Hunt List
8,459 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
90
|
CVE-2026-107092 |
9.8 | 0.0104 | NET NO AUTH LOW CX NO UI | 1 PoC | NexoPOS v6.2.4 is vulnerable to Directory Traversal via the api/update endpoint. |
|
90
|
CVE-2026-105192 |
9.8 | 0.0102 | NET NO AUTH LOW CX NO UI | 1 PoC | LMCache multiprocess mode, also called distributed mode, opens an unauthenticate |
|
80
|
CVE-2026-82119 |
9.8 | 0.0105 | NET NO AUTH LOW CX NO UI | OS Command Injection Vulnerability in HiRDB. This issue affects HiRDB Server V | |
|
80
|
CVE-2026-73240 |
9.8 | 0.0104 | NET NO AUTH LOW CX NO UI | Specifically crafted inputs may lead to git argument injection in Apache Allura. | |
|
80
|
CVE-2026-38450 |
9.8 | 0.0104 | NET NO AUTH LOW CX NO UI | An issue in Aetopia Digital Asset Management DAM v.1.0.0 allows a remote attacke | |
|
80
|
CVE-2026-47208 |
10.0 | 0.0104 | NET NO AUTH LOW CX NO UI | vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, VM2 suffe | |
|
80
|
CVE-2026-48330 |
10.0 | 0.0104 | NET NO AUTH LOW CX NO UI | Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Specia | |
|
80
|
CVE-2026-28323 |
9.8 | 0.0103 | NET NO AUTH LOW CX NO UI | SolarWinds Web Help Desk is found to be affected by a SAML authentication bypass | |
|
80
|
CVE-2026-69845 |
9.8 | 0.0102 | NET NO AUTH LOW CX NO UI | Heap-based buffer overflow in Windows DHCP Server allows an unauthorized attacke | |
|
80
|
CVE-2026-68839 |
9.8 | 0.0102 | NET NO AUTH LOW CX NO UI | Heap-based buffer overflow in Windows USB Mass Storage Class Driver allows an un | |
|
80
|
CVE-2026-24227 |
9.8 | 0.0102 | NET NO AUTH LOW CX NO UI | NVIDIA TensorRT for contains a vulnerability where a user might cause a deserial | |
|
80
|
CVE-2026-76008 |
10.0 | 0.0102 | NET NO AUTH LOW CX NO UI | A flaw has been found in Comfast CF-N1-S 2.6.0.1. This affects the function get_ | |
|
79
|
CVE-2026-65761 |
9.3 | 0.0104 | NET NO AUTH LOW CX NO UI | Joomla Extension - joomshaper.com - Unauthenticated SQL injection in Easy Store | |
|
79
|
CVE-2026-12046 |
9.5 | 0.0104 | NET NO AUTH LOW CX NO UI | Two state-mutating endpoints in pgAdmin 4's SQL Editor blueprint -- DELETE /sqle | |
|
79
|
CVE-2026-41315 |
9.3 | 0.0103 | NET NO AUTH LOW CX NO UI | mdserver-web is a simple Linux panel. From 0.18.0 to 0.18.4, mdserver-web has a | |
|
79
|
CVE-2026-67192 |
9.2 | 0.0103 | NET NO AUTH LOW CX NO UI | Xlight FTP Server before 3.9.5 contains a pre-authentication stack buffer overfl | |
|
78
|
CVE-2026-14261 |
9.1 | 0.0103 | NET NO AUTH LOW CX NO UI | A vulnerability in the Xerte Online Tools allows for authentication bypass and r | |
|
78
|
CVE-2026-43871 |
8.7 | 0.0103 | NET NO AUTH LOW CX NO UI | Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache T | |
|
78
|
CVE-2026-48586 |
8.7 | 0.0103 | NET NO AUTH LOW CX NO UI | Improper Handling of Highly Compressed Data (Data Amplification) vulnerability i | |
|
78
|
CVE-2026-55968 |
8.7 | 0.0103 | NET NO AUTH LOW CX NO UI | Inefficient Algorithmic Complexity, Allocation of Resources Without Limits or Th | |
|
78
|
CVE-2026-55969 |
8.7 | 0.0103 | NET NO AUTH LOW CX NO UI | Integer Overflow or Wraparound vulnerability in Apache Thrift C++, c_glib, Go, n | |
|
78
|
CVE-2026-58389 |
8.7 | 0.0103 | NET NO AUTH LOW CX NO UI | Allocation of Resources Without Limits or Throttling vulnerability in Apache Thr | |
|
77
|
CVE-2026-69519 |
8.6 | 0.0103 | NET NO AUTH LOW CX NO UI | Observable response discrepancy in Azure Stack HCI allows an unauthorized attack | |
|
75
|
CVE-2026-85321 |
7.5 | 0.0103 | NET NO AUTH LOW CX NO UI | Allocation of resources without limits or throttling in Active Directory Federat | |
|
75
|
CVE-2026-45815 |
7.5 | 0.0103 | NET NO AUTH LOW CX NO UI | Reachable Assertion vulnerability in Apache NimBLE. A specially crafted ATT Read | |
