Hunt List
8,520 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2023-2186 |
9.8 | 0.0071 | NET NO AUTH LOW CX NO UI | On Triangle MicroWorks' SCADA Data Gateway version <= v5.01.03, an unauthenticat | |
|
80
|
CVE-2026-50628 |
9.8 | 0.0071 | NET NO AUTH LOW CX NO UI | A logic error in OAuthRequestFilter rejects legitimate requests originating from | |
|
80
|
CVE-2026-71207 |
9.8 | 0.0071 | NET NO AUTH LOW CX NO UI | The Stock-Inventory-Management-System application's login.php assigns raw userna | |
|
78
|
CVE-2026-53985 |
8.7 | 0.0071 | NET NO AUTH LOW CX NO UI | Ground Station prior to 0.6.0 contains an unauthenticated denial-of-service vuln | |
|
78
|
CVE-2026-67585 |
8.7 | 0.0071 | NET NO AUTH LOW CX NO UI | Allocation of Resources Without Limits or Throttling vulnerability in DivvyPayHQ | |
|
75
|
CVE-2026-42895 |
7.5 | 0.0071 | NET NO AUTH LOW CX NO UI | Improper neutralization of special elements used in a command ('command injectio | |
|
75
|
CVE-2026-89528 |
7.5 | 0.0071 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: svcrdma: Re | |
|
75
|
CVE-2026-4967 |
7.5 | 0.0071 | NET NO AUTH LOW CX NO UI | In IMS, there is a possible out of bounds read due to a missing bounds check. Th | |
|
75
|
CVE-2026-20479 |
7.5 | 0.0071 | NET NO AUTH LOW CX NO UI | In Modem, there is a possible out of bounds read due to a missing bounds check. | |
|
75
|
CVE-2026-21548 |
7.5 | 0.0071 | NET NO AUTH LOW CX NO UI | In nr modem, there is a possible improper input validation. This could lead to r | |
|
75
|
CVE-2026-21549 |
7.5 | 0.0071 | NET NO AUTH LOW CX NO UI | In modem, there is a possible improper input validation. This could lead to remo | |
|
75
|
CVE-2026-21550 |
7.5 | 0.0071 | NET NO AUTH LOW CX NO UI | In modem, there is a possible improper input validation. This could lead to remo | |
|
75
|
CVE-2026-21551 |
7.5 | 0.0071 | NET NO AUTH LOW CX NO UI | In modem, there is a possible improper input validation. This could lead to remo | |
|
75
|
CVE-2026-21552 |
7.5 | 0.0071 | NET NO AUTH LOW CX NO UI | In modem, there is a possible improper input validation. This could lead to remo | |
|
75
|
CVE-2026-21553 |
7.5 | 0.0071 | NET NO AUTH LOW CX NO UI | In modem, there is a possible improper input validation. This could lead to remo | |
|
75
|
CVE-2026-21554 |
7.5 | 0.0071 | NET NO AUTH LOW CX NO UI | In modem, there is a possible improper input validation. This could lead to remo | |
|
75
|
CVE-2026-21555 |
7.5 | 0.0071 | NET NO AUTH LOW CX NO UI | In modem, there is a possible improper input validation. This could lead to remo | |
|
75
|
CVE-2026-45742 |
7.5 | 0.0070 | NET NO AUTH LOW CX NO UI | Gotenberg is a Docker-powered stateless API for PDF files. From 8.10.0 until 8.3 | |
|
66
|
CVE-2026-62781 |
8.1 | 0.0071 | NET NO AUTH NO UI | Heap-based buffer overflow in RPC Runtime allows an unauthorized attacker to exe | |
|
66
|
CVE-2026-65679 |
8.1 | 0.0071 | NET NO AUTH NO UI | Heap-based buffer overflow in Windows iSCSI Target Service allows an unauthorize | |
|
66
|
CVE-2026-65796 |
8.1 | 0.0071 | NET NO AUTH NO UI | Heap-based buffer overflow in Windows iSCSI Target Service allows an unauthorize | |
|
66
|
CVE-2026-71331 |
8.1 | 0.0071 | NET NO AUTH NO UI | Integer overflow or wraparound in Windows Device Health Attestation (DHA) allows | |
|
66
|
CVE-2026-50686 |
8.1 | 0.0071 | NET NO AUTH NO UI | Access of resource using incompatible type ('type confusion') in Windows OLE all | |
|
66
|
CVE-2026-62792 |
8.1 | 0.0071 | NET NO AUTH NO UI | Stack-based buffer overflow in Windows TCP/IP allows an unauthorized attacker to | |
|
66
|
CVE-2026-62819 |
