Hunt List
8,459 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
90
|
CVE-2026-53921 |
9.8 | 0.0112 | NET NO AUTH LOW CX NO UI | 2 PoC | odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. P |
|
80
|
CVE-2026-88156 |
9.8 | 0.0117 | NET NO AUTH LOW CX NO UI | Stack-based buffer overflow in Microsoft Office Outlook allows an unauthorized a | |
|
80
|
CVE-2026-97016 |
9.8 | 0.0117 | NET NO AUTH LOW CX NO UI | Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized at | |
|
80
|
CVE-2026-26015 |
10.0 | 0.0117 | NET NO AUTH LOW CX NO UI | DocsGPT is a GPT-powered chat for documentation. From version 0.15.0 to before v | |
|
80
|
CVE-2026-48286 |
10.0 | 0.0117 | NET NO AUTH LOW CX NO UI | Adobe Campaign Classic (ACC) versions 7.4.3 build 9396 and earlier are affected | |
|
80
|
CVE-2026-27302 |
10.0 | 0.0117 | NET NO AUTH LOW CX NO UI | Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerabi | |
|
80
|
CVE-2026-71398 |
10.0 | 0.0117 | NET NO AUTH LOW CX NO UI | Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerabi | |
|
80
|
CVE-2026-35435 |
10.0 | 0.0116 | NET NO AUTH LOW CX NO UI | Improper access control in Azure AI Foundry M365 published agents allows an unau | |
|
80
|
CVE-2026-51785 |
9.8 | 0.0115 | NET NO AUTH LOW CX NO UI | An issue in Hugo Leisink Hiawatha v.12.1 and before allows a remote attacker to | |
|
80
|
CVE-2026-66909 |
9.8 | 0.0115 | NET NO AUTH LOW CX NO UI | Apache CXF's JMS transport deserializes the body of any inbound JMS ObjectMessag | |
|
80
|
CVE-2026-53421 |
9.8 | 0.0114 | NET NO AUTH LOW CX NO UI | Improper Isolation or Compartmentalization vulnerability in Apache Syncope. A | |
|
80
|
CVE-2026-70300 |
9.8 | 0.0113 | NET NO AUTH LOW CX NO UI | Untrusted pointer dereference in Microsoft Office Word allows an unauthorized at | |
|
80
|
CVE-2026-83770 |
9.8 | 0.0113 | NET NO AUTH LOW CX NO UI | Heap-based buffer overflow in Windows Text Shaping allows an unauthorized attack | |
|
80
|
CVE-2026-48316 |
10.0 | 0.0112 | NET NO AUTH LOW CX NO UI | ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Inpu | |
|
80
|
CVE-2026-52680 |
9.8 | 0.0111 | NET NO AUTH LOW CX NO UI | Apache Kyuubi REST batch multipart upload handling uses the client-supplied mult | |
|
80
|
CVE-2026-22738 |
9.8 | 0.0111 | NET NO AUTH LOW CX NO UI | In Spring AI, a SpEL injection vulnerability exists in SimpleVectorStore when a | |
|
80
|
CVE-2026-41252 |
9.8 | 0.0111 | NET NO AUTH LOW CX NO UI | xrdp is an open source RDP server. Versions 0.10.6 and prior contain a missing b | |
|
80
|
CVE-2026-100202 |
9.8 | 0.0111 | NET NO AUTH LOW CX NO UI | Use after free in Windows Message Queuing Queue Manager allows an unauthorized a | |
|
80
|
CVE-2026-100219 |
9.8 | 0.0111 | NET NO AUTH LOW CX NO UI | Use after free in Microsoft QUIC allows an unauthorized attacker to execute code | |
|
79
|
CVE-2026-68771 |
9.3 | 0.0115 | NET NO AUTH LOW CX NO UI | ComfyUI v0.23.0 contains an unsafe deserialization vulnerability in the LoadTrai | |
|
79
|
CVE-2026-100886 |
9.3 | 0.0115 | NET NO AUTH LOW CX NO UI | A vulnerability was identified in Seetong T8108, T8108P, T8116 and T8232 4.6.1.4 | |
|
79
|
CVE-2026-44590 |
9.3 | 0.0114 | NET NO AUTH LOW CX NO UI | Sherlock hunts down social media accounts by username across social networks. Pr | |
|
79
|
CVE-2026-42613 |
9.4 | 0.0114 | NET NO AUTH LOW CX NO UI | Grav is a file-based Web platform. Prior to 2.0.0-beta.2, the Login::register() | |
|
79
|
CVE-2026-63767 |
9.3 | 0.0112 | NET NO AUTH LOW CX NO UI | ktransformers through 0.6.3, fixed in commit def0f93, contains an unauthenticate | |
|
78
|
CVE-2017-20284 |
8.7 | 0.0117 | NET NO AUTH LOW CX NO UI | Caucho Resin contains a path traversal vulnerability in the documentation webapp | |
