Hunt List
12,857 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-11405 |
9.8 | 0.0076 | NET NO AUTH LOW CX NO UI | The web server binary /bin/httpd contains a hidden backdoor authentication mecha | |
|
80
|
CVE-2026-66012 |
10.0 | 0.0076 | NET NO AUTH LOW CX NO UI | SiYuan before v3.7.2 contains a missing authorization vulnerability in the POST | |
|
80
|
CVE-2026-79851 |
10.0 | 0.0076 | NET NO AUTH LOW CX NO UI | Buffer overflow vulnerabilities exist in the affected interface of AOS-10 that c | |
|
80
|
CVE-2023-30191 |
9.8 | 0.0076 | NET NO AUTH LOW CX NO UI | PrestaShop cdesigner < 3.1.9 is vulnerable to SQL Injection via CdesignerTraitem | |
|
80
|
CVE-2026-47131 |
10.0 | 0.0076 | NET NO AUTH LOW CX NO UI | vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, by combin | |
|
80
|
CVE-2026-68503 |
9.8 | 0.0075 | NET NO AUTH LOW CX NO UI | LazyOwn RedTeam/APT Framework is an AI-powered C2 and red-team operations framew | |
|
80
|
CVE-2026-79855 |
9.8 | 0.0075 | NET NO AUTH LOW CX NO UI | An authentication bypass vulnerability in the SSH daemon of AOS-8 allows an unau | |
|
80
|
CVE-2026-63071 |
9.8 | 0.0075 | NET NO AUTH LOW CX NO UI | Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An | |
|
79
|
CVE-2026-6350 |
9.3 | 0.0076 | NET NO AUTH LOW CX NO UI | MailGates/MailAudit developed by Openfind has a Stack-based Buffer Overflow vuln | |
|
79
|
CVE-2026-67595 |
9.2 | 0.0076 | NET NO AUTH LOW CX NO UI | VaahCMS versions 2.0.0 through 2.3.4 contain a malicious obfuscated JavaScript p | |
|
79
|
CVE-2026-20744 |
9.3 | 0.0076 | NET NO AUTH LOW CX NO UI | The charging station websocket endpoint accepts connections without proper auth | |
|
79
|
CVE-2024-26828 |
9.4 | 0.0075 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: cifs: fix u | |
|
79
|
CVE-2026-16462 |
9.3 | 0.0075 | NET NO AUTH LOW CX NO UI | In PROCON-WEB SCADA the endpoint 'GetGridData' is not properly sanitized. This a | |
|
78
|
CVE-2026-7546 |
8.9 | 0.0075 | NET NO AUTH LOW CX NO UI | A security vulnerability has been detected in Totolink NR1800X 9.1.0u.6279_B2021 | |
|
77
|
CVE-2026-39804 |
8.2 | 0.0076 | NET NO AUTH LOW CX NO UI | Allocation of Resources Without Limits or Throttling vulnerability in mtrudel ba | |
|
75
|
CVE-2026-48834 |
7.5 | 0.0076 | NET NO AUTH LOW CX NO UI | Improper Handling of Length Parameter Inconsistency vulnerability in Apache Answ | |
|
75
|
CVE-2026-42403 |
7.5 | 0.0076 | NET NO AUTH LOW CX NO UI | Apache Neethi does not properly detect circular references in policy definitions | |
|
69
|
CVE-2026-119145 |
9.4 | 0.0076 | NET LOW CX NO UI | Frappe before 15.121.0 and 16.x before 16.34.0 contains a path traversal vulnera | |
|
69
|
CVE-2026-69356 |
9.3 | 0.0076 | NET NO AUTH LOW CX | Improper neutralization of input during web page generation ('cross-site scripti | |
|
68
|
CVE-2026-41862 |
8.8 | 0.0076 | NET LOW CX NO UI | Spring Statemachine's Kryo-based persistence backends (JPA, MongoDB, Redis and Z | |
|
68
|
CVE-2026-96224 |
8.8 | 0.0076 | NET NO AUTH LOW CX | Out-of-bounds write in .NET allows an unauthorized attacker to execute code over | |
|
68
|
CVE-2026-47645 |
8.8 | 0.0076 | NET NO AUTH LOW CX | Url redirection to untrusted site ('open redirect') in Microsoft 365 Copilot's B | |
|
68
|
CVE-2026-59113 |
8.8 | 0.0076 | NET NO AUTH LOW CX | Missing authorization in Visual Studio Code allows an unauthorized attacker to e | |
|
68
|
CVE-2026-88150 |
8.8 | 0.0076 | NET NO AUTH LOW CX | Use of uninitialized resource in Microsoft Office Word allows an unauthorized at | |
|
68
|
CVE-2026-88202 |
