Hunt List
12,276 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-55799 |
9.8 | 0.0122 | NET NO AUTH LOW CX NO UI | Remote Code Execution Vulnerability in GraalScriptEngineCreator in Apache Ranger | |
|
80
|
CVE-2026-76578 |
9.8 | 0.0121 | NET NO AUTH LOW CX NO UI | A flaw was found in FreeIPA. The self-managed OTP token ACI does not require aut | |
|
80
|
CVE-2026-8592 |
9.8 | 0.0120 | NET NO AUTH LOW CX NO UI | OS Command Injection vulnerability in the process_string action of Rapid7 Insigh | |
|
80
|
CVE-2026-8660 |
9.8 | 0.0120 | NET NO AUTH LOW CX NO UI | OS Command Injection vulnerability in the ping action of Rapid7 InsightConnect P | |
|
80
|
CVE-2026-8665 |
9.8 | 0.0120 | NET NO AUTH LOW CX NO UI | OS Command Injection vulnerability in the TR action of Rapid7 InsightConnect Tra | |
|
80
|
CVE-2026-8666 |
9.8 | 0.0120 | NET NO AUTH LOW CX NO UI | OS Command Injection vulnerability in the traceroute action of Rapid7 InsightCon | |
|
80
|
CVE-2026-110879 |
9.8 | 0.0120 | NET NO AUTH LOW CX NO UI | jackson-databind validates the outer class of a class-name type ID but accepts a | |
|
80
|
CVE-2026-97749 |
9.8 | 0.0120 | NET NO AUTH LOW CX NO UI | Double free in Microsoft Office Outlook allows an unauthorized attacker to execu | |
|
80
|
CVE-2025-63334 |
9.8 | 0.0118 | NET NO AUTH LOW CX NO UI | PocketVJ CP PocketVJ-CP-v3 pvj version 3.9.1 contains an unauthenticated remote | |
|
80
|
CVE-2025-50526 |
9.8 | 0.0118 | NET NO AUTH LOW CX NO UI | Netgear EX8000 V1.0.0.126 was discovered to contain a command injection vulnerab | |
|
80
|
CVE-2026-104252 |
9.8 | 0.0117 | NET NO AUTH LOW CX NO UI | Vitess is a database clustering system for horizontal scaling of MySQL. Prior to | |
|
79
|
CVE-2026-55450 |
9.3 | 0.0119 | NET NO AUTH LOW CX NO UI | Langflow is a tool for building and deploying AI-powered agents and workflows. P | |
|
79
|
CVE-2026-52715 |
9.3 | 0.0119 | NET NO AUTH LOW CX NO UI | Unauthenticated SQL Injection in GEO my WordPress <= 4.5.5 versions. | |
|
75
|
CVE-2026-96958 |
7.5 | 0.0120 | NET NO AUTH LOW CX NO UI | Inefficient algorithmic complexity in .NET allows an unauthorized attacker to de | |
|
75
|
CVE-2026-96960 |
7.5 | 0.0120 | NET NO AUTH LOW CX NO UI | Asymmetric resource consumption (amplification) in .NET allows an unauthorized a | |
|
75
|
CVE-2026-56170 |
7.5 | 0.0117 | NET NO AUTH LOW CX NO UI | Allocation of resources without limits or throttling in ASP.NET Core allows an u | |
|
75
|
CVE-2026-57108 |
7.5 | 0.0117 | NET NO AUTH LOW CX NO UI | Access of resource using incompatible type ('type confusion') in .NET Core allow | |
|
75
|
CVE-2026-47302 |
7.5 | 0.0117 | NET NO AUTH LOW CX NO UI | Allocation of resources without limits or throttling in .NET allows an unauthori | |
|
75
|
CVE-2026-50525 |
7.5 | 0.0117 | NET NO AUTH LOW CX NO UI | Allocation of resources without limits or throttling in .NET allows an unauthori | |
|
75
|
CVE-2026-50527 |
7.5 | 0.0117 | NET NO AUTH LOW CX NO UI | Stack-based buffer overflow in .NET Framework allows an unauthorized attacker to | |
|
75
|
CVE-2026-50648 |
7.5 | 0.0117 | NET NO AUTH LOW CX NO UI | Allocation of resources without limits or throttling in .NET Framework allows an | |
|
75
|
CVE-2026-50651 |
7.5 | 0.0117 | NET NO AUTH LOW CX NO UI | Allocation of resources without limits or throttling in .NET allows an unauthori | |
|
75
|
CVE-2026-65681 |
7.5 | 0.0117 | NET NO AUTH LOW CX NO UI | Null pointer dereference in Windows iSCSI Target Service allows an unauthorized | |
|
75
|
CVE-2026-40378 |
7.5 | 0.0117 | NET NO AUTH LOW CX NO UI | Memory allocation with excessive size value in Windows Local Security Authority | |
|
75
|
CVE-2026-45646 |