|
78
|
CVE-2014-125133 |
8.7 | 0.0112 | NET NO AUTH LOW CX NO UI | NativeChurch theme for WordPress before 1.6.2 contains a path traversal vulnerab | |
|
78
|
CVE-2026-66050 |
8.7 | 0.0112 | NET NO AUTH LOW CX NO UI | NitroShare Desktop through 0.3.4 contains a path traversal vulnerability in its | |
|
78
|
CVE-2026-24301 |
8.8 | 0.0111 | NET NO AUTH LOW CX | 1 PoC | Improper neutralization of special elements used in a command ('command injectio |
|
77
|
CVE-2026-42564 |
8.2 | 0.0116 | NET NO AUTH LOW CX NO UI | jotty·page is a self-hosted app for your checklists and notes. Prior to 1.22.0, | |
|
75
|
CVE-2026-77890 |
7.5 | 0.0117 | NET NO AUTH LOW CX NO UI | Access of resource using incompatible type ('type confusion') in Windows DHCP Se | |
|
75
|
CVE-2026-77893 |
7.5 | 0.0117 | NET NO AUTH LOW CX NO UI | Out-of-bounds read in Windows DHCP Server allows an unauthorized attacker to den | |
|
75
|
CVE-2026-77895 |
7.5 | 0.0117 | NET NO AUTH LOW CX NO UI | Out-of-bounds read in Windows DHCP Server allows an unauthorized attacker to den | |
|
75
|
CVE-2026-84001 |
7.5 | 0.0117 | NET NO AUTH LOW CX NO UI | Out-of-bounds read in Windows Key Distribution Center allows an unauthorized att | |
|
75
|
CVE-2026-49181 |
7.5 | 0.0117 | NET NO AUTH LOW CX NO UI | Integer underflow (wrap or wraparound) in Windows DHCP Client allows an unauthor | |
|
75
|
CVE-2026-72571 |
7.5 | 0.0115 | NET NO AUTH LOW CX NO UI | A path traversal vulnerability in mustafaakin/cast-localvideo (all versions) all | |
|
75
|
CVE-2026-72572 |
7.5 | 0.0115 | NET NO AUTH LOW CX NO UI | A path traversal vulnerability in o1lab/xmysql (all versions) allows an unauthen | |
|
75
|
CVE-2026-26129 |
7.5 | 0.0114 | NET NO AUTH LOW CX NO UI | Improper neutralization of special elements used in a command ('command injectio | |
|
75
|
CVE-2026-33111 |
7.5 | 0.0114 | NET NO AUTH LOW CX NO UI | Improper neutralization of special elements used in a command ('command injectio | |
|
75
|
CVE-2026-96861 |
7.5 | 0.0112 | NET NO AUTH LOW CX NO UI | Out-of-bounds read in Network Device Enrollment Service (NDES) allows an unautho | |
|
75
|
CVE-2026-96866 |
7.5 | 0.0112 | NET NO AUTH LOW CX NO UI | Out-of-bounds read in Network Device Enrollment Service (NDES) allows an unautho | |
|
75
|
CVE-2026-84017 |
7.5 | 0.0112 | NET NO AUTH LOW CX NO UI | Null pointer dereference in Windows Routing and Remote Access Service (RRAS) all | |
|
75
|
CVE-2026-85808 |
7.5 | 0.0112 | NET NO AUTH LOW CX NO UI | Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an | |
|
75
|
CVE-2026-87716 |
7.5 | 0.0112 | NET NO AUTH LOW CX NO UI | Heap-based buffer overflow in Windows Storage Spaces Controller allows an unauth | |
|
75
|
CVE-2026-96248 |
7.5 | 0.0112 | NET NO AUTH LOW CX NO UI | Stack-based buffer overflow in Windows Host Guardian Service allows an unauthori | |
|
75
|
CVE-2026-70281 |
7.5 | 0.0112 | NET NO AUTH LOW CX NO UI | Out-of-bounds read in Microsoft Office Outlook allows an unauthorized attacker t | |
|
75
|
CVE-2026-43668 |
7.5 | 0.0112 | NET NO AUTH LOW CX NO UI | A use after free issue was addressed with improved memory management. This issue | |
|
75
|
CVE-2026-103569 |
7.5 | 0.0111 | NET NO AUTH LOW CX NO UI | Out-of-bounds read in Windows IKE Extension allows an unauthorized attacker to d | |
|
68
|
CVE-2026-90865 |
9.0 | 0.0114 | NET NO AUTH NO UI | An OS command injection vulnerability in Progress Software WS_FTP Server version | |
|
66
|
CVE-2026-47297 |
8.1 | 0.0111 | NET NO AUTH NO UI | Deserialization of untrusted data in SQL Server allows an unauthorized attacker | |
|
64
|
CVE-2026-49069 |
7.1 | 0.0117 | NET NO AUTH LOW CX | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti |