Hunt List
8,506 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-44181 |
10.0 | 0.0077 | NET NO AUTH LOW CX NO UI | Jupyter Enterprise Gateway launches remote Jupyter Notebook kernels across distr | |
|
80
|
CVE-2026-43750 |
9.8 | 0.0077 | NET NO AUTH LOW CX NO UI | A buffer overflow was addressed with improved bounds checking. This issue is fix | |
|
80
|
CVE-2026-46412 |
10.0 | 0.0076 | NET NO AUTH LOW CX NO UI | @beproduct/nestjs-auth is a NestJS authentication module for BeProduct IDS (Iden | |
|
80
|
CVE-2026-11405 |
9.8 | 0.0076 | NET NO AUTH LOW CX NO UI | The web server binary /bin/httpd contains a hidden backdoor authentication mecha | |
|
80
|
CVE-2026-66012 |
10.0 | 0.0076 | NET NO AUTH LOW CX NO UI | SiYuan before v3.7.2 contains a missing authorization vulnerability in the POST | |
|
80
|
CVE-2026-79851 |
10.0 | 0.0076 | NET NO AUTH LOW CX NO UI | Buffer overflow vulnerabilities exist in the affected interface of AOS-10 that c | |
|
80
|
CVE-2023-30191 |
9.8 | 0.0076 | NET NO AUTH LOW CX NO UI | PrestaShop cdesigner < 3.1.9 is vulnerable to SQL Injection via CdesignerTraitem | |
|
80
|
CVE-2026-47131 |
10.0 | 0.0076 | NET NO AUTH LOW CX NO UI | vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, by combin | |
|
80
|
CVE-2026-68503 |
9.8 | 0.0075 | NET NO AUTH LOW CX NO UI | LazyOwn RedTeam/APT Framework is an AI-powered C2 and red-team operations framew | |
|
80
|
CVE-2026-79855 |
9.8 | 0.0075 | NET NO AUTH LOW CX NO UI | An authentication bypass vulnerability in the SSH daemon of AOS-8 allows an unau | |
|
80
|
CVE-2026-63071 |
9.8 | 0.0075 | NET NO AUTH LOW CX NO UI | Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An | |
|
79
|
CVE-2026-65321 |
9.3 | 0.0077 | NET NO AUTH LOW CX NO UI | PyAthena prior to 3.35.4 contains a sql injection vulnerability that allows unau | |
|
79
|
CVE-2026-6350 |
9.3 | 0.0076 | NET NO AUTH LOW CX NO UI | MailGates/MailAudit developed by Openfind has a Stack-based Buffer Overflow vuln | |
|
79
|
CVE-2026-67595 |
9.2 | 0.0076 | NET NO AUTH LOW CX NO UI | VaahCMS versions 2.0.0 through 2.3.4 contain a malicious obfuscated JavaScript p | |
|
79
|
CVE-2026-20744 |
9.3 | 0.0076 | NET NO AUTH LOW CX NO UI | The charging station websocket endpoint accepts connections without proper auth | |
|
79
|
CVE-2024-26828 |
9.4 | 0.0075 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: cifs: fix u | |
|
79
|
CVE-2026-16462 |
9.3 | 0.0075 | NET NO AUTH LOW CX NO UI | In PROCON-WEB SCADA the endpoint 'GetGridData' is not properly sanitized. This a | |
|
78
|
CVE-2026-71560 |
9.1 | 0.0077 | NET NO AUTH LOW CX NO UI | Out-of-bounds Read vulnerability in Apache Fory C++ deserialization. This issue | |
|
78
|
CVE-2026-7546 |
8.9 | 0.0075 | NET NO AUTH LOW CX NO UI | A security vulnerability has been detected in Totolink NR1800X 9.1.0u.6279_B2021 | |
|
77
|
CVE-2026-39804 |
8.2 | 0.0076 | NET NO AUTH LOW CX NO UI | Allocation of Resources Without Limits or Throttling vulnerability in mtrudel ba | |
|
75
|
CVE-2026-48834 |
7.5 | 0.0076 | NET NO AUTH LOW CX NO UI | Improper Handling of Length Parameter Inconsistency vulnerability in Apache Answ | |
|
75
|
CVE-2026-42403 |
7.5 | 0.0076 | NET NO AUTH LOW CX NO UI | Apache Neethi does not properly detect circular references in policy definitions | |
|
69
|
CVE-2026-69356 |
9.3 | 0.0076 | NET NO AUTH LOW CX | Improper neutralization of input during web page generation ('cross-site scripti | |
|
68
|
CVE-2026-69326 |
8.8 | 0.0077 | NET NO AUTH LOW CX | Heap-based buffer overflow in Graphic Fonts allows an unauthorized attacker to e | |
|
68
|
CVE-2026-83725 |