8.8 | 0.0076 | NET NO AUTH LOW CX | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attac | |
|
68
|
CVE-2026-97003 |
8.8 | 0.0076 | NET NO AUTH LOW CX | Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized atta | |
|
68
|
CVE-2026-97017 |
8.8 | 0.0076 | NET NO AUTH LOW CX | Use after free in Microsoft Office Excel allows an unauthorized attacker to exec | |
|
68
|
CVE-2026-97750 |
8.8 | 0.0076 | NET NO AUTH LOW CX | Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized att | |
|
68
|
CVE-2026-97766 |
8.8 | 0.0076 | NET NO AUTH LOW CX | Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized atta | |
|
68
|
CVE-2026-78462 |
8.8 | 0.0076 | NET NO AUTH LOW CX | Authorization bypass through user-controlled key in Visual Studio Code allows an | |
|
68
|
CVE-2026-17630 |
8.8 | 0.0076 | NET LOW CX NO UI | IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote attacker to execute a | |
|
68
|
CVE-2023-37202 |
8.8 | 0.0076 | NET NO AUTH LOW CX | Cross-compartment wrappers wrapping a scripted proxy could have caused objects f | |
|
68
|
CVE-2023-32213 |
8.8 | 0.0075 | NET NO AUTH LOW CX | When reading a file, an uninitialized value could have been used as read limit. | |
|
68
|
CVE-2023-37211 |
8.8 | 0.0075 | NET NO AUTH LOW CX | Memory safety bugs present in Firefox 114, Firefox ESR 102.12, and Thunderbird 1 | |
|
68
|
CVE-2023-41677 |
8.8 | 0.0075 | NET NO AUTH LOW CX | A insufficiently protected credentials vulnerability in Fortinet FortiOS 7.4.0 t | |
|
68
|
CVE-2026-44880 |
8.8 | 0.0075 | NET LOW CX NO UI | A buffer overflow vulnerability was found in the command line interface of AOS-C | |
|
68
|
CVE-2026-16877 |
8.8 | 0.0075 | NET LOW CX NO UI | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote authenticated | |
|
68
|
CVE-2026-16911 |
8.8 | 0.0075 | NET LOW CX NO UI | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote authenticated | |
|
67
|
CVE-2026-15343 |
8.6 | 0.0075 | NET LOW CX NO UI | A path traversal vulnerability was identified in GitHub Enterprise Server that a | |
|
66
|
CVE-2026-108457 |
8.1 | 0.0076 | NET NO AUTH NO UI | Out-of-bounds write in Microsoft Windows PDF allows an unauthorized attacker to | |
|
66
|
CVE-2026-108460 |
8.1 | 0.0076 | NET NO AUTH NO UI | Use after free in Windows Message Queuing allows an unauthorized attacker to exe | |
|
66
|
CVE-2026-88119 |
8.1 | 0.0076 | NET NO AUTH NO UI | Use after free in Windows DHCP Server allows an unauthorized attacker to execute | |
|
66
|
CVE-2026-88120 |
8.1 | 0.0076 | NET NO AUTH NO UI | Use after free in Windows DHCP Server allows an unauthorized attacker to execute | |
|
66
|
CVE-2026-5821 |
8.1 | 0.0076 | NET LOW CX NO UI | The Image Optimizer plugin for WordPress is vulnerable to arbitrary file deletio | |
|
65
|
CVE-2026-10303 |
7.4 | 0.0076 | NET NO AUTH NO UI | In ServerCo getssl version 2.49 and prior, the ACME challenge token returned to | |
|
65
|
CVE-2026-63035 |
7.2 | 0.0076 | NET LOW CX NO UI | A heap use-after-free vulnerability in the TransferSubscriptions service in ope | |
|
64
|
CVE-2026-57988 |
7.1 | 0.0076 | NET NO AUTH LOW CX | Relative path traversal in Microsoft Edge (Chromium-based) allows an unauthorize | |
|
63
|
CVE-2026-35573 |
9.1 | 0.0076 | NET LOW CX NO UI | ChurchCRM is an open-source church management system. Prior to 6.5.3, a path tra | |
|
60
|
CVE-2026-39816 |
7.5 | 0.0076 | NET LOW CX NO UI | The optional extension component TinkerpopClientService is missing the Restricte | |
|
51
|
CVE-2026-49169 |
8.0 | 0.0075 | NET NO UI | Use after free in DNS Server allows an authorized attacker to execute code over |