Hunt List
8,459 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-83693 |
9.8 | 0.0110 | NET NO AUTH LOW CX NO UI | Heap-based buffer overflow in Windows Error Reporting allows an unauthorized att | |
|
80
|
CVE-2026-97814 |
9.8 | 0.0109 | NET NO AUTH LOW CX NO UI | Heap-based buffer overflow in Windows Text Shaping allows an unauthorized attack | |
|
80
|
CVE-2026-70096 |
9.8 | 0.0109 | NET NO AUTH LOW CX NO UI | Heap-based buffer overflow in Windows Rich Text Edit Control allows an unauthori | |
|
80
|
CVE-2026-44024 |
9.8 | 0.0109 | NET NO AUTH LOW CX NO UI | Fluentd collects events from various data sources and writes them to files, RDBM | |
|
80
|
CVE-2026-83780 |
9.8 | 0.0108 | NET NO AUTH LOW CX NO UI | Use after free in Windows CCFFilter Driver allows an unauthorized attacker to ex | |
|
80
|
CVE-2026-49819 |
9.8 | 0.0108 | NET NO AUTH LOW CX NO UI | UpSnap is a wake on lan web app. Versions 4.4.1 through 5.3.5 are vulnerable to | |
|
80
|
CVE-2026-51947 |
9.8 | 0.0107 | NET NO AUTH LOW CX NO UI | An issue in Pivotal CRM 6.6.4.08 and systems using patch-ghi-15381-cwe-502-20251 | |
|
80
|
CVE-2026-70147 |
9.8 | 0.0107 | NET NO AUTH LOW CX NO UI | Heap-based buffer overflow in Microsoft PostScript Printer Driver allows an unau | |
|
80
|
CVE-2026-70153 |
9.8 | 0.0107 | NET NO AUTH LOW CX NO UI | Heap-based buffer overflow in Microsoft PostScript Printer Driver allows an unau | |
|
80
|
CVE-2026-83578 |
9.8 | 0.0106 | NET NO AUTH LOW CX NO UI | Integer underflow (wrap or wraparound) in Windows PowerShell allows an unauthori | |
|
80
|
CVE-2026-70157 |
9.8 | 0.0106 | NET NO AUTH LOW CX NO UI | Heap-based buffer overflow in Windows System Information Console allows an unaut | |
|
80
|
CVE-2026-100222 |
9.8 | 0.0106 | NET NO AUTH LOW CX NO UI | Heap-based buffer overflow in Network Policy Server (NPS) allows an unauthorized | |
|
80
|
CVE-2026-83517 |
9.8 | 0.0106 | NET NO AUTH LOW CX NO UI | Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unaut | |
|
80
|
CVE-2026-83519 |
9.8 | 0.0106 | NET NO AUTH LOW CX NO UI | Heap-based buffer overflow in Windows Error Reporting allows an unauthorized att | |
|
80
|
CVE-2026-83910 |
9.8 | 0.0106 | NET NO AUTH LOW CX NO UI | Out-of-bounds write in RPC Runtime allows an unauthorized attacker to execute co | |
|
80
|
CVE-2026-97805 |
9.8 | 0.0106 | NET NO AUTH LOW CX NO UI | Out-of-bounds read in Windows Partition Management Driver allows an unauthorized | |
|
80
|
CVE-2026-65770 |
10.0 | 0.0105 | NET NO AUTH LOW CX NO UI | Improper neutralization of argument delimiters in a command ('argument injection | |
|
80
|
CVE-2026-96320 |
9.8 | 0.0105 | NET NO AUTH LOW CX NO UI | Heap-based buffer overflow in Windows DHCP Server allows an unauthorized attacke | |
|
79
|
CVE-2026-41939 |
9.3 | 0.0110 | NET NO AUTH LOW CX NO UI | Care Everywhere Gateway 14.3.10 contains a hard-coded credentials vulnerability | |
|
79
|
CVE-2026-18588 |
9.3 | 0.0110 | NET NO AUTH LOW CX NO UI | A vulnerability has been found in Wavlink WL-NU516U1 708c073-mt7628. This affect | |
|
79
|
CVE-2026-75784 |
9.3 | 0.0110 | NET NO AUTH LOW CX NO UI | A vulnerability was detected in TRENDnet TEW-WLC100 1v2.07b01. Affected by this | |
|
79
|
CVE-2026-71957 |
9.3 | 0.0107 | NET NO AUTH LOW CX NO UI | D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2_C1_2 | |
|
79
|
CVE-2026-71958 |
9.3 | 0.0107 | NET NO AUTH LOW CX NO UI | D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2_C1_2 | |
|
78
|
CVE-2026-69111 |
8.7 | 0.0110 | NET NO AUTH LOW CX NO UI | Milvus through 2.6.22 and 3.0.0 contains an unauthenticated denial of service vu | |
|
78
|
CVE-2026-15701 |
8.9 | 0.0110 | NET NO AUTH LOW CX NO UI | A weakness has been identified in Totolink NR1800X 9.1.0u.6279_B20210910. Affect | |
