Hunt List
8,487 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-14512 |
9.8 | 0.0097 | NET NO AUTH LOW CX NO UI | IBM WebSphere Application Server 9.0, and 8.5 traditional is vulnerable to pre-a | |
|
80
|
CVE-2026-69705 |
9.8 | 0.0097 | NET NO AUTH LOW CX NO UI | Out-of-bounds write in Windows iSCSI allows an unauthorized attacker to execute | |
|
80
|
CVE-2026-70024 |
9.8 | 0.0096 | NET NO AUTH LOW CX NO UI | Stack-based buffer overflow in Windows Internet Information Services allows an u | |
|
80
|
CVE-2026-57878 |
9.8 | 0.0095 | NET NO AUTH LOW CX NO UI | An unauthenticated stack-based buffer overflow vulnerability exists in thttpd in | |
|
80
|
CVE-2026-58115 |
10.0 | 0.0095 | NET NO AUTH LOW CX NO UI | A vulnerability has been identified in SIMATIC IoT2050 Advanced (6ES7647-0BA00-1 | |
|
80
|
CVE-2026-69634 |
9.8 | 0.0095 | NET NO AUTH LOW CX NO UI | Heap-based buffer overflow in Windows iSCSI allows an unauthorized attacker to e | |
|
80
|
CVE-2026-69639 |
9.8 | 0.0095 | NET NO AUTH LOW CX NO UI | Heap-based buffer overflow in Windows Libarchive allows an unauthorized attacker | |
|
80
|
CVE-2026-69883 |
9.8 | 0.0095 | NET NO AUTH LOW CX NO UI | Use after free in Windows iSCSI allows an unauthorized attacker to execute code | |
|
80
|
CVE-2026-69886 |
9.8 | 0.0095 | NET NO AUTH LOW CX NO UI | Heap-based buffer overflow in Windows Imaging Component allows an unauthorized a | |
|
80
|
CVE-2026-48331 |
10.0 | 0.0095 | NET NO AUTH LOW CX NO UI | Adobe Campaign Classic (ACC) is affected by a Server-Side Request Forgery (SSRF) | |
|
80
|
CVE-2023-34844 |
9.8 | 0.0095 | NET NO AUTH LOW CX NO UI | Play With Docker < 0.0.2 has an insecure CAP_SYS_ADMIN privileged mode causing t | |
|
80
|
CVE-2026-48333 |
9.8 | 0.0095 | NET NO AUTH LOW CX NO UI | Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerabi | |
|
80
|
CVE-2026-57879 |
9.8 | 0.0095 | NET NO AUTH LOW CX NO UI | An unauthenticated stack-based buffer overflow vulnerability exists in ssvr in G | |
|
80
|
CVE-2026-57880 |
9.8 | 0.0095 | NET NO AUTH LOW CX NO UI | An unauthenticated stack-based buffer overflow vulnerability exists in ssvr in G | |
|
80
|
CVE-2026-12940 |
9.8 | 0.0094 | NET NO AUTH LOW CX NO UI | IBM Langflow OSS 1.0.0 through 1.10.1 are vulnerable to unauthenticated remote | |
|
80
|
CVE-2023-29542 |
9.8 | 0.0094 | NET NO AUTH LOW CX NO UI | A newline in a filename could have been used to bypass the file extension securi | |
|
80
|
CVE-2026-57572 |
10.0 | 0.0094 | NET NO AUTH LOW CX NO UI | Crawl4AI is an open-source LLM-friendly web crawler and scraper. Prior to 0.9.0, | |
|
80
|
CVE-2026-96934 |
9.8 | 0.0094 | NET NO AUTH LOW CX NO UI | Use after free in Windows DHCP Server allows an unauthorized attacker to execute | |
|
80
|
CVE-2026-3960 |
9.8 | 0.0094 | NET NO AUTH LOW CX NO UI | A critical remote code execution vulnerability exists in the unauthenticated RES | |
|
79
|
CVE-2026-67614 |
9.3 | 0.0096 | NET NO AUTH LOW CX NO UI | CyberPanel before 3.0.0 contains a hard-coded JWT secret vulnerability in the We | |
|
79
|
CVE-2026-57517 |
9.3 | 0.0096 | NET NO AUTH LOW CX NO UI | Control Web Panel before 0.9.8.1225 contains a blind SQL injection vulnerability | |
|
79
|
CVE-2026-67191 |
9.3 | 0.0096 | NET NO AUTH LOW CX NO UI | Xlight FTP Server before 3.9.5 contains a pre-authentication heap buffer overflo | |
|
79
|
CVE-2026-8634 |
9.3 | 0.0095 | NET NO AUTH LOW CX NO UI | Crabbox prior to v0.12.0 contains an environment variable exposure vulnerability | |
|
79
|
CVE-2026-112403 |
9.2 | 0.0095 | NET NO AUTH LOW CX NO UI | Pillow is a Python imaging library. Prior to 13.0.0, Pillow's JPEG decoder can w | |
|
79
|
CVE-2026-42097 |
