Hunt List
12,861 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
90
|
CVE-2026-83938 |
10.0 | 0.0071 | NET NO AUTH LOW CX NO UI | 1 PoC | Missing authentication for critical function in Azure Kubernetes Configuration S |
|
80
|
CVE-2026-26332 |
10.0 | 0.0071 | NET NO AUTH LOW CX NO UI | vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.0, Suppresse | |
|
80
|
CVE-2026-110799 |
9.8 | 0.0071 | NET NO AUTH LOW CX NO UI | Vvveb is a powerful and easy to use CMS with page builder to build websites, blo | |
|
80
|
CVE-2026-77264 |
9.8 | 0.0071 | NET NO AUTH LOW CX NO UI | The Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Co | |
|
78
|
CVE-2026-17060 |
9.1 | 0.0071 | NET NO AUTH LOW CX NO UI | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to o | |
|
78
|
CVE-2026-13164 |
8.8 | 0.0071 | NET NO AUTH LOW CX NO UI | Missing Authentication for Critical Function (CWE-306) in the RegisterView (apps | |
|
78
|
CVE-2026-55685 |
8.7 | 0.0071 | NET NO AUTH LOW CX NO UI | React Router is a router for React. In versions 7.0.0 through 7.17.0, the manife | |
|
78
|
CVE-2026-53985 |
8.7 | 0.0071 | NET NO AUTH LOW CX NO UI | Ground Station prior to 0.6.0 contains an unauthenticated denial-of-service vuln | |
|
78
|
CVE-2026-67585 |
8.7 | 0.0071 | NET NO AUTH LOW CX NO UI | Allocation of Resources Without Limits or Throttling vulnerability in DivvyPayHQ | |
|
75
|
CVE-2026-42402 |
7.5 | 0.0071 | NET NO AUTH LOW CX NO UI | Apache Neethi is vulnerable to a Denial of Service attack through algorithmic co | |
|
70
|
CVE-2026-105895 |
9.9 | 0.0071 | NET LOW CX NO UI | Adobe Experience Manager is affected by an Improper Input Validation vulnerabili | |
|
68
|
CVE-2026-12044 |
8.7 | 0.0071 | NET LOW CX NO UI | SQL injection in pgAdmin 4 across every dialog template that renders ``COMMENT O | |
|
68
|
CVE-2023-29550 |
8.8 | 0.0071 | NET NO AUTH LOW CX | Memory safety bugs present in Firefox 111 and Firefox ESR 102.9. Some of these b | |
|
68
|
CVE-2026-35164 |
8.8 | 0.0071 | NET LOW CX NO UI | Brave CMS is an open-source CMS. Prior to 2.0.6, an unrestricted file upload vul | |
|
68
|
CVE-2026-67378 |
9.0 | 0.0071 | NET NO AUTH NO UI | Untrusted pointer dereference in SQL Server allows an unauthorized attacker to e | |
|
68
|
CVE-2026-67636 |
9.0 | 0.0071 | NET NO AUTH NO UI | Out-of-bounds read in SQL Server allows an unauthorized attacker to execute code | |
|
68
|
CVE-2026-85610 |
8.7 | 0.0071 | NET LOW CX NO UI | OpenPanel before 2.3.0 fails to properly validate chart formula expressions, all | |
|
67
|
CVE-2026-52751 |
8.6 | 0.0071 | NET NO AUTH LOW CX | Ghidra before 12.1 contains an unsafe deserialization vulnerability in client-si | |
|
67
|
CVE-2026-13165 |
8.6 | 0.0071 | NET NO AUTH LOW CX | SzafirHost verifies the downloaded native library archive with one JarFile parse | |
|
66
|
CVE-2025-40135 |
8.1 | 0.0071 | NET NO AUTH NO UI | In the Linux kernel, the following vulnerability has been resolved: ipv6: use R | |
|
66
|
CVE-2026-62781 |
8.1 | 0.0071 | NET NO AUTH NO UI | Heap-based buffer overflow in RPC Runtime allows an unauthorized attacker to exe | |
|
66
|
CVE-2026-65679 |
8.1 | 0.0071 | NET NO AUTH NO UI | Heap-based buffer overflow in Windows iSCSI Target Service allows an unauthorize | |
|
66
|
CVE-2026-65796 |
8.1 | 0.0071 | NET NO AUTH NO UI | Heap-based buffer overflow in Windows iSCSI Target Service allows an unauthorize | |
|
66
|
CVE-2026-71331 |
8.1 | 0.0071 | NET NO AUTH NO UI | Integer overflow or wraparound in Windows Device Health Attestation (DHA) allows | |
|
66
|
CVE-2026-50686 |