|
75
|
CVE-2026-45816 |
7.5 | 0.0103 | NET NO AUTH LOW CX NO UI | NULL Pointer Dereference vulnerability in Apache NimBLE in LE Long Term Key Requ | |
|
75
|
CVE-2026-41608 |
7.5 | 0.0103 | NET NO AUTH LOW CX NO UI | Improper Handling of Highly Compressed Data (Data Amplification) vulnerability i | |
|
75
|
CVE-2026-49158 |
7.5 | 0.0103 | NET NO AUTH LOW CX NO UI | Improper Handling of Highly Compressed Data (Data Amplification) vulnerability i | |
|
75
|
CVE-2026-61483 |
7.5 | 0.0103 | NET NO AUTH LOW CX NO UI | ** UNSUPPORTED WHEN ASSIGNED ** Uncontrolled Recursion vulnerability in Apache L | |
|
75
|
CVE-2026-32952 |
7.5 | 0.0103 | NET NO AUTH LOW CX NO UI | go-ntlmssp is a Go package that provides NTLM/Negotiate authentication over HTTP | |
|
75
|
CVE-2026-47633 |
7.5 | 0.0103 | NET NO AUTH LOW CX NO UI | Exposure of sensitive information to an unauthorized actor in Cost Management In | |
|
75
|
CVE-2026-62898 |
7.5 | 0.0103 | NET NO AUTH LOW CX NO UI | Use after free in Microsoft QUIC allows an unauthorized attacker to disclose inf | |
|
75
|
CVE-2026-50463 |
7.5 | 0.0103 | NET NO AUTH LOW CX NO UI | Out-of-bounds read in Windows Kernel allows an unauthorized attacker to disclose | |
|
75
|
CVE-2026-50470 |
7.5 | 0.0103 | NET NO AUTH LOW CX NO UI | Out-of-bounds read in Windows Network Policy Server SNMP allows an unauthorized | |
|
75
|
CVE-2026-85322 |
7.5 | 0.0103 | NET NO AUTH LOW CX NO UI | Use of uninitialized resource in Windows Routing and Remote Access Service (RRAS | |
|
75
|
CVE-2026-70579 |
7.5 | 0.0103 | NET NO AUTH LOW CX NO UI | Out-of-bounds read in Windows Mobile Broadband allows an unauthorized attacker t | |
|
75
|
CVE-2026-72932 |
7.5 | 0.0103 | NET NO AUTH LOW CX NO UI | Buffer over-read in Windows Message Queuing Queue Manager allows an unauthorized | |
|
75
|
CVE-2026-72989 |
7.5 | 0.0103 | NET NO AUTH LOW CX NO UI | Use of uninitialized resource in Windows Failover Cluster allows an unauthorized | |
|
75
|
CVE-2026-69443 |
7.5 | 0.0103 | NET NO AUTH LOW CX NO UI | Out-of-bounds read in Microsoft Azure Attestation service and Device Health Atte | |
|
75
|
CVE-2026-70587 |
7.5 | 0.0103 | NET NO AUTH LOW CX NO UI | Improper null termination in Windows Remote Desktop Protocol allows an unauthori | |
|
75
|
CVE-2026-71330 |
7.5 | 0.0103 | NET NO AUTH LOW CX NO UI | Exposure of sensitive system information to an unauthorized control sphere in Wi | |
|
69
|
CVE-2026-48315 |
9.3 | 0.0103 | NET NO AUTH LOW CX | ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Inpu | |
|
69
|
CVE-2026-83662 |
9.3 | 0.0103 | NET NO AUTH LOW CX | Adobe Experience Manager is affected by a reflected Cross-Site Scripting (XSS) v | |
|
69
|
CVE-2026-112393 |
9.2 | 0.0102 | NET NO AUTH NO UI | Pillow is a Python imaging library. From 2.0.0 until 13.0.0, Pillow has a heap b | |
|
68
|
CVE-2026-83923 |
8.8 | 0.0102 | NET NO AUTH LOW CX | Relative path traversal in OpenSSH for Windows allows an unauthorized attacker t | |
|
67
|
CVE-2024-9341 |
8.2 | 0.0103 | NET NO AUTH LOW CX | A flaw was found in Go. When FIPS mode is enabled on a system, container runtime | |
|
66
|
CVE-2026-92387 |
8.1 | 0.0104 | NET NO AUTH NO UI | By permanently omitting the final control-response line, a malicious FTP, IMAP, | |
|
66
|
CVE-2026-70229 |
8.1 | 0.0104 | NET NO AUTH NO UI | Incorrect authorization in Active Directory Domain Services allows an unauthoriz | |
|
65
|
CVE-2026-57991 |
7.4 | 0.0104 | NET NO AUTH LOW CX | Improper link resolution before file access ('link following') in Microsoft Edge | |
|
65
|
CVE-2026-78461 |
7.4 | 0.0104 | NET NO AUTH LOW CX | Improper limitation of a pathname to a restricted directory ('path traversal') i |