Hunt List
12,406 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
90
|
CVE-2026-107092 |
9.8 | 0.0104 | NET NO AUTH LOW CX NO UI | 1 PoC | NexoPOS v6.2.4 is vulnerable to Directory Traversal via the api/update endpoint. |
|
80
|
CVE-2026-51947 |
9.8 | 0.0107 | NET NO AUTH LOW CX NO UI | An issue in Pivotal CRM 6.6.4.08 and systems using patch-ghi-15381-cwe-502-20251 | |
|
80
|
CVE-2026-70147 |
9.8 | 0.0107 | NET NO AUTH LOW CX NO UI | Heap-based buffer overflow in Microsoft PostScript Printer Driver allows an unau | |
|
80
|
CVE-2026-70153 |
9.8 | 0.0107 | NET NO AUTH LOW CX NO UI | Heap-based buffer overflow in Microsoft PostScript Printer Driver allows an unau | |
|
80
|
CVE-2026-83578 |
9.8 | 0.0106 | NET NO AUTH LOW CX NO UI | Integer underflow (wrap or wraparound) in Windows PowerShell allows an unauthori | |
|
80
|
CVE-2026-70157 |
9.8 | 0.0106 | NET NO AUTH LOW CX NO UI | Heap-based buffer overflow in Windows System Information Console allows an unaut | |
|
80
|
CVE-2026-100222 |
9.8 | 0.0106 | NET NO AUTH LOW CX NO UI | Heap-based buffer overflow in Network Policy Server (NPS) allows an unauthorized | |
|
80
|
CVE-2026-83517 |
9.8 | 0.0106 | NET NO AUTH LOW CX NO UI | Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unaut | |
|
80
|
CVE-2026-83519 |
9.8 | 0.0106 | NET NO AUTH LOW CX NO UI | Heap-based buffer overflow in Windows Error Reporting allows an unauthorized att | |
|
80
|
CVE-2026-83910 |
9.8 | 0.0106 | NET NO AUTH LOW CX NO UI | Out-of-bounds write in RPC Runtime allows an unauthorized attacker to execute co | |
|
80
|
CVE-2026-97805 |
9.8 | 0.0106 | NET NO AUTH LOW CX NO UI | Out-of-bounds read in Windows Partition Management Driver allows an unauthorized | |
|
80
|
CVE-2026-65770 |
10.0 | 0.0105 | NET NO AUTH LOW CX NO UI | Improper neutralization of argument delimiters in a command ('argument injection | |
|
80
|
CVE-2026-96320 |
9.8 | 0.0105 | NET NO AUTH LOW CX NO UI | Heap-based buffer overflow in Windows DHCP Server allows an unauthorized attacke | |
|
80
|
CVE-2026-82119 |
9.8 | 0.0105 | NET NO AUTH LOW CX NO UI | OS Command Injection Vulnerability in HiRDB. This issue affects HiRDB Server V | |
|
80
|
CVE-2026-73240 |
9.8 | 0.0104 | NET NO AUTH LOW CX NO UI | Specifically crafted inputs may lead to git argument injection in Apache Allura. | |
|
80
|
CVE-2026-38450 |
9.8 | 0.0104 | NET NO AUTH LOW CX NO UI | An issue in Aetopia Digital Asset Management DAM v.1.0.0 allows a remote attacke | |
|
80
|
CVE-2026-47208 |
10.0 | 0.0104 | NET NO AUTH LOW CX NO UI | vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, VM2 suffe | |
|
80
|
CVE-2026-48330 |
10.0 | 0.0104 | NET NO AUTH LOW CX NO UI | Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Specia | |
|
79
|
CVE-2026-71957 |
9.3 | 0.0107 | NET NO AUTH LOW CX NO UI | D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2_C1_2 | |
|
79
|
CVE-2026-71958 |
9.3 | 0.0107 | NET NO AUTH LOW CX NO UI | D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2_C1_2 | |
|
79
|
CVE-2026-65761 |
9.3 | 0.0104 | NET NO AUTH LOW CX NO UI | Joomla Extension - joomshaper.com - Unauthenticated SQL injection in Easy Store | |
|
79
|
CVE-2026-12046 |
9.5 | 0.0104 | NET NO AUTH LOW CX NO UI | Two state-mutating endpoints in pgAdmin 4's SQL Editor blueprint -- DELETE /sqle | |
|
78
|
CVE-2026-33598 |
9.1 | 0.0107 | NET NO AUTH LOW CX NO UI | A cached crafted response can cause an out-of-bounds read if custom Lua code cal | |
|
78
|
CVE-2026-14261 |
9.1 | 0.0103 | NET NO AUTH LOW CX NO UI | A vulnerability in the Xerte Online Tools allows for authentication bypass and r | |
|
77
|
CVE-2026-50429 |
8.2 | 0.0107 | NET NO AUTH LOW CX NO UI | Out-of-bounds read in Windows Kernel allows an unauthorized attacker to disclose | |
|
75
|
CVE-2026-97830 |
7.5 | 0.0107 | NET NO AUTH LOW CX NO UI | Double free in Windows Internet Information Services allows an unauthorized atta | |
|
75
|
CVE-2026-69577 |
7.5 | 0.0107 | NET NO AUTH LOW CX NO UI | Out-of-bounds read in Microsoft Azure Attestation service and Device Health Atte | |
|
75
|
CVE-2026-83670 |
7.5 | 0.0107 | NET NO AUTH LOW CX NO UI | Out-of-bounds read in Function Discovery Service (fdwsd.dll) allows an unauthori | |
|
75
|
CVE-2026-26154 |
7.5 | 0.0106 | NET NO AUTH LOW CX NO UI | Improper input validation in Windows Server Update Service allows an unauthorize | |
|
75
|
CVE-2026-78002 |
7.5 | 0.0106 | NET NO AUTH LOW CX NO UI | A flaw was found in rsyslog. An unauthenticated remote attacker can trigger a he | |
|
75
|
CVE-2026-32071 |
7.5 | 0.0106 | NET NO AUTH LOW CX NO UI | Null pointer dereference in Windows Local Security Authority Subsystem Service ( | |
|
75
|
CVE-2026-96325 |
7.5 | 0.0105 | NET NO AUTH LOW CX NO UI | Missing reference to active allocated resource in Windows SMB Server allows an u | |
|
75
|
CVE-2026-96945 |
7.5 | 0.0105 | NET NO AUTH LOW CX NO UI | Uncaught exception in Windows Failover Cluster allows an unauthorized attacker t | |
|
75
|
CVE-2026-0265 |
7.2 | 0.0105 | NET NO AUTH LOW CX NO UI | An authentication bypass vulnerability in Palo Alto Networks PAN-OS® software en | |
|
75
|
CVE-2023-22799 |
7.5 | 0.0105 | NET NO AUTH LOW CX NO UI | A ReDoS based DoS vulnerability in the GlobalID <1.0.1 which could allow an atta | |
|
68
|
CVE-2026-70266 |
8.8 | 0.0108 | NET LOW CX NO UI | Improper neutralization of special elements used in an sql command ('sql injecti | |
|
68
|
CVE-2026-83889 |
8.8 | 0.0106 | NET LOW CX NO UI | Release of invalid pointer or reference in DNS Server allows an authorized attac | |
|
68
|
CVE-2023-47534 |
8.8 | 0.0105 | NET NO AUTH LOW CX | A improper neutralization of formula elements in a csv file vulnerability in For | |
|
68
|
CVE-2026-102226 |
8.8 | 0.0104 | NET LOW CX NO UI | Improper limitation of a pathname to a restricted directory ('path traversal') i | |
|
68
|
CVE-2026-105727 |
8.8 | 0.0104 | NET LOW CX NO UI | Improper limitation of a pathname to a restricted directory ('path traversal') i | |
|
68
|
CVE-2025-34181 |
8.7 | 0.0104 | NET LOW CX NO UI | NetSupport Manager < 14.12.0001 contains an arbitrary file write vulnerability i | |
|
67
|
CVE-2026-67623 |
8.6 | 0.0106 | NET NO AUTH LOW CX | Mistral Vibe before 2.23.3 contains a remote code execution vulnerability that a | |
|
66
|
CVE-2026-92387 |
8.1 | 0.0104 | NET NO AUTH NO UI | By permanently omitting the final control-response line, a malicious FTP, IMAP, | |
|
66
|
CVE-2026-70229 |
8.1 | 0.0104 | NET NO AUTH NO UI | Incorrect authorization in Active Directory Domain Services allows an unauthoriz | |
|
65
|
CVE-2026-66321 |
7.4 | 0.0107 | NET NO AUTH LOW CX | Access of resource using incompatible type ('type confusion') in Microsoft Edge | |
|
65
|
CVE-2026-57991 |
7.4 | 0.0104 | NET NO AUTH LOW CX | Improper link resolution before file access ('link following') in Microsoft Edge | |
|
64
|
CVE-2026-42010 |
7.1 | 0.0105 | NET LOW CX NO UI | A flaw was found in gnutls. Servers configured with RSA-PSK (Rivest–Shamir–Adlem | |
|
64
|
CVE-2026-58529 |
7.1 | 0.0104 | NET LOW CX NO UI | Out-of-bounds read in Active Directory Federation Services (AD FS) allows an aut | |
|
63
|
CVE-2026-33568 |
9.1 | 0.0104 | NET LOW CX NO UI | A OS command injection vulnerability exists in the boa formMapDelDevice macstr f | |
|
63
|
CVE-2026-40627 |
9.1 | 0.0104 | NET LOW CX NO UI | An os command injection vulnerability exists in the boa formWsc targetAPSsid fun |