Hunt List
12,891 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-85928 |
9.8 | 0.0063 | NET NO AUTH LOW CX NO UI | Heap-based buffer overflow in Windows Volume Manager Extension Driver allows an | |
|
80
|
CVE-2026-96864 |
9.8 | 0.0063 | NET NO AUTH LOW CX NO UI | Double free in Microsoft Failover Cluster Virtual Driver allows an unauthorized | |
|
80
|
CVE-2026-88102 |
9.8 | 0.0063 | NET NO AUTH LOW CX NO UI | Use after free in Windows Failover Cluster allows an unauthorized attacker to ex | |
|
80
|
CVE-2026-44182 |
10.0 | 0.0063 | NET NO AUTH LOW CX NO UI | Jupyter Enterprise Gateway launches remote Jupyter Notebook kernels across distr | |
|
80
|
CVE-2026-53481 |
9.8 | 0.0063 | NET NO AUTH LOW CX NO UI | Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release ver | |
|
78
|
CVE-2026-32145 |
8.7 | 0.0063 | NET NO AUTH LOW CX NO UI | Allocation of Resources Without Limits or Throttling vulnerability in gleam-wisp | |
|
78
|
CVE-2026-58375 |
8.7 | 0.0063 | NET NO AUTH LOW CX NO UI | JimuReport through 2.5.0 exposes the POST /jmreport/auto/export endpoint without | |
|
78
|
CVE-2026-9265 |
9.1 | 0.0063 | NET NO AUTH LOW CX NO UI | Crypt::OpenSSL::PKCS12 versions before 1.96 for Perl permits a heap OOB read in | |
|
78
|
CVE-2026-57074 |
9.1 | 0.0063 | NET NO AUTH LOW CX NO UI | XML::Bare versions through 0.53 for Perl have an unbounded character lookahead. | |
|
78
|
CVE-2026-57075 |
9.1 | 0.0063 | NET NO AUTH LOW CX NO UI | YAML::Syck versions before 1.47 for Perl allow an out-of-bounds read via a signe | |
|
78
|
CVE-2026-15065 |
9.1 | 0.0063 | NET NO AUTH LOW CX NO UI | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 NIM could allow a remote attacker | |
|
78
|
CVE-2025-51679 |
9.1 | 0.0063 | NET NO AUTH LOW CX NO UI | An issue was discovered in openRISC OR1200 commit 83ac6b. A mismatch between the | |
|
78
|
CVE-2016-20097 |
8.7 | 0.0063 | NET NO AUTH LOW CX NO UI | Weaver (Fanwei) E-cology 8.0 contains a SQL injection vulnerability in the Signa | |
|
77
|
CVE-2026-64642 |
8.3 | 0.0063 | NET NO AUTH LOW CX NO UI | Next.js is a React framework for building full-stack web applications. In versio | |
|
77
|
CVE-2026-111103 |
8.2 | 0.0063 | NET NO AUTH LOW CX NO UI | Improper Cleanup on Thrown Exception vulnerability in the HTTP/2 handler of mtru | |
|
75
|
CVE-2026-39836 |
7.5 | 0.0063 | NET NO AUTH LOW CX NO UI | The Dial and LookupPort functions panic on Windows when provided with an input c | |
|
75
|
CVE-2026-72586 |
7.5 | 0.0063 | NET NO AUTH LOW CX NO UI | A missing authentication vulnerability in frangoteam/FUXA through 1.3.3 allows a | |
|
75
|
CVE-2026-6732 |
7.5 | 0.0063 | NET NO AUTH LOW CX NO UI | A flaw was found in libxml2. This vulnerability occurs when the library processe | |
|
75
|
CVE-2026-56673 |
7.5 | 0.0063 | NET NO AUTH LOW CX NO UI | ComfyUI is a modular diffusion model GUI, API, and backend with a graph-and-node | |
|
75
|
CVE-2026-16958 |
7.5 | 0.0063 | NET NO AUTH LOW CX NO UI | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to c | |
|
74
|
CVE-2026-39999 |
7.0 | 0.0063 | NET NO AUTH LOW CX NO UI | Authentication Bypass by Spoofing vulnerability in Apache APISIX. The attacker | |
|
70
|
CVE-2026-12946 |
9.9 | 0.0063 | NET LOW CX NO UI | IBM Langflow OSS 1.0.0 through 1.10.0 could allow a remote attacker to inject ar | |
|
69
|
CVE-2026-66418 |
9.3 | 0.0063 | NET NO AUTH LOW CX | OpenClaw Dashboard v3.0.0 contains a stored cross-site scripting vulnerability t | |
|
69
|
CVE-2026-113678 |
9.4 | 0.0063 | NET LOW CX NO UI | Froxlor before 2.3.15 contains a symlink following vulnerability in Statistics:: | |
|
68
|
