Hunt List
8,504 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-45618 |
10.0 | 0.0082 | NET NO AUTH LOW CX NO UI | LiquidJS is a Shopify/GitHub Pages compatible template engine. Prior to version | |
|
80
|
CVE-2026-79847 |
10.0 | 0.0082 | NET NO AUTH LOW CX NO UI | Buffer overflow vulnerabilities in the affected interface of AOS-10 could lead t | |
|
80
|
CVE-2026-24270 |
9.8 | 0.0081 | NET NO AUTH LOW CX NO UI | NVIDIA AIStore framework contains a vulnerability where an attacker could bypass | |
|
80
|
CVE-2023-24482 |
9.8 | 0.0081 | NET NO AUTH LOW CX NO UI | A vulnerability has been identified in COMOS V10.2 (All versions), COMOS V10.3.3 | |
|
80
|
CVE-2024-11080 |
9.8 | 0.0081 | NET NO AUTH LOW CX NO UI | The Post Grid and Gutenberg Blocks – ComboBlocks plugin for WordPress is vulnera | |
|
80
|
CVE-2026-11756 |
10.0 | 0.0081 | NET NO AUTH LOW CX NO UI | A Deserialization of Untrusted Data vulnerability affecting Station Launcher App | |
|
80
|
CVE-2026-65883 |
10.0 | 0.0081 | NET NO AUTH LOW CX NO UI | Joomla Extension - aimy-extensions.com - RCE via PHP object injection in Aimy Ca | |
|
80
|
CVE-2026-17061 |
10.0 | 0.0081 | NET NO AUTH LOW CX NO UI | A Deserialization of Untrusted Data vulnerability affecting SIMULIA Execution En | |
|
80
|
CVE-2026-59940 |
9.8 | 0.0081 | NET NO AUTH LOW CX NO UI | Seroval facilitates JS value stringification, including complex structures beyon | |
|
80
|
CVE-2026-61486 |
9.8 | 0.0081 | NET NO AUTH LOW CX NO UI | ** UNSUPPORTED WHEN ASSIGNED ** Stack-based Buffer Overflow vulnerability in Apa | |
|
78
|
CVE-2014-125134 |
8.7 | 0.0082 | NET NO AUTH LOW CX NO UI | ChurcHope theme for WordPress before 2.2 contains a path traversal vulnerability | |
|
78
|
CVE-2026-47896 |
8.9 | 0.0081 | NET NO AUTH LOW CX NO UI | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') v | |
|
78
|
CVE-2026-65315 |
8.7 | 0.0081 | NET NO AUTH LOW CX NO UI | Ollama (HEAD f0078ae) contains an uncontrolled memory allocation vulnerability i | |
|
75
|
CVE-2026-17615 |
7.5 | 0.0082 | NET NO AUTH LOW CX NO UI | A flaw was found in RESTEasy's SourceProvider. This vulnerability allows an unau | |
|
75
|
CVE-2026-78058 |
7.5 | 0.0081 | NET NO AUTH LOW CX NO UI | Uncontrolled resource consumption in the HTTP/2 (h2) receive path of Apache bRPC | |
|
75
|
CVE-2026-6758 |
7.5 | 0.0081 | NET NO AUTH LOW CX NO UI | Use-after-free in the JavaScript: WebAssembly component. This vulnerability was | |
|
75
|
CVE-2026-28983 |
7.5 | 0.0081 | NET NO AUTH LOW CX NO UI | A type confusion issue was addressed with improved checks. This issue is fixed i | |
|
75
|
CVE-2026-61372 |
7.5 | 0.0081 | NET NO AUTH LOW CX NO UI | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') v | |
|
75
|
CVE-2026-66907 |
7.5 | 0.0081 | NET NO AUTH LOW CX NO UI | Relative path traversal vulnerability in Apache Camel Google Storage component. | |
|
75
|
CVE-2026-110354 |
7.5 | 0.0081 | NET NO AUTH LOW CX NO UI | HAProxy 3 before 3.4.6 allows a remote unauthenticated attacker to cause a denia | |
|
69
|
CVE-2026-102238 |
9.6 | 0.0082 | NET NO AUTH LOW CX | Improper limitation of a pathname to a restricted directory ('path traversal') i | |
|
69
|
CVE-2026-70477 |
9.5 | 0.0081 | NET NO AUTH NO UI | Flowise is a drag & drop user interface to build a customized large language mod | |
|
69
|
CVE-2026-57571 |
9.6 | 0.0081 | NET NO AUTH LOW CX | Crawl4AI is an open-source LLM-friendly web crawler and scraper. Prior to 0.9.0, | |
|
68
|
CVE-2026-69742 |
8.8 | 0.0082 | NET NO AUTH LOW CX | Integer overflow or wraparound in Microsoft Office Publisher allows an unauthori | |
