Hunt List
12,786 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-72979 |
9.8 | 0.0097 | NET NO AUTH LOW CX NO UI | Use after free in Windows DHCP Server allows an unauthorized attacker to execute | |
|
80
|
CVE-2026-72982 |
9.8 | 0.0097 | NET NO AUTH LOW CX NO UI | Stack-based buffer overflow in Windows Netlogon allows an unauthorized attacker | |
|
80
|
CVE-2026-72983 |
9.8 | 0.0097 | NET NO AUTH LOW CX NO UI | Use after free in Windows Internet Connection Sharing (ICS) allows an unauthoriz | |
|
80
|
CVE-2026-77493 |
9.8 | 0.0097 | NET NO AUTH LOW CX NO UI | Double free in Microsoft Graphics Component allows an unauthorized attacker to e | |
|
80
|
CVE-2026-78509 |
9.8 | 0.0097 | NET NO AUTH LOW CX NO UI | Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized at | |
|
80
|
CVE-2026-68502 |
9.8 | 0.0097 | NET NO AUTH LOW CX NO UI | LazyOwn RedTeam/APT Framework is an AI-powered C2 and red-team operations framew | |
|
80
|
CVE-2026-48382 |
10.0 | 0.0097 | NET NO AUTH LOW CX NO UI | Adobe Experience Manager is affected by an Incorrect Authorization vulnerability | |
|
80
|
CVE-2026-48383 |
10.0 | 0.0097 | NET NO AUTH LOW CX NO UI | Adobe Experience Manager is affected by an Incorrect Authorization vulnerability | |
|
80
|
CVE-2026-88178 |
9.8 | 0.0097 | NET NO AUTH LOW CX NO UI | Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to | |
|
80
|
CVE-2026-47698 |
9.8 | 0.0097 | NET NO AUTH LOW CX NO UI | vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.6, lib/bridge.js and | |
|
80
|
CVE-2026-14512 |
9.8 | 0.0097 | NET NO AUTH LOW CX NO UI | IBM WebSphere Application Server 9.0, and 8.5 traditional is vulnerable to pre-a | |
|
80
|
CVE-2026-69705 |
9.8 | 0.0097 | NET NO AUTH LOW CX NO UI | Out-of-bounds write in Windows iSCSI allows an unauthorized attacker to execute | |
|
80
|
CVE-2026-70024 |
9.8 | 0.0096 | NET NO AUTH LOW CX NO UI | Stack-based buffer overflow in Windows Internet Information Services allows an u | |
|
79
|
CVE-2026-62835 |
9.3 | 0.0097 | NET NO AUTH LOW CX NO UI | Improper authorization in Azure Portal allows an unauthorized attacker to disclo | |
|
79
|
CVE-2026-70470 |
9.5 | 0.0097 | NET NO AUTH LOW CX NO UI | Flowise is a drag & drop user interface to build a customized large language mod | |
|
79
|
CVE-2026-0625 |
9.3 | 0.0097 | NET NO AUTH LOW CX NO UI | Multiple D-Link DSL/DIR/DNS devices contain an authentication bypass and imprope | |
|
79
|
CVE-2026-67614 |
9.3 | 0.0096 | NET NO AUTH LOW CX NO UI | CyberPanel before 3.0.0 contains a hard-coded JWT secret vulnerability in the We | |
|
79
|
CVE-2026-57517 |
9.3 | 0.0096 | NET NO AUTH LOW CX NO UI | Control Web Panel before 0.9.8.1225 contains a blind SQL injection vulnerability | |
|
79
|
CVE-2026-67191 |
9.3 | 0.0096 | NET NO AUTH LOW CX NO UI | Xlight FTP Server before 3.9.5 contains a pre-authentication heap buffer overflo | |
|
78
|
CVE-2026-58399 |
8.7 | 0.0097 | NET NO AUTH LOW CX NO UI | @acastellon/auth is an authentication control system for microservices. Versions | |
|
78
|
CVE-2026-53977 |
8.7 | 0.0097 | NET NO AUTH LOW CX NO UI | OpenChamber 1.11.7 contains an authentication bypass vulnerability that allows u | |
|
78
|
CVE-2026-73487 |
9.0 | 0.0096 | NET NO AUTH LOW CX NO UI | Flowise before 3.1.3 contains a regex-based Python code validator bypass in CSV | |
|
77
|
CVE-2026-66800 |
8.6 | 0.0097 | NET NO AUTH LOW CX NO UI | Server-side request forgery (ssrf) in Azure Data Factory allows an unauthorized | |
|
77
|
CVE-2026-69558 |
8.6 | 0.0097 | NET NO AUTH LOW CX NO UI | Authorization bypass through user-controlled key in Microsoft Partner Center all | |
