Hunt List
12,713 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
90
|
CVE-2026-105192 |
9.8 | 0.0102 | NET NO AUTH LOW CX NO UI | 1 PoC | LMCache multiprocess mode, also called distributed mode, opens an unauthenticate |
|
80
|
CVE-2026-28323 |
9.8 | 0.0103 | NET NO AUTH LOW CX NO UI | SolarWinds Web Help Desk is found to be affected by a SAML authentication bypass | |
|
80
|
CVE-2026-24227 |
9.8 | 0.0102 | NET NO AUTH LOW CX NO UI | NVIDIA TensorRT for contains a vulnerability where a user might cause a deserial | |
|
80
|
CVE-2026-76008 |
10.0 | 0.0102 | NET NO AUTH LOW CX NO UI | A flaw has been found in Comfast CF-N1-S 2.6.0.1. This affects the function get_ | |
|
80
|
CVE-2026-14522 |
9.8 | 0.0102 | NET NO AUTH LOW CX NO UI | IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0. | |
|
79
|
CVE-2026-41315 |
9.3 | 0.0103 | NET NO AUTH LOW CX NO UI | mdserver-web is a simple Linux panel. From 0.18.0 to 0.18.4, mdserver-web has a | |
|
79
|
CVE-2026-67192 |
9.2 | 0.0103 | NET NO AUTH LOW CX NO UI | Xlight FTP Server before 3.9.5 contains a pre-authentication stack buffer overfl | |
|
79
|
CVE-2026-112346 |
9.3 | 0.0101 | NET NO AUTH LOW CX NO UI | OpenHands Software Agent SDK before 1.52.0 contains an unauthenticated remote co | |
|
79
|
CVE-2026-19264 |
9.3 | 0.0101 | NET NO AUTH LOW CX NO UI | Postiz is an open-source social media scheduling tool. The route that serves loc | |
|
78
|
CVE-2026-43871 |
8.7 | 0.0103 | NET NO AUTH LOW CX NO UI | Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache T | |
|
78
|
CVE-2026-48586 |
8.7 | 0.0103 | NET NO AUTH LOW CX NO UI | Improper Handling of Highly Compressed Data (Data Amplification) vulnerability i | |
|
78
|
CVE-2026-55968 |
8.7 | 0.0103 | NET NO AUTH LOW CX NO UI | Inefficient Algorithmic Complexity, Allocation of Resources Without Limits or Th | |
|
78
|
CVE-2026-55969 |
8.7 | 0.0103 | NET NO AUTH LOW CX NO UI | Integer Overflow or Wraparound vulnerability in Apache Thrift C++, c_glib, Go, n | |
|
78
|
CVE-2026-58389 |
8.7 | 0.0103 | NET NO AUTH LOW CX NO UI | Allocation of Resources Without Limits or Throttling vulnerability in Apache Thr | |
|
78
|
CVE-2026-29063 |
8.7 | 0.0101 | NET NO AUTH LOW CX NO UI | Immutable.js provides many Persistent Immutable data structures. Prior to versio | |
|
77
|
CVE-2026-69519 |
8.6 | 0.0103 | NET NO AUTH LOW CX NO UI | Observable response discrepancy in Azure Stack HCI allows an unauthorized attack | |
|
75
|
CVE-2026-85321 |
7.5 | 0.0103 | NET NO AUTH LOW CX NO UI | Allocation of resources without limits or throttling in Active Directory Federat | |
|
75
|
CVE-2026-45815 |
7.5 | 0.0103 | NET NO AUTH LOW CX NO UI | Reachable Assertion vulnerability in Apache NimBLE. A specially crafted ATT Read | |
|
75
|
CVE-2026-45816 |
7.5 | 0.0103 | NET NO AUTH LOW CX NO UI | NULL Pointer Dereference vulnerability in Apache NimBLE in LE Long Term Key Requ | |
|
75
|
CVE-2026-41608 |
7.5 | 0.0103 | NET NO AUTH LOW CX NO UI | Improper Handling of Highly Compressed Data (Data Amplification) vulnerability i | |
|
75
|
CVE-2026-49158 |
7.5 | 0.0103 | NET NO AUTH LOW CX NO UI | Improper Handling of Highly Compressed Data (Data Amplification) vulnerability i | |
|
75
|
CVE-2026-61483 |
7.5 | 0.0103 | NET NO AUTH LOW CX NO UI | ** UNSUPPORTED WHEN ASSIGNED ** Uncontrolled Recursion vulnerability in Apache L | |
|
75
|
CVE-2026-32952 |
7.5 | 0.0103 | NET NO AUTH LOW CX NO UI | go-ntlmssp is a Go package that provides NTLM/Negotiate authentication over HTTP | |
|
75
|
CVE-2026-47633 |
7.5 | 0.0103 | NET NO AUTH LOW CX NO UI | Exposure of sensitive information to an unauthorized actor in Cost Management In | |
|
75
|
CVE-2026-62898 |
