Hunt List
12,263 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2025-29229 |
9.8 | 0.0127 | NET NO AUTH LOW CX NO UI | linksys E5600 V1.1.0.26 is vulnerable to command injection in the function ddnsS | |
|
80
|
CVE-2026-48276 |
10.0 | 0.0126 | NET NO AUTH LOW CX NO UI | ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Unrestricted | |
|
80
|
CVE-2026-48283 |
10.0 | 0.0126 | NET NO AUTH LOW CX NO UI | ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Unrestricted | |
|
80
|
CVE-2026-44416 |
9.8 | 0.0124 | NET NO AUTH LOW CX NO UI | Remote Code Execution via Arbitrary Class Instantiation in plugin-schema-registr | |
|
80
|
CVE-2026-42779 |
9.8 | 0.0123 | NET NO AUTH LOW CX NO UI | The fix for CVE-2026-41635 was not applied to the 2.1.X and 2.2.X branches. Here | |
|
80
|
CVE-2026-88131 |
9.8 | 0.0123 | NET NO AUTH LOW CX NO UI | Deserialization of untrusted data in Microsoft Dataverse allows an unauthorized | |
|
80
|
CVE-2026-55799 |
9.8 | 0.0122 | NET NO AUTH LOW CX NO UI | Remote Code Execution Vulnerability in GraalScriptEngineCreator in Apache Ranger | |
|
79
|
CVE-2026-70553 |
9.3 | 0.0127 | NET NO AUTH LOW CX NO UI | MaxSite CMS contains a remote code execution vulnerability that allows unauthent | |
|
79
|
CVE-2026-73519 |
9.3 | 0.0124 | NET NO AUTH LOW CX NO UI | WolfStack before 25.9.2 contains a hard-coded cluster-authentication secret comp | |
|
79
|
CVE-2026-41926 |
9.3 | 0.0123 | NET NO AUTH LOW CX NO UI | WDR201A WiFi Extender (HW V2.1, FW LFMZX28040922V1.02) contains an OS command in | |
|
79
|
CVE-2026-70554 |
9.3 | 0.0123 | NET NO AUTH LOW CX NO UI | MaxSite CMS contains a PHP object injection vulnerability that allows unauthenti | |
|
78
|
CVE-2026-6043 |
8.8 | 0.0126 | NET NO AUTH LOW CX NO UI | P4 Server versions prior to 2026.1 are configured with insecure default settings | |
|
78
|
CVE-2026-43515 |
9.1 | 0.0122 | NET NO AUTH LOW CX NO UI | Improper Authorization vulnerability when multiple method constraints define an | |
|
77
|
CVE-2026-3324 |
8.2 | 0.0126 | NET NO AUTH LOW CX NO UI | Zohocorp ManageEngine Log360 versions 13000 through 13013 are vulnerable to auth | |
|
75
|
CVE-2026-70133 |
7.5 | 0.0127 | NET NO AUTH LOW CX NO UI | Allocation of resources without limits or throttling in Windows SMB Server allow | |
|
75
|
CVE-2026-83795 |
7.5 | 0.0127 | NET NO AUTH LOW CX NO UI | Heap-based buffer overflow in Windows IKE Extension allows an unauthorized attac | |
|
75
|
CVE-2026-83843 |
7.5 | 0.0127 | NET NO AUTH LOW CX NO UI | Out-of-bounds read in Windows Internet Key Exchange (IKE) Protocol allows an una | |
|
75
|
CVE-2026-102192 |
7.5 | 0.0127 | NET NO AUTH LOW CX NO UI | Integer underflow (wrap or wraparound) in Windows Failover Cluster allows an una | |
|
75
|
CVE-2026-70031 |
7.5 | 0.0127 | NET NO AUTH LOW CX NO UI | Heap-based buffer overflow in Windows iSCSI allows an unauthorized attacker to d | |
|
75
|
CVE-2026-70033 |
7.5 | 0.0127 | NET NO AUTH LOW CX NO UI | Missing release of memory after effective lifetime in Remote Desktop Gateway Ser | |
|
75
|
CVE-2026-70079 |
7.5 | 0.0127 | NET NO AUTH LOW CX NO UI | Improper enforcement of behavioral workflow in Windows DNS allows an unauthorize | |
|
75
|
CVE-2026-83860 |
7.5 | 0.0127 | NET NO AUTH LOW CX NO UI | Stack-based buffer overflow in Windows GDI allows an unauthorized attacker to de | |
|
75
|
CVE-2026-83647 |
7.5 | 0.0127 | NET NO AUTH LOW CX NO UI | Out-of-bounds read in Active Directory Domain Services allows an unauthorized at | |
|
75
|
CVE-2022-44566 |
7.5 | 0.0126 | NET NO AUTH LOW CX NO UI | A denial of service vulnerability present in ActiveRecord's PostgreSQL adapter < | |
|
75
|
CVE-2026-43661 |
