Hunt List
8,454 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
90
|
CVE-2026-110264 |
10.0 | 0.0131 | NET NO AUTH LOW CX NO UI | 12 PoC | An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 bef |
|
80
|
CVE-2026-79846 |
10.0 | 0.0137 | NET NO AUTH LOW CX NO UI | Command injection vulnerabilities exist in the affected interface of AOS-8 that | |
|
80
|
CVE-2026-48323 |
10.0 | 0.0137 | NET NO AUTH LOW CX NO UI | Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Specia | |
|
80
|
CVE-2026-42221 |
9.8 | 0.0134 | NET NO AUTH LOW CX NO UI | Nginx UI is a web user interface for the Nginx web server. From version 2.0.0 to | |
|
80
|
CVE-2026-70291 |
9.8 | 0.0133 | NET NO AUTH LOW CX NO UI | Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized at | |
|
80
|
CVE-2026-43512 |
9.8 | 0.0133 | NET NO AUTH LOW CX NO UI | DEPRECATED: Authentication Bypass Issues vulnerability in digest authentication | |
|
80
|
CVE-2026-48277 |
10.0 | 0.0129 | NET NO AUTH LOW CX NO UI | ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Inpu | |
|
80
|
CVE-2026-42537 |
9.8 | 0.0129 | NET NO AUTH LOW CX NO UI | Remote Code Execution via JDBC URL Injection in Apache Ranger <= 2.8.0 Users are | |
|
80
|
CVE-2026-72577 |
9.8 | 0.0127 | NET NO AUTH LOW CX NO UI | Multiple vulnerabilities in NASA fprime-gds through 3.4.3 allow an unauthenticat | |
|
79
|
CVE-2026-97854 |
9.3 | 0.0137 | NET NO AUTH LOW CX NO UI | Yamaha wireless LAN router NWR100 provided by Yamaha Corporation contains an OS | |
|
79
|
CVE-2026-47103 |
9.3 | 0.0136 | NET NO AUTH LOW CX NO UI | Python StateMachine versions 3.0.0 before 3.2.0 contains a remote code execution | |
|
79
|
CVE-2026-58449 |
9.3 | 0.0135 | NET NO AUTH LOW CX NO UI | txtai through 9.10.0, fixed in commit 11b32da, exposes an API /reindex endpoint | |
|
79
|
CVE-2026-54836 |
9.3 | 0.0134 | NET NO AUTH LOW CX NO UI | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti | |
|
79
|
CVE-2026-59864 |
9.3 | 0.0133 | NET NO AUTH LOW CX NO UI | Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5 | |
|
79
|
CVE-2026-42647 |
9.3 | 0.0132 | NET NO AUTH LOW CX NO UI | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti | |
|
79
|
CVE-2026-112900 |
9.2 | 0.0130 | NET NO AUTH LOW CX NO UI | Pillow is a Python imaging library. From 2.6.0 until 13.0.0, Pillow is vulnerabl | |
|
79
|
CVE-2026-63385 |
9.2 | 0.0129 | NET NO AUTH LOW CX NO UI | Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libe | |
|
79
|
CVE-2026-70553 |
9.3 | 0.0127 | NET NO AUTH LOW CX NO UI | MaxSite CMS contains a remote code execution vulnerability that allows unauthent | |
|
78
|
CVE-2026-39339 |
9.1 | 0.0135 | NET NO AUTH LOW CX NO UI | ChurchCRM is an open-source church management system. Prior to 7.1.0, a critica | |
|
78
|
CVE-2026-112352 |
9.1 | 0.0132 | NET NO AUTH LOW CX NO UI | Sunhillo SureLine before 9.1.5 contains an authentication bypass vulnerability t | |
|
78
|
CVE-2026-2332 |
9.1 | 0.0131 | NET NO AUTH LOW CX NO UI | In Eclipse Jetty, the HTTP/1.1 parser is vulnerable to request smuggling when ch | |
|
78
|
CVE-2026-33765 |
8.9 | 0.0130 | NET NO AUTH LOW CX NO UI | Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level | |
|
75
|
CVE-2026-59862 |
7.5 | 0.0138 | NET NO AUTH LOW CX NO UI | Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.0 | |
|
75
|
CVE-2026-47717 |
7.5 | 0.0138 | NET NO AUTH LOW CX NO UI | FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. In fux | |
|
75
|
CVE-2026-67918 |
7.5 | 0.0136 | NET NO AUTH LOW CX NO UI | Directory Traversal vulnerability in hermes-studio v.0.6.26 allows a remote atta | |
|
75
|
CVE-2026-42009 |