7.5 | 0.0103 | NET NO AUTH LOW CX NO UI | Use after free in Microsoft QUIC allows an unauthorized attacker to disclose inf | |
|
75
|
CVE-2026-50463 |
7.5 | 0.0103 | NET NO AUTH LOW CX NO UI | Out-of-bounds read in Windows Kernel allows an unauthorized attacker to disclose | |
|
75
|
CVE-2026-50470 |
7.5 | 0.0103 | NET NO AUTH LOW CX NO UI | Out-of-bounds read in Windows Network Policy Server SNMP allows an unauthorized | |
|
75
|
CVE-2026-85322 |
7.5 | 0.0103 | NET NO AUTH LOW CX NO UI | Use of uninitialized resource in Windows Routing and Remote Access Service (RRAS | |
|
70
|
CVE-2026-5366 |
9.9 | 0.0103 | NET LOW CX NO UI | Prefect version 3.6.23 is vulnerable to remote code execution due to improper ha | |
|
70
|
CVE-2026-65974 |
9.9 | 0.0103 | NET LOW CX NO UI | ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15 | |
|
70
|
CVE-2026-59115 |
9.9 | 0.0102 | NET LOW CX NO UI | '.../...//' in Microsoft Entra Provisioning Service (SyncFabric) allows an autho | |
|
70
|
CVE-2026-63509 |
9.9 | 0.0102 | NET LOW CX NO UI | Relative path traversal in Microsoft Fabric allows an authorized attacker to ele | |
|
69
|
CVE-2026-48315 |
9.3 | 0.0103 | NET NO AUTH LOW CX | ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Inpu | |
|
69
|
CVE-2026-114625 |
9.4 | 0.0103 | NET LOW CX NO UI | KEV | Arista VeloCloud Orchestrator on-prem contains a SQL injection vulnerability tha |
|
69
|
CVE-2026-112393 |
9.2 | 0.0102 | NET NO AUTH NO UI | Pillow is a Python imaging library. From 2.0.0 until 13.0.0, Pillow has a heap b | |
|
68
|
CVE-2026-70069 |
8.8 | 0.0103 | NET LOW CX NO UI | Stack-based buffer overflow in Windows DHCP Server allows an authorized attacker | |
|
68
|
CVE-2026-49970 |
8.7 | 0.0103 | NET LOW CX NO UI | Laravel-Mediable before 7.0.0 contains a path traversal vulnerability in the Fil | |
|
68
|
CVE-2026-56196 |
8.8 | 0.0102 | NET LOW CX NO UI | Relative path traversal in Windows Admin Center allows an authorized attacker to | |
|
68
|
CVE-2026-49163 |
8.8 | 0.0102 | NET LOW CX NO UI | Improper limitation of a pathname to a restricted directory ('path traversal') i | |
|
68
|
CVE-2026-67368 |
8.8 | 0.0102 | NET LOW CX NO UI | Improper link resolution before file access ('link following') in SQL Server all | |
|
68
|
CVE-2026-102863 |
8.8 | 0.0102 | NET LOW CX NO UI | Improper control of generation of code ('code injection') in Microsoft Office Sh | |
|
68
|
CVE-2026-83923 |
8.8 | 0.0102 | NET NO AUTH LOW CX | Relative path traversal in OpenSSH for Windows allows an unauthorized attacker t | |
|
68
|
CVE-2026-69100 |
8.7 | 0.0102 | NET LOW CX NO UI | LAMP Rapid Development Platform through 5.6.2, fixed in commit 84b0c27, contains | |
|
68
|
CVE-2026-72551 |
8.8 | 0.0101 | NET LOW CX NO UI | A remote code execution vulnerability in Apioo Fusio 8.8.3 allows authenticated | |
|
67
|
CVE-2024-9341 |
8.2 | 0.0103 | NET NO AUTH LOW CX | A flaw was found in Go. When FIPS mode is enabled on a system, container runtime | |
|
62
|
CVE-2026-61524 |
8.6 | 0.0103 | NET LOW CX NO UI | WebsiteBaker CMS before 2.13.10 contains an unrestricted file upload vulnerabili | |
|
60
|
CVE-2026-70267 |
7.2 | 0.0101 | NET LOW CX NO UI | Inclusion of functionality from untrusted control sphere in Microsoft Office Sha | |
|
60
|
CVE-2026-44853 |
7.2 | 0.0101 | NET LOW CX NO UI | Command injection vulnerabilities exist in the web-based management interface of | |
|
60
|
CVE-2026-44854 |
7.2 | 0.0101 | NET LOW CX NO UI | Command injection vulnerabilities exist in the web-based management interface of | |
|
49
|
CVE-2026-4620 |
7.1 | 0.0101 | NET LOW CX | OS Command Injection vulnerability in NEC Platforms, Ltd. Aterm Series allows a |