Hunt List
12,844 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
89
|
CVE-2026-114509 |
9.2 | 0.0078 | NET NO AUTH LOW CX NO UI | 6 PoC | Laravel is a web application framework. Prior to 12.68.0 and 13.29.0, TokenGuard |
|
80
|
CVE-2026-67282 |
10.0 | 0.0078 | NET NO AUTH LOW CX NO UI | Joomla Extension - fabrikar.com - Unauthenticated remote code execution in Fabri | |
|
80
|
CVE-2026-63887 |
9.8 | 0.0078 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: scsi: targe | |
|
80
|
CVE-2026-63888 |
9.8 | 0.0078 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: scsi: targe | |
|
78
|
CVE-2026-50234 |
8.7 | 0.0078 | NET NO AUTH LOW CX NO UI | Lyrion Music Server 9.2.0 contains a path traversal vulnerability that allows un | |
|
78
|
CVE-2026-69223 |
9.1 | 0.0078 | NET NO AUTH LOW CX NO UI | Apache Allura's webhooks are vulnerable to Server-Side Request Forgery (SSRF). | |
|
78
|
CVE-2026-47301 |
8.8 | 0.0078 | NET LOW CX NO UI | 1 PoC | Improper access control in Microsoft Configuration Manager allows an authorized |
|
78
|
CVE-2026-54121 |
8.8 | 0.0078 | NET LOW CX NO UI | 15 PoC | Improper authorization in Active Directory Certificate Services (AD CS) allows a |
|
78
|
CVE-2026-64609 |
9.1 | 0.0078 | NET NO AUTH LOW CX NO UI | Out-of-bounds read via sun.misc.Unsafe in Apache Fory. When out-of-band zero-cop | |
|
77
|
CVE-2026-59250 |
8.3 | 0.0078 | NET NO AUTH LOW CX NO UI | Classic buffer overflow in the Erlang/OTP megaco flex scanner C driver allows a | |
|
77
|
CVE-2026-62331 |
8.2 | 0.0078 | NET NO AUTH LOW CX NO UI | praktor is a multi-agent Claude Code orchestrator with Telegram input and output | |
|
75
|
CVE-2026-11595 |
7.5 | 0.0078 | NET NO AUTH LOW CX NO UI | IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to o | |
|
75
|
CVE-2026-54399 |
7.5 | 0.0078 | NET NO AUTH LOW CX NO UI | Uncontrolled Resource Consumption vulnerability in the HTTP/1.1 message parser i | |
|
75
|
CVE-2026-67260 |
7.3 | 0.0078 | NET NO AUTH LOW CX NO UI | Apache Airflow 3.3.0 moved human-in-the-loop tasks from the triggerer to a new ` | |
|
70
|
CVE-2026-47647 |
9.9 | 0.0078 | NET LOW CX NO UI | Improper access control in Microsoft Dynamics 365 allows an authorized attacker | |
|
70
|
CVE-2026-45499 |
9.9 | 0.0078 | NET LOW CX NO UI | Server-side request forgery (ssrf) in Azure OpenAI allows an authorized attacker | |
|
70
|
CVE-2026-57100 |
9.9 | 0.0078 | NET LOW CX NO UI | Server-side request forgery (ssrf) in Microsoft Entra Provisioning Service (Sync | |
|
70
|
CVE-2026-62830 |
9.9 | 0.0078 | NET LOW CX NO UI | Missing authorization in Azure SRE Agent allows an authorized attacker to elevat | |
|
70
|
CVE-2026-69851 |
9.9 | 0.0078 | NET LOW CX NO UI | Server-side request forgery (ssrf) in Azure Active Directory allows an authorize | |
|
70
|
CVE-2026-83941 |
9.9 | 0.0078 | NET LOW CX NO UI | Missing authorization in Entra ID allows an authorized attacker to elevate privi | |
|
70
|
CVE-2026-85878 |
9.9 | 0.0078 | NET LOW CX NO UI | Improper authorization in Azure Database for PostgreSQL allows an authorized att | |
|
68
|
CVE-2025-10533 |
8.8 | 0.0078 | NET LOW CX NO UI | Integer overflow in the SVG component. This vulnerability was fixed in Firefox 1 | |
|
68
|
CVE-2026-32157 |
8.8 | 0.0078 | NET NO AUTH LOW CX | Use after free in Remote Desktop Client allows an unauthorized attacker to execu | |
|
68
|
CVE-2026-54998 |
8.8 | 0.0078 | NET LOW CX NO UI | Incorrect authorization in Microsoft Exchange Online allows an authorized attack | |
|
68
|
CVE-2026-57969 |
