Hunt List
8,483 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
90
|
CVE-2026-62878 |
9.8 | 0.0097 | NET NO AUTH LOW CX NO UI | 1 PoC | Stack-based buffer overflow in Windows DNS allows an unauthorized attacker to ex |
|
80
|
CVE-2026-62893 |
9.8 | 0.0097 | NET NO AUTH LOW CX NO UI | Use after free in Windows Deployment Services allows an unauthorized attacker to | |
|
80
|
CVE-2026-67631 |
9.8 | 0.0097 | NET NO AUTH LOW CX NO UI | Heap-based buffer overflow in SQL Server allows an unauthorized attacker to exec | |
|
80
|
CVE-2026-66302 |
9.8 | 0.0097 | NET NO AUTH LOW CX NO UI | External control of file name or path in Skype for Business allows an unauthoriz | |
|
80
|
CVE-2026-69493 |
9.8 | 0.0097 | NET NO AUTH LOW CX NO UI | Out-of-bounds read in Windows Event Logging Service allows an unauthorized attac | |
|
80
|
CVE-2026-69586 |
9.8 | 0.0097 | NET NO AUTH LOW CX NO UI | Integer overflow or wraparound in Microsoft Windows PDF allows an unauthorized a | |
|
80
|
CVE-2026-69590 |
9.8 | 0.0097 | NET NO AUTH LOW CX NO UI | Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows | |
|
80
|
CVE-2026-69595 |
9.8 | 0.0097 | NET NO AUTH LOW CX NO UI | Use after free in Windows Services for NFS ONCRPC XDR Driver allows an unauthori | |
|
80
|
CVE-2026-69715 |
9.8 | 0.0097 | NET NO AUTH LOW CX NO UI | Out-of-bounds read in Windows Direct Show allows an unauthorized attacker to exe | |
|
80
|
CVE-2026-69768 |
9.8 | 0.0097 | NET NO AUTH LOW CX NO UI | Heap-based buffer overflow in Windows RNDIS allows an unauthorized attacker to e | |
|
80
|
CVE-2026-69769 |
9.8 | 0.0097 | NET NO AUTH LOW CX NO UI | Heap-based buffer overflow in Windows HTTP Print Provider allows an unauthorized | |
|
80
|
CVE-2026-69824 |
9.8 | 0.0097 | NET NO AUTH LOW CX NO UI | Integer underflow (wrap or wraparound) in Microsoft Standard XPS allows an unaut | |
|
80
|
CVE-2026-69829 |
9.8 | 0.0097 | NET NO AUTH LOW CX NO UI | Heap-based buffer overflow in Windows Shell allows an unauthorized attacker to e | |
|
80
|
CVE-2026-69910 |
9.8 | 0.0097 | NET NO AUTH LOW CX NO UI | Stack-based buffer overflow in Windows Hyper-V allows an unauthorized attacker t | |
|
80
|
CVE-2026-70296 |
9.8 | 0.0097 | NET NO AUTH LOW CX NO UI | Out-of-bounds write in Windows Imaging Component allows an unauthorized attacker | |
|
80
|
CVE-2026-73009 |
9.8 | 0.0097 | NET NO AUTH LOW CX NO UI | Use after free in Windows Secure Socket Tunneling Protocol (SSTP) allows an unau | |
|
80
|
CVE-2026-73010 |
9.8 | 0.0097 | NET NO AUTH LOW CX NO UI | Use after free in Windows Failover Cluster allows an unauthorized attacker to ex | |
|
80
|
CVE-2026-78445 |
9.8 | 0.0097 | NET NO AUTH LOW CX NO UI | Use after free in Windows Services for NFS ONCRPC XDR Driver allows an unauthori | |
|
80
|
CVE-2026-67643 |
9.8 | 0.0097 | NET NO AUTH LOW CX NO UI | Heap-based buffer overflow in SQL Server allows an unauthorized attacker to exec | |
|
80
|
CVE-2026-69276 |
9.8 | 0.0097 | NET NO AUTH LOW CX NO UI | Integer underflow (wrap or wraparound) in Microsoft UxTheme Library (uxtheme.dll | |
|
80
|
CVE-2026-69408 |
9.8 | 0.0097 | NET NO AUTH LOW CX NO UI | Integer overflow or wraparound in Microsoft Windows Media Foundation allows an u | |
|
80
|
CVE-2026-69431 |
9.8 | 0.0097 | NET NO AUTH LOW CX NO UI | Heap-based buffer overflow in Telnet Client allows an unauthorized attacker to e | |
|
80
|
CVE-2026-69463 |
9.8 | 0.0097 | NET NO AUTH LOW CX NO UI | Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to ex | |
|
80
|
CVE-2026-69491 |
9.8 | 0.0097 | NET NO AUTH LOW CX NO UI | Heap-based buffer overflow in Windows Microsoft DirectMusic allows an unauthoriz | |
|
80
|
CVE-2026-69496 |
9.8 | 0.0097 | NET NO AUTH LOW CX NO UI | Heap-based buffer overflow in Windows Compressed Folder allows an unauthorized a | |
