Hunt List
12,788 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-6057 |
9.8 | 0.0093 | NET NO AUTH LOW CX NO UI | FalkorDB Browser 1.9.3 contains an unauthenticated path traversal vulnerability | |
|
80
|
CVE-2026-85809 |
9.8 | 0.0093 | NET NO AUTH LOW CX NO UI | Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows | |
|
80
|
CVE-2026-85814 |
9.8 | 0.0093 | NET NO AUTH LOW CX NO UI | Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unaut | |
|
80
|
CVE-2026-0685 |
9.8 | 0.0093 | NET NO AUTH LOW CX NO UI | Server side template inject (SSTI) in the expression evaluation component in Gen | |
|
80
|
CVE-2026-43867 |
9.8 | 0.0093 | NET NO AUTH LOW CX NO UI | Deserialization of Untrusted Data vulnerability in Apache Camel PQC Component. | |
|
80
|
CVE-2026-52200 |
9.8 | 0.0093 | NET NO AUTH LOW CX NO UI | An issue in Generic OEM UZ801_v2.1 4G LTE Router V3.4.3 allows a remote attacker | |
|
80
|
CVE-2026-67919 |
9.8 | 0.0093 | NET NO AUTH LOW CX NO UI | An issue in Halo 2.25.4 allows a remote attacker to execute arbitrary code via t | |
|
80
|
CVE-2026-32871 |
10.0 | 0.0092 | NET NO AUTH LOW CX NO UI | FastMCP is a Pythonic way to build MCP servers and clients. Prior to version 3.2 | |
|
80
|
CVE-2026-58275 |
10.0 | 0.0092 | NET NO AUTH LOW CX NO UI | Missing authorization in Azure DNS allows an unauthorized attacker to elevate pr | |
|
80
|
CVE-2026-62825 |
10.0 | 0.0092 | NET NO AUTH LOW CX NO UI | Improper authentication in Azure Key Vault allows an unauthorized attacker to el | |
|
80
|
CVE-2026-17436 |
9.8 | 0.0092 | NET NO AUTH LOW CX NO UI | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to e | |
|
80
|
CVE-2026-18832 |
9.8 | 0.0092 | NET NO AUTH LOW CX NO UI | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to e | |
|
80
|
CVE-2026-17142 |
9.8 | 0.0092 | NET NO AUTH LOW CX NO UI | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to e | |
|
80
|
CVE-2026-83748 |
9.8 | 0.0091 | NET NO AUTH LOW CX NO UI | Heap-based buffer overflow in Windows Error Reporting allows an unauthorized att | |
|
79
|
CVE-2024-58351 |
9.3 | 0.0093 | NET NO AUTH LOW CX NO UI | Flowise before 2.1.4 allows configuration to be injected into the Chainflow duri | |
|
79
|
CVE-2026-113736 |
9.3 | 0.0092 | NET NO AUTH LOW CX NO UI | A vulnerability has been found in D-Link DHP-W610AV 1.02EUb03. The impacted elem | |
|
79
|
CVE-2026-69098 |
9.3 | 0.0091 | NET NO AUTH LOW CX NO UI | kotaemon through 0.12.0 contains an insecure deserialization vulnerability in th | |
|
79
|
CVE-2018-25254 |
9.3 | 0.0091 | NET NO AUTH LOW CX NO UI | NICO-FTP 3.0.1.19 contains a structured exception handler buffer overflow vulner | |
|
78
|
CVE-2026-69095 |
8.7 | 0.0093 | NET NO AUTH LOW CX NO UI | OpenWrt luci-app-bmx7 before commit 5890760a454dad2cb00389dba2cdc5e779e0ffdd con | |
|
78
|
CVE-2026-58465 |
8.7 | 0.0092 | NET NO AUTH LOW CX NO UI | Eclipse Wakaama before snapshot/2026-05-26 contains an unbounded memory allocati | |
|
78
|
CVE-2026-60109 |
8.7 | 0.0092 | NET NO AUTH LOW CX NO UI | Zeek before 8.0.9 contains a null pointer dereference vulnerability in its Kerbe | |
|
75
|
CVE-2022-47762 |
7.5 | 0.0093 | NET NO AUTH LOW CX NO UI | In gin-vue-admin < 2.5.5, the download module has a Path Traversal vulnerability | |
|
75
|
CVE-2026-85891 |
7.5 | 0.0092 | NET NO AUTH LOW CX NO UI | Exposure of sensitive information to an unauthorized actor in Azure HDInsight al | |
|
75
|
CVE-2026-50519 |
7.5 | 0.0092 | NET NO AUTH LOW CX NO UI | Initialization of a resource with an insecure default in GitHub Copilot and Visu | |
|
75
|
CVE-2023-32214 |
