Hunt List
12,788 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-3960 |
9.8 | 0.0094 | NET NO AUTH LOW CX NO UI | A critical remote code execution vulnerability exists in the unauthenticated RES | |
|
80
|
CVE-2023-34416 |
9.8 | 0.0093 | NET NO AUTH LOW CX NO UI | Memory safety bugs present in Firefox 113, Firefox ESR 102.11, and Thunderbird 1 | |
|
80
|
CVE-2026-20160 |
9.8 | 0.0093 | NET NO AUTH LOW CX NO UI | A vulnerability in Cisco Smart Software Manager On-Prem (SSM On-Prem) could allo | |
|
79
|
CVE-2026-88092 |
9.4 | 0.0093 | NET NO AUTH LOW CX NO UI | Inconsistent interpretation of http requests ('http request/response smuggling') | |
|
79
|
CVE-2026-34106 |
9.3 | 0.0093 | NET NO AUTH LOW CX NO UI | Guardian language-system passes the id GET parameter directly into a PHP exec() | |
|
79
|
CVE-2026-34107 |
9.3 | 0.0093 | NET NO AUTH LOW CX NO UI | Guardian language-system passes the id GET parameter directly into a PHP exec() | |
|
79
|
CVE-2026-34108 |
9.3 | 0.0093 | NET NO AUTH LOW CX NO UI | Guardian language-system passes the id GET parameter directly into a PHP exec() | |
|
79
|
CVE-2026-34109 |
9.3 | 0.0093 | NET NO AUTH LOW CX NO UI | Guardian language-system passes the id GET parameter directly into a PHP exec() | |
|
79
|
CVE-2026-34110 |
9.3 | 0.0093 | NET NO AUTH LOW CX NO UI | Guardian language-system passes the id GET parameter directly into a PHP exec() | |
|
79
|
CVE-2026-34111 |
9.3 | 0.0093 | NET NO AUTH LOW CX NO UI | Guardian language-system passes the id GET parameter directly into a PHP exec() | |
|
79
|
CVE-2026-34112 |
9.3 | 0.0093 | NET NO AUTH LOW CX NO UI | Guardian language-system passes the id GET parameter directly into a PHP exec() | |
|
79
|
CVE-2026-34113 |
9.3 | 0.0093 | NET NO AUTH LOW CX NO UI | Guardian language-system passes the id GET parameter directly into a PHP exec() | |
|
79
|
CVE-2026-34114 |
9.3 | 0.0093 | NET NO AUTH LOW CX NO UI | Guardian language-system passes the id GET parameter directly into a PHP exec() | |
|
79
|
CVE-2026-34115 |
9.3 | 0.0093 | NET NO AUTH LOW CX NO UI | Guardian language-system passes the id GET parameter directly into a PHP exec() | |
|
79
|
CVE-2026-34116 |
9.3 | 0.0093 | NET NO AUTH LOW CX NO UI | Guardian language-system passes the id GET parameter directly into a PHP exec() | |
|
79
|
CVE-2026-34117 |
9.3 | 0.0093 | NET NO AUTH LOW CX NO UI | Guardian language-system passes the id GET parameter directly into a PHP exec() | |
|
78
|
CVE-2026-70188 |
9.1 | 0.0094 | NET NO AUTH LOW CX NO UI | Inconsistent interpretation of http requests ('http request/response smuggling') | |
|
77
|
CVE-2026-42946 |
8.3 | 0.0093 | NET NO AUTH LOW CX NO UI | A vulnerability exists in the ngx_http_scgi_module and ngx_http_uwsgi_module mod | |
|
69
|
CVE-2026-13368 |
9.2 | 0.0094 | NET NO AUTH NO UI | WatchGuard Fireware OS contains a race condition leading to a use-after-free vul | |
|
69
|
CVE-2026-35428 |
9.6 | 0.0093 | NET NO AUTH LOW CX | Improper neutralization of special elements used in a command ('command injectio | |
|
68
|
CVE-2026-50663 |
8.8 | 0.0094 | NET NO AUTH LOW CX | Relative path traversal in Age of Empires II: Definitive Edition Game allows an | |
|
68
|
CVE-2026-65768 |
8.8 | 0.0094 | NET NO AUTH LOW CX | Improper limitation of a pathname to a restricted directory ('path traversal') i | |
|
68
|
CVE-2026-7569 |
8.8 | 0.0094 | NET NO AUTH LOW CX | Quest NetVault Backup viewclient Cross-Site Scripting Authentication Bypass Vuln | |
|
68
|
CVE-2026-9780 |
8.8 | 0.0094 | NET NO AUTH LOW CX | Quest NetVault Backup addclient3 Cross-Site Scripting Authentication Bypass Vuln | |