8.1 | 0.0071 | NET NO AUTH NO UI | Access of resource using incompatible type ('type confusion') in Windows OLE all | |
|
66
|
CVE-2026-62792 |
8.1 | 0.0071 | NET NO AUTH NO UI | Stack-based buffer overflow in Windows TCP/IP allows an unauthorized attacker to | |
|
66
|
CVE-2026-62819 |
8.1 | 0.0071 | NET NO AUTH NO UI | Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows | |
|
66
|
CVE-2026-62889 |
8.1 | 0.0071 | NET NO AUTH NO UI | Double free in Windows Secure Socket Tunneling Protocol (SSTP) allows an unautho | |
|
66
|
CVE-2026-65789 |
8.1 | 0.0071 | NET NO AUTH NO UI | Use after free in Windows DNS allows an unauthorized attacker to execute code ov | |
|
66
|
CVE-2026-69438 |
8.1 | 0.0071 | NET NO AUTH NO UI | Incorrect conversion between numeric types in Microsoft JScript allows an unauth | |
|
66
|
CVE-2026-69510 |
8.1 | 0.0071 | NET NO AUTH NO UI | Stack-based buffer overflow in Windows DHCP Server allows an unauthorized attack | |
|
66
|
CVE-2026-69530 |
8.1 | 0.0071 | NET NO AUTH NO UI | Use after free in Reliable Multicast Transport Driver (RMCAST) allows an unautho | |
|
66
|
CVE-2026-69546 |
8.1 | 0.0071 | NET NO AUTH NO UI | Use after free in Active Directory Domain Services allows an unauthorized attack | |
|
66
|
CVE-2026-69620 |
8.1 | 0.0071 | NET NO AUTH NO UI | Stack-based buffer overflow in Windows DHCP Server allows an unauthorized attack | |
|
66
|
CVE-2026-69786 |
8.1 | 0.0071 | NET NO AUTH NO UI | Heap-based buffer overflow in Windows Text Shaping allows an unauthorized attack | |
|
66
|
CVE-2026-69813 |
8.1 | 0.0071 | NET NO AUTH NO UI | Use after free in Windows DNS allows an unauthorized attacker to execute code ov | |
|
66
|
CVE-2026-69858 |
8.1 | 0.0071 | NET NO AUTH NO UI | Use after free in Windows DNS allows an unauthorized attacker to execute code ov | |
|
66
|
CVE-2026-72936 |
8.1 | 0.0071 | NET NO AUTH NO UI | Use after free in Windows SMB Client allows an unauthorized attacker to execute | |
|
66
|
CVE-2026-72987 |
8.1 | 0.0071 | NET NO AUTH NO UI | Use after free in Windows DNS allows an unauthorized attacker to execute code ov | |
|
66
|
CVE-2026-78444 |
8.1 | 0.0071 | NET NO AUTH NO UI | Untrusted pointer dereference in Windows Failover Cluster allows an unauthorized | |
|
66
|
CVE-2026-78449 |
8.1 | 0.0071 | NET NO AUTH NO UI | Use after free in Reliable Multicast Transport Driver (RMCAST) allows an unautho | |
|
66
|
CVE-2026-78450 |
8.1 | 0.0071 | NET NO AUTH NO UI | Use after free in Reliable Multicast Transport Driver (RMCAST) allows an unautho | |
|
66
|
CVE-2026-83997 |
8.1 | 0.0071 | NET NO AUTH NO UI | Use after free in Windows Message Queuing allows an unauthorized attacker to exe | |
|
66
|
CVE-2026-55007 |
8.1 | 0.0071 | NET NO AUTH NO UI | Double free in Microsoft Exchange Server allows an unauthorized attacker to exec | |
|
66
|
CVE-2026-69325 |
8.1 | 0.0071 | NET NO AUTH NO UI | Heap-based buffer overflow in Microsoft JScript allows an unauthorized attacker | |
|
66
|
CVE-2026-69524 |
8.1 | 0.0071 | NET NO AUTH NO UI | Use after free in Active Directory Domain Services allows an unauthorized attack | |
|
64
|
CVE-2025-39664 |
7.1 | 0.0071 | NET LOW CX NO UI | Insufficient escaping in the report scheduler within Checkmk <2.4.0p13, <2.3.0p3 | |
|
63
|
CVE-2026-71470 |
9.1 | 0.0071 | NET LOW CX NO UI | A flaw was found in the search-v2-operator. This vulnerability allows a privileg | |
|
60
|
CVE-2026-95707 |
7.2 | 0.0071 | NET LOW CX NO UI | A buffer overflow vulnerability in the PAPI protocol of AOS-8 could allow an aut | |
|
51
|
CVE-2026-33435 |
8.0 | 0.0071 | NET NO UI | Weblate is a web based localization tool. In versions prior to 5.17, the project |