Hunt List
8,490 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-32871 |
10.0 | 0.0092 | NET NO AUTH LOW CX NO UI | FastMCP is a Pythonic way to build MCP servers and clients. Prior to version 3.2 | |
|
80
|
CVE-2026-58275 |
10.0 | 0.0092 | NET NO AUTH LOW CX NO UI | Missing authorization in Azure DNS allows an unauthorized attacker to elevate pr | |
|
80
|
CVE-2026-62825 |
10.0 | 0.0092 | NET NO AUTH LOW CX NO UI | Improper authentication in Azure Key Vault allows an unauthorized attacker to el | |
|
80
|
CVE-2026-17436 |
9.8 | 0.0092 | NET NO AUTH LOW CX NO UI | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to e | |
|
80
|
CVE-2026-18832 |
9.8 | 0.0092 | NET NO AUTH LOW CX NO UI | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to e | |
|
80
|
CVE-2026-17142 |
9.8 | 0.0092 | NET NO AUTH LOW CX NO UI | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to e | |
|
80
|
CVE-2026-83748 |
9.8 | 0.0091 | NET NO AUTH LOW CX NO UI | Heap-based buffer overflow in Windows Error Reporting allows an unauthorized att | |
|
80
|
CVE-2026-41900 |
10.0 | 0.0091 | NET NO AUTH LOW CX NO UI | OpenLearnX is an open-source, decentralized learning and assessment platform. Pr | |
|
80
|
CVE-2026-85806 |
9.8 | 0.0091 | NET NO AUTH LOW CX NO UI | Integer underflow (wrap or wraparound) in Network Policy Server (NPS) allows an | |
|
80
|
CVE-2026-8984 |
10.0 | 0.0091 | NET NO AUTH LOW CX NO UI | Autel Maxi Charger Single firmware through V1.03.51 allows unauthenticated remot | |
|
80
|
CVE-2026-45480 |
10.0 | 0.0090 | NET NO AUTH LOW CX NO UI | Improper authentication in Azure Active Directory allows an unauthorized attacke | |
|
80
|
CVE-2026-56191 |
10.0 | 0.0090 | NET NO AUTH LOW CX NO UI | Improper authentication in Microsoft Exchange Online allows an unauthorized atta | |
|
80
|
CVE-2026-56163 |
10.0 | 0.0090 | NET NO AUTH LOW CX NO UI | Missing authentication for critical function in Microsoft Azure Kubernetes Servi | |
|
79
|
CVE-2026-113736 |
9.3 | 0.0092 | NET NO AUTH LOW CX NO UI | A vulnerability has been found in D-Link DHP-W610AV 1.02EUb03. The impacted elem | |
|
79
|
CVE-2026-69098 |
9.3 | 0.0091 | NET NO AUTH LOW CX NO UI | kotaemon through 0.12.0 contains an insecure deserialization vulnerability in th | |
|
79
|
CVE-2018-25254 |
9.3 | 0.0091 | NET NO AUTH LOW CX NO UI | NICO-FTP 3.0.1.19 contains a structured exception handler buffer overflow vulner | |
|
79
|
CVE-2026-68770 |
9.3 | 0.0091 | NET NO AUTH LOW CX NO UI | sentence-transformers contains a security control bypass vulnerability that allo | |
|
79
|
CVE-2026-58116 |
9.3 | 0.0090 | NET NO AUTH LOW CX NO UI | LLaMA-Factory through 0.9.5 contains a remote code execution vulnerability that | |
|
78
|
CVE-2026-58465 |
8.7 | 0.0092 | NET NO AUTH LOW CX NO UI | Eclipse Wakaama before snapshot/2026-05-26 contains an unbounded memory allocati | |
|
78
|
CVE-2026-60109 |
8.7 | 0.0092 | NET NO AUTH LOW CX NO UI | Zeek before 8.0.9 contains a null pointer dereference vulnerability in its Kerbe | |
|
78
|
CVE-2026-43947 |
8.9 | 0.0091 | NET NO AUTH LOW CX NO UI | FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Versio | |
|
78
|
CVE-2026-40324 |
9.1 | 0.0090 | NET NO AUTH LOW CX NO UI | Hot Chocolate is an open-source GraphQL server. Prior to versions 12.22.7, 13.9. | |
|
77
|
CVE-2026-76418 |
8.6 | 0.0091 | NET NO AUTH LOW CX NO UI | KEV | Cisco Secure Firewall ASA Software and Cisco Secure FTD Software contains an unc |
|
75
|
CVE-2026-85891 |
7.5 | 0.0092 | NET NO AUTH LOW CX NO UI | Exposure of sensitive information to an unauthorized actor in Azure HDInsight al | |
|
75
|