8.1 | 0.0071 | NET NO AUTH NO UI | Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows | |
|
66
|
CVE-2026-62889 |
8.1 | 0.0071 | NET NO AUTH NO UI | Double free in Windows Secure Socket Tunneling Protocol (SSTP) allows an unautho | |
|
66
|
CVE-2026-65789 |
8.1 | 0.0071 | NET NO AUTH NO UI | Use after free in Windows DNS allows an unauthorized attacker to execute code ov | |
|
66
|
CVE-2026-69438 |
8.1 | 0.0071 | NET NO AUTH NO UI | Incorrect conversion between numeric types in Microsoft JScript allows an unauth | |
|
66
|
CVE-2026-69510 |
8.1 | 0.0071 | NET NO AUTH NO UI | Stack-based buffer overflow in Windows DHCP Server allows an unauthorized attack | |
|
66
|
CVE-2026-69530 |
8.1 | 0.0071 | NET NO AUTH NO UI | Use after free in Reliable Multicast Transport Driver (RMCAST) allows an unautho | |
|
66
|
CVE-2026-69546 |
8.1 | 0.0071 | NET NO AUTH NO UI | Use after free in Active Directory Domain Services allows an unauthorized attack | |
|
66
|
CVE-2026-69620 |
8.1 | 0.0071 | NET NO AUTH NO UI | Stack-based buffer overflow in Windows DHCP Server allows an unauthorized attack | |
|
66
|
CVE-2026-69786 |
8.1 | 0.0071 | NET NO AUTH NO UI | Heap-based buffer overflow in Windows Text Shaping allows an unauthorized attack | |
|
66
|
CVE-2026-69813 |
8.1 | 0.0071 | NET NO AUTH NO UI | Use after free in Windows DNS allows an unauthorized attacker to execute code ov | |
|
66
|
CVE-2026-69858 |
8.1 | 0.0071 | NET NO AUTH NO UI | Use after free in Windows DNS allows an unauthorized attacker to execute code ov | |
|
66
|
CVE-2026-72936 |
8.1 | 0.0071 | NET NO AUTH NO UI | Use after free in Windows SMB Client allows an unauthorized attacker to execute | |
|
66
|
CVE-2026-72987 |
8.1 | 0.0071 | NET NO AUTH NO UI | Use after free in Windows DNS allows an unauthorized attacker to execute code ov | |
|
66
|
CVE-2026-78444 |
8.1 | 0.0071 | NET NO AUTH NO UI | Untrusted pointer dereference in Windows Failover Cluster allows an unauthorized | |
|
66
|
CVE-2026-78449 |
8.1 | 0.0071 | NET NO AUTH NO UI | Use after free in Reliable Multicast Transport Driver (RMCAST) allows an unautho | |
|
66
|
CVE-2026-78450 |
8.1 | 0.0071 | NET NO AUTH NO UI | Use after free in Reliable Multicast Transport Driver (RMCAST) allows an unautho | |
|
66
|
CVE-2026-83997 |
8.1 | 0.0071 | NET NO AUTH NO UI | Use after free in Windows Message Queuing allows an unauthorized attacker to exe | |
|
66
|
CVE-2026-55007 |
8.1 | 0.0071 | NET NO AUTH NO UI | Double free in Microsoft Exchange Server allows an unauthorized attacker to exec | |
|
66
|
CVE-2026-69325 |
8.1 | 0.0071 | NET NO AUTH NO UI | Heap-based buffer overflow in Microsoft JScript allows an unauthorized attacker | |
|
66
|
CVE-2026-69524 |
8.1 | 0.0071 | NET NO AUTH NO UI | Use after free in Active Directory Domain Services allows an unauthorized attack | |
|
66
|
CVE-2026-69989 |
8.1 | 0.0071 | NET NO AUTH NO UI | Use after free in DNS Server allows an unauthorized attacker to execute code ove | |
|
66
|
CVE-2026-70342 |
8.1 | 0.0071 | NET NO AUTH NO UI | Use after free in Windows Ancillary Function Driver for WinSock allows an unauth | |
|
66
|
CVE-2026-72981 |
8.1 | 0.0071 | NET NO AUTH NO UI | Use after free in IP Helper allows an unauthorized attacker to execute code over | |
|
66
|
CVE-2026-77505 |
8.1 | 0.0071 | NET NO AUTH NO UI | Use after free in DNS Server allows an unauthorized attacker to execute code ove | |
|
66
|
CVE-2026-34728 |
8.1 | 0.0070 | NET NO AUTH LOW CX | phpMyFAQ is an open source FAQ web application. Prior to version 4.1.1, the Medi | |
|
66
|
CVE-2026-107928 |
8.1 | 0.0070 | NET NO AUTH NO UI | When curl is built with GnuTLS, a malicious WebSocket server can make curl send |