Hunt List
8,477 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
90
|
CVE-2026-56190 |
9.8 | 0.0097 | NET NO AUTH LOW CX NO UI | 2 PoC | Use of uninitialized resource in Windows RDP allows an unauthorized attacker to |
|
80
|
CVE-2026-14522 |
9.8 | 0.0102 | NET NO AUTH LOW CX NO UI | IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0. | |
|
80
|
CVE-2026-83782 |
9.8 | 0.0101 | NET NO AUTH LOW CX NO UI | Heap-based buffer overflow in Windows Shell allows an unauthorized attacker to e | |
|
80
|
CVE-2026-96924 |
9.8 | 0.0101 | NET NO AUTH LOW CX NO UI | Untrusted pointer dereference in Windows OLE allows an unauthorized attacker to | |
|
80
|
CVE-2026-97816 |
9.8 | 0.0101 | NET NO AUTH LOW CX NO UI | Use after free in OpenSSH for Windows allows an unauthorized attacker to execute | |
|
80
|
CVE-2026-20093 |
9.8 | 0.0101 | NET NO AUTH LOW CX NO UI | A vulnerability in the change password functionality of Cisco Integrated Managem | |
|
80
|
CVE-2026-4149 |
9.8 | 0.0100 | NET NO AUTH LOW CX NO UI | Sonos Era 300 SMB Response Out-Of-Bounds Access Remote Code Execution Vulnerabil | |
|
80
|
CVE-2026-9862 |
9.8 | 0.0099 | NET NO AUTH LOW CX NO UI | Fortra's Core Privileged Access Manager (BoKS) contains an OS command injection | |
|
80
|
CVE-2026-71558 |
9.8 | 0.0099 | NET NO AUTH LOW CX NO UI | Heap type confusion vulnerability in Apache Fory C++ deserialization. This issu | |
|
80
|
CVE-2026-105010 |
9.8 | 0.0099 | NET NO AUTH LOW CX NO UI | Use after free in Microsoft Windows Search Component allows an unauthorized atta | |
|
80
|
CVE-2026-102210 |
9.8 | 0.0099 | NET NO AUTH LOW CX NO UI | Heap-based buffer overflow in Windows Text Shaping allows an unauthorized attack | |
|
80
|
CVE-2026-96909 |
9.8 | 0.0099 | NET NO AUTH LOW CX NO UI | Heap-based buffer overflow in Windows BitLocker allows an unauthorized attacker | |
|
80
|
CVE-2026-1555 |
9.8 | 0.0098 | NET NO AUTH LOW CX NO UI | The WebStack theme for WordPress is vulnerable to arbitrary file uploads due to | |
|
80
|
CVE-2026-47140 |
10.0 | 0.0098 | NET NO AUTH LOW CX NO UI | vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, NodeVM bl | |
|
80
|
CVE-2026-65816 |
10.0 | 0.0097 | NET NO AUTH LOW CX NO UI | Use of incorrectly-resolved name or reference in Azure Arc allows an unauthorize | |
|
80
|
CVE-2023-29531 |
9.8 | 0.0097 | NET NO AUTH LOW CX NO UI | An attacker could have caused an out of bounds memory access using WebGL APIs, l | |
|
80
|
CVE-2026-55010 |
9.8 | 0.0097 | NET NO AUTH LOW CX NO UI | Heap-based buffer overflow in Minecraft Bedrock Dedicated Server allows an unaut | |
|
80
|
CVE-2026-56165 |
9.8 | 0.0097 | NET NO AUTH LOW CX NO UI | Heap-based buffer overflow in Microsoft Account allows an unauthorized attacker | |
|
80
|
CVE-2026-65791 |
9.8 | 0.0097 | NET NO AUTH LOW CX NO UI | Heap-based buffer overflow in Windows iSCSI Target Service allows an unauthorize | |
|
80
|
CVE-2026-42990 |
9.8 | 0.0097 | NET NO AUTH LOW CX NO UI | Heap-based buffer overflow in SQL Server ODBC driver allows an unauthorized atta | |
|
80
|
CVE-2026-49172 |
9.8 | 0.0097 | NET NO AUTH LOW CX NO UI | Heap-based buffer overflow in Windows FTP Service allows an unauthorized attacke | |
|
80
|
CVE-2026-50447 |
9.8 | 0.0097 | NET NO AUTH LOW CX NO UI | Heap-based buffer overflow in Windows Message Queuing allows an unauthorized att | |
|
80
|
CVE-2026-50518 |
9.8 | 0.0097 | NET NO AUTH LOW CX NO UI | Heap-based buffer overflow in Windows DHCP Server allows an unauthorized attacke | |
|
80
|
CVE-2026-56159 |
9.8 | 0.0097 | NET NO AUTH LOW CX NO UI | Heap-based buffer overflow in Windows DHCP Server allows an unauthorized attacke | |
|
80
|
CVE-2026-62815 |
9.8 | 0.0097 | NET NO AUTH LOW CX NO UI | Use after free in Microsoft QUIC allows an unauthorized attacker to execute code | |
