Hunt List
12,833 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
90
|
CVE-2026-53921 |
9.8 | 0.0112 | NET NO AUTH LOW CX NO UI | 2 PoC | odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. P |
|
80
|
CVE-2026-88156 |
9.8 | 0.0117 | NET NO AUTH LOW CX NO UI | Stack-based buffer overflow in Microsoft Office Outlook allows an unauthorized a | |
|
80
|
CVE-2026-97016 |
9.8 | 0.0117 | NET NO AUTH LOW CX NO UI | Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized at | |
|
80
|
CVE-2026-26015 |
10.0 | 0.0117 | NET NO AUTH LOW CX NO UI | DocsGPT is a GPT-powered chat for documentation. From version 0.15.0 to before v | |
|
80
|
CVE-2026-48286 |
10.0 | 0.0117 | NET NO AUTH LOW CX NO UI | Adobe Campaign Classic (ACC) versions 7.4.3 build 9396 and earlier are affected | |
|
80
|
CVE-2026-27302 |
10.0 | 0.0117 | NET NO AUTH LOW CX NO UI | Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerabi | |
|
80
|
CVE-2026-71398 |
10.0 | 0.0117 | NET NO AUTH LOW CX NO UI | Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerabi | |
|
80
|
CVE-2026-35435 |
10.0 | 0.0116 | NET NO AUTH LOW CX NO UI | Improper access control in Azure AI Foundry M365 published agents allows an unau | |
|
80
|
CVE-2026-51785 |
9.8 | 0.0115 | NET NO AUTH LOW CX NO UI | An issue in Hugo Leisink Hiawatha v.12.1 and before allows a remote attacker to | |
|
80
|
CVE-2026-66909 |
9.8 | 0.0115 | NET NO AUTH LOW CX NO UI | Apache CXF's JMS transport deserializes the body of any inbound JMS ObjectMessag | |
|
80
|
CVE-2026-53421 |
9.8 | 0.0114 | NET NO AUTH LOW CX NO UI | Improper Isolation or Compartmentalization vulnerability in Apache Syncope. A | |
|
80
|
CVE-2026-70300 |
9.8 | 0.0113 | NET NO AUTH LOW CX NO UI | Untrusted pointer dereference in Microsoft Office Word allows an unauthorized at | |
|
80
|
CVE-2026-83770 |
9.8 | 0.0113 | NET NO AUTH LOW CX NO UI | Heap-based buffer overflow in Windows Text Shaping allows an unauthorized attack | |
|
80
|
CVE-2026-48316 |
10.0 | 0.0112 | NET NO AUTH LOW CX NO UI | ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Inpu | |
|
79
|
CVE-2026-68771 |
9.3 | 0.0115 | NET NO AUTH LOW CX NO UI | ComfyUI v0.23.0 contains an unsafe deserialization vulnerability in the LoadTrai | |
|
79
|
CVE-2026-100886 |
9.3 | 0.0115 | NET NO AUTH LOW CX NO UI | A vulnerability was identified in Seetong T8108, T8108P, T8116 and T8232 4.6.1.4 | |
|
79
|
CVE-2026-44590 |
9.3 | 0.0114 | NET NO AUTH LOW CX NO UI | Sherlock hunts down social media accounts by username across social networks. Pr | |
|
79
|
CVE-2026-42613 |
9.4 | 0.0114 | NET NO AUTH LOW CX NO UI | Grav is a file-based Web platform. Prior to 2.0.0-beta.2, the Login::register() | |
|
79
|
CVE-2026-63767 |
9.3 | 0.0112 | NET NO AUTH LOW CX NO UI | ktransformers through 0.6.3, fixed in commit def0f93, contains an unauthenticate | |
|
78
|
CVE-2014-125133 |
8.7 | 0.0112 | NET NO AUTH LOW CX NO UI | NativeChurch theme for WordPress before 1.6.2 contains a path traversal vulnerab | |
|
77
|
CVE-2026-42564 |
8.2 | 0.0116 | NET NO AUTH LOW CX NO UI | jotty·page is a self-hosted app for your checklists and notes. Prior to 1.22.0, | |
|
75
|
CVE-2026-49181 |