8.8 | 0.0077 | NET NO AUTH LOW CX | Heap-based buffer overflow in Microsoft Windows Search Component allows an unaut | |
|
68
|
CVE-2026-83851 |
8.8 | 0.0077 | NET NO AUTH LOW CX | Heap-based buffer overflow in Windows Partition Management Driver allows an unau | |
|
68
|
CVE-2026-83831 |
8.8 | 0.0077 | NET NO AUTH LOW CX | Double free in Microsoft Edge (Chromium-based) allows an unauthorized attacker t | |
|
68
|
CVE-2026-85898 |
8.8 | 0.0077 | NET NO AUTH LOW CX | Access of resource using incompatible type ('type confusion') in Microsoft Edge | |
|
68
|
CVE-2026-96196 |
8.8 | 0.0077 | NET NO AUTH LOW CX | Incomplete list of disallowed inputs in Microsoft Edge (Chromium-based) allows a | |
|
68
|
CVE-2026-96224 |
8.8 | 0.0076 | NET NO AUTH LOW CX | Out-of-bounds write in .NET allows an unauthorized attacker to execute code over | |
|
68
|
CVE-2026-47645 |
8.8 | 0.0076 | NET NO AUTH LOW CX | Url redirection to untrusted site ('open redirect') in Microsoft 365 Copilot's B | |
|
68
|
CVE-2026-59113 |
8.8 | 0.0076 | NET NO AUTH LOW CX | Missing authorization in Visual Studio Code allows an unauthorized attacker to e | |
|
68
|
CVE-2026-88150 |
8.8 | 0.0076 | NET NO AUTH LOW CX | Use of uninitialized resource in Microsoft Office Word allows an unauthorized at | |
|
68
|
CVE-2026-88202 |
8.8 | 0.0076 | NET NO AUTH LOW CX | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attac | |
|
68
|
CVE-2026-97003 |
8.8 | 0.0076 | NET NO AUTH LOW CX | Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized atta | |
|
68
|
CVE-2026-97017 |
8.8 | 0.0076 | NET NO AUTH LOW CX | Use after free in Microsoft Office Excel allows an unauthorized attacker to exec | |
|
68
|
CVE-2026-97750 |
8.8 | 0.0076 | NET NO AUTH LOW CX | Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized att | |
|
68
|
CVE-2026-97766 |
8.8 | 0.0076 | NET NO AUTH LOW CX | Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized atta | |
|
68
|
CVE-2026-78462 |
8.8 | 0.0076 | NET NO AUTH LOW CX | Authorization bypass through user-controlled key in Visual Studio Code allows an | |
|
68
|
CVE-2023-37202 |
8.8 | 0.0076 | NET NO AUTH LOW CX | Cross-compartment wrappers wrapping a scripted proxy could have caused objects f | |
|
68
|
CVE-2023-32213 |
8.8 | 0.0075 | NET NO AUTH LOW CX | When reading a file, an uninitialized value could have been used as read limit. | |
|
68
|
CVE-2023-37211 |
8.8 | 0.0075 | NET NO AUTH LOW CX | Memory safety bugs present in Firefox 114, Firefox ESR 102.12, and Thunderbird 1 | |
|
68
|
CVE-2023-41677 |
8.8 | 0.0075 | NET NO AUTH LOW CX | A insufficiently protected credentials vulnerability in Fortinet FortiOS 7.4.0 t | |
|
66
|
CVE-2026-86410 |
8.1 | 0.0077 | NET NO AUTH NO UI | A flaw in the curl command line tool's logic makes it only set SSH host verifica | |
|
66
|
CVE-2026-108457 |
8.1 | 0.0076 | NET NO AUTH NO UI | Out-of-bounds write in Microsoft Windows PDF allows an unauthorized attacker to | |
|
66
|
CVE-2026-108460 |
8.1 | 0.0076 | NET NO AUTH NO UI | Use after free in Windows Message Queuing allows an unauthorized attacker to exe | |
|
66
|
CVE-2026-88119 |
8.1 | 0.0076 | NET NO AUTH NO UI | Use after free in Windows DHCP Server allows an unauthorized attacker to execute | |
|
66
|
CVE-2026-88120 |
8.1 | 0.0076 | NET NO AUTH NO UI | Use after free in Windows DHCP Server allows an unauthorized attacker to execute | |
|
65
|
CVE-2026-10303 |
7.4 | 0.0076 | NET NO AUTH NO UI | In ServerCo getssl version 2.49 and prior, the ACME challenge token returned to | |
|
64
|
CVE-2026-57988 |
7.1 | 0.0076 | NET NO AUTH LOW CX | Relative path traversal in Microsoft Edge (Chromium-based) allows an unauthorize |