Hunt List
12,830 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-46454 |
9.8 | 0.0083 | NET NO AUTH LOW CX NO UI | Improper Input Validation vulnerability in Apache Camel Cometd Component. The c | |
|
80
|
CVE-2026-90532 |
10.0 | 0.0083 | NET NO AUTH LOW CX NO UI | Adobe Experience Manager is affected by an Incorrect Authorization vulnerability | |
|
80
|
CVE-2026-16634 |
9.8 | 0.0082 | NET NO AUTH LOW CX NO UI | TOML::XS versions before 0.06 for Perl bundle an unsupported and vulnerable vers | |
|
80
|
CVE-2026-3490 |
10.0 | 0.0082 | NET NO AUTH LOW CX NO UI | picklescan before 1.0.4 fails to block pkgutil.resolve_name, allowing attackers | |
|
80
|
CVE-2026-66915 |
10.0 | 0.0082 | NET NO AUTH LOW CX NO UI | Joomla Extension - fabrikar.com - Remote code execution in Fabrik < 4.7.2 - An u | |
|
80
|
CVE-2026-10561 |
10.0 | 0.0082 | NET NO AUTH LOW CX NO UI | IBM Langflow OSS 1.0.0 through 1.9.3 has an vulnerability due to an improper iso | |
|
80
|
CVE-2026-5788 |
9.8 | 0.0082 | NET NO AUTH LOW CX NO UI | An Improper Access Control in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, an | |
|
80
|
CVE-2026-54990 |
9.8 | 0.0082 | NET NO AUTH LOW CX NO UI | Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attac | |
|
80
|
CVE-2026-83869 |
9.8 | 0.0082 | NET NO AUTH LOW CX NO UI | Integer underflow (wrap or wraparound) in DNS Server allows an unauthorized atta | |
|
79
|
CVE-2026-61514 |
9.3 | 0.0083 | NET NO AUTH LOW CX NO UI | Puwell IP Camera firmware versions 2.x through 4.x contains an authentication by | |
|
79
|
CVE-2026-70552 |
9.3 | 0.0083 | NET NO AUTH LOW CX NO UI | MaxSite CMS 109.5 and earlier contains an authentication bypass vulnerability in | |
|
79
|
CVE-2026-70558 |
9.3 | 0.0082 | NET NO AUTH LOW CX NO UI | Dinky's POST /download/uploadFromRsByLocal handler passes the caller-supplied pa | |
|
77
|
CVE-2026-76418 |
8.6 | 0.0082 | NET NO AUTH LOW CX NO UI | KEV | Cisco Secure Firewall ASA Software and Cisco Secure FTD Software contains an unc |
|
75
|
CVE-2026-69793 |
7.5 | 0.0083 | NET NO AUTH LOW CX NO UI | Improper validation of consistency within input in Windows TCP/IP allows an unau | |
|
75
|
CVE-2026-47612 |
7.5 | 0.0082 | NET NO AUTH LOW CX NO UI | NVIDIA Dynamo for Linux contains a vulnerability in the image loading component | |
|
75
|
CVE-2026-67866 |
7.5 | 0.0082 | NET NO AUTH LOW CX NO UI | Buffer Overflow vulnerability in Systerel S2OPC 1.7.3 allows a remote attacker t | |
|
75
|
CVE-2026-67871 |
7.5 | 0.0082 | NET NO AUTH LOW CX NO UI | Buffer Overflow vulnerability in Systerel S2OPC 1.7.3 allows a remote attacker t | |
|
72
|
CVE-2026-90932 |
8.6 | 0.0082 | NET LOW CX NO UI | 1 PoC | LaraDashboard versions 0.9.2 through 1.2.2 contain a path traversal vulnerabilit |
|
70
|
CVE-2026-47367 |
9.9 | 0.0083 | NET LOW CX NO UI | A malicious actor with access to the network and low privileges could exploit an | |
|
70
|
CVE-2026-50481 |
9.9 | 0.0082 | NET LOW CX NO UI | Modification of assumed-immutable data (maid) in Azure Active Directory allows a | |
|
69
|
CVE-2026-69259 |
9.4 | 0.0082 | NET LOW CX NO UI | Flowise is a drag & drop user interface to build a customized large language mod | |
|
69
|
CVE-2026-50380 |
9.6 | 0.0082 | NET NO AUTH LOW CX | Heap-based buffer overflow in Windows GDI+ allows an unauthorized attacker to ex | |
|
68
|
CVE-2026-73602 |
9.0 | 0.0083 | NET LOW CX NO UI | Flowise before 3.1.3 contains a sandbox escape vulnerability in the vm2 JavaScri | |
|
68
|
CVE-2026-108452 |
8.8 | 0.0082 | NET LOW CX NO UI | Improper limitation of a pathname to a restricted directory ('path traversal') i | |