|
78
|
CVE-2026-18589 |
8.9 | 0.0110 | NET NO AUTH LOW CX NO UI | A vulnerability was found in Wavlink WL-NU516U1 708c073-mt7628. This impacts the | |
|
78
|
CVE-2026-58662 |
8.7 | 0.0108 | NET NO AUTH LOW CX NO UI | Improper Validation of Specified Quantity in Input, Out-of-bounds Read vulnerabi | |
|
78
|
CVE-2026-33598 |
9.1 | 0.0107 | NET NO AUTH LOW CX NO UI | A cached crafted response can cause an out-of-bounds read if custom Lua code cal | |
|
77
|
CVE-2026-20224 |
8.6 | 0.0109 | NET NO AUTH LOW CX NO UI | A vulnerability in the web UI of Cisco Catalyst SD-WAN Manager, formerly SD-WAN | |
|
77
|
CVE-2026-50429 |
8.2 | 0.0107 | NET NO AUTH LOW CX NO UI | Out-of-bounds read in Windows Kernel allows an unauthorized attacker to disclose | |
|
75
|
CVE-2026-83677 |
7.5 | 0.0110 | NET NO AUTH LOW CX NO UI | Missing release of memory after effective lifetime in Windows DHCP Client allows | |
|
75
|
CVE-2026-69454 |
7.5 | 0.0109 | NET NO AUTH LOW CX NO UI | Out-of-bounds read in Microsoft Azure Attestation service and Device Health Atte | |
|
75
|
CVE-2026-96236 |
7.5 | 0.0109 | NET NO AUTH LOW CX NO UI | Allocation of resources without limits or throttling in ASP.NET Core allows an u | |
|
75
|
CVE-2026-54130 |
7.5 | 0.0108 | NET NO AUTH LOW CX NO UI | Missing authentication for critical function in M365 Copilot allows an unauthori | |
|
75
|
CVE-2026-85319 |
7.5 | 0.0108 | NET NO AUTH LOW CX NO UI | Allocation of resources without limits or throttling in Active Directory Federat | |
|
75
|
CVE-2026-97830 |
7.5 | 0.0107 | NET NO AUTH LOW CX NO UI | Double free in Windows Internet Information Services allows an unauthorized atta | |
|
75
|
CVE-2026-69577 |
7.5 | 0.0107 | NET NO AUTH LOW CX NO UI | Out-of-bounds read in Microsoft Azure Attestation service and Device Health Atte | |
|
75
|
CVE-2026-83670 |
7.5 | 0.0107 | NET NO AUTH LOW CX NO UI | Out-of-bounds read in Function Discovery Service (fdwsd.dll) allows an unauthori | |
|
75
|
CVE-2026-26154 |
7.5 | 0.0106 | NET NO AUTH LOW CX NO UI | Improper input validation in Windows Server Update Service allows an unauthorize | |
|
75
|
CVE-2026-78002 |
7.5 | 0.0106 | NET NO AUTH LOW CX NO UI | A flaw was found in rsyslog. An unauthenticated remote attacker can trigger a he | |
|
75
|
CVE-2026-32071 |
7.5 | 0.0106 | NET NO AUTH LOW CX NO UI | Null pointer dereference in Windows Local Security Authority Subsystem Service ( | |
|
75
|
CVE-2026-96325 |
7.5 | 0.0105 | NET NO AUTH LOW CX NO UI | Missing reference to active allocated resource in Windows SMB Server allows an u | |
|
75
|
CVE-2026-96945 |
7.5 | 0.0105 | NET NO AUTH LOW CX NO UI | Uncaught exception in Windows Failover Cluster allows an unauthorized attacker t | |
|
75
|
CVE-2026-0265 |
7.2 | 0.0105 | NET NO AUTH LOW CX NO UI | An authentication bypass vulnerability in Palo Alto Networks PAN-OS® software en | |
|
75
|
CVE-2023-22799 |
7.5 | 0.0105 | NET NO AUTH LOW CX NO UI | A ReDoS based DoS vulnerability in the GlobalID <1.0.1 which could allow an atta | |
|
68
|
CVE-2023-47534 |
8.8 | 0.0105 | NET NO AUTH LOW CX | A improper neutralization of formula elements in a csv file vulnerability in For | |
|
67
|
CVE-2026-67623 |
8.6 | 0.0106 | NET NO AUTH LOW CX | Mistral Vibe before 2.23.3 contains a remote code execution vulnerability that a | |
|
66
|
CVE-2026-86409 |
8.1 | 0.0110 | NET NO AUTH NO UI | Setting `CURLOPT_AWS_SIGV4` to NULL but does not disable SigV4 authentication, c | |
|
65
|
CVE-2026-66321 |
7.4 | 0.0107 | NET NO AUTH LOW CX | Access of resource using incompatible type ('type confusion') in Microsoft Edge | |
|
55
|
CVE-2026-72579 |
7.5 | 0.0110 | NET NO AUTH | An OS command injection vulnerability in NASA HyperCP (main branch) allows a net |