|
80
|
CVE-2026-69525 |
9.8 | 0.0097 | NET NO AUTH LOW CX NO UI | Use after free in Windows Remote Desktop Services allows an unauthorized attacke | |
|
80
|
CVE-2026-69579 |
9.8 | 0.0097 | NET NO AUTH LOW CX NO UI | Use after free in Windows Message Queuing allows an unauthorized attacker to exe | |
|
80
|
CVE-2026-69730 |
9.8 | 0.0097 | NET NO AUTH LOW CX NO UI | Use after free in Windows DNS allows an unauthorized attacker to execute code ov | |
|
80
|
CVE-2026-69819 |
9.8 | 0.0097 | NET NO AUTH LOW CX NO UI | Out-of-bounds write in RPC Runtime allows an unauthorized attacker to execute co | |
|
80
|
CVE-2026-72979 |
9.8 | 0.0097 | NET NO AUTH LOW CX NO UI | Use after free in Windows DHCP Server allows an unauthorized attacker to execute | |
|
80
|
CVE-2026-72982 |
9.8 | 0.0097 | NET NO AUTH LOW CX NO UI | Stack-based buffer overflow in Windows Netlogon allows an unauthorized attacker | |
|
80
|
CVE-2026-72983 |
9.8 | 0.0097 | NET NO AUTH LOW CX NO UI | Use after free in Windows Internet Connection Sharing (ICS) allows an unauthoriz | |
|
80
|
CVE-2026-77493 |
9.8 | 0.0097 | NET NO AUTH LOW CX NO UI | Double free in Microsoft Graphics Component allows an unauthorized attacker to e | |
|
80
|
CVE-2026-78509 |
9.8 | 0.0097 | NET NO AUTH LOW CX NO UI | Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized at | |
|
80
|
CVE-2026-68502 |
9.8 | 0.0097 | NET NO AUTH LOW CX NO UI | LazyOwn RedTeam/APT Framework is an AI-powered C2 and red-team operations framew | |
|
80
|
CVE-2026-48382 |
10.0 | 0.0097 | NET NO AUTH LOW CX NO UI | Adobe Experience Manager is affected by an Incorrect Authorization vulnerability | |
|
80
|
CVE-2026-48383 |
10.0 | 0.0097 | NET NO AUTH LOW CX NO UI | Adobe Experience Manager is affected by an Incorrect Authorization vulnerability | |
|
80
|
CVE-2026-88178 |
9.8 | 0.0097 | NET NO AUTH LOW CX NO UI | Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to | |
|
80
|
CVE-2026-47698 |
9.8 | 0.0097 | NET NO AUTH LOW CX NO UI | vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.6, lib/bridge.js and | |
|
79
|
CVE-2026-62835 |
9.3 | 0.0097 | NET NO AUTH LOW CX NO UI | Improper authorization in Azure Portal allows an unauthorized attacker to disclo | |
|
79
|
CVE-2026-70470 |
9.5 | 0.0097 | NET NO AUTH LOW CX NO UI | Flowise is a drag & drop user interface to build a customized large language mod | |
|
79
|
CVE-2026-0625 |
9.3 | 0.0097 | NET NO AUTH LOW CX NO UI | Multiple D-Link DSL/DIR/DNS devices contain an authentication bypass and imprope | |
|
78
|
CVE-2026-58399 |
8.7 | 0.0097 | NET NO AUTH LOW CX NO UI | @acastellon/auth is an authentication control system for microservices. Versions | |
|
77
|
CVE-2026-66800 |
8.6 | 0.0097 | NET NO AUTH LOW CX NO UI | Server-side request forgery (ssrf) in Azure Data Factory allows an unauthorized | |
|
77
|
CVE-2026-69558 |
8.6 | 0.0097 | NET NO AUTH LOW CX NO UI | Authorization bypass through user-controlled key in Microsoft Partner Center all | |
|
75
|
CVE-2026-66304 |
7.5 | 0.0097 | NET NO AUTH LOW CX NO UI | Server-side request forgery (ssrf) in Skype for Business allows an unauthorized | |
|
75
|
CVE-2026-85917 |
7.5 | 0.0097 | NET NO AUTH LOW CX NO UI | Server-side request forgery (ssrf) in Azure AI Foundry allows an unauthorized at | |
|
68
|
CVE-2026-108463 |
8.8 | 0.0097 | NET NO AUTH LOW CX | Improper resolution of path equivalence in Windows SmartScreen allows an unautho | |
|
68
|
CVE-2026-53597 |
8.7 | 0.0097 | NET NO AUTH LOW CX | Prompty is a markdown file format (.prompty) for LLM prompts. From 2.0.0-alpha.1 | |
|
68
|
CVE-2026-42238 |
9.0 | 0.0097 | NET NO AUTH LOW CX | Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3. |