Hunt List
12,825 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-107656 |
9.8 | 0.0085 | NET NO AUTH LOW CX NO UI | An authentication bypass using an alternate path or channel vulnerability in For | |
|
80
|
CVE-2026-12118 |
9.8 | 0.0085 | NET NO AUTH LOW CX NO UI | IBM webMethods Integration (on prem) 10.15, 10.11 could allow an unauthenticated | |
|
80
|
CVE-2026-13019 |
9.8 | 0.0085 | NET NO AUTH LOW CX NO UI | Esri Portal for ArcGIS versions 12.1 and earlier on Windows, Linux and Kubernete | |
|
80
|
CVE-2026-33819 |
9.8 | 0.0084 | NET NO AUTH LOW CX NO UI | Deserialization of untrusted data in Microsoft Bing allows an unauthorized attac | |
|
79
|
CVE-2026-44128 |
9.3 | 0.0085 | NET NO AUTH LOW CX NO UI | SEPPmail Secure Email Gateway before version 15.0.2.1 allows unauthenticated rem | |
|
79
|
CVE-2026-67594 |
9.3 | 0.0085 | NET NO AUTH LOW CX NO UI | Spikster through commit e1cdf8c contains a missing authentication vulnerability | |
|
79
|
CVE-2026-75627 |
9.3 | 0.0084 | NET NO AUTH LOW CX NO UI | Bastillion fails to properly validate request URI paths in its controller dispat | |
|
79
|
CVE-2026-69110 |
9.3 | 0.0084 | NET NO AUTH LOW CX NO UI | OpenCode Studio before 2.4.4 contains a missing authentication vulnerability tha | |
|
78
|
CVE-2026-67200 |
8.7 | 0.0085 | NET NO AUTH LOW CX NO UI | Perspective 5.0.0 contains a path traversal vulnerability that allows unauthenti | |
|
78
|
CVE-2026-43945 |
8.9 | 0.0084 | NET NO AUTH LOW CX NO UI | FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Versio | |
|
77
|
CVE-2026-41432 |
8.2 | 0.0085 | NET NO AUTH LOW CX NO UI | New API is a large language mode (LLM) gateway and artificial intelligence (AI) | |
|
75
|
CVE-2026-23904 |
7.3 | 0.0085 | NET NO AUTH LOW CX NO UI | Kyuubi Engine UI proxy accepts a host and port from the request path and proxies | |
|
75
|
CVE-2026-15561 |
7.5 | 0.0085 | NET NO AUTH LOW CX NO UI | A flaw was found in EAP's undertow http/1.1 chunked-transfer decoder. missing li | |
|
75
|
CVE-2024-26690 |
7.5 | 0.0084 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: net: stmmac | |
|
75
|
CVE-2026-25800 |
7.5 | 0.0084 | NET NO AUTH LOW CX NO UI | Quinn is a pure-Rust, async-compatible implementation of the IETF QUIC transport | |
|
75
|
CVE-2026-33814 |
7.5 | 0.0084 | NET NO AUTH LOW CX NO UI | When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of | |
|
75
|
CVE-2026-42826 |
7.5 | 0.0084 | NET NO AUTH LOW CX NO UI | Exposure of sensitive information to an unauthorized actor in Azure DevOps allow | |
|
75
|
CVE-2026-58015 |
7.5 | 0.0084 | NET NO AUTH LOW CX NO UI | A flaw was found in GLib. The D-Bus client-side implementation of the DBUS_COOKI | |
|
70
|
CVE-2026-9135 |
9.9 | 0.0084 | NET LOW CX NO UI | IBM Langflow OSS 1.0.0 through 1.10.0 Langflow versions up to 1.9.2 (commit 9498 | |
|
68
|
CVE-2026-88165 |
8.8 | 0.0085 | NET LOW CX NO UI | Out-of-bounds write in Active Directory Domain Services allows an authorized att | |
|
68
|
CVE-2026-64831 |
8.7 | 0.0085 | NET NO AUTH LOW CX | FFmpeg versions 8.0 through 8.1.2 contains a stack buffer overflow vulnerability | |
|
68
|
CVE-2026-103575 |
8.8 | 0.0085 | NET NO AUTH LOW CX | Use after free in Remote Desktop Client allows an unauthorized attacker to execu | |
|
68
|
CVE-2026-105007 |
8.8 | 0.0085 | NET NO AUTH LOW CX | An elevation of privilege vulnerability exists in the Network Driver Interface S | |
|
68
|
CVE-2026-108458 |
8.8 | 0.0085 | NET NO AUTH LOW CX | Use after free in Remote Desktop Client allows an unauthorized attacker to execu | |
|
68
|
CVE-2026-83789 |