|
68
|
CVE-2026-97739 |
8.8 | 0.0082 | NET NO AUTH LOW CX | Integer underflow (wrap or wraparound) in Microsoft Office Excel allows an unaut | |
|
68
|
CVE-2026-97761 |
8.8 | 0.0082 | NET NO AUTH LOW CX | Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized att | |
|
68
|
CVE-2026-97765 |
8.8 | 0.0082 | NET NO AUTH LOW CX | Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized atta | |
|
68
|
CVE-2026-97776 |
8.8 | 0.0082 | NET NO AUTH LOW CX | Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized atta | |
|
68
|
CVE-2026-97780 |
8.8 | 0.0082 | NET NO AUTH LOW CX | Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized atta | |
|
68
|
CVE-2026-56645 |
8.8 | 0.0082 | NET NO AUTH LOW CX | Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthor | |
|
68
|
CVE-2026-57974 |
8.8 | 0.0082 | NET NO AUTH LOW CX | Integer overflow or wraparound in Microsoft Edge (Chromium-based) allows an unau | |
|
68
|
CVE-2026-57981 |
8.8 | 0.0082 | NET NO AUTH LOW CX | Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacke | |
|
68
|
CVE-2026-57102 |
8.8 | 0.0082 | NET NO AUTH LOW CX | Inclusion of functionality from untrusted control sphere in Visual Studio Code a | |
|
68
|
CVE-2026-62785 |
8.8 | 0.0082 | NET NO AUTH LOW CX | Heap-based buffer overflow in Windows LDAP - Lightweight Directory Access Protoc | |
|
68
|
CVE-2026-62795 |
8.8 | 0.0082 | NET NO AUTH LOW CX | Use after free in Windows LDAP - Lightweight Directory Access Protocol allows an | |
|
68
|
CVE-2026-62822 |
8.8 | 0.0082 | NET NO AUTH LOW CX | Integer overflow or wraparound in Windows GDI+ allows an unauthorized attacker t | |
|
68
|
CVE-2026-62824 |
8.8 | 0.0082 | NET NO AUTH LOW CX | Stack-based buffer overflow in Remote Desktop Client allows an unauthorized atta | |
|
68
|
CVE-2026-62870 |
8.8 | 0.0082 | NET NO AUTH LOW CX | Use after free in Microsoft Office Excel allows an unauthorized attacker to exec | |
|
67
|
CVE-2026-50521 |
8.3 | 0.0082 | NET LOW CX NO UI | Use after free in Microsoft Edge (Chromium-based) allows an authorized attacker | |
|
66
|
CVE-2026-86412 |
8.1 | 0.0083 | NET NO AUTH NO UI | A remote HTTP server can set a cookie that curl accepts and writes to a Netscape | |
|
66
|
CVE-2026-87863 |
8.1 | 0.0083 | NET NO AUTH NO UI | An authenticated HTTPS origin can supply an HSTS `max-age` value that the parser | |
|
66
|
CVE-2026-87864 |
8.1 | 0.0083 | NET NO AUTH NO UI | Enabling `CURLOPT_CRLF` causes curl to advertise the raw input byte count in the | |
|
66
|
CVE-2026-92386 |
8.1 | 0.0083 | NET NO AUTH NO UI | When writing a long cookie name and value to a Netscape cookie jar, a remote HTT | |
|
66
|
CVE-2026-41105 |
8.1 | 0.0083 | NET LOW CX NO UI | Server-side request forgery (ssrf) in Azure Notification Service allows an autho | |
|
66
|
CVE-2026-88094 |
8.1 | 0.0082 | NET LOW CX NO UI | Improper neutralization of special elements in output used by a downstream compo | |
|
65
|
CVE-2026-102234 |
7.4 | 0.0082 | NET NO AUTH LOW CX | Reliance on untrusted inputs in a security decision in Visual Studio Code allows | |
|
63
|
CVE-2026-66709 |
9.1 | 0.0082 | NET LOW CX NO UI | Shop manager Remote Code Execution (RCE) in CTX Feed <= 6.6.42 versions. | |
|
60
|
CVE-2026-25917 |
7.2 | 0.0082 | NET LOW CX NO UI | Dag Authors, who normally should not be able to execute code in the webserver co | |
|
60
|
CVE-2026-14958 |
7.2 | 0.0082 | NET LOW CX NO UI | IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 could allow a remote authenticated at | |
|
55
|
CVE-2026-76012 |
7.5 | 0.0083 | NET NO UI | The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for Wor |