Hunt List
13,787 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-20184 |
9.8 | 0.0052 | NET NO AUTH LOW CX NO UI | A vulnerability in the integration of single sign-on (SSO) with Control Hub in C | |
|
80
|
CVE-2026-7663 |
9.8 | 0.0052 | NET NO AUTH LOW CX NO UI | IBM Langflow OSS 1.0.0 through 1.9.6 could allow unauthenticated attackers to ac | |
|
80
|
CVE-2026-109220 |
9.8 | 0.0052 | NET NO AUTH LOW CX NO UI | The PDF Invoice for WooCommerce + Drag and Drop Template Builder plugin for Word | |
|
80
|
CVE-2026-46807 |
9.8 | 0.0052 | NET NO AUTH LOW CX NO UI | Vulnerability in the Identity Manager product of Oracle Fusion Middleware (compo | |
|
80
|
CVE-2026-58081 |
9.8 | 0.0052 | NET NO AUTH LOW CX NO UI | Several encoding modules, including HZ, UTF-7, VIQR, and ZW, did not properly ch | |
|
80
|
CVE-2026-58082 |
9.8 | 0.0052 | NET NO AUTH LOW CX NO UI | The ISO-2022 encoding module used a stack buffer sized to MB_LEN_MAX (6 bytes) f | |
|
80
|
CVE-2026-76934 |
9.8 | 0.0052 | NET NO AUTH LOW CX NO UI | Stack-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System | |
|
80
|
CVE-2026-76939 |
9.8 | 0.0052 | NET NO AUTH LOW CX NO UI | Heap-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System | |
|
80
|
CVE-2026-82118 |
9.8 | 0.0052 | NET NO AUTH LOW CX NO UI | Stack-based Buffer Overflow Vulnerability in HiRDB. This issue affects HiRDB S | |
|
80
|
CVE-2026-86574 |
9.8 | 0.0052 | NET NO AUTH LOW CX NO UI | Heap-based Buffer Overflow Vulnerability in JP1/Base. This issue affects JP1/Ba | |
|
79
|
CVE-2026-119660 |
9.3 | 0.0052 | NET NO AUTH LOW CX NO UI | MuseBot before 2.0.0 contains an authentication bypass vulnerability that allows | |
|
79
|
CVE-2021-47731 |
9.3 | 0.0052 | NET NO AUTH LOW CX NO UI | Selea Targa IP OCR-ANPR Camera contains a hard-coded developer password vulnerab | |
|
78
|
CVE-2026-63229 |
9.1 | 0.0052 | NET NO AUTH LOW CX NO UI | A pre-authentication blind SQL injection vulnerability in Koollab LMS allowed an | |
|
78
|
CVE-2026-63230 |
9.1 | 0.0052 | NET NO AUTH LOW CX NO UI | A pre-authentication error-based SQL injection vulnerability in Koollab LMS allo | |
|
78
|
CVE-2026-103603 |
8.7 | 0.0052 | NET NO AUTH LOW CX NO UI | Memory allocation with excessive size value in the HSS/LMS signature code (HssPu | |
|
78
|
CVE-2026-31908 |
9.1 | 0.0052 | NET NO AUTH LOW CX NO UI | Header injection vulnerability in Apache APISIX. The attacker can take advantag | |
|
78
|
CVE-2026-48544 |
8.7 | 0.0052 | NET NO AUTH LOW CX NO UI | Taipy 4.1.1, fixed in commit 129fd40, contains a path traversal vulnerability in | |
|
78
|
CVE-2026-49851 |
8.7 | 0.0052 | NET NO AUTH LOW CX NO UI | Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, | |
|
78
|
CVE-2026-63101 |
8.7 | 0.0052 | NET NO AUTH LOW CX NO UI | Open Event Server through 1.19.1 contains a missing authentication vulnerability | |
|
77
|
CVE-2026-102560 |
8.6 | 0.0052 | NET NO AUTH LOW CX NO UI | A flaw was found in libsoup. When the permessage-deflate WebSocket extension com | |
|
77
|
CVE-2026-21045 |
8.3 | 0.0052 | NET NO AUTH LOW CX NO UI | Out-of-bounds write in parsing TIFF format in libimagecodec.media.quram.so prior | |
|
77
|
CVE-2026-21048 |
8.3 | 0.0052 | NET NO AUTH LOW CX NO UI | Out-of-bounds write in parsing DNG format in libimagecodec.media.quram.so prior | |
|
77
|
CVE-2026-54058 |
8.3 | 0.0052 | NET NO AUTH LOW CX NO UI | Pillow is a Python imaging library. Prior to 12.3.0, when Pillow loads an uncomp | |
|
77
|
CVE-2025-15620 |
8.6 | 0.0052 | NET NO AUTH LOW CX NO UI | HiOS Switch Platform versions 09.1.00 through 09.4.04 and 10.0.00 through 10.3.0 | |
|
76
|
CVE-2026-8034 |