7.5 | 0.0117 | NET NO AUTH LOW CX NO UI | Allocation of resources without limits or throttling in ASP.NET Core allows an u | |
|
75
|
CVE-2026-49787 |
7.5 | 0.0117 | NET NO AUTH LOW CX NO UI | Allocation of resources without limits or throttling in Windows HTTP.sys allows | |
|
75
|
CVE-2026-49788 |
7.5 | 0.0117 | NET NO AUTH LOW CX NO UI | Allocation of resources without limits or throttling in HTTP/2 allows an unautho | |
|
75
|
CVE-2026-50304 |
7.5 | 0.0117 | NET NO AUTH LOW CX NO UI | Stack-based buffer overflow in Active Directory Federation Services allows an un | |
|
75
|
CVE-2026-50355 |
7.5 | 0.0117 | NET NO AUTH LOW CX NO UI | Stack-based buffer overflow in Active Directory Federation Services allows an un | |
|
75
|
CVE-2026-50368 |
7.5 | 0.0117 | NET NO AUTH LOW CX NO UI | Stack-based buffer overflow in Active Directory Federation Services allows an un | |
|
75
|
CVE-2026-50411 |
7.5 | 0.0117 | NET NO AUTH LOW CX NO UI | Stack-based buffer overflow in Active Directory Federation Services (AD FS) allo | |
|
75
|
CVE-2026-50424 |
7.5 | 0.0117 | NET NO AUTH LOW CX NO UI | Untrusted pointer dereference in Windows Domain Controller allows an unauthorize | |
|
75
|
CVE-2026-50496 |
7.5 | 0.0117 | NET NO AUTH LOW CX NO UI | Out-of-bounds read in Windows Network Policy Server SNMP allows an unauthorized | |
|
75
|
CVE-2026-50506 |
7.5 | 0.0117 | NET NO AUTH LOW CX NO UI | Allocation of resources without limits or throttling in ASP.NET Core allows an u | |
|
75
|
CVE-2026-50647 |
7.5 | 0.0117 | NET NO AUTH LOW CX NO UI | Loop with unreachable exit condition ('infinite loop') in Active Directory Feder | |
|
70
|
CVE-2026-42898 |
9.9 | 0.0119 | NET LOW CX NO UI | Improper control of generation of code ('code injection') in Microsoft Dynamics | |
|
68
|
CVE-2024-58312 |
8.7 | 0.0120 | NET LOW CX NO UI | xbtitFM 4.1.18 contains a path traversal vulnerability that allows unauthenticat | |
|
68
|
CVE-2026-67195 |
8.7 | 0.0119 | NET LOW CX NO UI | Perspective 5.0.0 contains a remote code execution vulnerability that allows una | |
|
68
|
CVE-2026-103403 |
8.8 | 0.0118 | NET LOW CX NO UI | An Improper Neutralization of Special Elements used in an OS Command ('OS Comman | |
|
68
|
CVE-2026-106079 |
8.8 | 0.0118 | NET LOW CX NO UI | An Improper Neutralization of Special Elements used in an OS Command ('OS Comman | |
|
67
|
CVE-2026-75779 |
8.6 | 0.0120 | NET NO AUTH LOW CX | Improper Neutralization of Special Elements used in an OS Command (“OS Command I | |
|
66
|
CVE-2026-93479 |
8.1 | 0.0120 | NET NO AUTH NO UI | A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive | |
|
64
|
CVE-2026-3183 |
7.1 | 0.0121 | NET LOW CX NO UI | Zohocorp ManageEngine ADSelfService Plus versions before 6524 are vulnerable to | |
|
64
|
CVE-2026-22599 |
9.3 | 0.0118 | NET LOW CX NO UI | Strapi is an open source headless content management system. In versions on the | |
|
63
|
CVE-2026-71471 |
9.0 | 0.0122 | NET LOW CX NO UI | A flaw was found in acm-search-v2-rhel9. An attacker with administrative privile | |
|
62
|
CVE-2026-21719 |
8.6 | 0.0120 | NET LOW CX NO UI | An OS command injection vulnerability exists in CubeCart prior to 6.6.0, which m | |
|
62
|
CVE-2026-61523 |
8.6 | 0.0119 | NET LOW CX NO UI | WebsiteBaker CMS before 2.13.10 contains a code injection vulnerability in the D | |
|
60
|
CVE-2026-24506 |
7.2 | 0.0119 | NET LOW CX NO UI | Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2025 release ver | |
|
60
|
CVE-2026-26943 |
7.2 | 0.0119 | NET LOW CX NO UI | Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2025 release ver | |
|
60
|
CVE-2026-3120 |
7.2 | 0.0118 | NET LOW CX NO UI | Improper Control of Generation of Code ('Code Injection') vulnerability in Profe |