Hunt List
8,494 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-16956 |
9.8 | 0.0086 | NET NO AUTH LOW CX NO UI | IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to execute | |
|
80
|
CVE-2026-16882 |
9.8 | 0.0086 | NET NO AUTH LOW CX NO UI | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to e | |
|
80
|
CVE-2026-48449 |
9.8 | 0.0086 | NET NO AUTH LOW CX NO UI | Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerabi | |
|
80
|
CVE-2026-58231 |
10.0 | 0.0086 | NET NO AUTH LOW CX NO UI | SAP Commerce Cloud allows an unauthenticated attacker to abuse a default authent | |
|
80
|
CVE-2026-107656 |
9.8 | 0.0085 | NET NO AUTH LOW CX NO UI | An authentication bypass using an alternate path or channel vulnerability in For | |
|
80
|
CVE-2025-13204 |
9.8 | 0.0085 | NET NO AUTH LOW CX NO UI | npm package `expr-eval` is vulnerable to Prototype Pollution. An attacker with a | |
|
80
|
CVE-2026-12118 |
9.8 | 0.0085 | NET NO AUTH LOW CX NO UI | IBM webMethods Integration (on prem) 10.15, 10.11 could allow an unauthenticated | |
|
80
|
CVE-2026-13019 |
9.8 | 0.0085 | NET NO AUTH LOW CX NO UI | Esri Portal for ArcGIS versions 12.1 and earlier on Windows, Linux and Kubernete | |
|
79
|
CVE-2026-75827 |
9.3 | 0.0086 | NET NO AUTH LOW CX NO UI | Grav before 2.0.15 contains an arbitrary file write vulnerability in the Bluepri | |
|
79
|
CVE-2026-71878 |
9.2 | 0.0086 | NET NO AUTH LOW CX NO UI | Missing authentication in initial setup functionality left exposed after initial | |
|
79
|
CVE-2026-44128 |
9.3 | 0.0085 | NET NO AUTH LOW CX NO UI | SEPPmail Secure Email Gateway before version 15.0.2.1 allows unauthenticated rem | |
|
79
|
CVE-2026-67594 |
9.3 | 0.0085 | NET NO AUTH LOW CX NO UI | Spikster through commit e1cdf8c contains a missing authentication vulnerability | |
|
78
|
CVE-2026-71879 |
9.1 | 0.0086 | NET NO AUTH LOW CX NO UI | Missing authentication in initial setup functionality left exposed until first r | |
|
78
|
CVE-2026-58166 |
8.8 | 0.0085 | NET NO AUTH LOW CX NO UI | OpenBMB ChatDev through 2.2.0, fixed in commit 4fd4da6, contains a path traversa | |
|
78
|
CVE-2026-67200 |
8.7 | 0.0085 | NET NO AUTH LOW CX NO UI | Perspective 5.0.0 contains a path traversal vulnerability that allows unauthenti | |
|
77
|
CVE-2026-64641 |
8.2 | 0.0086 | NET NO AUTH LOW CX NO UI | Next.js is a React framework for building full-stack web applications. In versio | |
|
77
|
CVE-2026-41432 |
8.2 | 0.0085 | NET NO AUTH LOW CX NO UI | New API is a large language mode (LLM) gateway and artificial intelligence (AI) | |
|
75
|
CVE-2026-46726 |
7.5 | 0.0086 | NET NO AUTH LOW CX NO UI | Improper Input Validation, Exposure of Sensitive Information to an Unauthorized | |
|
75
|
CVE-2026-66143 |
7.5 | 0.0085 | NET NO AUTH LOW CX NO UI | It is possible to bypass the maximum number of normalized policy alternatives th | |
|
75
|
CVE-2026-23904 |
7.3 | 0.0085 | NET NO AUTH LOW CX NO UI | Kyuubi Engine UI proxy accepts a host and port from the request path and proxies | |
|
75
|
CVE-2026-15561 |
7.5 | 0.0085 | NET NO AUTH LOW CX NO UI | A flaw was found in EAP's undertow http/1.1 chunked-transfer decoder. missing li | |
|
68
|
CVE-2026-85363 |
8.8 | 0.0086 | NET NO AUTH LOW CX | Integer overflow or wraparound in .NET Framework allows an unauthorized attacker | |
|
68
|
CVE-2026-96235 |
8.8 | 0.0086 | NET NO AUTH LOW CX | Out-of-bounds write in .NET allows an unauthorized attacker to execute code over | |
|
68
|
CVE-2026-88186 |
8.8 | 0.0086 | NET NO AUTH LOW CX | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attac | |
|
68
|
CVE-2026-97004 |
