Hunt List
8,494 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-84015 |
9.8 | 0.0087 | NET NO AUTH LOW CX NO UI | Heap-based buffer overflow in Remote Access Point-to-Point Protocol (PPP) EAP-TL | |
|
80
|
CVE-2026-8505 |
9.8 | 0.0087 | NET NO AUTH LOW CX NO UI | IBM Langflow OSS 1.0.0 through 1.10.0 has a vulnerability in Langflow's webhook | |
|
80
|
CVE-2026-96113 |
9.8 | 0.0087 | NET NO AUTH LOW CX NO UI | Heap-based buffer overflow in DNS Server allows an unauthorized attacker to exec | |
|
80
|
CVE-2026-97815 |
9.8 | 0.0087 | NET NO AUTH LOW CX NO UI | Heap-based buffer overflow in Windows Error Reporting allows an unauthorized att | |
|
80
|
CVE-2026-38165 |
9.8 | 0.0087 | NET NO AUTH LOW CX NO UI | A Server-Side Template Injection (SSTI) vulnerability in the Velocity template e | |
|
80
|
CVE-2026-58630 |
10.0 | 0.0086 | NET NO AUTH LOW CX NO UI | Improper access control in Azure App Service allows an unauthorized attacker to | |
|
80
|
CVE-2026-49827 |
9.8 | 0.0086 | NET NO AUTH LOW CX NO UI | WebErpMesv2 is a Resource Management and Manufacturing execution system Web for | |
|
80
|
CVE-2026-57624 |
10.0 | 0.0086 | NET NO AUTH LOW CX NO UI | Unauthenticated Remote Code Execution (RCE) in Blocksy Companion Pro <= 2.1.46 v | |
|
80
|
CVE-2026-65553 |
10.0 | 0.0086 | NET NO AUTH LOW CX NO UI | Unauthenticated Remote Code Execution (RCE) in Spider Analyser – WordPress | |
|
80
|
CVE-2026-27544 |
10.0 | 0.0086 | NET NO AUTH LOW CX NO UI | Unauthenticated Remote Code Execution (RCE) in QA Analytics <= 5.2.0.0 versions. | |
|
80
|
CVE-2026-73343 |
10.0 | 0.0086 | NET NO AUTH LOW CX NO UI | Unauthenticated Remote Code Execution (RCE) in WP Compress < 7.20.01 versions. | |
|
80
|
CVE-2026-10109 |
9.8 | 0.0086 | NET NO AUTH LOW CX NO UI | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to remote | |
|
80
|
CVE-2026-16956 |
9.8 | 0.0086 | NET NO AUTH LOW CX NO UI | IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to execute | |
|
80
|
CVE-2026-16882 |
9.8 | 0.0086 | NET NO AUTH LOW CX NO UI | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to e | |
|
80
|
CVE-2026-48449 |
9.8 | 0.0086 | NET NO AUTH LOW CX NO UI | Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerabi | |
|
79
|
CVE-2026-54733 |
9.3 | 0.0088 | NET NO AUTH LOW CX NO UI | The Microsoft 365 and Microsoft Entra ID Plugins for Moodle provide Office 365 a | |
|
79
|
CVE-2026-53805 |
9.3 | 0.0087 | NET NO AUTH LOW CX NO UI | NVIDIA Spatial Intelligence Lab's (SIL) GEN3C contains an unauthenticated remote | |
|
79
|
CVE-2026-65687 |
9.3 | 0.0087 | NET NO AUTH LOW CX NO UI | Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepa | |
|
79
|
CVE-2026-65688 |
9.3 | 0.0087 | NET NO AUTH LOW CX NO UI | Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepa | |
|
79
|
CVE-2026-65689 |
9.3 | 0.0087 | NET NO AUTH LOW CX NO UI | Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepa | |
|
79
|
CVE-2026-75827 |
9.3 | 0.0086 | NET NO AUTH LOW CX NO UI | Grav before 2.0.15 contains an arbitrary file write vulnerability in the Bluepri | |
|
78
|
CVE-2026-62916 |
9.1 | 0.0086 | NET NO AUTH LOW CX NO UI | Authentication bypass using an alternate path or channel in Microsoft Entra ID a | |
|
78
|
CVE-2026-49179 |
8.8 | 0.0086 | NET NO AUTH LOW CX | 1 PoC | Improper neutralization of special elements used in a command ('command injectio |
|
75
|
CVE-2026-97788 |
7.5 | 0.0088 | NET NO AUTH LOW CX NO UI | Observable discrepancy in Active Directory Federation Services (AD FS) allows an | |
|
75
|
CVE-2026-33811 |
7.5 | 0.0088 | NET NO AUTH LOW CX NO UI | When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can | |
