Hunt List
12,788 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-57878 |
9.8 | 0.0095 | NET NO AUTH LOW CX NO UI | An unauthenticated stack-based buffer overflow vulnerability exists in thttpd in | |
|
80
|
CVE-2026-58115 |
10.0 | 0.0095 | NET NO AUTH LOW CX NO UI | A vulnerability has been identified in SIMATIC IoT2050 Advanced (6ES7647-0BA00-1 | |
|
80
|
CVE-2026-69634 |
9.8 | 0.0095 | NET NO AUTH LOW CX NO UI | Heap-based buffer overflow in Windows iSCSI allows an unauthorized attacker to e | |
|
80
|
CVE-2026-69639 |
9.8 | 0.0095 | NET NO AUTH LOW CX NO UI | Heap-based buffer overflow in Windows Libarchive allows an unauthorized attacker | |
|
80
|
CVE-2026-69883 |
9.8 | 0.0095 | NET NO AUTH LOW CX NO UI | Use after free in Windows iSCSI allows an unauthorized attacker to execute code | |
|
80
|
CVE-2026-69886 |
9.8 | 0.0095 | NET NO AUTH LOW CX NO UI | Heap-based buffer overflow in Windows Imaging Component allows an unauthorized a | |
|
80
|
CVE-2026-48331 |
10.0 | 0.0095 | NET NO AUTH LOW CX NO UI | Adobe Campaign Classic (ACC) is affected by a Server-Side Request Forgery (SSRF) | |
|
80
|
CVE-2023-34844 |
9.8 | 0.0095 | NET NO AUTH LOW CX NO UI | Play With Docker < 0.0.2 has an insecure CAP_SYS_ADMIN privileged mode causing t | |
|
80
|
CVE-2026-48333 |
9.8 | 0.0095 | NET NO AUTH LOW CX NO UI | Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerabi | |
|
80
|
CVE-2026-57879 |
9.8 | 0.0095 | NET NO AUTH LOW CX NO UI | An unauthenticated stack-based buffer overflow vulnerability exists in ssvr in G | |
|
80
|
CVE-2026-57880 |
9.8 | 0.0095 | NET NO AUTH LOW CX NO UI | An unauthenticated stack-based buffer overflow vulnerability exists in ssvr in G | |
|
80
|
CVE-2026-12940 |
9.8 | 0.0094 | NET NO AUTH LOW CX NO UI | IBM Langflow OSS 1.0.0 through 1.10.1 are vulnerable to unauthenticated remote | |
|
80
|
CVE-2023-29542 |
9.8 | 0.0094 | NET NO AUTH LOW CX NO UI | A newline in a filename could have been used to bypass the file extension securi | |
|
80
|
CVE-2026-57572 |
10.0 | 0.0094 | NET NO AUTH LOW CX NO UI | Crawl4AI is an open-source LLM-friendly web crawler and scraper. Prior to 0.9.0, | |
|
80
|
CVE-2026-96934 |
9.8 | 0.0094 | NET NO AUTH LOW CX NO UI | Use after free in Windows DHCP Server allows an unauthorized attacker to execute | |
|
79
|
CVE-2026-8634 |
9.3 | 0.0095 | NET NO AUTH LOW CX NO UI | Crabbox prior to v0.12.0 contains an environment variable exposure vulnerability | |
|
79
|
CVE-2026-112403 |
9.2 | 0.0095 | NET NO AUTH LOW CX NO UI | Pillow is a Python imaging library. Prior to 13.0.0, Pillow's JPEG decoder can w | |
|
79
|
CVE-2026-42097 |
9.3 | 0.0094 | NET NO AUTH LOW CX NO UI | Sparx Pro Cloud Server requires authentication based on requested URL. An attack | |
|
78
|
CVE-2026-112350 |
8.7 | 0.0095 | NET NO AUTH LOW CX NO UI | Sunhillo SureLine before 9.1.5 contains a path traversal vulnerability in the ra | |
|
78
|
CVE-2026-96230 |
8.8 | 0.0095 | NET NO AUTH LOW CX | 1 PoC | Improper neutralization of input during web page generation ('cross-site scripti |
|
75
|
CVE-2022-43768 |
7.5 | 0.0095 | NET NO AUTH LOW CX NO UI | A vulnerability has been identified in SIMATIC CP 1242-7 V2 (6GK7242-7KX31-0XE0) | |
|
75
|
CVE-2026-109468 |
7.5 | 0.0095 | NET NO AUTH LOW CX NO UI | Allocation of resources without limits or throttling in ASP.NET Core allows an u | |
|
69
|
CVE-2026-48317 |
9.6 | 0.0094 | NET LOW CX NO UI | Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Direct | |
|
69
|
CVE-2026-69400 |
9.6 | 0.0094 | NET NO AUTH LOW CX | Improper limitation of a pathname to a restricted directory ('path traversal') i | |
|
68
|