7.5 | 0.0092 | NET NO AUTH LOW CX NO UI | Protocol handlers `ms-cxh` and `ms-cxh-full` could have been leveraged to trigge | |
|
75
|
CVE-2024-33288 |
7.3 | 0.0092 | NET NO AUTH LOW CX NO UI | Prison Management System Using PHP v1.0 was discovered to contain a SQL injectio | |
|
75
|
CVE-2026-45798 |
7.5 | 0.0092 | NET NO AUTH LOW CX NO UI | Wazuh is a free and open source platform used for threat prevention, detection, | |
|
70
|
CVE-2026-57092 |
9.9 | 0.0091 | NET LOW CX NO UI | Use after free in Windows VMSwitch allows an authorized attacker to elevate priv | |
|
68
|
CVE-2026-83688 |
8.8 | 0.0093 | NET NO AUTH LOW CX | Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attac | |
|
68
|
CVE-2023-28663 |
8.8 | 0.0093 | NET LOW CX NO UI | The Formidable PRO2PDF WordPress Plugin, version < 3.11, is affected by an authe | |
|
68
|
CVE-2026-83759 |
8.8 | 0.0092 | NET LOW CX NO UI | Improper control of generation of code ('code injection') in Windows Encrypting | |
|
68
|
CVE-2026-62312 |
8.8 | 0.0092 | NET LOW CX NO UI | 9Router is an AI router & token saver. Prior to 0.5.2, 9Router allows a remote a | |
|
68
|
CVE-2026-72950 |
8.8 | 0.0092 | NET LOW CX NO UI | Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows | |
|
68
|
CVE-2026-73625 |
8.7 | 0.0092 | NET LOW CX NO UI | GitPython versions before 3.1.54 contain a remote code execution vulnerability i | |
|
68
|
CVE-2026-56748 |
8.7 | 0.0092 | NET LOW CX NO UI | Improper validation of symbolic links in the Pack Git import feature in Cribl St | |
|
68
|
CVE-2026-48584 |
8.8 | 0.0091 | NET LOW CX NO UI | Execution with unnecessary privileges in Azure Synapse allows an authorized atta | |
|
68
|
CVE-2026-56642 |
8.8 | 0.0091 | NET LOW CX NO UI | Stack-based buffer overflow in Microsoft Fabric Data Warehouse allows an authori | |
|
68
|
CVE-2026-59133 |
8.8 | 0.0091 | NET LOW CX NO UI | Execution with unnecessary privileges in Microsoft High Performance Computing (H | |
|
68
|
CVE-2026-70174 |
8.8 | 0.0091 | NET NO AUTH LOW CX | Improperly implemented security check for standard in .NET allows an unauthorize | |
|
68
|
CVE-2026-62790 |
8.8 | 0.0091 | NET LOW CX NO UI | Heap-based buffer overflow in Windows SMB Server allows an authorized attacker t | |
|
68
|
CVE-2026-48564 |
8.8 | 0.0091 | NET LOW CX NO UI | Heap-based buffer overflow in Windows DHCP Server allows an authorized attacker | |
|
65
|
CVE-2026-57990 |
7.4 | 0.0092 | NET NO AUTH LOW CX | Files or directories accessible to external parties in Microsoft Edge (Chromium- | |
|
65
|
CVE-2026-65802 |
7.4 | 0.0092 | NET NO AUTH LOW CX | External control of file name or path in Microsoft Edge for Android allows an un | |
|
65
|
CVE-2026-62906 |
7.4 | 0.0092 | NET NO AUTH LOW CX | Improper neutralization of special elements in data query logic in Microsoft Dis | |
|
65
|
CVE-2026-81383 |
7.4 | 0.0092 | NET NO AUTH LOW CX | Use of incorrectly-resolved name or reference in Visual Studio Code allows an un | |
|
63
|
CVE-2026-22313 |
9.1 | 0.0092 | NET LOW CX NO UI | The device has a webserver that exposes a REST API authenticated with a token on | |
|
62
|
CVE-2026-67340 |
8.6 | 0.0092 | NET LOW CX NO UI | ArcadeDB before 26.7.2 (arcadedb-engine) allows trigger scripts to look up host | |
|
60
|
CVE-2026-44865 |
7.2 | 0.0092 | NET LOW CX NO UI | Command injection vulnerabilities exist in the web-based management interface of | |
|
60
|
CVE-2026-71284 |
7.2 | 0.0092 | NET LOW CX NO UI | Fledge's backup-restore upload handler, upload_backup (python/fledge/services/co | |
|
60
|
CVE-2026-48163 |
7.2 | 0.0091 | NET LOW CX NO UI | MariaDB server is a community developed fork of MySQL server. From versions 10.6 |