Hunt List
8,505 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-64608 |
9.8 | 0.0081 | NET NO AUTH LOW CX NO UI | Heap type confusion and out-of-bounds read/write in the Apache Fory C++ implemen | |
|
80
|
CVE-2026-61484 |
9.8 | 0.0081 | NET NO AUTH LOW CX NO UI | ** UNSUPPORTED WHEN ASSIGNED ** Deserialization of Untrusted Data vulnerability | |
|
80
|
CVE-2026-72130 |
9.8 | 0.0080 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: | |
|
80
|
CVE-2026-72398 |
9.8 | 0.0080 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: sctp: add I | |
|
80
|
CVE-2026-72592 |
9.8 | 0.0080 | NET NO AUTH LOW CX NO UI | An unrestricted file upload vulnerability in dulldusk/phpfm through 1.8.0 allows | |
|
80
|
CVE-2026-17083 |
9.8 | 0.0080 | NET NO AUTH LOW CX NO UI | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to execute arbitrary | |
|
80
|
CVE-2026-16845 |
9.8 | 0.0080 | NET NO AUTH LOW CX NO UI | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to e | |
|
80
|
CVE-2026-16862 |
9.8 | 0.0080 | NET NO AUTH LOW CX NO UI | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to e | |
|
80
|
CVE-2026-16864 |
9.8 | 0.0080 | NET NO AUTH LOW CX NO UI | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to e | |
|
80
|
CVE-2026-16872 |
9.8 | 0.0080 | NET NO AUTH LOW CX NO UI | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to e | |
|
80
|
CVE-2026-16885 |
9.8 | 0.0080 | NET NO AUTH LOW CX NO UI | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to e | |
|
80
|
CVE-2026-16894 |
9.8 | 0.0080 | NET NO AUTH LOW CX NO UI | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to e | |
|
80
|
CVE-2026-16913 |
9.8 | 0.0080 | NET NO AUTH LOW CX NO UI | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to e | |
|
80
|
CVE-2026-17040 |
9.8 | 0.0080 | NET NO AUTH LOW CX NO UI | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to e | |
|
80
|
CVE-2026-17122 |
9.8 | 0.0080 | NET NO AUTH LOW CX NO UI | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to e | |
|
80
|
CVE-2026-17141 |
9.8 | 0.0080 | NET NO AUTH LOW CX NO UI | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to e | |
|
80
|
CVE-2026-17152 |
9.8 | 0.0080 | NET NO AUTH LOW CX NO UI | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to e | |
|
80
|
CVE-2026-17157 |
9.8 | 0.0080 | NET NO AUTH LOW CX NO UI | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to e | |
|
80
|
CVE-2026-63508 |
10.0 | 0.0080 | NET NO AUTH LOW CX NO UI | Missing authentication for critical function in Microsoft Planetary Computer Pro | |
|
80
|
CVE-2026-65667 |
10.0 | 0.0080 | NET NO AUTH LOW CX NO UI | Missing authorization in Microsoft Teams allows an unauthorized attacker to elev | |
|
80
|
CVE-2026-69502 |
10.0 | 0.0080 | NET NO AUTH LOW CX NO UI | Server-side request forgery (ssrf) in Azure SQL Database allows an unauthorized | |
|
80
|
CVE-2026-69555 |
10.0 | 0.0080 | NET NO AUTH LOW CX NO UI | Incorrect authorization in Azure Arc allows an unauthorized attacker to elevate | |
|
80
|
CVE-2026-69865 |
10.0 | 0.0080 | NET NO AUTH LOW CX NO UI | Authorization bypass through user-controlled key in Microsoft Container Registry | |
|
80
|
CVE-2026-83711 |
10.0 | 0.0080 | NET NO AUTH LOW CX NO UI | Authorization bypass through user-controlled key in Microsoft Azure Active Direc | |
|
80
|
CVE-2026-63455 |
9.8 | 0.0080 | NET NO AUTH LOW CX NO UI | Multiple vulnerabilities in the REST API interface of HPE Networking SD-WAN Orch | |
|
80
|
CVE-2026-63456 |