CVE-2026-105718 |
8.8 | 0.0095 | NET NO AUTH LOW CX | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to | |
|
68
|
CVE-2026-88136 |
8.8 | 0.0095 | NET LOW CX NO UI | Improper resolution of path equivalence in WebDAV allows an authorized attacker | |
|
68
|
CVE-2026-100209 |
8.8 | 0.0095 | NET NO AUTH LOW CX | Use after free in Microsoft Office Excel allows an unauthorized attacker to exec | |
|
68
|
CVE-2026-114094 |
8.7 | 0.0095 | NET NO AUTH LOW CX | Dulwich before 1.2.9 fails to validate DOS drive letter prefixes in Git tree pat | |
|
68
|
CVE-2026-88163 |
8.8 | 0.0095 | NET LOW CX NO UI | Integer overflow or wraparound in Microsoft Office SharePoint allows an authoriz | |
|
68
|
CVE-2026-88166 |
8.8 | 0.0095 | NET LOW CX NO UI | Integer overflow or wraparound in Microsoft Office SharePoint allows an authoriz | |
|
68
|
CVE-2026-7570 |
8.8 | 0.0095 | NET LOW CX NO UI | Quest NetVault Backup NVBUDashboard SQL Injection Remote Code Execution Vulnerab | |
|
68
|
CVE-2026-9781 |
8.8 | 0.0095 | NET LOW CX NO UI | Quest NetVault Backup NVBURASDevice SQL Injection Remote Code Execution Vulnerab | |
|
68
|
CVE-2026-9782 |
8.8 | 0.0095 | NET LOW CX NO UI | Quest NetVault Backup NVBUDeviceDrive SQL Injection Remote Code Execution Vulner | |
|
68
|
CVE-2026-9783 |
8.8 | 0.0095 | NET LOW CX NO UI | Quest NetVault Backup NVBURemovableMedia SQL Injection Remote Code Execution Vul | |
|
68
|
CVE-2026-9784 |
8.8 | 0.0095 | NET LOW CX NO UI | Quest NetVault Backup NVBULibraryPort SQL Injection Remote Code Execution Vulner | |
|
68
|
CVE-2026-9785 |
8.8 | 0.0095 | NET LOW CX NO UI | Quest NetVault Backup NVBULibrarySlot SQL Injection Remote Code Execution Vulner | |
|
68
|
CVE-2026-9786 |
8.8 | 0.0095 | NET LOW CX NO UI | Quest NetVault Backup NVBUDashboard SQL Injection Remote Code Execution Vulnerab | |
|
68
|
CVE-2026-67920 |
8.8 | 0.0094 | NET LOW CX NO UI | An issue in Halo 2.25.4 allows a remote attacker to execute arbitrary code via t | |
|
68
|
CVE-2026-64921 |
8.8 | 0.0094 | NET LOW CX NO UI | Missing authentication for critical function in Microsoft Office SharePoint allo | |
|
68
|
CVE-2026-55052 |
8.8 | 0.0094 | NET LOW CX NO UI | Missing authorization in Microsoft Office SharePoint allows an authorized attack | |
|
68
|
CVE-2026-58277 |
8.8 | 0.0094 | NET LOW CX NO UI | Improper authorization in Microsoft Office SharePoint allows an authorized attac | |
|
68
|
CVE-2026-62827 |
8.8 | 0.0094 | NET LOW CX NO UI | Improper authentication in Microsoft Office SharePoint allows an authorized atta | |
|
68
|
CVE-2026-70324 |
8.8 | 0.0094 | NET LOW CX NO UI | Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an auth | |
|
66
|
CVE-2026-94300 |
8.1 | 0.0095 | NET NO AUTH NO UI | Replaying GSS-TSIG signed UDP messages can result in memory corruption in "`name | |
|
66
|
CVE-2026-54512 |
8.1 | 0.0094 | NET NO AUTH NO UI | jackson-databind contains the general-purpose data-binding functionality and tre | |
|
65
|
CVE-2026-105013 |
7.4 | 0.0095 | NET LOW CX NO UI | Deserialization of untrusted data in Microsoft Office SharePoint allows an autho | |
|
62
|
CVE-2026-11845 |
8.6 | 0.0095 | NET LOW CX NO UI | The iVEC-IEI Virtualization Edge Computer developed by IEI Integration Corp has | |
|
55
|
CVE-2026-55021 |
7.3 | 0.0095 | NET LOW CX | Improper neutralization of input during web page generation ('cross-site scripti | |
|
55
|
CVE-2026-55034 |
7.3 | 0.0095 | NET LOW CX | Improper neutralization of input during web page generation ('cross-site scripti | |
|
54
|
CVE-2026-48997 |
7.1 | 0.0095 | NET NO UI | e107 is a content management system (CMS). Versions 2.3.5 and earlier contain a |