Hunt List
12,831 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
78
|
CVE-2017-20284 |
8.7 | 0.0117 | NET NO AUTH LOW CX NO UI | Caucho Resin contains a path traversal vulnerability in the documentation webapp | |
|
75
|
CVE-2026-45646 |
7.5 | 0.0117 | NET NO AUTH LOW CX NO UI | Allocation of resources without limits or throttling in ASP.NET Core allows an u | |
|
75
|
CVE-2026-49787 |
7.5 | 0.0117 | NET NO AUTH LOW CX NO UI | Allocation of resources without limits or throttling in Windows HTTP.sys allows | |
|
75
|
CVE-2026-49788 |
7.5 | 0.0117 | NET NO AUTH LOW CX NO UI | Allocation of resources without limits or throttling in HTTP/2 allows an unautho | |
|
75
|
CVE-2026-50304 |
7.5 | 0.0117 | NET NO AUTH LOW CX NO UI | Stack-based buffer overflow in Active Directory Federation Services allows an un | |
|
75
|
CVE-2026-50355 |
7.5 | 0.0117 | NET NO AUTH LOW CX NO UI | Stack-based buffer overflow in Active Directory Federation Services allows an un | |
|
75
|
CVE-2026-50368 |
7.5 | 0.0117 | NET NO AUTH LOW CX NO UI | Stack-based buffer overflow in Active Directory Federation Services allows an un | |
|
75
|
CVE-2026-50411 |
7.5 | 0.0117 | NET NO AUTH LOW CX NO UI | Stack-based buffer overflow in Active Directory Federation Services (AD FS) allo | |
|
75
|
CVE-2026-50424 |
7.5 | 0.0117 | NET NO AUTH LOW CX NO UI | Untrusted pointer dereference in Windows Domain Controller allows an unauthorize | |
|
75
|
CVE-2026-50496 |
7.5 | 0.0117 | NET NO AUTH LOW CX NO UI | Out-of-bounds read in Windows Network Policy Server SNMP allows an unauthorized | |
|
75
|
CVE-2026-50506 |
7.5 | 0.0117 | NET NO AUTH LOW CX NO UI | Allocation of resources without limits or throttling in ASP.NET Core allows an u | |
|
75
|
CVE-2026-50647 |
7.5 | 0.0117 | NET NO AUTH LOW CX NO UI | Loop with unreachable exit condition ('infinite loop') in Active Directory Feder | |
|
75
|
CVE-2026-50653 |
7.5 | 0.0117 | NET NO AUTH LOW CX NO UI | Loop with unreachable exit condition ('infinite loop') in Azure Active Directory | |
|
75
|
CVE-2026-50695 |
7.5 | 0.0117 | NET NO AUTH LOW CX NO UI | Stack-based buffer overflow in Active Directory Federation Services allows an un | |
|
75
|
CVE-2026-50696 |
7.5 | 0.0117 | NET NO AUTH LOW CX NO UI | Heap-based buffer overflow in Windows Internet Key Exchange (IKE) Protocol allow | |
|
75
|
CVE-2026-54113 |
7.5 | 0.0117 | NET NO AUTH LOW CX NO UI | Allocation of resources without limits or throttling in Windows Kernel allows an | |
|
75
|
CVE-2026-54119 |
7.5 | 0.0117 | NET NO AUTH LOW CX NO UI | Loop with unreachable exit condition ('infinite loop') in Windows Active Directo | |
|
75
|
CVE-2026-54983 |
7.5 | 0.0117 | NET NO AUTH LOW CX NO UI | Stack-based buffer overflow in Active Directory Federation Services (AD FS) allo | |
|
75
|
CVE-2026-58627 |
7.5 | 0.0117 | NET NO AUTH LOW CX NO UI | Uncontrolled resource consumption in Windows DHCP Server allows an unauthorized | |
|
75
|
CVE-2026-59132 |
7.5 | 0.0117 | NET NO AUTH LOW CX NO UI | Null pointer dereference in Windows TCP/IP allows an unauthorized attacker to de | |
|
75
|
CVE-2026-57099 |
7.5 | 0.0117 | NET NO AUTH LOW CX NO UI | Allocation of resources without limits or throttling in ASP.NET Core allows an u | |
|
75
|
CVE-2026-66307 |
7.5 | 0.0117 | NET NO AUTH LOW CX NO UI | Integer underflow (wrap or wraparound) in Skype for Business allows an unauthori | |
|
75
|
CVE-2026-69329 |
7.5 | 0.0117 | NET NO AUTH LOW CX NO UI | Out-of-bounds read in BranchCache allows an unauthorized attacker to deny servic | |
|
75
|
CVE-2026-69342 |
7.5 | 0.0117 | NET NO AUTH LOW CX NO UI | Out-of-bounds read in Windows DHCP Server allows an unauthorized attacker to den | |
|
75
|
CVE-2026-69428 |
7.5 | 0.0117 | NET NO AUTH LOW CX NO UI | Out-of-bounds read in Windows LDAP - Lightweight Directory Access Protocol allow | |
