Hunt List
8,489 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2023-34416 |
9.8 | 0.0093 | NET NO AUTH LOW CX NO UI | Memory safety bugs present in Firefox 113, Firefox ESR 102.11, and Thunderbird 1 | |
|
80
|
CVE-2026-20160 |
9.8 | 0.0093 | NET NO AUTH LOW CX NO UI | A vulnerability in Cisco Smart Software Manager On-Prem (SSM On-Prem) could allo | |
|
80
|
CVE-2026-6057 |
9.8 | 0.0093 | NET NO AUTH LOW CX NO UI | FalkorDB Browser 1.9.3 contains an unauthenticated path traversal vulnerability | |
|
80
|
CVE-2026-85809 |
9.8 | 0.0093 | NET NO AUTH LOW CX NO UI | Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows | |
|
80
|
CVE-2026-85814 |
9.8 | 0.0093 | NET NO AUTH LOW CX NO UI | Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unaut | |
|
80
|
CVE-2026-0685 |
9.8 | 0.0093 | NET NO AUTH LOW CX NO UI | Server side template inject (SSTI) in the expression evaluation component in Gen | |
|
80
|
CVE-2026-43867 |
9.8 | 0.0093 | NET NO AUTH LOW CX NO UI | Deserialization of Untrusted Data vulnerability in Apache Camel PQC Component. | |
|
80
|
CVE-2026-52200 |
9.8 | 0.0093 | NET NO AUTH LOW CX NO UI | An issue in Generic OEM UZ801_v2.1 4G LTE Router V3.4.3 allows a remote attacker | |
|
80
|
CVE-2026-67919 |
9.8 | 0.0093 | NET NO AUTH LOW CX NO UI | An issue in Halo 2.25.4 allows a remote attacker to execute arbitrary code via t | |
|
79
|
CVE-2026-88092 |
9.4 | 0.0093 | NET NO AUTH LOW CX NO UI | Inconsistent interpretation of http requests ('http request/response smuggling') | |
|
79
|
CVE-2026-34106 |
9.3 | 0.0093 | NET NO AUTH LOW CX NO UI | Guardian language-system passes the id GET parameter directly into a PHP exec() | |
|
79
|
CVE-2026-34107 |
9.3 | 0.0093 | NET NO AUTH LOW CX NO UI | Guardian language-system passes the id GET parameter directly into a PHP exec() | |
|
79
|
CVE-2026-34108 |
9.3 | 0.0093 | NET NO AUTH LOW CX NO UI | Guardian language-system passes the id GET parameter directly into a PHP exec() | |
|
79
|
CVE-2026-34109 |
9.3 | 0.0093 | NET NO AUTH LOW CX NO UI | Guardian language-system passes the id GET parameter directly into a PHP exec() | |
|
79
|
CVE-2026-34110 |
9.3 | 0.0093 | NET NO AUTH LOW CX NO UI | Guardian language-system passes the id GET parameter directly into a PHP exec() | |
|
79
|
CVE-2026-34111 |
9.3 | 0.0093 | NET NO AUTH LOW CX NO UI | Guardian language-system passes the id GET parameter directly into a PHP exec() | |
|
79
|
CVE-2026-34112 |
9.3 | 0.0093 | NET NO AUTH LOW CX NO UI | Guardian language-system passes the id GET parameter directly into a PHP exec() | |
|
79
|
CVE-2026-34113 |
9.3 | 0.0093 | NET NO AUTH LOW CX NO UI | Guardian language-system passes the id GET parameter directly into a PHP exec() | |
|
79
|
CVE-2026-34114 |
9.3 | 0.0093 | NET NO AUTH LOW CX NO UI | Guardian language-system passes the id GET parameter directly into a PHP exec() | |
|
79
|
CVE-2026-34115 |
9.3 | 0.0093 | NET NO AUTH LOW CX NO UI | Guardian language-system passes the id GET parameter directly into a PHP exec() | |
|
79
|
CVE-2026-34116 |
9.3 | 0.0093 | NET NO AUTH LOW CX NO UI | Guardian language-system passes the id GET parameter directly into a PHP exec() | |
|
79
|
CVE-2026-34117 |
9.3 | 0.0093 | NET NO AUTH LOW CX NO UI | Guardian language-system passes the id GET parameter directly into a PHP exec() | |
|
79
|
CVE-2024-58351 |
9.3 | 0.0093 | NET NO AUTH LOW CX NO UI | Flowise before 2.1.4 allows configuration to be injected into the Chainflow duri | |
|
78
|
CVE-2026-69095 |
8.7 | 0.0093 | NET NO AUTH LOW CX NO UI | OpenWrt luci-app-bmx7 before commit 5890760a454dad2cb00389dba2cdc5e779e0ffdd con | |
|