CVE-2026-108427 |
8.8 | 0.0063 | NET NO AUTH LOW CX | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attac | |
|
68
|
CVE-2023-3600 |
8.8 | 0.0063 | NET NO AUTH LOW CX | During the worker lifecycle, a use-after-free condition could have occurred, whi | |
|
68
|
CVE-2026-64960 |
8.7 | 0.0063 | NET LOW CX NO UI | ATutor Gameme module allows users to upload files of any type and extension with | |
|
68
|
CVE-2023-27310 |
8.8 | 0.0063 | NET LOW CX NO UI | A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.2). | |
|
68
|
CVE-2026-8478 |
8.8 | 0.0063 | NET LOW CX NO UI | IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote attacker to inject ar | |
|
68
|
CVE-2026-7607 |
8.7 | 0.0063 | NET LOW CX NO UI | A security vulnerability has been detected in TRENDnet TEW-821DAP 1.12B01. Impac | |
|
66
|
CVE-2026-25524 |
8.1 | 0.0063 | NET NO AUTH NO UI | Magento Long Term Support (LTS) is an unofficial, community-driven project provi | |
|
65
|
CVE-2026-7019 |
7.4 | 0.0063 | NET LOW CX NO UI | A vulnerability was identified in Tenda F456 1.0.0.5. The impacted element is th | |
|
65
|
CVE-2026-7029 |
7.4 | 0.0063 | NET LOW CX NO UI | A weakness has been identified in Tenda F456 1.0.0.5. The impacted element is th | |
|
65
|
CVE-2026-7030 |
7.4 | 0.0063 | NET LOW CX NO UI | A security vulnerability has been detected in Tenda F456 1.0.0.5. This affects t | |
|
65
|
CVE-2026-7032 |
7.4 | 0.0063 | NET LOW CX NO UI | A flaw has been found in Tenda F456 1.0.0.5. Affected is the function SafeEmailF | |
|
65
|
CVE-2026-7035 |
7.4 | 0.0063 | NET LOW CX NO UI | A vulnerability was determined in Tenda FH1202 1.2.0.14. This affects the functi | |
|
65
|
CVE-2026-7057 |
7.4 | 0.0063 | NET LOW CX NO UI | A flaw has been found in Tenda F456 1.0.0.5. The affected element is an unknown | |
|
65
|
CVE-2026-7079 |
7.4 | 0.0063 | NET LOW CX NO UI | A weakness has been identified in Tenda F456 1.0.0.5. This affects the function | |
|
65
|
CVE-2026-7099 |
7.4 | 0.0063 | NET LOW CX NO UI | A vulnerability was detected in Tenda F456 1.0.0.5. The affected element is the | |
|
65
|
CVE-2026-7151 |
7.4 | 0.0063 | NET LOW CX NO UI | A vulnerability was determined in Tenda HG3 2.0. Impacted is the function formUp | |
|
64
|
CVE-2026-6257 |
9.2 | 0.0063 | NET LOW CX NO UI | Vvveb CMS before 1.0.8.2 contains a remote code execution vulnerability in its m | |
|
63
|
CVE-2026-9827 |
9.1 | 0.0063 | NET LOW CX NO UI | A arbitrary file write vulnerability exists in the boa formUploadFile functional | |
|
63
|
CVE-2026-20266 |
9.1 | 0.0063 | NET LOW CX NO UI | In Splunk AI Toolkit versions below 5.7.4, a user who holds the "admin" Splunk r | |
|
62
|
CVE-2026-74035 |
8.6 | 0.0063 | NET LOW CX NO UI | Wazuh versions from 4.6.0 before 4.14.8 contain an authentication bypass vulnera | |
|
62
|
CVE-2026-55975 |
8.6 | 0.0063 | NET LOW CX NO UI | A vulnerability exists in H.View IP cameras that could allow an authenticated us | |
|
60
|
CVE-2026-9640 |
7.2 | 0.0063 | NET LOW CX NO UI | A privilege escalation vulnerability exists in LXD from 6.0 before 6.9, 5.21.0 b | |
|
57
|
CVE-2026-65818 |
8.5 | 0.0063 | NET NO UI | Server-side request forgery (ssrf) in Power Automate allows an authorized attack | |
|
57
|
CVE-2026-69857 |
8.5 | 0.0063 | NET NO UI | Authorization bypass through user-controlled key in Azure Cosmos DB allows an au | |
|
57
|
CVE-2026-70178 |
8.5 | 0.0063 | NET NO UI | Missing authorization in Microsoft Fabric allows an authorized attacker to eleva | |
|
55
|
CVE-2026-70095 |
7.5 | 0.0063 | NET NO AUTH | Heap-based buffer overflow in Windows iSCSI allows an unauthorized attacker to e |