Hunt List
13,789 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-105781 |
10.0 | 0.0052 | NET NO AUTH LOW CX NO UI | Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Specia | |
|
80
|
CVE-2026-35312 |
9.8 | 0.0052 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Virtual Directory product of Oracle Fusion Middlewar | |
|
80
|
CVE-2026-46773 |
9.8 | 0.0052 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middlewar | |
|
80
|
CVE-2026-46774 |
9.8 | 0.0052 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middlewar | |
|
80
|
CVE-2026-65884 |
10.0 | 0.0052 | NET NO AUTH LOW CX NO UI | Joomla Extension - balbooa.com - Privilege Escalation in Gridbox < 2.20.2 - The | |
|
80
|
CVE-2026-65887 |
10.0 | 0.0052 | NET NO AUTH LOW CX NO UI | Joomla Extension - balbooa.com - Unauthenticated arbitrary password reset in Gri | |
|
80
|
CVE-2026-65888 |
10.0 | 0.0052 | NET NO AUTH LOW CX NO UI | Joomla Extension - balbooa.com - Account takeover vulnerability in Gridbox < 2.2 | |
|
80
|
CVE-2026-103406 |
9.8 | 0.0052 | NET NO AUTH LOW CX NO UI | An Improper Neutralization of Special Elements used in an OS Command vulnerabili | |
|
79
|
CVE-2026-27843 |
9.2 | 0.0052 | NET NO AUTH LOW CX NO UI | A vulnerability exists in SenseLive X3050's web management interface that allows | |
|
79
|
CVE-2026-8980 |
9.3 | 0.0052 | NET NO AUTH LOW CX NO UI | The Mennekes Amtron series (firmware versions ≤ 5.22.3) is vulnerable to privile | |
|
78
|
CVE-2026-60027 |
8.7 | 0.0052 | NET NO AUTH LOW CX NO UI | Joomla Extension - themexpert.com - Unauthenticated path traversal / file read i | |
|
78
|
CVE-2026-19426 |
8.8 | 0.0052 | NET NO AUTH LOW CX NO UI | POS System developed by FitSoft has a Missing Authentication vulnerability. Unau | |
|
78
|
CVE-2026-6918 |
8.7 | 0.0052 | NET NO AUTH LOW CX NO UI | In Eclipse Open9J versions 0.21 to 0.58, a pre-authentication remote attacker ca | |
|
77
|
CVE-2026-70476 |
8.3 | 0.0052 | NET NO AUTH LOW CX NO UI | Flowise is a drag & drop user interface to build a customized large language mod | |
|
75
|
CVE-2026-55677 |
7.5 | 0.0052 | NET NO AUTH LOW CX NO UI | Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, Echo's router and static | |
|
75
|
CVE-2026-24173 |
7.5 | 0.0052 | NET NO AUTH LOW CX NO UI | NVIDIA Triton Inference Server contains a vulnerability where an attacker could | |
|
75
|
CVE-2026-24174 |
7.5 | 0.0052 | NET NO AUTH LOW CX NO UI | NVIDIA Triton Inference Server contains a vulnerability where an attacker could | |
|
75
|
CVE-2026-55380 |
7.5 | 0.0052 | NET NO AUTH LOW CX NO UI | Pillow is a Python imaging library. Prior to 12.3.0, PIL/GdImageFile.py GdImageF | |
|
75
|
CVE-2026-99081 |
7.5 | 0.0052 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: bnxt_en: fi | |
|
75
|
CVE-2026-15574 |
7.5 | 0.0052 | NET NO AUTH LOW CX NO UI | A flaw was found in the vllm-orchestrator-gateway component. The system's produc | |
|
75
|
CVE-2026-16376 |
7.5 | 0.0052 | NET NO AUTH LOW CX NO UI | Denial-of-service in the Graphics: WebGPU component. This vulnerability was fixe | |
|
75
|
CVE-2026-16409 |
7.5 | 0.0052 | NET NO AUTH LOW CX NO UI | Invalid pointer in the Security: PSM component. This vulnerability was fixed in | |
|
75
|
CVE-2026-47667 |
7.5 | 0.0052 | NET NO AUTH LOW CX NO UI | CImg Library is a C++ library for image processing. Prior to version 4.0.0 in `_ | |
|
70
|
CVE-2026-35268 |
9.9 | 0.0052 | NET LOW CX NO UI | Vulnerability in the Identity Manager product of Oracle Fusion Middleware (compo | |
|
69
|
CVE-2026-32998 |
