Hunt List
12,907 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-98959 |
9.8 | 0.0061 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: btrfs: fix | |
|
80
|
CVE-2026-56188 |
9.8 | 0.0061 | NET NO AUTH LOW CX NO UI | Concurrent execution using shared resource with improper synchronization ('race | |
|
80
|
CVE-2026-4767 |
9.8 | 0.0061 | NET NO AUTH LOW CX NO UI | Missing authentication for critical function vulnerability in TR7 Cyber Defens | |
|
80
|
CVE-2026-9695 |
9.8 | 0.0061 | NET NO AUTH LOW CX NO UI | An Improper Authentication vulnerability affecting DELMIA Apriso from Release 20 | |
|
80
|
CVE-2026-62873 |
9.8 | 0.0061 | NET NO AUTH LOW CX NO UI | Improper verification of cryptographic signature in Microsoft 365 Admin Center a | |
|
80
|
CVE-2026-28008 |
9.8 | 0.0061 | NET NO AUTH LOW CX NO UI | Unauthenticated Broken Authentication in OAuth Single Sign On – SSO (OAuth Clien | |
|
80
|
CVE-2026-66465 |
9.8 | 0.0061 | NET NO AUTH LOW CX NO UI | Unauthenticated Broken Authentication in Cartify <= 1.3.0.1 versions. | |
|
80
|
CVE-2026-74001 |
9.8 | 0.0061 | NET NO AUTH LOW CX NO UI | Unauthenticated Broken Authentication in User Registration & Membership Pro <= 5 | |
|
80
|
CVE-2026-82116 |
9.8 | 0.0061 | NET NO AUTH LOW CX NO UI | Missing Authentication for Critical Function Vulnerability in HiRDB. This issu | |
|
80
|
CVE-2026-59555 |
10.0 | 0.0060 | NET NO AUTH LOW CX NO UI | Unauthenticated Arbitrary File Deletion in Participants Database <= 2.7.8.3 vers | |
|
80
|
CVE-2026-59792 |
9.8 | 0.0060 | NET NO AUTH LOW CX NO UI | In JetBrains IntelliJ IDEA before 2026.1.4, 2026.2 code execution via path trav | |
|
80
|
CVE-2026-65431 |
9.8 | 0.0060 | NET NO AUTH LOW CX NO UI | Joomla Extension - regularlabs.com - Zipslip in GeoIP extension - Geo IP databas | |
|
80
|
CVE-2026-43757 |
9.8 | 0.0060 | NET NO AUTH LOW CX NO UI | An out-of-bounds read was addressed with improved bounds checking. This issue is | |
|
80
|
CVE-2026-43802 |
9.8 | 0.0060 | NET NO AUTH LOW CX NO UI | An out-of-bounds write issue was addressed with improved bounds checking. This i | |
|
80
|
CVE-2026-43809 |
9.8 | 0.0060 | NET NO AUTH LOW CX NO UI | An out-of-bounds read was addressed with improved bounds checking. This issue is | |
|
79
|
CVE-2023-53982 |
9.3 | 0.0061 | NET NO AUTH LOW CX NO UI | PMB 7.4.6 contains a SQL injection vulnerability in the id parameter of the stor | |
|
78
|
CVE-2026-55276 |
9.1 | 0.0061 | NET NO AUTH LOW CX NO UI | Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat mean | |
|
78
|
CVE-2026-7747 |
8.9 | 0.0061 | NET NO AUTH LOW CX NO UI | A security flaw has been discovered in Totolink N300RH 3.2.4-B20220812. Affected | |
|
75
|
CVE-2023-25747 |
7.5 | 0.0061 | NET NO AUTH LOW CX NO UI | A potential use-after-free in libaudio was fixed by disabling the AAudio backend | |
|
75
|
CVE-2026-67422 |
7.5 | 0.0061 | NET NO AUTH LOW CX NO UI | pymdown-extensions is a collection of extensions for the Python Markdown library | |
|
75
|
CVE-2026-72582 |
7.5 | 0.0061 | NET NO AUTH LOW CX NO UI | A NULL pointer dereference vulnerability in fastschema through v0.15.1 allows an | |
|
75
|
CVE-2026-54063 |
7.5 | 0.0061 | NET NO AUTH LOW CX NO UI | Excelize is a Go language library for reading and writing Microsoft Excel spread | |
|
75
|
CVE-2026-45713 |
7.5 | 0.0061 | NET NO AUTH LOW CX NO UI | Mailpit is an email testing tool and API for developers. Prior to version 1.30.0 | |
|
75
|
CVE-2026-33256 |
