Hunt List
12,779 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
90
|
CVE-2026-105192 |
9.8 | 0.0102 | NET NO AUTH LOW CX NO UI | 1 PoC | LMCache multiprocess mode, also called distributed mode, opens an unauthenticate |
|
80
|
CVE-2026-28323 |
9.8 | 0.0103 | NET NO AUTH LOW CX NO UI | SolarWinds Web Help Desk is found to be affected by a SAML authentication bypass | |
|
80
|
CVE-2026-69845 |
9.8 | 0.0102 | NET NO AUTH LOW CX NO UI | Heap-based buffer overflow in Windows DHCP Server allows an unauthorized attacke | |
|
80
|
CVE-2026-68839 |
9.8 | 0.0102 | NET NO AUTH LOW CX NO UI | Heap-based buffer overflow in Windows USB Mass Storage Class Driver allows an un | |
|
80
|
CVE-2026-24227 |
9.8 | 0.0102 | NET NO AUTH LOW CX NO UI | NVIDIA TensorRT for contains a vulnerability where a user might cause a deserial | |
|
80
|
CVE-2026-76008 |
10.0 | 0.0102 | NET NO AUTH LOW CX NO UI | A flaw has been found in Comfast CF-N1-S 2.6.0.1. This affects the function get_ | |
|
80
|
CVE-2026-14522 |
9.8 | 0.0102 | NET NO AUTH LOW CX NO UI | IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0. | |
|
80
|
CVE-2026-83782 |
9.8 | 0.0101 | NET NO AUTH LOW CX NO UI | Heap-based buffer overflow in Windows Shell allows an unauthorized attacker to e | |
|
80
|
CVE-2026-96924 |
9.8 | 0.0101 | NET NO AUTH LOW CX NO UI | Untrusted pointer dereference in Windows OLE allows an unauthorized attacker to | |
|
79
|
CVE-2026-67192 |
9.2 | 0.0103 | NET NO AUTH LOW CX NO UI | Xlight FTP Server before 3.9.5 contains a pre-authentication stack buffer overfl | |
|
79
|
CVE-2026-112346 |
9.3 | 0.0101 | NET NO AUTH LOW CX NO UI | OpenHands Software Agent SDK before 1.52.0 contains an unauthenticated remote co | |
|
79
|
CVE-2026-19264 |
9.3 | 0.0101 | NET NO AUTH LOW CX NO UI | Postiz is an open-source social media scheduling tool. The route that serves loc | |
|
78
|
CVE-2026-29063 |
8.7 | 0.0101 | NET NO AUTH LOW CX NO UI | Immutable.js provides many Persistent Immutable data structures. Prior to versio | |
|
78
|
CVE-2026-89009 |
8.8 | 0.0101 | NET NO AUTH LOW CX NO UI | WAVLINK WN535M1 and WN535M3 routers running firmware prior to M35M1_V250922 cont | |
|
77
|
CVE-2026-69519 |
8.6 | 0.0103 | NET NO AUTH LOW CX NO UI | Observable response discrepancy in Azure Stack HCI allows an unauthorized attack | |
|
75
|
CVE-2026-32952 |
7.5 | 0.0103 | NET NO AUTH LOW CX NO UI | go-ntlmssp is a Go package that provides NTLM/Negotiate authentication over HTTP | |
|
75
|
CVE-2026-47633 |
7.5 | 0.0103 | NET NO AUTH LOW CX NO UI | Exposure of sensitive information to an unauthorized actor in Cost Management In | |
|
75
|
CVE-2026-62898 |
7.5 | 0.0103 | NET NO AUTH LOW CX NO UI | Use after free in Microsoft QUIC allows an unauthorized attacker to disclose inf | |
|
75
|
CVE-2026-50463 |
7.5 | 0.0103 | NET NO AUTH LOW CX NO UI | Out-of-bounds read in Windows Kernel allows an unauthorized attacker to disclose | |
|
75
|
CVE-2026-50470 |
7.5 | 0.0103 | NET NO AUTH LOW CX NO UI | Out-of-bounds read in Windows Network Policy Server SNMP allows an unauthorized | |
|
75
|
CVE-2026-85322 |
7.5 | 0.0103 | NET NO AUTH LOW CX NO UI | Use of uninitialized resource in Windows Routing and Remote Access Service (RRAS | |
|
75
|
CVE-2026-70579 |
7.5 | 0.0103 | NET NO AUTH LOW CX NO UI | Out-of-bounds read in Windows Mobile Broadband allows an unauthorized attacker t | |
|
75
|
CVE-2026-72932 |
7.5 | 0.0103 | NET NO AUTH LOW CX NO UI | Buffer over-read in Windows Message Queuing Queue Manager allows an unauthorized | |
|
75
|
CVE-2026-72989 |
7.5 | 0.0103 | NET NO AUTH LOW CX NO UI | Use of uninitialized resource in Windows Failover Cluster allows an unauthorized | |
|
75
|
CVE-2026-69443 |