9.8 | 0.0080 | NET NO AUTH LOW CX NO UI | Multiple vulnerabilities in the REST API interface of HPE Networking SD-WAN Orch | |
|
80
|
CVE-2026-17218 |
9.8 | 0.0080 | NET NO AUTH LOW CX NO UI | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to execute arbitrary | |
|
80
|
CVE-2026-16840 |
9.8 | 0.0080 | NET NO AUTH LOW CX NO UI | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to e | |
|
79
|
CVE-2026-35019 |
9.2 | 0.0081 | NET NO AUTH LOW CX NO UI | NetComm NF20MESH routers running firmware R6B031 and earlier contain an authenti | |
|
79
|
CVE-2026-58466 |
9.3 | 0.0080 | NET NO AUTH LOW CX NO UI | AutoBangumi before 3.2.8 contains a hard-coded default credentials vulnerability | |
|
78
|
CVE-2026-17556 |
8.8 | 0.0080 | NET NO AUTH LOW CX NO UI | A path traversal vulnerability was identified in GitHub Enterprise Server that a | |
|
78
|
CVE-2026-64320 |
9.1 | 0.0080 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: nvmet: fix | |
|
77
|
CVE-2026-68749 |
8.2 | 0.0080 | NET NO AUTH LOW CX NO UI | Inefficient Regular Expression Complexity vulnerability in the CSS scrubber in r | |
|
77
|
CVE-2026-68750 |
8.2 | 0.0080 | NET NO AUTH LOW CX NO UI | Inefficient Algorithmic Complexity vulnerability in the traversal engine in rrre | |
|
75
|
CVE-2026-25703 |
7.3 | 0.0080 | NET NO AUTH LOW CX NO UI | NeuVector through 5.4.9 is can potentially leak information from manager /networ | |
|
75
|
CVE-2026-111765 |
7.5 | 0.0080 | NET NO AUTH LOW CX NO UI | A2A Java SDK is the official Java SDK for the Agent2Agent (A2A) Protocol. Starti | |
|
75
|
CVE-2026-28952 |
7.5 | 0.0080 | NET NO AUTH LOW CX NO UI | An integer overflow was addressed with improved input validation. This issue is | |
|
75
|
CVE-2026-26164 |
7.5 | 0.0080 | NET NO AUTH LOW CX NO UI | Improper neutralization of special elements used in a command ('command injectio | |
|
75
|
CVE-2026-71559 |
7.5 | 0.0080 | NET NO AUTH LOW CX NO UI | Deserialization of Untrusted Data vulnerability in the Go implementation of Apac | |
|
68
|
CVE-2026-97753 |
8.8 | 0.0080 | NET NO AUTH LOW CX | Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized atta | |
|
68
|
CVE-2026-97755 |
8.8 | 0.0080 | NET NO AUTH LOW CX | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to | |
|
68
|
CVE-2026-97759 |
8.8 | 0.0080 | NET NO AUTH LOW CX | Use after free in Microsoft Office Excel allows an unauthorized attacker to exec | |
|
68
|
CVE-2026-70007 |
8.8 | 0.0080 | NET NO AUTH LOW CX | Out-of-bounds write in .NET Framework allows an unauthorized attacker to execute | |
|
68
|
CVE-2026-69521 |
8.8 | 0.0080 | NET NO AUTH LOW CX | Integer overflow or wraparound in Windows iSCSI allows an unauthorized attacker | |
|
68
|
CVE-2026-69765 |
8.8 | 0.0080 | NET NO AUTH LOW CX | Use after free in Windows Storport Miniport Driver allows an unauthorized attack | |
|
68
|
CVE-2026-69985 |
8.8 | 0.0080 | NET NO AUTH LOW CX | Heap-based buffer overflow in Windows Libarchive allows an unauthorized attacker | |
|
68
|
CVE-2026-62895 |
8.8 | 0.0080 | NET NO AUTH LOW CX | Permissive cross-domain policy with untrusted domains in Azure Arc allows an una | |
|
67
|
CVE-2026-40501 |
8.6 | 0.0080 | NET NO AUTH LOW CX | Cherry Studio versions 1.2.2 through 1.9.12, fixed in commit 1518530, contain a | |
|
66
|
CVE-2026-83522 |
8.1 | 0.0080 | NET NO AUTH NO UI | Reliance on untrusted inputs in a security decision in Windows IKE Extension all | |
|
66
|
CVE-2026-83914 |
8.1 | 0.0080 | NET NO AUTH NO UI | Use after free in Microsoft XML allows an unauthorized attacker to execute code |