CVE-2026-50519 |
7.5 | 0.0092 | NET NO AUTH LOW CX NO UI | Initialization of a resource with an insecure default in GitHub Copilot and Visu | |
|
75
|
CVE-2023-32214 |
7.5 | 0.0092 | NET NO AUTH LOW CX NO UI | Protocol handlers `ms-cxh` and `ms-cxh-full` could have been leveraged to trigge | |
|
75
|
CVE-2024-33288 |
7.3 | 0.0092 | NET NO AUTH LOW CX NO UI | Prison Management System Using PHP v1.0 was discovered to contain a SQL injectio | |
|
75
|
CVE-2026-45798 |
7.5 | 0.0092 | NET NO AUTH LOW CX NO UI | Wazuh is a free and open source platform used for threat prevention, detection, | |
|
75
|
CVE-2026-40379 |
7.5 | 0.0091 | NET NO AUTH LOW CX NO UI | Exposure of sensitive information to an unauthorized actor in Azure Entra ID all | |
|
75
|
CVE-2026-18907 |
7.5 | 0.0091 | NET NO AUTH LOW CX NO UI | Path Traversal in Download File Feature in com.talpa.hibrowser 2.23.1.1 on Andro | |
|
68
|
CVE-2026-70174 |
8.8 | 0.0091 | NET NO AUTH LOW CX | Improperly implemented security check for standard in .NET allows an unauthorize | |
|
68
|
CVE-2026-100212 |
8.8 | 0.0091 | NET NO AUTH LOW CX | Use after free in Microsoft Office Excel allows an unauthorized attacker to exec | |
|
68
|
CVE-2026-70343 |
8.8 | 0.0091 | NET NO AUTH LOW CX | Heap-based buffer overflow in Microsoft MPEG-2 Video Extension allows an unautho | |
|
68
|
CVE-2026-70256 |
8.8 | 0.0091 | NET NO AUTH LOW CX | Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized at | |
|
68
|
CVE-2026-70257 |
8.8 | 0.0091 | NET NO AUTH LOW CX | Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized at | |
|
68
|
CVE-2026-70268 |
8.8 | 0.0091 | NET NO AUTH LOW CX | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attac | |
|
68
|
CVE-2026-70282 |
8.8 | 0.0091 | NET NO AUTH LOW CX | Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized at | |
|
68
|
CVE-2026-70287 |
8.8 | 0.0091 | NET NO AUTH LOW CX | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attac | |
|
68
|
CVE-2026-70301 |
8.8 | 0.0091 | NET NO AUTH LOW CX | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attac | |
|
68
|
CVE-2026-70302 |
8.8 | 0.0091 | NET NO AUTH LOW CX | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attac | |
|
68
|
CVE-2026-83778 |
8.8 | 0.0091 | NET NO AUTH LOW CX | Heap-based buffer overflow in Microsoft Internet Messaging API allows an unautho | |
|
68
|
CVE-2026-97756 |
8.8 | 0.0091 | NET NO AUTH LOW CX | Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized atta | |
|
68
|
CVE-2026-102870 |
8.8 | 0.0091 | NET NO AUTH LOW CX | Improper control of generation of code ('code injection') in ASP.NET Core allows | |
|
68
|
CVE-2026-108400 |
8.8 | 0.0091 | NET NO AUTH LOW CX | Integer overflow or wraparound in Microsoft Windows Codecs Library allows an una | |
|
68
|
CVE-2026-102857 |
8.8 | 0.0090 | NET NO AUTH LOW CX | Heap-based buffer overflow in Microsoft Office Visio allows an unauthorized atta | |
|
68
|
CVE-2026-96952 |
8.8 | 0.0090 | NET NO AUTH LOW CX | Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unaut | |
|
65
|
CVE-2026-57990 |
7.4 | 0.0092 | NET NO AUTH LOW CX | Files or directories accessible to external parties in Microsoft Edge (Chromium- | |
|
65
|
CVE-2026-65802 |
7.4 | 0.0092 | NET NO AUTH LOW CX | External control of file name or path in Microsoft Edge for Android allows an un | |
|
65
|
CVE-2026-62906 |
7.4 | 0.0092 | NET NO AUTH LOW CX | Improper neutralization of special elements in data query logic in Microsoft Dis | |
|
65
|
CVE-2026-81383 |
7.4 | 0.0092 | NET NO AUTH LOW CX | Use of incorrectly-resolved name or reference in Visual Studio Code allows an un |