77
|
CVE-2026-42946 |
8.3 | 0.0093 | NET NO AUTH LOW CX NO UI | A vulnerability exists in the ngx_http_scgi_module and ngx_http_uwsgi_module mod | |
|
75
|
CVE-2022-47762 |
7.5 | 0.0093 | NET NO AUTH LOW CX NO UI | In gin-vue-admin < 2.5.5, the download module has a Path Traversal vulnerability | |
|
69
|
CVE-2026-35428 |
9.6 | 0.0093 | NET NO AUTH LOW CX | Improper neutralization of special elements used in a command ('command injectio | |
|
68
|
CVE-2026-7569 |
8.8 | 0.0094 | NET NO AUTH LOW CX | Quest NetVault Backup viewclient Cross-Site Scripting Authentication Bypass Vuln | |
|
68
|
CVE-2026-9780 |
8.8 | 0.0094 | NET NO AUTH LOW CX | Quest NetVault Backup addclient3 Cross-Site Scripting Authentication Bypass Vuln | |
|
68
|
CVE-2026-100210 |
8.8 | 0.0093 | NET NO AUTH LOW CX | Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized atta | |
|
68
|
CVE-2026-100211 |
8.8 | 0.0093 | NET NO AUTH LOW CX | Use after free in Microsoft Office Excel allows an unauthorized attacker to exec | |
|
68
|
CVE-2026-96202 |
8.8 | 0.0093 | NET NO AUTH LOW CX | Heap-based buffer overflow in Windows Raw Image Extension allows an unauthorized | |
|
68
|
CVE-2026-100220 |
8.8 | 0.0093 | NET NO AUTH LOW CX | Heap-based buffer overflow in Windows Media Video Decoder allows an unauthorized | |
|
68
|
CVE-2026-70215 |
8.8 | 0.0093 | NET NO AUTH LOW CX | Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to | |
|
68
|
CVE-2026-88144 |
8.8 | 0.0093 | NET NO AUTH LOW CX | Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to | |
|
68
|
CVE-2026-97741 |
8.8 | 0.0093 | NET NO AUTH LOW CX | Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized atta | |
|
68
|
CVE-2026-97742 |
8.8 | 0.0093 | NET NO AUTH LOW CX | Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized att | |
|
68
|
CVE-2026-97745 |
8.8 | 0.0093 | NET NO AUTH LOW CX | Use after free in Microsoft Office Excel allows an unauthorized attacker to exec | |
|
68
|
CVE-2026-70068 |
8.8 | 0.0093 | NET NO AUTH LOW CX | Heap-based buffer overflow in Windows Client-Side Caching (CSC) Service allows a | |
|
68
|
CVE-2026-70089 |
8.8 | 0.0093 | NET NO AUTH LOW CX | Heap-based buffer overflow in Windows GDI allows an unauthorized attacker to exe | |
|
68
|
CVE-2026-70149 |
8.8 | 0.0093 | NET NO AUTH LOW CX | Exposure of sensitive information to an unauthorized actor in Windows Client Sid | |
|
68
|
CVE-2026-70210 |
8.8 | 0.0093 | NET NO AUTH LOW CX | Heap-based buffer overflow in Windows OLE DB allows an unauthorized attacker to | |
|
68
|
CVE-2026-70258 |
8.8 | 0.0093 | NET NO AUTH LOW CX | Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unaut | |
|
68
|
CVE-2026-70262 |
8.8 | 0.0093 | NET NO AUTH LOW CX | Heap-based buffer overflow in WebDAV allows an unauthorized attacker to elevate | |
|
68
|
CVE-2026-70275 |
8.8 | 0.0093 | NET NO AUTH LOW CX | Untrusted pointer dereference in Windows CD-ROM Driver allows an unauthorized at | |
|
68
|
CVE-2026-77496 |
8.8 | 0.0093 | NET NO AUTH LOW CX | Heap-based buffer overflow in Windows Imaging Component allows an unauthorized a | |
|
68
|
CVE-2026-83523 |
8.8 | 0.0093 | NET NO AUTH LOW CX | Heap-based buffer overflow in Windows Image Acquisition allows an unauthorized a | |
|
68
|
CVE-2026-83642 |
8.8 | 0.0093 | NET NO AUTH LOW CX | Access of resource using incompatible type ('type confusion') in DNS Server allo | |
|
68
|
CVE-2026-83643 |
8.8 | 0.0093 | NET NO AUTH LOW CX | Stack-based buffer overflow in Windows Error Reporting allows an unauthorized at | |
|
68
|
CVE-2026-83688 |
8.8 | 0.0093 | NET NO AUTH LOW CX | Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attac |