|
68
|
CVE-2026-69759 |
8.8 | 0.0082 | NET NO AUTH LOW CX | Stack-based buffer overflow in Microsoft Office Word allows an unauthorized atta | |
|
68
|
CVE-2026-69764 |
8.8 | 0.0082 | NET NO AUTH LOW CX | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attac | |
|
68
|
CVE-2026-69767 |
8.8 | 0.0082 | NET NO AUTH LOW CX | Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to | |
|
68
|
CVE-2026-69772 |
8.8 | 0.0082 | NET NO AUTH LOW CX | Heap-based buffer overflow in Windows Network File System allows an unauthorized | |
|
68
|
CVE-2026-69778 |
8.8 | 0.0082 | NET NO AUTH LOW CX | Heap-based buffer overflow in Microsoft Office Access allows an unauthorized att | |
|
68
|
CVE-2026-69797 |
8.8 | 0.0082 | NET NO AUTH LOW CX | Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to | |
|
68
|
CVE-2026-69860 |
8.8 | 0.0082 | NET NO AUTH LOW CX | Heap-based buffer overflow in Windows Imaging Component allows an unauthorized a | |
|
68
|
CVE-2026-70351 |
8.8 | 0.0082 | NET NO AUTH LOW CX | Integer overflow or wraparound in Microsoft WebP Image Extension allows an unaut | |
|
68
|
CVE-2026-70586 |
8.8 | 0.0082 | NET NO AUTH LOW CX | Heap-based buffer overflow in Windows Paint allows an unauthorized attacker to e | |
|
68
|
CVE-2026-72940 |
8.8 | 0.0082 | NET NO AUTH LOW CX | Heap-based buffer overflow in Windows Schannel allows an unauthorized attacker t | |
|
68
|
CVE-2026-72986 |
8.8 | 0.0082 | NET NO AUTH LOW CX | Heap-based buffer overflow in Graphic Fonts allows an unauthorized attacker to e | |
|
68
|
CVE-2026-77495 |
8.8 | 0.0082 | NET NO AUTH LOW CX | Heap-based buffer overflow in Windows Imaging Component allows an unauthorized a | |
|
68
|
CVE-2026-77504 |
8.8 | 0.0082 | NET NO AUTH LOW CX | Double free in Microsoft Office Word allows an unauthorized attacker to execute | |
|
68
|
CVE-2026-77907 |
8.8 | 0.0082 | NET NO AUTH LOW CX | Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to e | |
|
68
|
CVE-2026-78504 |
8.8 | 0.0082 | NET NO AUTH LOW CX | Stack-based buffer overflow in Microsoft Office Word allows an unauthorized atta | |
|
68
|
CVE-2026-78505 |
8.8 | 0.0082 | NET NO AUTH LOW CX | Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker t | |
|
68
|
CVE-2026-78511 |
8.8 | 0.0082 | NET NO AUTH LOW CX | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attac | |
|
68
|
CVE-2026-78517 |
8.8 | 0.0082 | NET NO AUTH LOW CX | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attac | |
|
68
|
CVE-2026-80074 |
8.8 | 0.0082 | NET NO AUTH LOW CX | Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attac | |
|
68
|
CVE-2026-80077 |
8.8 | 0.0082 | NET NO AUTH LOW CX | Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attac | |
|
68
|
CVE-2026-83998 |
8.8 | 0.0082 | NET NO AUTH LOW CX | Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attac | |
|
68
|
CVE-2026-85877 |
8.8 | 0.0082 | NET NO AUTH LOW CX | Heap-based buffer overflow in Windows Print Spooler Components allows an unautho | |
|
68
|
CVE-2023-0767 |
8.8 | 0.0082 | NET NO AUTH LOW CX | An attacker could construct a PKCS 12 cert bundle in such a way that could allow | |
|
68
|
CVE-2026-70336 |
8.8 | 0.0082 | NET NO AUTH LOW CX | Improper control of generation of code ('code injection') in Visual Studio Code | |
|
66
|
CVE-2026-100218 |
8.1 | 0.0082 | NET NO AUTH NO UI | Use after free in Remote Desktop Gateway Service allows an unauthorized attacker | |
|
66
|
CVE-2026-70127 |
8.1 | 0.0082 | NET NO AUTH NO UI | Use after free in DNS Server allows an unauthorized attacker to execute code ove |