9.4 | 0.0052 | NET LOW CX NO UI | This vulnerability in Veeam Service Provider Console allows for remote code exec | |
|
68
|
CVE-2026-17601 |
8.9 | 0.0052 | NET LOW CX NO UI | A user holding a permission to update privilege definitions could modify a wildc | |
|
68
|
CVE-2026-56053 |
8.8 | 0.0052 | NET LOW CX NO UI | Subscriber PHP Object Injection in EventPrime <= 4.3.4.1 versions. | |
|
68
|
CVE-2026-56055 |
8.8 | 0.0052 | NET LOW CX NO UI | Subscriber PHP Object Injection in RealHomes <= 4.5.3 versions. | |
|
68
|
CVE-2026-27060 |
8.8 | 0.0052 | NET LOW CX NO UI | Deserialization of Untrusted Data vulnerability in Repute Infosystems ARMember P | |
|
68
|
CVE-2026-27414 |
8.8 | 0.0052 | NET LOW CX NO UI | Contributor PHP Object Injection in Werkstatt <= 4.8.3 versions. | |
|
68
|
CVE-2026-56037 |
8.8 | 0.0052 | NET LOW CX NO UI | Deserialization of Untrusted Data vulnerability in Themify Themify Popup allows | |
|
68
|
CVE-2026-13696 |
8.8 | 0.0052 | NET LOW CX NO UI | Improper neutralization of special elements used in an LDAP query ('LDAP injecti | |
|
68
|
CVE-2026-57371 |
8.8 | 0.0052 | NET LOW CX NO UI | Deserialization of Untrusted Data vulnerability in denishua WPJAM Basic wpjam-ba | |
|
68
|
CVE-2026-55773 |
8.8 | 0.0052 | NET LOW CX NO UI | CedarJava is an open source Java implementation of the Cedar policy language, us | |
|
68
|
CVE-2026-71235 |
8.8 | 0.0052 | NET LOW CX NO UI | Magistrala's Rules Engine allows authenticated users to create rules with embedd | |
|
68
|
CVE-2026-71243 |
8.8 | 0.0052 | NET LOW CX NO UI | The backmeup npm package assembles shell command strings by directly concatenati | |
|
68
|
CVE-2026-32465 |
8.8 | 0.0052 | NET LOW CX NO UI | Customer PHP Object Injection in Essential Real Estate <= 5.3.3 versions. | |
|
68
|
CVE-2026-74012 |
8.8 | 0.0052 | NET LOW CX NO UI | Deserialization of Untrusted Data vulnerability in TaxoPress allows Object Injec | |
|
68
|
CVE-2026-16793 |
8.7 | 0.0052 | NET LOW CX NO UI | An improper neutralization of special elements used in an operating system comma | |
|
67
|
CVE-2026-19111 |
8.6 | 0.0052 | NET LOW CX NO UI | Insecure direct object reference in the mongodb_memory, elasticsearch_memory, an | |
|
67
|
CVE-2026-50338 |
8.2 | 0.0052 | NET NO UI | 1 PoC | Improper authentication in Azure Spring Apps allows an authorized attacker to el |
|
66
|
CVE-2025-58955 |
8.1 | 0.0052 | NET NO AUTH NO UI | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP | |
|
66
|
CVE-2025-59550 |
8.1 | 0.0052 | NET NO AUTH NO UI | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP | |
|
65
|
CVE-2026-6123 |
7.4 | 0.0052 | NET LOW CX NO UI | A vulnerability was found in Tenda F451 1.0.0.7. This affects the function fromA | |
|
64
|
CVE-2026-67199 |
7.1 | 0.0052 | NET LOW CX NO UI | Perspective 5.0.0 contains a denial of service vulnerability that allows remote | |
|
64
|
CVE-2026-105420 |
9.4 | 0.0052 | NET LOW CX NO UI | Wing FTP Server does not verify user's base folder. An attacker with admin privi | |
|
64
|
CVE-2026-33767 |
7.1 | 0.0052 | NET LOW CX NO UI | WWBN AVideo is an open source video platform. In versions up to and including 26 | |
|
62
|
CVE-2026-66917 |
8.6 | 0.0052 | NET LOW CX NO UI | Joomla Extension - joomgalleryfriends.net - Stored XSS in JoomGallery < 4.4.0 - | |
|
62
|
CVE-2024-56837 |
8.6 | 0.0052 | NET LOW CX NO UI | A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.1 | |
|
55
|
CVE-2026-54499 |
7.5 | 0.0052 | NET NO AUTH | Stanza is a Stanford NLP Python library for tokenization, sentence segmentation, |