7.5 | 0.0061 | NET NO AUTH LOW CX NO UI | An attacker can send a web request that causes unlimited memory allocation in th | |
|
69
|
CVE-2026-104350 |
9.3 | 0.0060 | NET NO AUTH LOW CX | Adobe Campaign Classic (ACC) is affected by a reflected Cross-Site Scripting (XS | |
|
68
|
CVE-2026-55730 |
8.7 | 0.0061 | NET NO AUTH LOW CX | Reflected Cross-Site Scripting (CWE-79) in LWEB802 in Loytec LWEB-802 before 5.0 | |
|
66
|
CVE-2026-58293 |
8.1 | 0.0061 | NET NO AUTH NO UI | External control of file name or path in Microsoft Edge (Chromium-based) allows | |
|
65
|
CVE-2026-85922 |
7.4 | 0.0061 | NET NO AUTH NO UI | Weak authentication in Azure Key Vault allows an unauthorized attacker to bypass | |
|
65
|
CVE-2026-65015 |
7.2 | 0.0061 | NET LOW CX NO UI | n8n versions before 2.30.1 contain a privilege escalation vulnerability in the A | |
|
63
|
CVE-2026-34653 |
8.7 | 0.0061 | NET LOW CX NO UI | Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2 | |
|
62
|
CVE-2026-8596 |
8.5 | 0.0061 | NET LOW CX NO UI | Cleartext storage of sensitive information in the ModelBuilder/Serve component i | |
|
58
|
CVE-2026-45738 |
8.7 | 0.0061 | NET LOW CX | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior | |
|
57
|
CVE-2026-58285 |
8.3 | 0.0061 | NET NO AUTH | Access of resource using incompatible type ('type confusion') in Microsoft Edge | |
|
57
|
CVE-2026-58287 |
8.3 | 0.0061 | NET NO AUTH | Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacke | |
|
57
|
CVE-2026-58288 |
8.3 | 0.0061 | NET NO AUTH | Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacke | |
|
57
|
CVE-2026-58596 |
8.3 | 0.0061 | NET NO AUTH | Untrusted pointer dereference in Microsoft Edge (Chromium-based) allows an unaut | |
|
55
|
CVE-2026-57975 |
7.5 | 0.0061 | NET NO AUTH | Access of resource using incompatible type ('type confusion') in Microsoft Edge | |
|
55
|
CVE-2026-57984 |
7.5 | 0.0061 | NET NO AUTH | Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacke | |
|
55
|
CVE-2026-57986 |
7.5 | 0.0061 | NET NO AUTH | Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacke | |
|
55
|
CVE-2026-57992 |
7.5 | 0.0061 | NET NO AUTH | Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacke | |
|
55
|
CVE-2026-58276 |
7.5 | 0.0061 | NET NO AUTH | Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacke | |
|
55
|
CVE-2026-58294 |
7.5 | 0.0061 | NET NO AUTH | Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacke | |
|
55
|
CVE-2026-59117 |
7.5 | 0.0061 | NET NO AUTH | Integer overflow or wraparound in Windows Terminal allows an unauthorized attack | |
|
55
|
CVE-2026-66315 |
7.5 | 0.0061 | NET NO AUTH | Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacke | |
|
55
|
CVE-2026-105592 |
7.5 | 0.0061 | NET NO AUTH | Heap-based buffer overflow in Microsoft Office Access allows an unauthorized att | |
|
55
|
CVE-2026-105714 |
7.5 | 0.0061 | NET NO AUTH | Heap-based buffer overflow in Microsoft Office Access allows an unauthorized att | |
|
55
|
CVE-2026-105715 |
7.5 | 0.0061 | NET NO AUTH | Integer overflow or wraparound in Microsoft Office Word allows an unauthorized a | |
|
55
|
CVE-2026-69397 |
7.5 | 0.0061 | NET NO AUTH | Use after free in OpenSSH for Windows allows an unauthorized attacker to execute | |
|
55
|
CVE-2026-69607 |
7.5 | 0.0061 | NET NO AUTH | Use after free in Windows Deployment Services allows an unauthorized attacker to | |
|
55
|
CVE-2026-77898 |
7.5 | 0.0061 | NET NO AUTH | Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker t |