7.5 | 0.0126 | NET NO AUTH LOW CX NO UI | A buffer overflow issue was addressed with improved memory handling. This issue | |
|
75
|
CVE-2026-50330 |
7.5 | 0.0125 | NET NO AUTH LOW CX NO UI | Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attac | |
|
75
|
CVE-2026-58280 |
7.5 | 0.0125 | NET NO AUTH LOW CX NO UI | Uncontrolled recursion in .NET allows an unauthorized attacker to deny service o | |
|
75
|
CVE-2026-69651 |
7.5 | 0.0125 | NET NO AUTH LOW CX NO UI | Inefficient algorithmic complexity in .NET allows an unauthorized attacker to de | |
|
75
|
CVE-2026-50524 |
7.5 | 0.0123 | NET NO AUTH LOW CX NO UI | Improper validation of specified type of input in .NET Framework allows an unaut | |
|
75
|
CVE-2026-62901 |
7.5 | 0.0123 | NET NO AUTH LOW CX NO UI | Unchecked input for loop condition in .NET allows an unauthorized attacker to de | |
|
75
|
CVE-2026-50328 |
7.5 | 0.0123 | NET NO AUTH LOW CX NO UI | Uncaught exception in Windows Server Update Service allows an unauthorized attac | |
|
75
|
CVE-2026-70159 |
7.5 | 0.0123 | NET NO AUTH LOW CX NO UI | Allocation of resources without limits or throttling in ASP.NET Core allows an u | |
|
75
|
CVE-2026-70181 |
7.5 | 0.0123 | NET NO AUTH LOW CX NO UI | Allocation of resources without limits or throttling in ASP.NET Core allows an u | |
|
75
|
CVE-2026-70163 |
7.5 | 0.0123 | NET NO AUTH LOW CX NO UI | Allocation of resources without limits or throttling in OpenSSH for Windows allo | |
|
75
|
CVE-2026-83645 |
7.5 | 0.0122 | NET NO AUTH LOW CX NO UI | Allocation of resources without limits or throttling in Active Directory Federat | |
|
75
|
CVE-2026-9181 |
7.5 | 0.0122 | NET NO AUTH LOW CX NO UI | Esri ArcGIS Server contains a directory traversal vulnerability. ArcGIS Enterpri | |
|
69
|
CVE-2026-1115 |
9.6 | 0.0126 | NET NO AUTH LOW CX | A Stored Cross-Site Scripting (XSS) vulnerability was identified in the social f | |
|
68
|
CVE-2026-35018 |
8.7 | 0.0127 | NET LOW CX NO UI | NetComm NF20MESH routers running firmware R6B031 and earlier contain an authenti | |
|
68
|
CVE-2026-102217 |
8.8 | 0.0126 | NET LOW CX NO UI | Improper resolution of path equivalence in WebDAV allows an authorized attacker | |
|
68
|
CVE-2026-43715 |
8.8 | 0.0126 | NET NO AUTH LOW CX | A use-after-free issue was addressed with improved memory management. This issue | |
|
68
|
CVE-2026-116748 |
8.7 | 0.0125 | NET NO AUTH LOW CX | Transmission 4.0.0 before 4.1.3 contains a permissive CORS vulnerability in hand | |
|
68
|
CVE-2026-41876 |
8.7 | 0.0123 | NET LOW CX NO UI | R-SOFT DMS is vulnerable to OS Command Injection in konwertujAction() function. | |
|
68
|
CVE-2026-44871 |
8.8 | 0.0123 | NET LOW CX NO UI | Command injection vulnerabilities exist in the command line interface (CLI) serv | |
|
64
|
CVE-2026-3183 |
7.1 | 0.0121 | NET LOW CX NO UI | Zohocorp ManageEngine ADSelfService Plus versions before 6524 are vulnerable to | |
|
63
|
CVE-2026-71471 |
9.0 | 0.0122 | NET LOW CX NO UI | A flaw was found in acm-search-v2-rhel9. An attacker with administrative privile | |
|
62
|
CVE-2026-23698 |
8.6 | 0.0123 | NET LOW CX NO UI | Vtiger CRM through 8.4.0 contains an authenticated remote code execution vulnera | |
|
60
|
CVE-2026-95708 |
7.2 | 0.0126 | NET LOW CX NO UI | Command injection vulnerabilities exist in the affected interface of AOS-10 that | |
|
60
|
CVE-2026-95709 |
7.2 | 0.0126 | NET LOW CX NO UI | Command injection vulnerabilities exist in the affected interface of AOS-10 that | |
|
58
|
CVE-2026-14371 |
8.8 | 0.0123 | NET LOW CX | The Lenovo XClarity Integrator for Windows Admin Center plugin version 5.1.1 and | |
|
57
|
CVE-2026-11565 |
8.5 | 0.0125 | NET NO UI | The Advanced File Manager WordPress plugin before 5.4.13 does not perform capab |