|
75
|
CVE-2026-48399 |
7.5 | 0.0087 | NET NO AUTH LOW CX NO UI | Adobe Campaign Classic (ACC) is affected by a Violation of Secure Design Princip | |
|
75
|
CVE-2026-54428 |
7.5 | 0.0087 | NET NO AUTH LOW CX NO UI | Allocation of resources without limits or throttling in the HTTP/2 HPACK decoder | |
|
75
|
CVE-2026-8023 |
7.5 | 0.0087 | NET NO AUTH LOW CX NO UI | Zephyr's HTTP server (subsys/net/lib/http) provides a static-filesystem resource | |
|
75
|
CVE-2023-2829 |
7.5 | 0.0087 | NET NO AUTH LOW CX NO UI | A `named` instance configured to run as a DNSSEC-validating recursive resolver w | |
|
75
|
CVE-2023-35920 |
7.5 | 0.0087 | NET NO AUTH LOW CX NO UI | A vulnerability has been identified in SIMATIC MV540 H (All versions < V3.3.4), | |
|
75
|
CVE-2023-35921 |
7.5 | 0.0087 | NET NO AUTH LOW CX NO UI | A vulnerability has been identified in SIMATIC MV540 H (All versions < V3.3.4), | |
|
75
|
CVE-2026-108131 |
7.5 | 0.0086 | NET NO AUTH LOW CX NO UI | No cwe for this issue in Active Directory Federation Services (AD FS) allows an | |
|
75
|
CVE-2026-15323 |
7.5 | 0.0086 | NET NO AUTH LOW CX NO UI | The Product Designer for WooCommerce WordPress | Lumise plugin for WordPress is | |
|
69
|
CVE-2026-106629 |
9.3 | 0.0087 | NET NO AUTH LOW CX | Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vuln | |
|
69
|
CVE-2026-106630 |
9.3 | 0.0087 | NET NO AUTH LOW CX | Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vuln | |
|
69
|
CVE-2026-70332 |
9.6 | 0.0086 | NET NO AUTH LOW CX | Improper neutralization of input during web page generation ('cross-site scripti | |
|
69
|
CVE-2026-48561 |
9.6 | 0.0086 | NET NO AUTH LOW CX | Improper neutralization of special elements used in a command ('command injectio | |
|
69
|
CVE-2026-55008 |
9.6 | 0.0086 | NET NO AUTH LOW CX | Improper neutralization of input during web page generation ('cross-site scripti | |
|
69
|
CVE-2026-65669 |
9.6 | 0.0086 | NET NO AUTH LOW CX | Improper neutralization of special elements in output used by a downstream compo | |
|
68
|
CVE-2026-71476 |
8.7 | 0.0086 | NET NO AUTH LOW CX | Nx is a monorepo solution for TypeScript and polyglot codebases. From version 20 | |
|
68
|
CVE-2026-57104 |
8.8 | 0.0086 | NET NO AUTH LOW CX | Improper neutralization of input during web page generation ('cross-site scripti | |
|
68
|
CVE-2026-69320 |
8.8 | 0.0086 | NET NO AUTH LOW CX | Improper neutralization of special elements used in an os command ('os command i | |
|
68
|
CVE-2026-78463 |
8.8 | 0.0086 | NET NO AUTH LOW CX | Improper control of generation of code ('code injection') in Remote Desktop Clie | |
|
68
|
CVE-2026-41109 |
8.8 | 0.0086 | NET NO AUTH LOW CX | Improper neutralization of special elements in output used by a downstream compo | |
|
68
|
CVE-2026-85363 |
8.8 | 0.0086 | NET NO AUTH LOW CX | Integer overflow or wraparound in .NET Framework allows an unauthorized attacker | |
|
68
|
CVE-2026-96235 |
8.8 | 0.0086 | NET NO AUTH LOW CX | Out-of-bounds write in .NET allows an unauthorized attacker to execute code over | |
|
68
|
CVE-2026-88186 |
8.8 | 0.0086 | NET NO AUTH LOW CX | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attac | |
|
68
|
CVE-2026-97004 |
8.8 | 0.0086 | NET NO AUTH LOW CX | Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized atta | |
|
65
|
CVE-2026-57993 |
7.4 | 0.0088 | NET NO AUTH LOW CX | Server-side request forgery (ssrf) in Microsoft Edge (Chromium-based) allows an | |
|
65
|
CVE-2026-58612 |
7.4 | 0.0087 | NET NO AUTH LOW CX | Server-side request forgery (ssrf) in Microsoft PowerShell Core allows an unauth |