8.8 | 0.0086 | NET NO AUTH LOW CX | Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized atta | |
|
68
|
CVE-2026-97007 |
8.8 | 0.0086 | NET NO AUTH LOW CX | Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized atta | |
|
68
|
CVE-2026-97008 |
8.8 | 0.0086 | NET NO AUTH LOW CX | Buffer underwrite ('buffer underflow') in Microsoft Office Excel allows an unaut | |
|
68
|
CVE-2026-97738 |
8.8 | 0.0086 | NET NO AUTH LOW CX | Use after free in Microsoft Office Excel allows an unauthorized attacker to exec | |
|
68
|
CVE-2026-97746 |
8.8 | 0.0086 | NET NO AUTH LOW CX | Integer underflow (wrap or wraparound) in Microsoft Office Excel allows an unaut | |
|
68
|
CVE-2026-97748 |
8.8 | 0.0086 | NET NO AUTH LOW CX | Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized atta | |
|
68
|
CVE-2026-97757 |
8.8 | 0.0086 | NET NO AUTH LOW CX | Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized atta | |
|
68
|
CVE-2026-97762 |
8.8 | 0.0086 | NET NO AUTH LOW CX | Out-of-bounds write in Microsoft Office Excel allows an unauthorized attacker to | |
|
68
|
CVE-2026-97763 |
8.8 | 0.0086 | NET NO AUTH LOW CX | Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized atta | |
|
68
|
CVE-2026-97768 |
8.8 | 0.0086 | NET NO AUTH LOW CX | Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized atta | |
|
68
|
CVE-2026-102858 |
8.8 | 0.0086 | NET NO AUTH LOW CX | Heap-based buffer overflow in Microsoft Office OneNote allows an unauthorized at | |
|
68
|
CVE-2026-69614 |
8.8 | 0.0086 | NET NO AUTH LOW CX | Stack-based buffer overflow in Microsoft Office Access allows an unauthorized at | |
|
68
|
CVE-2026-78518 |
8.8 | 0.0086 | NET NO AUTH LOW CX | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to | |
|
68
|
CVE-2026-64831 |
8.7 | 0.0085 | NET NO AUTH LOW CX | FFmpeg versions 8.0 through 8.1.2 contains a stack buffer overflow vulnerability | |
|
68
|
CVE-2026-103575 |
8.8 | 0.0085 | NET NO AUTH LOW CX | Use after free in Remote Desktop Client allows an unauthorized attacker to execu | |
|
68
|
CVE-2026-105007 |
8.8 | 0.0085 | NET NO AUTH LOW CX | An elevation of privilege vulnerability exists in the Network Driver Interface S | |
|
68
|
CVE-2026-108458 |
8.8 | 0.0085 | NET NO AUTH LOW CX | Use after free in Remote Desktop Client allows an unauthorized attacker to execu | |
|
68
|
CVE-2026-83789 |
8.8 | 0.0085 | NET NO AUTH LOW CX | Heap-based buffer overflow in Windows SMB Client allows an unauthorized attacker | |
|
68
|
CVE-2026-83797 |
8.8 | 0.0085 | NET NO AUTH LOW CX | Out-of-bounds read in Windows Partition Management Driver allows an unauthorized | |
|
68
|
CVE-2026-102203 |
8.8 | 0.0085 | NET NO AUTH LOW CX | Access of resource using incompatible type ('type confusion') in RPC Runtime all | |
|
68
|
CVE-2026-88219 |
8.8 | 0.0085 | NET NO AUTH LOW CX | Untrusted pointer dereference in RPC Runtime allows an unauthorized attacker to | |
|
68
|
CVE-2026-83874 |
8.8 | 0.0085 | NET NO AUTH LOW CX | Heap-based buffer overflow in Windows Event Tracing allows an unauthorized attac | |
|
68
|
CVE-2026-63093 |
8.7 | 0.0085 | NET NO AUTH LOW CX | Cursor for Windows version 3.2.16 contains a binary planting vulnerability that | |
|
67
|
CVE-2026-57516 |
8.6 | 0.0086 | NET NO AUTH LOW CX | Ray prior to 2.56.0 contains an unsafe deserialization vulnerability in the WebD | |
|
66
|
CVE-2026-41113 |
8.1 | 0.0085 | NET NO AUTH NO UI | sagredo qmail before 2026.04.07 allows tls_quit remote code execution because of | |
|
66
|
CVE-2026-70563 |
8.1 | 0.0085 | NET NO AUTH LOW CX | Improper link resolution before file access ('link following') in Windows Shell |