8.8 | 0.0078 | NET LOW CX NO UI | Missing authentication for critical function in Azure CycleCloud allows an autho | |
|
68
|
CVE-2026-47300 |
8.8 | 0.0078 | NET LOW CX NO UI | Incorrect implementation of authentication algorithm in ASP.NET Core allows an a | |
|
68
|
CVE-2026-65668 |
8.8 | 0.0078 | NET LOW CX NO UI | Improper access control in Microsoft Purview eDiscovery allows an authorized att | |
|
68
|
CVE-2026-70326 |
8.8 | 0.0078 | NET LOW CX NO UI | Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an auth | |
|
68
|
CVE-2026-62872 |
8.8 | 0.0078 | NET LOW CX NO UI | Incorrect authorization in .NET Framework allows an authorized attacker to eleva | |
|
68
|
CVE-2026-50360 |
8.8 | 0.0078 | NET LOW CX NO UI | Incorrect implementation of authentication algorithm in Windows SMB Server allow | |
|
68
|
CVE-2026-50444 |
8.8 | 0.0078 | NET LOW CX NO UI | Missing authentication for critical function in Windows Server Update Service al | |
|
68
|
CVE-2026-69465 |
8.8 | 0.0078 | NET LOW CX NO UI | Missing authorization in Microsoft Office SharePoint allows an authorized attack | |
|
68
|
CVE-2026-73028 |
8.8 | 0.0078 | NET LOW CX NO UI | Improper access control in SQL Server allows an authorized attacker to elevate p | |
|
68
|
CVE-2026-77480 |
8.8 | 0.0078 | NET LOW CX NO UI | Insufficient granularity of access control in SQL Server allows an authorized at | |
|
68
|
CVE-2026-77483 |
8.8 | 0.0078 | NET LOW CX NO UI | Weak authentication in SQL Server allows an authorized attacker to elevate privi | |
|
68
|
CVE-2026-77487 |
8.8 | 0.0078 | NET LOW CX NO UI | Improper access control in SQL Server allows an authorized attacker to elevate p | |
|
68
|
CVE-2026-66814 |
8.8 | 0.0078 | NET LOW CX NO UI | Insufficient granularity of access control in SQL Server allows an authorized at | |
|
68
|
CVE-2026-66818 |
8.8 | 0.0078 | NET LOW CX NO UI | Improper privilege management in SQL Server allows an authorized attacker to ele | |
|
68
|
CVE-2026-69268 |
8.8 | 0.0078 | NET LOW CX NO UI | Improper access control in Microsoft Office SharePoint allows an authorized atta | |
|
68
|
CVE-2026-69273 |
8.8 | 0.0078 | NET LOW CX NO UI | Improper access control in Microsoft Office SharePoint allows an authorized atta | |
|
68
|
CVE-2026-69282 |
8.8 | 0.0078 | NET LOW CX NO UI | Improper access control in Microsoft Office SharePoint allows an authorized atta | |
|
68
|
CVE-2026-69676 |
8.8 | 0.0078 | NET LOW CX NO UI | Authentication bypass by capture-replay in Windows Kerberos allows an authorized | |
|
68
|
CVE-2026-69724 |
8.8 | 0.0078 | NET LOW CX NO UI | Missing authorization in Microsoft Office SharePoint allows an authorized attack | |
|
68
|
CVE-2026-102855 |
8.8 | 0.0078 | NET NO AUTH LOW CX | Heap-based buffer overflow in Microsoft Office Visio allows an unauthorized atta | |
|
68
|
CVE-2026-110193 |
8.8 | 0.0078 | NET LOW CX NO UI | IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker with a low-p | |
|
66
|
CVE-2026-88185 |
8.1 | 0.0078 | NET NO AUTH NO UI | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attac | |
|
66
|
CVE-2026-70187 |
8.1 | 0.0078 | NET NO AUTH NO UI | Use after free in Remote Desktop Gateway Service allows an unauthorized attacker | |
|
66
|
CVE-2026-13308 |
8.1 | 0.0078 | NET NO AUTH NO UI | Autel MaxiCharger AC Elite Home WebSockets Integer Underflow Remote Code Executi | |
|
63
|
CVE-2026-48024 |
9.1 | 0.0078 | NET LOW CX NO UI | Wazuh is a free and open source platform used for threat prevention, detection, | |
|
57
|
CVE-2026-94109 |
8.6 | 0.0078 | NET LOW CX | openEQUELLA before 2026.1.0 contains an authenticated stored server-side templat |