|
77
|
CVE-2026-63913 |
8.2 | 0.0097 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: netfilter: | |
|
77
|
CVE-2026-57206 |
8.6 | 0.0096 | NET NO AUTH LOW CX NO UI | SimpleChat is a secure AI conversation application with personal and group works | |
|
76
|
CVE-2026-63520 |
8.1 | 0.0096 | NET NO AUTH NO UI | 1 PoC | Improper input validation in Microsoft Office SharePoint allows an unauthorized |
|
75
|
CVE-2026-66304 |
7.5 | 0.0097 | NET NO AUTH LOW CX NO UI | Server-side request forgery (ssrf) in Skype for Business allows an unauthorized | |
|
75
|
CVE-2026-85917 |
7.5 | 0.0097 | NET NO AUTH LOW CX NO UI | Server-side request forgery (ssrf) in Azure AI Foundry allows an unauthorized at | |
|
75
|
CVE-2026-56671 |
7.5 | 0.0097 | NET NO AUTH LOW CX NO UI | ComfyUI is a modular diffusion model GUI, api and backend with a graph/nodes int | |
|
75
|
CVE-2026-96959 |
7.5 | 0.0097 | NET NO AUTH LOW CX NO UI | Allocation of resources without limits or throttling in .NET allows an unauthori | |
|
75
|
CVE-2026-70186 |
7.5 | 0.0096 | NET NO AUTH LOW CX NO UI | Deadlock in ASP.NET Core allows an unauthorized attacker to deny service over a | |
|
70
|
CVE-2026-48326 |
9.9 | 0.0097 | NET LOW CX NO UI | Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Specia | |
|
70
|
CVE-2026-54120 |
9.9 | 0.0096 | NET LOW CX NO UI | Improper input validation in Microsoft Surface allows an authorized attacker to | |
|
68
|
CVE-2023-31208 |
8.8 | 0.0097 | NET LOW CX NO UI | Improper neutralization of livestatus command delimiters in the RestAPI in Check | |
|
68
|
CVE-2026-108463 |
8.8 | 0.0097 | NET NO AUTH LOW CX | Improper resolution of path equivalence in Windows SmartScreen allows an unautho | |
|
68
|
CVE-2026-53597 |
8.7 | 0.0097 | NET NO AUTH LOW CX | Prompty is a markdown file format (.prompty) for LLM prompts. From 2.0.0-alpha.1 | |
|
68
|
CVE-2026-42238 |
9.0 | 0.0097 | NET NO AUTH LOW CX | Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3. | |
|
68
|
CVE-2026-73298 |
8.7 | 0.0097 | NET LOW CX NO UI | The Microsoft Container Migration Solution Accelerator is a multi-service applic | |
|
68
|
CVE-2026-70158 |
8.8 | 0.0096 | NET LOW CX NO UI | Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows | |
|
68
|
CVE-2026-18420 |
8.7 | 0.0096 | NET LOW CX NO UI | Improper input validation in the Time Series Visual Builder (TSVB) plugin in Ope | |
|
68
|
CVE-2026-40365 |
8.8 | 0.0096 | NET LOW CX NO UI | Deserialization of untrusted data in Microsoft Office SharePoint allows an autho | |
|
68
|
CVE-2026-47871 |
8.8 | 0.0096 | NET LOW CX NO UI | VMware Avi Load Balancer contains a directory traversal vulnerability. Flaws in | |
|
68
|
CVE-2026-65811 |
8.8 | 0.0096 | NET LOW CX NO UI | Improper input validation in Power BI allows an authorized attacker to execute c | |
|
68
|
CVE-2026-19949 |
8.8 | 0.0096 | NET LOW CX NO UI | The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to SQL | |
|
66
|
CVE-2026-79890 |
8.1 | 0.0096 | NET NO AUTH NO UI | There are command injection vulnerabilities in AOS-8 that could lead to unauthen | |
|
60
|
CVE-2023-36755 |
7.2 | 0.0097 | NET LOW CX NO UI | A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.1 | |
|
60
|
CVE-2026-5208 |
7.2 | 0.0097 | NET LOW CX NO UI | Command injection in alerts in CoolerControl/coolercontrold <4.0.0 allows authen | |
|
60
|
CVE-2026-23823 |
7.2 | 0.0096 | NET LOW CX NO UI | A vulnerability in the command line interface of Access Points running AOS-10 co | |
|
57
|
CVE-2026-58281 |
8.3 | 0.0096 | NET NO AUTH | Deserialization of untrusted data in Microsoft Edge (Chromium-based) allows an u |