Hunt List
12,807 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-41900 |
10.0 | 0.0091 | NET NO AUTH LOW CX NO UI | OpenLearnX is an open-source, decentralized learning and assessment platform. Pr | |
|
78
|
CVE-2026-43947 |
8.9 | 0.0091 | NET NO AUTH LOW CX NO UI | FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Versio | |
|
77
|
CVE-2026-76418 |
8.6 | 0.0091 | NET NO AUTH LOW CX NO UI | KEV | Cisco Secure Firewall ASA Software and Cisco Secure FTD Software contains an unc |
|
75
|
CVE-2026-40379 |
7.5 | 0.0091 | NET NO AUTH LOW CX NO UI | Exposure of sensitive information to an unauthorized actor in Azure Entra ID all | |
|
68
|
CVE-2026-49178 |
8.8 | 0.0091 | NET LOW CX NO UI | Heap-based buffer overflow in Active Directory Domain Services allows an authori | |
|
68
|
CVE-2026-50666 |
8.8 | 0.0091 | NET LOW CX NO UI | Use after free in Windows Remote Access Connection Manager allows an authorized | |
|
68
|
CVE-2026-55002 |
8.8 | 0.0091 | NET LOW CX NO UI | External control of file name or path in SQL Server allows an authorized attacke | |
|
68
|
CVE-2026-56194 |
8.8 | 0.0091 | NET LOW CX NO UI | Heap-based buffer overflow in Windows Network File System allows an authorized a | |
|
68
|
CVE-2026-56647 |
8.8 | 0.0091 | NET LOW CX NO UI | Integer overflow or wraparound in Windows Remote Access Service Infrastructure a | |
|
68
|
CVE-2026-58626 |
8.8 | 0.0091 | NET LOW CX NO UI | Use after free in Windows Remote Desktop Services allows an authorized attacker | |
|
68
|
CVE-2026-62784 |
8.8 | 0.0091 | NET LOW CX NO UI | Heap-based buffer overflow in Microsoft Local Security Authority Server (lsasrv) | |
|
68
|
CVE-2026-62818 |
8.8 | 0.0091 | NET LOW CX NO UI | Use after free in Active Directory Certificate Services (AD CS) allows an author | |
|
68
|
CVE-2026-62913 |
8.8 | 0.0091 | NET LOW CX NO UI | Heap-based buffer overflow in Microsoft Exchange Server allows an authorized att | |
|
68
|
CVE-2026-67373 |
8.8 | 0.0091 | NET LOW CX NO UI | Heap-based buffer overflow in SQL Server allows an authorized attacker to execut | |
|
68
|
CVE-2026-69464 |
8.8 | 0.0091 | NET LOW CX NO UI | Execution with unnecessary privileges in Microsoft Office SharePoint allows an a | |
|
68
|
CVE-2026-69547 |
8.8 | 0.0091 | NET LOW CX NO UI | Heap-based buffer overflow in Windows DHCP Server allows an authorized attacker | |
|
68
|
CVE-2026-71352 |
8.8 | 0.0091 | NET LOW CX NO UI | Integer underflow (wrap or wraparound) in Windows Remote Access Connection Manag | |
|
68
|
CVE-2026-72959 |
8.8 | 0.0091 | NET LOW CX NO UI | Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows | |
|
68
|
CVE-2026-73012 |
8.8 | 0.0091 | NET LOW CX NO UI | Heap-based buffer overflow in Windows Management Services allows an authorized a | |
|
68
|
CVE-2026-77481 |
8.8 | 0.0091 | NET LOW CX NO UI | Heap-based buffer overflow in SQL Server allows an authorized attacker to execut | |
|
68
|
CVE-2026-78456 |
8.8 | 0.0091 | NET LOW CX NO UI | Heap-based buffer overflow in SQL Server allows an authorized attacker to execut | |
|
68
|
CVE-2026-80096 |
8.8 | 0.0091 | NET LOW CX NO UI | Out-of-bounds read in Windows Remote Desktop Services allows an authorized attac | |
|
68
|
CVE-2026-67380 |
8.8 | 0.0091 | NET LOW CX NO UI | Heap-based buffer overflow in SQL Server allows an authorized attacker to execut | |
|
68
|
CVE-2026-67381 |
8.8 | 0.0091 | NET LOW CX NO UI | Heap-based buffer overflow in SQL Server allows an authorized attacker to elevat | |
|
68
|
CVE-2026-67384 |