7.9 | 0.0052 | NET NO AUTH LOW CX NO UI | A server-side request forgery (SSRF) vulnerability was identified in the GitHub | |
|
75
|
CVE-2026-52196 |
7.5 | 0.0052 | NET NO AUTH LOW CX NO UI | Buffer Overflow vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows | |
|
75
|
CVE-2026-52195 |
7.5 | 0.0052 | NET NO AUTH LOW CX NO UI | Buffer Overflow vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows | |
|
75
|
CVE-2026-52190 |
7.5 | 0.0052 | NET NO AUTH LOW CX NO UI | Buffer Overflow vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows | |
|
75
|
CVE-2026-54405 |
7.5 | 0.0052 | NET NO AUTH LOW CX NO UI | A malicious actor with access to the network could exploit an Improper Input Val | |
|
75
|
CVE-2026-52187 |
7.5 | 0.0052 | NET NO AUTH LOW CX NO UI | Buffer Overflow vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows | |
|
75
|
CVE-2026-52189 |
7.5 | 0.0052 | NET NO AUTH LOW CX NO UI | Buffer Overflow vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows | |
|
75
|
CVE-2026-52191 |
7.5 | 0.0052 | NET NO AUTH LOW CX NO UI | Buffer Overflow vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows | |
|
75
|
CVE-2026-55379 |
7.5 | 0.0052 | NET NO AUTH LOW CX NO UI | Pillow is a Python imaging library. Prior to 12.3.0, PIL/BdfFontFile.py bdf_char | |
|
75
|
CVE-2026-113873 |
7.5 | 0.0052 | NET NO AUTH LOW CX NO UI | SmileCDR HAPI FHIR does not properly handle highly compressed data, allowing an | |
|
75
|
CVE-2026-87743 |
7.5 | 0.0052 | NET NO AUTH LOW CX NO UI | A flaw was found in Quarkus HTTP security. An unauthenticated attacker can explo | |
|
75
|
CVE-2026-56848 |
7.5 | 0.0052 | NET NO AUTH LOW CX NO UI | A flaw in Node.js HTTP/2 handling allows `nghttp2_session_mem_send()` to be call | |
|
70
|
CVE-2026-46850 |
9.9 | 0.0052 | NET LOW CX NO UI | Vulnerability in the MySQL Shell product of Oracle MySQL (component: Shell for V | |
|
70
|
CVE-2026-19656 |
9.9 | 0.0052 | NET LOW CX NO UI | ScadaLTS 2.7.8.1 exposes a server-side method that lacks authorization checks, a | |
|
69
|
CVE-2026-70398 |
9.6 | 0.0052 | NET LOW CX NO UI | A flaw was found in multicloud-integrations, a component of Red Hat Advanced Clu | |
|
68
|
CVE-2026-41613 |
8.8 | 0.0052 | NET NO AUTH LOW CX | Session fixation in Visual Studio Code allows an unauthorized attacker to elevat | |
|
68
|
CVE-2026-33613 |
8.8 | 0.0052 | NET LOW CX NO UI | Due to the improper neutralisation of special elements used in an OS command, a | |
|
68
|
CVE-2026-42017 |
8.8 | 0.0052 | NET LOW CX NO UI | An event-handling weakness in JFrog Artifactory could expose privileged authoriz | |
|
68
|
CVE-2026-69106 |
8.8 | 0.0052 | NET LOW CX NO UI | A low-privileged user may poison cached artifact metadata under specific conditi | |
|
67
|
CVE-2026-54208 |
8.5 | 0.0052 | NET NO AUTH LOW CX | Tobit Laboratories AG TeamDavid's Webbox application is vulnerable to arbitrary | |
|
67
|
CVE-2026-62240 |
8.3 | 0.0052 | NET NO AUTH LOW CX | CrewAI before 1.15.1 contains a server-side request forgery vulnerability in the | |
|
66
|
CVE-2026-90153 |
8.1 | 0.0052 | NET LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: ksmbd: boun | |
|
66
|
CVE-2026-8442 |
8.1 | 0.0052 | NET LOW CX NO UI | The WP Review Slider Pro plugin for WordPress is vulnerable to Arbitrary File De | |
|
64
|
CVE-2026-57188 |
7.1 | 0.0052 | NET LOW CX NO UI | Asterisk is an open source private branch exchange and telephony toolkit. Prior | |
|
64
|
CVE-2026-65885 |
9.4 | 0.0052 | NET LOW CX NO UI | Joomla Extension - balbooa.com - Authenticated arbitrary file upload in Gridbox | |
|
64
|
CVE-2026-120425 |
7.1 | 0.0052 | NET LOW CX NO UI | Chatify before 1.6.4 contains an authorization bypass vulnerability in the Pushe |