053 | NET LOW CX NO UI | A SQL injection and unsafe deserialisation vulnerability in Koollab LMS allowed | |
|
70
|
CVE-2026-63233 |
9.9 | 0.0053 | NET LOW CX NO UI | A SQL injection and unsafe deserialisation vulnerability in Koollab LMS allowed | |
|
70
|
CVE-2026-63234 |
9.9 | 0.0053 | NET LOW CX NO UI | A SQL injection and unsafe deserialisation vulnerability in Koollab LMS allowed | |
|
70
|
CVE-2026-13435 |
9.9 | 0.0053 | NET LOW CX NO UI | IBM Langflow OSS 1.0.0 through 1.10.1 contains an improper input validation vuln | |
|
69
|
CVE-2026-44790 |
9.4 | 0.0053 | NET LOW CX NO UI | n8n is an open source workflow automation platform. Prior to 1.123.43, 2.22.1, a | |
|
68
|
CVE-2026-58072 |
9.0 | 0.0053 | NET LOW CX NO UI | A vulnerability in Veeam Service Provider Console allowing arbitrary file write | |
|
68
|
CVE-2026-44941 |
8.8 | 0.0053 | NET NO AUTH LOW CX | A relative path traversal in the "keyhint" option in repomd.xml parsing of libzy | |
|
68
|
CVE-2026-76040 |
8.8 | 0.0053 | NET NO AUTH LOW CX | Use after free in Browser in Google Chrome on on Mac prior to 151.0.7922.169 all | |
|
68
|
CVE-2026-105476 |
8.8 | 0.0053 | NET LOW CX NO UI | Improper link resolution before file access in cPanel allows remote authenticate | |
|
68
|
CVE-2026-22049 |
8.7 | 0.0053 | NET LOW CX NO UI | ONTAP versions 9.16.1 and higher with WebAuthn multi-factor authentication (MFA) | |
|
68
|
CVE-2026-40349 |
8.8 | 0.0053 | NET LOW CX NO UI | Movary is a self hosted web app to track and rate a user's watched movies. Prior | |
|
68
|
CVE-2026-15067 |
8.8 | 0.0053 | NET LOW CX NO UI | Snowflake Terraform Provider versions prior to 2.18.0 contain several security v | |
|
68
|
CVE-2026-8056 |
8.8 | 0.0053 | NET LOW CX NO UI | IBM Langflow OSS 1.0.0 through 1.10.0 allows authenticated users to override com | |
|
68
|
CVE-2026-16800 |
8.8 | 0.0053 | NET LOW CX NO UI | Improper control of generation of code ('Code Injection') in the schedule featur | |
|
68
|
CVE-2026-16801 |
8.8 | 0.0053 | NET LOW CX NO UI | Improper control of generation of code ('Code Injection') in the variables featu | |
|
67
|
CVE-2026-69086 |
8.3 | 0.0053 | NET LOW CX NO UI | SiYuan versions before v3.7.3 fail to validate the avID parameter on all code br | |
|
67
|
CVE-2026-49332 |
8.5 | 0.0053 | NET LOW CX NO UI | A flaw was found in openshift/oauth-proxy. The proxy sets authenticated identity | |
|
66
|
CVE-2026-98968 |
8.1 | 0.0053 | NET NO AUTH NO UI | In the Linux kernel, the following vulnerability has been resolved: amt: send t | |
|
66
|
CVE-2026-57197 |
7.7 | 0.0053 | NET LOW CX NO UI | Asterisk is an open source private branch exchange and telephony toolkit. Prior | |
|
65
|
CVE-2026-70634 |
7.2 | 0.0053 | NET LOW CX NO UI | TimescaleDB through 2.29.1, fixed in commit 517c13e, contains an out-of-bounds r | |
|
63
|
CVE-2026-45158 |
9.1 | 0.0053 | NET LOW CX NO UI | OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.8, unsa | |
|
62
|
CVE-2026-104069 |
8.6 | 0.0053 | NET LOW CX NO UI | HortusFox before 6.2 contains a remote code execution vulnerability in ThemeModu | |
|
60
|
CVE-2026-94346 |
7.2 | 0.0053 | NET LOW CX NO UI | PowerProtect Data Domain Virtual Edition, Feature Release versions 7.7.1.0 throu | |
|
55
|
CVE-2026-70183 |
7.5 | 0.0053 | NET NO UI | Concurrent execution using shared resource with improper synchronization ('race | |
|
54
|
CVE-2026-6968 |
7.1 | 0.0053 | NET NO UI | Incomplete path traversal fixes in awslabs/tough before tough-v0.22.0 allow remo |