8.8 | 0.0091 | NET LOW CX NO UI | Integer overflow or wraparound in SQL Server allows an authorized attacker to ex | |
|
68
|
CVE-2026-67385 |
8.8 | 0.0091 | NET LOW CX NO UI | Use after free in SQL Server allows an authorized attacker to execute code over | |
|
68
|
CVE-2026-67388 |
8.8 | 0.0091 | NET LOW CX NO UI | Heap-based buffer overflow in SQL Server allows an authorized attacker to execut | |
|
68
|
CVE-2026-67638 |
8.8 | 0.0091 | NET LOW CX NO UI | Heap-based buffer overflow in SQL Server allows an authorized attacker to execut | |
|
68
|
CVE-2026-67639 |
8.8 | 0.0091 | NET LOW CX NO UI | Heap-based buffer overflow in SQL Server allows an authorized attacker to execut | |
|
68
|
CVE-2026-67642 |
8.8 | 0.0091 | NET LOW CX NO UI | Heap-based buffer overflow in SQL Server allows an authorized attacker to execut | |
|
68
|
CVE-2026-68775 |
8.8 | 0.0091 | NET LOW CX NO UI | Heap-based buffer overflow in SQL Server allows an authorized attacker to execut | |
|
68
|
CVE-2026-68786 |
8.8 | 0.0091 | NET LOW CX NO UI | Heap-based buffer overflow in SQL Server allows an authorized attacker to execut | |
|
68
|
CVE-2026-69355 |
8.8 | 0.0091 | NET LOW CX NO UI | External control of file name or path in Microsoft Exchange Server allows an aut | |
|
68
|
CVE-2026-69485 |
8.8 | 0.0091 | NET LOW CX NO UI | Use of uninitialized resource in Remote Desktop Client allows an authorized atta | |
|
68
|
CVE-2026-69551 |
8.8 | 0.0091 | NET LOW CX NO UI | Use after free in Windows DNS allows an authorized attacker to execute code over | |
|
68
|
CVE-2026-69628 |
8.8 | 0.0091 | NET LOW CX NO UI | Heap-based buffer overflow in Windows iSCSI allows an authorized attacker to exe | |
|
68
|
CVE-2026-69712 |
8.8 | 0.0091 | NET LOW CX NO UI | Use after free in Windows Key Distribution Center allows an authorized attacker | |
|
68
|
CVE-2026-69729 |
8.8 | 0.0091 | NET LOW CX NO UI | Heap-based buffer overflow in Windows Credential Providers allows an authorized | |
|
68
|
CVE-2026-71336 |
8.8 | 0.0091 | NET LOW CX NO UI | Integer overflow or wraparound in Windows Work Folder Service allows an authoriz | |
|
68
|
CVE-2026-100212 |
8.8 | 0.0091 | NET NO AUTH LOW CX | Use after free in Microsoft Office Excel allows an unauthorized attacker to exec | |
|
68
|
CVE-2026-70343 |
8.8 | 0.0091 | NET NO AUTH LOW CX | Heap-based buffer overflow in Microsoft MPEG-2 Video Extension allows an unautho | |
|
68
|
CVE-2026-70256 |
8.8 | 0.0091 | NET NO AUTH LOW CX | Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized at | |
|
68
|
CVE-2026-70257 |
8.8 | 0.0091 | NET NO AUTH LOW CX | Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized at | |
|
68
|
CVE-2026-70268 |
8.8 | 0.0091 | NET NO AUTH LOW CX | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attac | |
|
68
|
CVE-2026-70282 |
8.8 | 0.0091 | NET NO AUTH LOW CX | Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized at | |
|
68
|
CVE-2026-70287 |
8.8 | 0.0091 | NET NO AUTH LOW CX | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attac | |
|
68
|
CVE-2026-70301 |
8.8 | 0.0091 | NET NO AUTH LOW CX | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attac | |
|
68
|
CVE-2026-70302 |
8.8 | 0.0091 | NET NO AUTH LOW CX | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attac | |
|
68
|
CVE-2026-83778 |
8.8 | 0.0091 | NET NO AUTH LOW CX | Heap-based buffer overflow in Microsoft Internet Messaging API allows an unautho | |
|
68
|
CVE-2026-97756 |
8.8 | 0.0091 | NET NO AUTH LOW CX | Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized atta |