7.5 | 0.0134 | NET NO AUTH LOW CX NO UI | A flaw was found in gnutls. A remote attacker could exploit an issue in the Data | |
|
75
|
CVE-2026-70058 |
7.5 | 0.0133 | NET NO AUTH LOW CX NO UI | Out-of-bounds write in Windows DHCP Server allows an unauthorized attacker to ex | |
|
75
|
CVE-2026-70082 |
7.5 | 0.0133 | NET NO AUTH LOW CX NO UI | Uncaught exception in Windows DNS allows an unauthorized attacker to deny servic | |
|
75
|
CVE-2026-70155 |
7.5 | 0.0133 | NET NO AUTH LOW CX NO UI | Missing release of memory after effective lifetime in Windows DNS allows an unau | |
|
75
|
CVE-2026-83516 |
7.5 | 0.0133 | NET NO AUTH LOW CX NO UI | Out-of-bounds read in Windows Local Security Authority Subsystem Service (LSASS) | |
|
75
|
CVE-2026-83635 |
7.5 | 0.0133 | NET NO AUTH LOW CX NO UI | Out-of-bounds read in DNS Server allows an unauthorized attacker to deny service | |
|
75
|
CVE-2026-83655 |
7.5 | 0.0133 | NET NO AUTH LOW CX NO UI | Out-of-bounds read in Network Policy Server (NPS) allows an unauthorized attacke | |
|
75
|
CVE-2026-83665 |
7.5 | 0.0133 | NET NO AUTH LOW CX NO UI | Null pointer dereference in Windows DHCP Server allows an unauthorized attacker | |
|
75
|
CVE-2026-83855 |
7.5 | 0.0133 | NET NO AUTH LOW CX NO UI | Integer underflow (wrap or wraparound) in Windows WLAN Service allows an unautho | |
|
75
|
CVE-2026-105723 |
7.5 | 0.0132 | NET NO AUTH LOW CX NO UI | Untrusted pointer dereference in Windows Distributed File System (DFS) allows an | |
|
75
|
CVE-2026-2100 |
7.5 | 0.0131 | NET NO AUTH LOW CX NO UI | A flaw was found in p11-kit. A remote attacker could exploit this vulnerability | |
|
75
|
CVE-2026-53598 |
7.5 | 0.0129 | NET NO AUTH LOW CX NO UI | Prompty is a markdown file format (.prompty) for LLM prompts. Prior to 2.0.0-bet | |
|
75
|
CVE-2026-70133 |
7.5 | 0.0127 | NET NO AUTH LOW CX NO UI | Allocation of resources without limits or throttling in Windows SMB Server allow | |
|
75
|
CVE-2026-83795 |
7.5 | 0.0127 | NET NO AUTH LOW CX NO UI | Heap-based buffer overflow in Windows IKE Extension allows an unauthorized attac | |
|
75
|
CVE-2026-83843 |
7.5 | 0.0127 | NET NO AUTH LOW CX NO UI | Out-of-bounds read in Windows Internet Key Exchange (IKE) Protocol allows an una | |
|
75
|
CVE-2026-102192 |
7.5 | 0.0127 | NET NO AUTH LOW CX NO UI | Integer underflow (wrap or wraparound) in Windows Failover Cluster allows an una | |
|
75
|
CVE-2026-70031 |
7.5 | 0.0127 | NET NO AUTH LOW CX NO UI | Heap-based buffer overflow in Windows iSCSI allows an unauthorized attacker to d | |
|
75
|
CVE-2026-70033 |
7.5 | 0.0127 | NET NO AUTH LOW CX NO UI | Missing release of memory after effective lifetime in Remote Desktop Gateway Ser | |
|
75
|
CVE-2026-70079 |
7.5 | 0.0127 | NET NO AUTH LOW CX NO UI | Improper enforcement of behavioral workflow in Windows DNS allows an unauthorize | |
|
75
|
CVE-2026-83860 |
7.5 | 0.0127 | NET NO AUTH LOW CX NO UI | Stack-based buffer overflow in Windows GDI allows an unauthorized attacker to de | |
|
69
|
CVE-2026-70279 |
9.3 | 0.0129 | NET NO AUTH LOW CX | Improper neutralization of input during web page generation ('cross-site scripti | |
|
69
|
CVE-2026-44939 |
9.4 | 0.0128 | NET NO AUTH LOW CX | A command injection vulnerability in the Rancher Manager cluster before 2.14.2 i | |
|
68
|
CVE-2026-81385 |
8.8 | 0.0129 | NET NO AUTH LOW CX | Deserialization of untrusted data in Microsoft Office Publisher allows an unauth | |
|
64
|
CVE-2026-59863 |
7.0 | 0.0137 | NET NO AUTH LOW CX | Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5 | |
|
57
|
CVE-2024-3727 |
8.3 | 0.0128 | NET NO AUTH | A flaw was found in the github.com/containers/image library. This flaw allows at |