9.3 | 0.0094 | NET NO AUTH LOW CX NO UI | Sparx Pro Cloud Server requires authentication based on requested URL. An attack | |
|
78
|
CVE-2026-53977 |
8.7 | 0.0097 | NET NO AUTH LOW CX NO UI | OpenChamber 1.11.7 contains an authentication bypass vulnerability that allows u | |
|
78
|
CVE-2026-73487 |
9.0 | 0.0096 | NET NO AUTH LOW CX NO UI | Flowise before 3.1.3 contains a regex-based Python code validator bypass in CSV | |
|
78
|
CVE-2026-112350 |
8.7 | 0.0095 | NET NO AUTH LOW CX NO UI | Sunhillo SureLine before 9.1.5 contains a path traversal vulnerability in the ra | |
|
78
|
CVE-2026-96230 |
8.8 | 0.0095 | NET NO AUTH LOW CX | 1 PoC | Improper neutralization of input during web page generation ('cross-site scripti |
|
78
|
CVE-2026-70188 |
9.1 | 0.0094 | NET NO AUTH LOW CX NO UI | Inconsistent interpretation of http requests ('http request/response smuggling') | |
|
77
|
CVE-2026-63913 |
8.2 | 0.0097 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: netfilter: | |
|
77
|
CVE-2026-57206 |
8.6 | 0.0096 | NET NO AUTH LOW CX NO UI | SimpleChat is a secure AI conversation application with personal and group works | |
|
76
|
CVE-2026-63520 |
8.1 | 0.0096 | NET NO AUTH NO UI | 1 PoC | Improper input validation in Microsoft Office SharePoint allows an unauthorized |
|
75
|
CVE-2026-56671 |
7.5 | 0.0097 | NET NO AUTH LOW CX NO UI | ComfyUI is a modular diffusion model GUI, api and backend with a graph/nodes int | |
|
75
|
CVE-2026-96959 |
7.5 | 0.0097 | NET NO AUTH LOW CX NO UI | Allocation of resources without limits or throttling in .NET allows an unauthori | |
|
75
|
CVE-2026-70186 |
7.5 | 0.0096 | NET NO AUTH LOW CX NO UI | Deadlock in ASP.NET Core allows an unauthorized attacker to deny service over a | |
|
75
|
CVE-2022-43768 |
7.5 | 0.0095 | NET NO AUTH LOW CX NO UI | A vulnerability has been identified in SIMATIC CP 1242-7 V2 (6GK7242-7KX31-0XE0) | |
|
75
|
CVE-2026-109468 |
7.5 | 0.0095 | NET NO AUTH LOW CX NO UI | Allocation of resources without limits or throttling in ASP.NET Core allows an u | |
|
69
|
CVE-2026-69400 |
9.6 | 0.0094 | NET NO AUTH LOW CX | Improper limitation of a pathname to a restricted directory ('path traversal') i | |
|
69
|
CVE-2026-13368 |
9.2 | 0.0094 | NET NO AUTH NO UI | WatchGuard Fireware OS contains a race condition leading to a use-after-free vul | |
|
68
|
CVE-2026-105718 |
8.8 | 0.0095 | NET NO AUTH LOW CX | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to | |
|
68
|
CVE-2026-100209 |
8.8 | 0.0095 | NET NO AUTH LOW CX | Use after free in Microsoft Office Excel allows an unauthorized attacker to exec | |
|
68
|
CVE-2026-114094 |
8.7 | 0.0095 | NET NO AUTH LOW CX | Dulwich before 1.2.9 fails to validate DOS drive letter prefixes in Git tree pat | |
|
68
|
CVE-2026-50663 |
8.8 | 0.0094 | NET NO AUTH LOW CX | Relative path traversal in Age of Empires II: Definitive Edition Game allows an | |
|
68
|
CVE-2026-65768 |
8.8 | 0.0094 | NET NO AUTH LOW CX | Improper limitation of a pathname to a restricted directory ('path traversal') i | |
|
67
|
CVE-2026-27650 |
8.6 | 0.0094 | NET NO AUTH LOW CX | OS Command Injection vulnerability exists in BUFFALO Wi-Fi router products. If t | |
|
66
|
CVE-2026-79890 |
8.1 | 0.0096 | NET NO AUTH NO UI | There are command injection vulnerabilities in AOS-8 that could lead to unauthen | |
|
66
|
CVE-2026-94300 |
8.1 | 0.0095 | NET NO AUTH NO UI | Replaying GSS-TSIG signed UDP messages can result in memory corruption in "`name | |
|
66
|
CVE-2026-54512 |
8.1 | 0.0094 | NET NO AUTH NO UI | jackson-databind contains the general-purpose data-binding functionality and tre | |
|
57
|
CVE-2026-58281 |
8.3 | 0.0096 | NET NO AUTH | Deserialization of untrusted data in Microsoft Edge (Chromium-based) allows an u |