|
75
|
CVE-2026-69760 |
7.5 | 0.0117 | NET NO AUTH LOW CX NO UI | Out-of-bounds read in Windows Kerberos allows an unauthorized attacker to deny s | |
|
75
|
CVE-2026-69809 |
7.5 | 0.0117 | NET NO AUTH LOW CX NO UI | Missing release of memory after effective lifetime in Active Directory Domain Se | |
|
75
|
CVE-2026-69881 |
7.5 | 0.0117 | NET NO AUTH LOW CX NO UI | Null pointer dereference in Windows IKE Extension allows an unauthorized attacke | |
|
75
|
CVE-2026-83989 |
7.5 | 0.0117 | NET NO AUTH LOW CX NO UI | Out-of-bounds read in Windows Services for NFS ONCRPC XDR Driver allows an unaut | |
|
75
|
CVE-2026-67376 |
7.5 | 0.0117 | NET NO AUTH LOW CX NO UI | Integer overflow or wraparound in SQL Server allows an unauthorized attacker to | |
|
75
|
CVE-2026-68887 |
7.5 | 0.0117 | NET NO AUTH LOW CX NO UI | Out-of-bounds read in Windows Message Queuing Queue Manager allows an unauthoriz | |
|
75
|
CVE-2026-69378 |
7.5 | 0.0117 | NET NO AUTH LOW CX NO UI | Uncontrolled recursion in Microsoft Exchange Server allows an unauthorized attac | |
|
75
|
CVE-2026-69587 |
7.5 | 0.0117 | NET NO AUTH LOW CX NO UI | Null pointer dereference in Windows IKE Extension allows an unauthorized attacke | |
|
75
|
CVE-2026-69588 |
7.5 | 0.0117 | NET NO AUTH LOW CX NO UI | Missing release of memory after effective lifetime in Windows TCP/IP allows an u | |
|
75
|
CVE-2026-69631 |
7.5 | 0.0117 | NET NO AUTH LOW CX NO UI | Integer overflow or wraparound in Windows DNS allows an unauthorized attacker to | |
|
75
|
CVE-2026-69744 |
7.5 | 0.0117 | NET NO AUTH LOW CX NO UI | Null pointer dereference in Windows Kerberos allows an unauthorized attacker to | |
|
75
|
CVE-2026-70065 |
7.5 | 0.0117 | NET NO AUTH LOW CX NO UI | Missing release of memory after effective lifetime in Windows DHCP Server allows | |
|
75
|
CVE-2026-72949 |
7.5 | 0.0117 | NET NO AUTH LOW CX NO UI | Null pointer dereference in Windows SMB Server Network Transport Driver (srvnet. | |
|
75
|
CVE-2026-77494 |
7.5 | 0.0117 | NET NO AUTH LOW CX NO UI | Access of resource using incompatible type ('type confusion') in Windows DHCP Se | |
|
75
|
CVE-2026-77498 |
7.5 | 0.0117 | NET NO AUTH LOW CX NO UI | Out-of-bounds read in Windows DHCP Server allows an unauthorized attacker to den | |
|
75
|
CVE-2026-77499 |
7.5 | 0.0117 | NET NO AUTH LOW CX NO UI | Access of resource using incompatible type ('type confusion') in Windows DHCP Se | |
|
75
|
CVE-2026-77501 |
7.5 | 0.0117 | NET NO AUTH LOW CX NO UI | Out-of-bounds read in Windows DHCP Server allows an unauthorized attacker to den | |
|
75
|
CVE-2026-77502 |
7.5 | 0.0117 | NET NO AUTH LOW CX NO UI | Out-of-bounds read in Windows DHCP Server allows an unauthorized attacker to den | |
|
75
|
CVE-2026-77886 |
7.5 | 0.0117 | NET NO AUTH LOW CX NO UI | Out-of-bounds read in Windows DHCP Server allows an unauthorized attacker to den | |
|
75
|
CVE-2026-77888 |
7.5 | 0.0117 | NET NO AUTH LOW CX NO UI | Access of resource using incompatible type ('type confusion') in Windows DHCP Se | |
|
75
|
CVE-2026-77889 |
7.5 | 0.0117 | NET NO AUTH LOW CX NO UI | Access of resource using incompatible type ('type confusion') in Windows DHCP Se | |
|
75
|
CVE-2026-77890 |
7.5 | 0.0117 | NET NO AUTH LOW CX NO UI | Access of resource using incompatible type ('type confusion') in Windows DHCP Se | |
|
75
|
CVE-2026-77893 |
7.5 | 0.0117 | NET NO AUTH LOW CX NO UI | Out-of-bounds read in Windows DHCP Server allows an unauthorized attacker to den | |
|
75
|
CVE-2026-77895 |
7.5 | 0.0117 | NET NO AUTH LOW CX NO UI | Out-of-bounds read in Windows DHCP Server allows an unauthorized attacker to den | |
|
75
|
CVE-2026-84001 |
7.5 | 0.0117 | NET NO AUTH LOW CX NO UI | Out-of-bounds read in Windows Key Distribution Center allows an unauthorized att |