Hunt List
12,379 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
90
|
CVE-2026-53921 |
9.8 | 0.0112 | NET NO AUTH LOW CX NO UI | 2 PoC | odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. P |
|
80
|
CVE-2026-52680 |
9.8 | 0.0111 | NET NO AUTH LOW CX NO UI | Apache Kyuubi REST batch multipart upload handling uses the client-supplied mult | |
|
80
|
CVE-2026-22738 |
9.8 | 0.0111 | NET NO AUTH LOW CX NO UI | In Spring AI, a SpEL injection vulnerability exists in SimpleVectorStore when a | |
|
80
|
CVE-2026-41252 |
9.8 | 0.0111 | NET NO AUTH LOW CX NO UI | xrdp is an open source RDP server. Versions 0.10.6 and prior contain a missing b | |
|
80
|
CVE-2026-100202 |
9.8 | 0.0111 | NET NO AUTH LOW CX NO UI | Use after free in Windows Message Queuing Queue Manager allows an unauthorized a | |
|
80
|
CVE-2026-100219 |
9.8 | 0.0111 | NET NO AUTH LOW CX NO UI | Use after free in Microsoft QUIC allows an unauthorized attacker to execute code | |
|
80
|
CVE-2026-83693 |
9.8 | 0.0110 | NET NO AUTH LOW CX NO UI | Heap-based buffer overflow in Windows Error Reporting allows an unauthorized att | |
|
80
|
CVE-2026-97814 |
9.8 | 0.0109 | NET NO AUTH LOW CX NO UI | Heap-based buffer overflow in Windows Text Shaping allows an unauthorized attack | |
|
80
|
CVE-2026-70096 |
9.8 | 0.0109 | NET NO AUTH LOW CX NO UI | Heap-based buffer overflow in Windows Rich Text Edit Control allows an unauthori | |
|
80
|
CVE-2026-44024 |
9.8 | 0.0109 | NET NO AUTH LOW CX NO UI | Fluentd collects events from various data sources and writes them to files, RDBM | |
|
80
|
CVE-2026-83780 |
9.8 | 0.0108 | NET NO AUTH LOW CX NO UI | Use after free in Windows CCFFilter Driver allows an unauthorized attacker to ex | |
|
80
|
CVE-2026-49819 |
9.8 | 0.0108 | NET NO AUTH LOW CX NO UI | UpSnap is a wake on lan web app. Versions 4.4.1 through 5.3.5 are vulnerable to | |
|
79
|
CVE-2026-63767 |
9.3 | 0.0112 | NET NO AUTH LOW CX NO UI | ktransformers through 0.6.3, fixed in commit def0f93, contains an unauthenticate | |
|
79
|
CVE-2026-41939 |
9.3 | 0.0110 | NET NO AUTH LOW CX NO UI | Care Everywhere Gateway 14.3.10 contains a hard-coded credentials vulnerability | |
|
79
|
CVE-2026-18588 |
9.3 | 0.0110 | NET NO AUTH LOW CX NO UI | A vulnerability has been found in Wavlink WL-NU516U1 708c073-mt7628. This affect | |
|
79
|
CVE-2026-75784 |
9.3 | 0.0110 | NET NO AUTH LOW CX NO UI | A vulnerability was detected in TRENDnet TEW-WLC100 1v2.07b01. Affected by this | |
|
78
|
CVE-2014-125133 |
8.7 | 0.0112 | NET NO AUTH LOW CX NO UI | NativeChurch theme for WordPress before 1.6.2 contains a path traversal vulnerab | |
|
78
|
CVE-2026-66050 |
8.7 | 0.0112 | NET NO AUTH LOW CX NO UI | NitroShare Desktop through 0.3.4 contains a path traversal vulnerability in its | |
|
78
|
CVE-2026-24301 |
8.8 | 0.0111 | NET NO AUTH LOW CX | 1 PoC | Improper neutralization of special elements used in a command ('command injectio |
|
78
|
CVE-2026-69111 |
8.7 | 0.0110 | NET NO AUTH LOW CX NO UI | Milvus through 2.6.22 and 3.0.0 contains an unauthenticated denial of service vu | |
|
78
|
CVE-2026-15701 |
8.9 | 0.0110 | NET NO AUTH LOW CX NO UI | A weakness has been identified in Totolink NR1800X 9.1.0u.6279_B20210910. Affect | |
|
78
|
CVE-2026-18589 |
8.9 | 0.0110 | NET NO AUTH LOW CX NO UI | A vulnerability was found in Wavlink WL-NU516U1 708c073-mt7628. This impacts the | |
|
78
|
CVE-2026-58662 |
8.7 | 0.0108 | NET NO AUTH LOW CX NO UI | Improper Validation of Specified Quantity in Input, Out-of-bounds Read vulnerabi | |
|
77
|
CVE-2026-20224 |
8.6 | 0.0109 | NET NO AUTH LOW CX NO UI | A vulnerability in the web UI of Cisco Catalyst SD-WAN Manager, formerly SD-WAN | |
|
75
|
CVE-2026-87716 |