8.8 | 0.0085 | NET NO AUTH LOW CX | Heap-based buffer overflow in Windows SMB Client allows an unauthorized attacker | |
|
68
|
CVE-2026-83797 |
8.8 | 0.0085 | NET NO AUTH LOW CX | Out-of-bounds read in Windows Partition Management Driver allows an unauthorized | |
|
68
|
CVE-2026-102203 |
8.8 | 0.0085 | NET NO AUTH LOW CX | Access of resource using incompatible type ('type confusion') in RPC Runtime all | |
|
68
|
CVE-2026-88219 |
8.8 | 0.0085 | NET NO AUTH LOW CX | Untrusted pointer dereference in RPC Runtime allows an unauthorized attacker to | |
|
68
|
CVE-2026-83874 |
8.8 | 0.0085 | NET NO AUTH LOW CX | Heap-based buffer overflow in Windows Event Tracing allows an unauthorized attac | |
|
68
|
CVE-2026-63093 |
8.7 | 0.0085 | NET NO AUTH LOW CX | Cursor for Windows version 3.2.16 contains a binary planting vulnerability that | |
|
68
|
CVE-2026-96044 |
8.8 | 0.0085 | NET LOW CX NO UI | No cwe for this issue in Microsoft Office SharePoint allows an authorized attack | |
|
68
|
CVE-2026-87697 |
8.8 | 0.0084 | NET NO AUTH LOW CX | Deserialization of untrusted data in .NET allows an unauthorized attacker to exe | |
|
68
|
CVE-2026-34965 |
8.7 | 0.0084 | NET LOW CX NO UI | Cockpit CMS contains an authenticated remote code execution vulnerability in the | |
|
68
|
CVE-2026-41094 |
8.8 | 0.0084 | NET NO AUTH LOW CX | Improper control of generation of code ('code injection') in Microsoft Data Form | |
|
68
|
CVE-2026-47303 |
8.8 | 0.0084 | NET LOW CX NO UI | Authentication bypass by assumed-immutable data in ASP.NET Core allows an author | |
|
68
|
CVE-2026-97010 |
8.8 | 0.0084 | NET NO AUTH LOW CX | Use after free in Microsoft Office Excel allows an unauthorized attacker to exec | |
|
68
|
CVE-2026-97011 |
8.8 | 0.0084 | NET NO AUTH LOW CX | Use of uninitialized resource in Microsoft Office Excel allows an unauthorized a | |
|
68
|
CVE-2026-97772 |
8.8 | 0.0084 | NET NO AUTH LOW CX | Double free in Microsoft Office Excel allows an unauthorized attacker to execute | |
|
68
|
CVE-2026-97773 |
8.8 | 0.0084 | NET NO AUTH LOW CX | Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized atta | |
|
68
|
CVE-2026-97775 |
8.8 | 0.0084 | NET NO AUTH LOW CX | Use after free in Microsoft Office Excel allows an unauthorized attacker to exec | |
|
68
|
CVE-2026-97777 |
8.8 | 0.0084 | NET NO AUTH LOW CX | Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized atta | |
|
66
|
CVE-2026-41113 |
8.1 | 0.0085 | NET NO AUTH NO UI | sagredo qmail before 2026.04.07 allows tls_quit remote code execution because of | |
|
66
|
CVE-2026-70563 |
8.1 | 0.0085 | NET NO AUTH LOW CX | Improper link resolution before file access ('link following') in Windows Shell | |
|
66
|
CVE-2026-70111 |
8.1 | 0.0084 | NET NO AUTH NO UI | Untrusted pointer dereference in Windows Kernel allows an unauthorized attacker | |
|
66
|
CVE-2026-69855 |
7.7 | 0.0084 | NET LOW CX NO UI | Server-side request forgery (ssrf) in Microsoft Copilot in Azure allows an autho | |
|
66
|
CVE-2026-85887 |
7.7 | 0.0084 | NET LOW CX NO UI | Incorrect permission assignment for critical resource in M365 Copilot allows an | |
|
65
|
CVE-2024-12397 |
7.4 | 0.0084 | NET NO AUTH NO UI | A flaw was found in Quarkus-HTTP, which incorrectly parses cookies with certain | |
|
62
|
CVE-2026-111231 |
8.6 | 0.0084 | NET LOW CX NO UI | Netgate pfSense CE through 2.9.0 contains an authorization bypass vulnerability | |
|
60
|
CVE-2026-7829 |
7.2 | 0.0085 | NET LOW CX NO UI | UltraVNC repeater through 1.8.2.2 contains a post-authentication out-of-bounds w | |
|
60
|
CVE-2026-18901 |
7.3 | 0.0085 | NET LOW CX NO UI | A security vulnerability has been detected in H3C NX15 V100R017. Affected is the |