7.5 | 0.0103 | NET NO AUTH LOW CX NO UI | Out-of-bounds read in Microsoft Azure Attestation service and Device Health Atte | |
|
75
|
CVE-2026-70587 |
7.5 | 0.0103 | NET NO AUTH LOW CX NO UI | Improper null termination in Windows Remote Desktop Protocol allows an unauthori | |
|
75
|
CVE-2026-71330 |
7.5 | 0.0103 | NET NO AUTH LOW CX NO UI | Exposure of sensitive system information to an unauthorized control sphere in Wi | |
|
75
|
CVE-2026-35092 |
7.5 | 0.0101 | NET NO AUTH LOW CX NO UI | A flaw was found in Corosync. An integer overflow vulnerability in Corosync's jo | |
|
70
|
CVE-2026-59115 |
9.9 | 0.0102 | NET LOW CX NO UI | '.../...//' in Microsoft Entra Provisioning Service (SyncFabric) allows an autho | |
|
70
|
CVE-2026-63509 |
9.9 | 0.0102 | NET LOW CX NO UI | Relative path traversal in Microsoft Fabric allows an authorized attacker to ele | |
|
69
|
CVE-2026-48315 |
9.3 | 0.0103 | NET NO AUTH LOW CX | ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Inpu | |
|
69
|
CVE-2026-114625 |
9.4 | 0.0103 | NET LOW CX NO UI | KEV | Arista VeloCloud Orchestrator on-prem contains a SQL injection vulnerability tha |
|
69
|
CVE-2026-112393 |
9.2 | 0.0102 | NET NO AUTH NO UI | Pillow is a Python imaging library. From 2.0.0 until 13.0.0, Pillow has a heap b | |
|
69
|
CVE-2026-63732 |
9.4 | 0.0101 | NET LOW CX NO UI | 9router 0.4.59 (fixed in 0.4.60) contains a chain of vulnerabilities: a hardcode | |
|
68
|
CVE-2026-49970 |
8.7 | 0.0103 | NET LOW CX NO UI | Laravel-Mediable before 7.0.0 contains a path traversal vulnerability in the Fil | |
|
68
|
CVE-2026-56196 |
8.8 | 0.0102 | NET LOW CX NO UI | Relative path traversal in Windows Admin Center allows an authorized attacker to | |
|
68
|
CVE-2026-49163 |
8.8 | 0.0102 | NET LOW CX NO UI | Improper limitation of a pathname to a restricted directory ('path traversal') i | |
|
68
|
CVE-2026-67368 |
8.8 | 0.0102 | NET LOW CX NO UI | Improper link resolution before file access ('link following') in SQL Server all | |
|
68
|
CVE-2026-102863 |
8.8 | 0.0102 | NET LOW CX NO UI | Improper control of generation of code ('code injection') in Microsoft Office Sh | |
|
68
|
CVE-2026-83923 |
8.8 | 0.0102 | NET NO AUTH LOW CX | Relative path traversal in OpenSSH for Windows allows an unauthorized attacker t | |
|
68
|
CVE-2026-69100 |
8.7 | 0.0102 | NET LOW CX NO UI | LAMP Rapid Development Platform through 5.6.2, fixed in commit 84b0c27, contains | |
|
68
|
CVE-2026-72551 |
8.8 | 0.0101 | NET LOW CX NO UI | A remote code execution vulnerability in Apioo Fusio 8.8.3 allows authenticated | |
|
68
|
CVE-2026-72556 |
8.8 | 0.0101 | NET LOW CX NO UI | A remote code execution vulnerability in ZoneMinder 1.39.17 allows any authentic | |
|
68
|
CVE-2026-35337 |
8.8 | 0.0101 | NET LOW CX NO UI | Deserialization of Untrusted Data vulnerability in Apache Storm. Versions Affec | |
|
67
|
CVE-2024-9341 |
8.2 | 0.0103 | NET NO AUTH LOW CX | A flaw was found in Go. When FIPS mode is enabled on a system, container runtime | |
|
62
|
CVE-2026-61524 |
8.6 | 0.0103 | NET LOW CX NO UI | WebsiteBaker CMS before 2.13.10 contains an unrestricted file upload vulnerabili | |
|
60
|
CVE-2026-70267 |
7.2 | 0.0101 | NET LOW CX NO UI | Inclusion of functionality from untrusted control sphere in Microsoft Office Sha | |
|
60
|
CVE-2026-44853 |
7.2 | 0.0101 | NET LOW CX NO UI | Command injection vulnerabilities exist in the web-based management interface of | |
|
60
|
CVE-2026-44854 |
7.2 | 0.0101 | NET LOW CX NO UI | Command injection vulnerabilities exist in the web-based management interface of | |
|
49
|
CVE-2026-4620 |
7.1 | 0.0101 | NET LOW CX | OS Command Injection vulnerability in NEC Platforms, Ltd. Aterm Series allows a |