7.5 | 0.0112 | NET NO AUTH LOW CX NO UI | Heap-based buffer overflow in Windows Storage Spaces Controller allows an unauth | |
|
75
|
CVE-2026-96248 |
7.5 | 0.0112 | NET NO AUTH LOW CX NO UI | Stack-based buffer overflow in Windows Host Guardian Service allows an unauthori | |
|
75
|
CVE-2026-70281 |
7.5 | 0.0112 | NET NO AUTH LOW CX NO UI | Out-of-bounds read in Microsoft Office Outlook allows an unauthorized attacker t | |
|
75
|
CVE-2026-43668 |
7.5 | 0.0112 | NET NO AUTH LOW CX NO UI | A use after free issue was addressed with improved memory management. This issue | |
|
75
|
CVE-2026-103569 |
7.5 | 0.0111 | NET NO AUTH LOW CX NO UI | Out-of-bounds read in Windows IKE Extension allows an unauthorized attacker to d | |
|
75
|
CVE-2026-83677 |
7.5 | 0.0110 | NET NO AUTH LOW CX NO UI | Missing release of memory after effective lifetime in Windows DHCP Client allows | |
|
75
|
CVE-2026-69454 |
7.5 | 0.0109 | NET NO AUTH LOW CX NO UI | Out-of-bounds read in Microsoft Azure Attestation service and Device Health Atte | |
|
75
|
CVE-2026-96236 |
7.5 | 0.0109 | NET NO AUTH LOW CX NO UI | Allocation of resources without limits or throttling in ASP.NET Core allows an u | |
|
75
|
CVE-2026-54130 |
7.5 | 0.0108 | NET NO AUTH LOW CX NO UI | Missing authentication for critical function in M365 Copilot allows an unauthori | |
|
75
|
CVE-2026-85319 |
7.5 | 0.0108 | NET NO AUTH LOW CX NO UI | Allocation of resources without limits or throttling in Active Directory Federat | |
|
69
|
CVE-2026-69264 |
9.4 | 0.0111 | NET LOW CX NO UI | Prior to 3.1.3, Flowise CSVAgent interpolates an attacker-controlled segment of | |
|
68
|
CVE-2026-65608 |
8.7 | 0.0112 | NET LOW CX NO UI | Grav versions >= 1.7.0 and before 2.0.9 contain a remote code execution vulnerab | |
|
68
|
CVE-2023-30898 |
8.8 | 0.0111 | NET LOW CX NO UI | A vulnerability has been identified in Siveillance Video 2020 R2 (All versions < | |
|
68
|
CVE-2023-30899 |
8.8 | 0.0111 | NET LOW CX NO UI | A vulnerability has been identified in Siveillance Video 2020 R2 (All versions < | |
|
68
|
CVE-2026-118477 |
8.7 | 0.0111 | NET LOW CX NO UI | The ei_git_repo_url parameter in the Git remote configuration endpoint of KaliFa | |
|
68
|
CVE-2026-73601 |
9.0 | 0.0110 | NET LOW CX NO UI | Flowise versions before 3.1.3 contain a remote code execution vulnerability in t | |
|
68
|
CVE-2026-83784 |
8.8 | 0.0108 | NET LOW CX NO UI | Absolute path traversal in Windows Encrypting File System (EFS) allows an author | |
|
66
|
CVE-2026-56186 |
8.1 | 0.0111 | NET LOW CX NO UI | Out-of-bounds read in Windows Schannel allows an authorized attacker to disclose | |
|
66
|
CVE-2026-86409 |
8.1 | 0.0110 | NET NO AUTH NO UI | Setting `CURLOPT_AWS_SIGV4` to NULL but does not disable SigV4 authentication, c | |
|
66
|
CVE-2026-19942 |
8.1 | 0.0108 | NET LOW CX NO UI | The Atarim – AI Agency for WordPress: Edit Pages, Fix Code, Update Plugins, SEO | |
|
66
|
CVE-2026-49972 |
7.7 | 0.0108 | NET LOW CX NO UI | Laravel-Mediable before 7.0.0 contains a file upload vulnerability that allows u | |
|
62
|
CVE-2026-22100 |
8.6 | 0.0110 | NET LOW CX NO UI | The OCPP DataTransfer message `ReserveLogin` is vulnerable to command injection. | |
|
60
|
CVE-2026-33924 |
7.5 | 0.0111 | NET LOW CX NO UI | Two OS command injection vulnerabilities were discovered in the update installat | |
|
60
|
CVE-2026-12357 |
7.2 | 0.0109 | NET LOW CX NO UI | Heimdall Data Database Proxy generateFileContent CRLF Injection Remote Code Exec | |
|
60
|
CVE-2026-15686 |
7.2 | 0.0109 | NET LOW CX NO UI | Adminer multi_query Incorrect Check of Function Return Value Remote Code Executi | |
|
55
|
CVE-2026-72579 |
7.5 | 0.0110 | NET NO AUTH | An OS command injection vulnerability in NASA HyperCP (main branch) allows a net |