Hunt List
8,490 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
90
|
CVE-2026-110063 |
10.0 | 0.0089 | NET NO AUTH LOW CX NO UI | 1 PoC | Improper link resolution before file access ('link following') in VM Inspector f |
|
80
|
CVE-2026-57106 |
10.0 | 0.0090 | NET NO AUTH LOW CX NO UI | Server-side request forgery (ssrf) in Data Quality allows an unauthorized attack | |
|
80
|
CVE-2026-66803 |
10.0 | 0.0090 | NET NO AUTH LOW CX NO UI | Improper access control in Azure Cosmos DB allows an unauthorized attacker to ex | |
|
80
|
CVE-2026-56162 |
10.0 | 0.0090 | NET NO AUTH LOW CX NO UI | Improper authentication in Azure SQL Database allows an unauthorized attacker to | |
|
80
|
CVE-2026-65801 |
10.0 | 0.0090 | NET NO AUTH LOW CX NO UI | Server-side request forgery (ssrf) in Microsoft Exchange Online allows an unauth | |
|
80
|
CVE-2026-69843 |
10.0 | 0.0090 | NET NO AUTH LOW CX NO UI | Authentication bypass by spoofing in Microsoft Fabric allows an unauthorized att | |
|
80
|
CVE-2026-70352 |
10.0 | 0.0090 | NET NO AUTH LOW CX NO UI | Missing authentication for critical function in Azure AI Language allows an unau | |
|
80
|
CVE-2026-73025 |
9.8 | 0.0090 | NET NO AUTH LOW CX NO UI | Weak authentication in Windows iSCSI allows an unauthorized attacker to bypass a | |
|
80
|
CVE-2026-114278 |
9.8 | 0.0090 | NET NO AUTH LOW CX NO UI | The che-machine-exec service constructs a shell command by concatenating user-co | |
|
80
|
CVE-2023-46453 |
9.8 | 0.0090 | NET NO AUTH LOW CX NO UI | Certain GL.iNet devices with 4.x firmware allow authentication bypass (resulting | |
|
80
|
CVE-2026-83935 |
9.8 | 0.0090 | NET NO AUTH LOW CX NO UI | Heap-based buffer overflow in Microsoft XML allows an unauthorized attacker to e | |
|
80
|
CVE-2026-53633 |
9.8 | 0.0090 | NET NO AUTH LOW CX NO UI | Vitest is a testing framework powered by Vite. From 3.0.0 until 3.2.5, 4.1.8, an | |
|
80
|
CVE-2026-86400 |
9.8 | 0.0090 | NET NO AUTH LOW CX NO UI | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS | |
|
80
|
CVE-2026-64767 |
9.8 | 0.0089 | NET NO AUTH LOW CX NO UI | A buffer overflow was addressed with improved bounds checking. This issue is fix | |
|
80
|
CVE-2026-85792 |
9.8 | 0.0089 | NET NO AUTH LOW CX NO UI | Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows | |
|
80
|
CVE-2026-96219 |
9.8 | 0.0089 | NET NO AUTH LOW CX NO UI | Out-of-bounds write in Windows Local Security Authority Subsystem Service (LSASS | |
|
80
|
CVE-2023-25207 |
9.8 | 0.0089 | NET NO AUTH LOW CX NO UI | PrestaShop dpdfrance <6.1.3 is vulnerable to SQL Injection via dpdfrance/ajax.ph | |
|
80
|
CVE-2026-24254 |
9.8 | 0.0089 | NET NO AUTH LOW CX NO UI | NVIDIA Dynamo for Linux contains a vulnerability in the multimodal serving topol | |
|
80
|
CVE-2023-29129 |
9.8 | 0.0089 | NET NO AUTH LOW CX NO UI | A vulnerability has been identified in Mendix SAML (Mendix 7 compatible) (All ve | |
|
79
|
CVE-2026-73414 |
9.2 | 0.0089 | NET NO AUTH LOW CX NO UI | Shescape is a simple shell escape library for JavaScript. Prior to 2.1.14 and 3. | |
|
79
|
CVE-2026-75854 |
9.3 | 0.0089 | NET NO AUTH LOW CX NO UI | ArcadeDB versions before 26.8.1 contain a missing authentication vulnerability i | |
|
79
|
CVE-2026-23751 |
9.3 | 0.0088 | NET NO AUTH LOW CX NO UI | Kofax Capture, now referred to as Tungsten Capture, version 6.0.0.0 (other versi | |
|
79
|
CVE-2020-37281 |
9.2 | 0.0088 | NET NO AUTH LOW CX NO UI | Gravitee API Management through 4.12.22 contains an authentication bypass vulner | |
|
79
|
CVE-2026-6847 |
9.3 | 0.0088 | NET NO AUTH LOW CX NO UI | Remote Code Execution vulnerability exists in ThemisNETPanel due to missing auth | |
|
78
|
CVE-2026-5598 |