|
79
|
CVE-2026-112346 |
9.3 | 0.0101 | NET NO AUTH LOW CX NO UI | OpenHands Software Agent SDK before 1.52.0 contains an unauthenticated remote co | |
|
79
|
CVE-2026-19264 |
9.3 | 0.0101 | NET NO AUTH LOW CX NO UI | Postiz is an open-source social media scheduling tool. The route that serves loc | |
|
79
|
CVE-2026-55971 |
9.3 | 0.0098 | NET NO AUTH LOW CX NO UI | Heap-based Buffer Overflow vulnerability in Apache Thrift C++ bindings. This is | |
|
78
|
CVE-2026-29063 |
8.7 | 0.0101 | NET NO AUTH LOW CX NO UI | Immutable.js provides many Persistent Immutable data structures. Prior to versio | |
|
78
|
CVE-2026-89009 |
8.8 | 0.0101 | NET NO AUTH LOW CX NO UI | WAVLINK WN535M1 and WN535M3 routers running firmware prior to M35M1_V250922 cont | |
|
78
|
CVE-2026-5426 |
9.1 | 0.0101 | NET NO AUTH LOW CX NO UI | Hard-coded ASP.NET/IIS machineKey value in Digital Knowledge KnowledgeDeliver de | |
|
78
|
CVE-2026-18613 |
8.9 | 0.0100 | NET NO AUTH LOW CX NO UI | A vulnerability has been found in GL-iNet GL-MT3000 up to 4.4.5. This issue affe | |
|
77
|
CVE-2026-20349 |
8.6 | 0.0101 | NET NO AUTH LOW CX NO UI | KEV | Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Thre |
|
75
|
CVE-2026-35092 |
7.5 | 0.0101 | NET NO AUTH LOW CX NO UI | A flaw was found in Corosync. An integer overflow vulnerability in Corosync's jo | |
|
75
|
CVE-2026-15567 |
7.5 | 0.0101 | NET NO AUTH LOW CX NO UI | A flaw was found in Wildfly. A remote unauthenticated attacker can trigger OutOf | |
|
75
|
CVE-2026-49049 |
7.5 | 0.0099 | NET NO AUTH LOW CX NO UI | The Helix3 plugin for Joomla exposes an ajax handler task, that allows unauthent | |
|
75
|
CVE-2026-84008 |
7.5 | 0.0099 | NET NO AUTH LOW CX NO UI | Inefficient algorithmic complexity in .NET allows an unauthorized attacker to de | |
|
75
|
CVE-2026-96233 |
7.5 | 0.0099 | NET NO AUTH LOW CX NO UI | Out-of-bounds write in ASP.NET Core allows an unauthorized attacker to deny serv | |
|
75
|
CVE-2026-105728 |
7.5 | 0.0099 | NET NO AUTH LOW CX NO UI | Improper authentication in Dynamics Business Central allows an unauthorized atta | |
|
75
|
CVE-2026-85353 |
7.5 | 0.0098 | NET NO AUTH LOW CX NO UI | Out-of-bounds read in Windows Print Spooler Components allows an unauthorized at | |
|
75
|
CVE-2026-85334 |
7.5 | 0.0098 | NET NO AUTH LOW CX NO UI | Out-of-bounds read in Windows Message Queuing Queue Manager allows an unauthoriz | |
|
75
|
CVE-2026-96245 |
7.5 | 0.0098 | NET NO AUTH LOW CX NO UI | Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an | |
|
75
|
CVE-2026-96246 |
7.5 | 0.0098 | NET NO AUTH LOW CX NO UI | Out-of-bounds read in Network Policy Server (NPS) allows an unauthorized attacke | |
|
75
|
CVE-2026-103558 |
7.5 | 0.0098 | NET NO AUTH LOW CX NO UI | Deadlock in Windows Routing and Remote Access Service (RRAS) allows an unauthori | |
|
69
|
CVE-2026-70306 |
9.3 | 0.0101 | NET NO AUTH LOW CX | Improper neutralization of input during web page generation ('cross-site scripti | |
|
68
|
CVE-2026-6849 |
8.8 | 0.0101 | NET NO AUTH LOW CX | Improper neutralization of special elements used in an OS command ('OS command i | |
|
68
|
CVE-2026-77931 |
8.7 | 0.0100 | NET NO AUTH LOW CX | MoviePilot through 3.1.5 contains a command injection vulnerability that allows | |
|
68
|
CVE-2026-103572 |
8.8 | 0.0099 | NET NO AUTH LOW CX | Improper control of generation of code ('code injection') in Visual Studio Tools | |
|
68
|
CVE-2026-12935 |
8.7 | 0.0099 | NET NO AUTH LOW CX | The TL-WR940N v6 router contains a vulnerability in its RTSP connection tracking | |
|
66
|
CVE-2026-43865 |
8.1 | 0.0098 | NET NO AUTH NO UI | Deserialization of Untrusted Data vulnerability in Apache Camel Hazelcast compon |