Hunt List
8,520 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
89
|
CVE-2026-97631 |
9.5 | 0.0063 | NET NO AUTH LOW CX NO UI | 3 PoC | EDK2 contains a vulnerability in BIOS where a user may cause “Out-of-bounds Writ |
|
80
|
CVE-2026-85928 |
9.8 | 0.0063 | NET NO AUTH LOW CX NO UI | Heap-based buffer overflow in Windows Volume Manager Extension Driver allows an | |
|
80
|
CVE-2026-96864 |
9.8 | 0.0063 | NET NO AUTH LOW CX NO UI | Double free in Microsoft Failover Cluster Virtual Driver allows an unauthorized | |
|
80
|
CVE-2026-88102 |
9.8 | 0.0063 | NET NO AUTH LOW CX NO UI | Use after free in Windows Failover Cluster allows an unauthorized attacker to ex | |
|
80
|
CVE-2026-44182 |
10.0 | 0.0063 | NET NO AUTH LOW CX NO UI | Jupyter Enterprise Gateway launches remote Jupyter Notebook kernels across distr | |
|
80
|
CVE-2026-53481 |
9.8 | 0.0063 | NET NO AUTH LOW CX NO UI | Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release ver | |
|
80
|
CVE-2026-57211 |
10.0 | 0.0063 | NET NO AUTH LOW CX NO UI | RabbitMQ is a messaging and streaming broker. Prior to 4.1.11 and 4.2.6 on Windo | |
|
80
|
CVE-2026-64439 |
9.8 | 0.0063 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: crypto: krb | |
|
79
|
CVE-2026-59705 |
9.3 | 0.0064 | NET NO AUTH LOW CX NO UI | mem0's openmemory/api component contains an unauthenticated access vulnerability | |
|
78
|
CVE-2026-56124 |
8.7 | 0.0064 | NET NO AUTH LOW CX NO UI | phpUploader before 2.0.2 contains an unauthenticated information disclosure vuln | |
|
78
|
CVE-2026-44628 |
8.7 | 0.0064 | NET NO AUTH LOW CX NO UI | An unauthenticated attacker can crash the worklist server with a single crafted | |
|
78
|
CVE-2026-24013 |
9.1 | 0.0063 | NET NO AUTH LOW CX NO UI | Authentication Bypass by Spoofing vulnerability in Apache IoTDB. Certain Thrift | |
|
78
|
CVE-2026-32145 |
8.7 | 0.0063 | NET NO AUTH LOW CX NO UI | Allocation of Resources Without Limits or Throttling vulnerability in gleam-wisp | |
|
78
|
CVE-2026-58375 |
8.7 | 0.0063 | NET NO AUTH LOW CX NO UI | JimuReport through 2.5.0 exposes the POST /jmreport/auto/export endpoint without | |
|
78
|
CVE-2026-9265 |
9.1 | 0.0063 | NET NO AUTH LOW CX NO UI | Crypt::OpenSSL::PKCS12 versions before 1.96 for Perl permits a heap OOB read in | |
|
78
|
CVE-2026-57074 |
9.1 | 0.0063 | NET NO AUTH LOW CX NO UI | XML::Bare versions through 0.53 for Perl have an unbounded character lookahead. | |
|
78
|
CVE-2026-57075 |
9.1 | 0.0063 | NET NO AUTH LOW CX NO UI | YAML::Syck versions before 1.47 for Perl allow an out-of-bounds read via a signe | |
|
78
|
CVE-2026-15065 |
9.1 | 0.0063 | NET NO AUTH LOW CX NO UI | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 NIM could allow a remote attacker | |
|
78
|
CVE-2025-51679 |
9.1 | 0.0063 | NET NO AUTH LOW CX NO UI | An issue was discovered in openRISC OR1200 commit 83ac6b. A mismatch between the | |
|
78
|
CVE-2016-20097 |
8.7 | 0.0063 | NET NO AUTH LOW CX NO UI | Weaver (Fanwei) E-cology 8.0 contains a SQL injection vulnerability in the Signa | |
|
77
|
CVE-2026-64642 |
8.3 | 0.0063 | NET NO AUTH LOW CX NO UI | Next.js is a React framework for building full-stack web applications. In versio | |
|
77
|
CVE-2026-111103 |
8.2 | 0.0063 | NET NO AUTH LOW CX NO UI | Improper Cleanup on Thrown Exception vulnerability in the HTTP/2 handler of mtru | |
|
76
|
CVE-2026-42859 |
8.1 | 0.0063 | NET NO AUTH LOW CX NO UI | Neat VNC is a VNC server library. Prior to 0.9.6, a pre-authentication stack buf | |
|
75
|
CVE-2026-44241 |
7.5 | 0.0064 | NET NO AUTH LOW CX NO UI | Micronaut Framework is a JVM-based full stack Java framework designed for buildi | |
|
75
|
CVE-2026-59725 |
7.5 | 0.0064 | NET NO AUTH LOW CX NO UI | Socket.IO enables bidirectional and low-latency communication for every platform | |
|
75
|
CVE-2026-70646 |
7.5 | 0.0064 | NET NO AUTH LOW CX NO UI | aiosend is a synchronous and asynchronous Crypto Pay API client. Pror to version | |
|
75
|
CVE-2026-39836 |
7.5 | 0.0063 | NET NO AUTH LOW CX NO UI | The Dial and LookupPort functions panic on Windows when provided with an input c | |
|
75
|
CVE-2026-72586 |
7.5 | 0.0063 | NET NO AUTH LOW CX NO UI | A missing authentication vulnerability in frangoteam/FUXA through 1.3.3 allows a | |
|
75
|
CVE-2026-6732 |
7.5 | 0.0063 | NET NO AUTH LOW CX NO UI | A flaw was found in libxml2. This vulnerability occurs when the library processe | |
|
75
|
CVE-2026-56673 |
7.5 | 0.0063 | NET NO AUTH LOW CX NO UI | ComfyUI is a modular diffusion model GUI, API, and backend with a graph-and-node | |
|
75
|
CVE-2026-16958 |
7.5 | 0.0063 | NET NO AUTH LOW CX NO UI | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to c | |
|
75
|
CVE-2025-67223 |
7.5 | 0.0063 | NET NO AUTH LOW CX NO UI | The Aranda File Server (AFS) component in Aranda Software Aranda Service Desk be | |
|
74
|
CVE-2026-39999 |
7.0 | 0.0063 | NET NO AUTH LOW CX NO UI | Authentication Bypass by Spoofing vulnerability in Apache APISIX. The attacker | |
|
69
|
CVE-2026-34659 |
9.6 | 0.0063 | NET NO AUTH LOW CX | Adobe Connect versions 2025.9.15, 2025.8.157 and earlier are affected by a Deser | |
|
69
|
CVE-2026-66418 |
9.3 | 0.0063 | NET NO AUTH LOW CX | OpenClaw Dashboard v3.0.0 contains a stored cross-site scripting vulnerability t | |
|
68
|
CVE-2026-112688 |
8.8 | 0.0063 | NET NO AUTH LOW CX | A memory corruption issue was addressed with improved memory handling. This issu | |
|
68
|
CVE-2026-108427 |
8.8 | 0.0063 | NET NO AUTH LOW CX | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attac | |
|
68
|
CVE-2023-3600 |
8.8 | 0.0063 | NET NO AUTH LOW CX | During the worker lifecycle, a use-after-free condition could have occurred, whi | |
|
66
|
CVE-2026-25524 |
8.1 | 0.0063 | NET NO AUTH NO UI | Magento Long Term Support (LTS) is an unofficial, community-driven project provi | |
|
55
|
CVE-2026-70095 |
7.5 | 0.0063 | NET NO AUTH | Heap-based buffer overflow in Windows iSCSI allows an unauthorized attacker to e | |
|
55
|
CVE-2026-69976 |
7.5 | 0.0063 | NET NO AUTH | Use after free in Remote Desktop Client allows an unauthorized attacker to execu | |
|
55
|
CVE-2026-69984 |
7.5 | 0.0063 | NET NO AUTH | Use after free in Remote Desktop Client allows an unauthorized attacker to execu | |
|
55
|
CVE-2026-69986 |
7.5 | 0.0063 | NET NO AUTH | Use after free in Remote Desktop Client allows an unauthorized attacker to execu | |
|
55
|
CVE-2026-69987 |
7.5 | 0.0063 | NET NO AUTH | Use after free in Remote Desktop Client allows an unauthorized attacker to execu | |
|
55
|
CVE-2026-69988 |
7.5 | 0.0063 | NET NO AUTH | Use after free in Remote Desktop Client allows an unauthorized attacker to execu | |
|
55
|
CVE-2026-70006 |
7.5 | 0.0063 | NET NO AUTH | Use after free in Remote Desktop Client allows an unauthorized attacker to execu | |
|
55
|
CVE-2026-96071 |
7.5 | 0.0063 | NET NO AUTH | Heap-based buffer overflow in Windows Media allows an unauthorized attacker to e | |
|
55
|
CVE-2026-69991 |
7.5 | 0.0063 | NET NO AUTH | Use after free in Remote Desktop Client allows an unauthorized attacker to execu | |
|
55
|
CVE-2026-69992 |
7.5 | 0.0063 | NET NO AUTH | Use after free in Windows Remote Desktop Services allows an unauthorized attacke | |
|
55
|
CVE-2026-69994 |
7.5 | 0.0063 | NET NO AUTH | Use after free in Remote Desktop Client allows an unauthorized attacker to execu |