8.9 | 0.0090 | NET NO AUTH LOW CX NO UI | Covert timing channel vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA | |
|
78
|
CVE-2026-110690 |
8.7 | 0.0090 | NET NO AUTH LOW CX NO UI | Cloud Commander (cloudcmd) versions 19.20.2 through 19.21.1 contains a path trav | |
|
78
|
CVE-2026-54892 |
8.7 | 0.0089 | NET NO AUTH LOW CX NO UI | Inefficient algorithmic complexity in Plug's nested-parameter decoder allows an | |
|
78
|
CVE-2026-47731 |
9.1 | 0.0089 | NET NO AUTH LOW CX NO UI | The AMMOS Instrument Toolkit (Formerly the Bespoke Links to Instruments for Surf | |
|
77
|
CVE-2026-35091 |
8.2 | 0.0088 | NET NO AUTH LOW CX NO UI | A flaw was found in Corosync. A remote unauthenticated attacker can exploit a wr | |
|
75
|
CVE-2026-96232 |
7.5 | 0.0089 | NET NO AUTH LOW CX NO UI | Out-of-bounds read in .NET allows an unauthorized attacker to disclose informati | |
|
75
|
CVE-2026-32820 |
7.5 | 0.0089 | NET NO AUTH LOW CX NO UI | dataCycle is a data management system for centrally storing, managing, searching | |
|
75
|
CVE-2026-89059 |
7.5 | 0.0089 | NET NO AUTH LOW CX NO UI | A flaw was found in RESTEasy's IIOImageProvider, which decodes attacker-supplied | |
|
75
|
CVE-2026-115497 |
7.5 | 0.0089 | NET NO AUTH LOW CX NO UI | The Music Store – WordPress eCommerce plugin for WordPress is vulnerable to Dire | |
|
75
|
CVE-2026-48068 |
7.5 | 0.0088 | NET NO AUTH LOW CX NO UI | @grpc/grps-js implements the core functionality of gRPC purely in JavaScript, wi | |
|
75
|
CVE-2026-48069 |
7.5 | 0.0088 | NET NO AUTH LOW CX NO UI | @grpc/grps-js implements the core functionality of gRPC purely in JavaScript, wi | |
|
75
|
CVE-2022-31810 |
7.5 | 0.0088 | NET NO AUTH LOW CX NO UI | A vulnerability has been identified in SiPass integrated (All versions < V2.90.3 | |
|
69
|
CVE-2026-81376 |
9.6 | 0.0090 | NET NO AUTH LOW CX | Incomplete comparison with missing factors in Visual Studio Code allows an unaut | |
|
68
|
CVE-2026-97769 |
8.8 | 0.0090 | NET NO AUTH LOW CX | Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized atta | |
|
68
|
CVE-2026-83891 |
8.8 | 0.0090 | NET NO AUTH LOW CX | Stack-based buffer overflow in Microsoft Office Word allows an unauthorized atta | |
|
68
|
CVE-2026-70254 |
8.8 | 0.0089 | NET NO AUTH LOW CX | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to | |
|
68
|
CVE-2026-77902 |
8.8 | 0.0089 | NET NO AUTH LOW CX | Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized atta | |
|
68
|
CVE-2026-102856 |
8.8 | 0.0089 | NET NO AUTH LOW CX | Heap-based buffer overflow in Microsoft Office Visio allows an unauthorized atta | |
|
68
|
CVE-2026-102225 |
8.8 | 0.0089 | NET NO AUTH LOW CX | Out-of-bounds read in Windows Text Shaping allows an unauthorized attacker to ex | |
|
68
|
CVE-2026-83934 |
8.8 | 0.0089 | NET NO AUTH LOW CX | Stack-based buffer overflow in Windows GDI+ allows an unauthorized attacker to e | |
|
68
|
CVE-2026-97781 |
8.8 | 0.0088 | NET NO AUTH LOW CX | Improper neutralization of special elements used in a command ('command injectio | |
|
68
|
CVE-2026-105717 |
8.8 | 0.0088 | NET NO AUTH LOW CX | Heap-based buffer overflow in Microsoft Office Access allows an unauthorized att | |
|
68
|
CVE-2026-69370 |
8.8 | 0.0088 | NET NO AUTH LOW CX | Improper neutralization of special elements used in a command ('command injectio | |
|
66
|
CVE-2026-22828 |
8.1 | 0.0090 | NET NO AUTH NO UI | A heap-based buffer overflow vulnerability in Fortinet FortiAnalyzer Cloud 7.6.2 | |
|
66
|
CVE-2026-40859 |
8.1 | 0.0089 | NET NO AUTH NO UI | Deserialization of Untrusted Data vulnerability in Apache Camel. The camel-vert | |
|
65
|
CVE-2026-19611 |
7.4 | 0.0089 | NET NO AUTH NO UI | A flaw was found in WildFly Elytron. Password hashing and verification normalize |