|
68
|
CVE-2024-7557 |
8.8 | 0.0093 | NET LOW CX NO UI | A vulnerability was found in OpenShift AI that allows for authentication bypass | |
|
68
|
CVE-2026-100210 |
8.8 | 0.0093 | NET NO AUTH LOW CX | Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized atta | |
|
68
|
CVE-2026-100211 |
8.8 | 0.0093 | NET NO AUTH LOW CX | Use after free in Microsoft Office Excel allows an unauthorized attacker to exec | |
|
68
|
CVE-2026-96202 |
8.8 | 0.0093 | NET NO AUTH LOW CX | Heap-based buffer overflow in Windows Raw Image Extension allows an unauthorized | |
|
68
|
CVE-2026-100220 |
8.8 | 0.0093 | NET NO AUTH LOW CX | Heap-based buffer overflow in Windows Media Video Decoder allows an unauthorized | |
|
68
|
CVE-2026-70215 |
8.8 | 0.0093 | NET NO AUTH LOW CX | Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to | |
|
68
|
CVE-2026-88144 |
8.8 | 0.0093 | NET NO AUTH LOW CX | Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to | |
|
68
|
CVE-2026-97741 |
8.8 | 0.0093 | NET NO AUTH LOW CX | Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized atta | |
|
68
|
CVE-2026-97742 |
8.8 | 0.0093 | NET NO AUTH LOW CX | Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized att | |
|
68
|
CVE-2026-97745 |
8.8 | 0.0093 | NET NO AUTH LOW CX | Use after free in Microsoft Office Excel allows an unauthorized attacker to exec | |
|
68
|
CVE-2026-70068 |
8.8 | 0.0093 | NET NO AUTH LOW CX | Heap-based buffer overflow in Windows Client-Side Caching (CSC) Service allows a | |
|
68
|
CVE-2026-70089 |
8.8 | 0.0093 | NET NO AUTH LOW CX | Heap-based buffer overflow in Windows GDI allows an unauthorized attacker to exe | |
|
68
|
CVE-2026-70149 |
8.8 | 0.0093 | NET NO AUTH LOW CX | Exposure of sensitive information to an unauthorized actor in Windows Client Sid | |
|
68
|
CVE-2026-70210 |
8.8 | 0.0093 | NET NO AUTH LOW CX | Heap-based buffer overflow in Windows OLE DB allows an unauthorized attacker to | |
|
68
|
CVE-2026-70258 |
8.8 | 0.0093 | NET NO AUTH LOW CX | Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unaut | |
|
68
|
CVE-2026-70262 |
8.8 | 0.0093 | NET NO AUTH LOW CX | Heap-based buffer overflow in WebDAV allows an unauthorized attacker to elevate | |
|
68
|
CVE-2026-70275 |
8.8 | 0.0093 | NET NO AUTH LOW CX | Untrusted pointer dereference in Windows CD-ROM Driver allows an unauthorized at | |
|
68
|
CVE-2026-77496 |
8.8 | 0.0093 | NET NO AUTH LOW CX | Heap-based buffer overflow in Windows Imaging Component allows an unauthorized a | |
|
68
|
CVE-2026-83523 |
8.8 | 0.0093 | NET NO AUTH LOW CX | Heap-based buffer overflow in Windows Image Acquisition allows an unauthorized a | |
|
68
|
CVE-2026-83642 |
8.8 | 0.0093 | NET NO AUTH LOW CX | Access of resource using incompatible type ('type confusion') in DNS Server allo | |
|
68
|
CVE-2026-83643 |
8.8 | 0.0093 | NET NO AUTH LOW CX | Stack-based buffer overflow in Windows Error Reporting allows an unauthorized at | |
|
67
|
CVE-2026-27650 |
8.6 | 0.0094 | NET NO AUTH LOW CX | OS Command Injection vulnerability exists in BUFFALO Wi-Fi router products. If t | |
|
66
|
CVE-2017-20289 |
7.7 | 0.0093 | NET LOW CX NO UI | Broadstreet Ad Widget plugin for WordPress 2.2.0 before 2.12.0 contains a local | |
|
64
|
CVE-2026-50682 |
7.1 | 0.0093 | NET LOW CX NO UI | Out-of-bounds read in Windows Active Directory allows an authorized attacker to | |
|
63
|
CVE-2026-68823 |
9.1 | 0.0093 | NET LOW CX NO UI | Exposed dangerous method or function in Azure Confidential Ledger allows an auth | |
|
50
|
CVE-2026-111221 |
7.5 | 0.0094 | NET NO UI | Netgate pfSense CE through 2.9.0 contains a configuration injection vulnerabilit |