7.5 | 0.0117 | NET NO AUTH LOW CX NO UI | Integer underflow (wrap or wraparound) in Windows DHCP Client allows an unauthor | |
|
75
|
CVE-2026-92391 |
7.5 | 0.0117 | NET NO AUTH LOW CX NO UI | A deeply nested multipart MIME structure constructed via the public API causes a | |
|
75
|
CVE-2026-72571 |
7.5 | 0.0115 | NET NO AUTH LOW CX NO UI | A path traversal vulnerability in mustafaakin/cast-localvideo (all versions) all | |
|
75
|
CVE-2026-72572 |
7.5 | 0.0115 | NET NO AUTH LOW CX NO UI | A path traversal vulnerability in o1lab/xmysql (all versions) allows an unauthen | |
|
75
|
CVE-2026-26129 |
7.5 | 0.0114 | NET NO AUTH LOW CX NO UI | Improper neutralization of special elements used in a command ('command injectio | |
|
75
|
CVE-2026-33111 |
7.5 | 0.0114 | NET NO AUTH LOW CX NO UI | Improper neutralization of special elements used in a command ('command injectio | |
|
75
|
CVE-2026-96861 |
7.5 | 0.0112 | NET NO AUTH LOW CX NO UI | Out-of-bounds read in Network Device Enrollment Service (NDES) allows an unautho | |
|
75
|
CVE-2026-96866 |
7.5 | 0.0112 | NET NO AUTH LOW CX NO UI | Out-of-bounds read in Network Device Enrollment Service (NDES) allows an unautho | |
|
75
|
CVE-2026-84017 |
7.5 | 0.0112 | NET NO AUTH LOW CX NO UI | Null pointer dereference in Windows Routing and Remote Access Service (RRAS) all | |
|
75
|
CVE-2026-85808 |
7.5 | 0.0112 | NET NO AUTH LOW CX NO UI | Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an | |
|
75
|
CVE-2026-87716 |
7.5 | 0.0112 | NET NO AUTH LOW CX NO UI | Heap-based buffer overflow in Windows Storage Spaces Controller allows an unauth | |
|
75
|
CVE-2026-96248 |
7.5 | 0.0112 | NET NO AUTH LOW CX NO UI | Stack-based buffer overflow in Windows Host Guardian Service allows an unauthori | |
|
75
|
CVE-2026-70281 |
7.5 | 0.0112 | NET NO AUTH LOW CX NO UI | Out-of-bounds read in Microsoft Office Outlook allows an unauthorized attacker t | |
|
68
|
CVE-2026-69943 |
8.8 | 0.0116 | NET LOW CX NO UI | Improper limitation of a pathname to a restricted directory ('path traversal') i | |
|
68
|
CVE-2026-70297 |
8.8 | 0.0116 | NET LOW CX NO UI | Absolute path traversal in Skype for Business and Microsoft Lync allows an autho | |
|
68
|
CVE-2026-90865 |
9.0 | 0.0114 | NET NO AUTH NO UI | An OS command injection vulnerability in Progress Software WS_FTP Server version | |
|
68
|
CVE-2026-20094 |
8.8 | 0.0114 | NET LOW CX NO UI | A vulnerability in the web-based management interface of Cisco IMC could allow a | |
|
68
|
CVE-2026-66748 |
8.7 | 0.0114 | NET LOW CX NO UI | Camaleon CMS versions 2.1.1 through 2.9.1 contains an authenticated remote code | |
|
68
|
CVE-2026-15307 |
8.7 | 0.0113 | NET LOW CX NO UI | An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDja | |
|
68
|
CVE-2026-76010 |
8.8 | 0.0113 | NET LOW CX NO UI | The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for Wor | |
|
68
|
CVE-2023-31209 |
8.8 | 0.0112 | NET LOW CX NO UI | Improper neutralization of active check command arguments in Checkmk < 2.1.0p32, | |
|
68
|
CVE-2026-65608 |
8.7 | 0.0112 | NET LOW CX NO UI | Grav versions >= 1.7.0 and before 2.0.9 contain a remote code execution vulnerab | |
|
66
|
CVE-2026-83746 |
8.1 | 0.0115 | NET LOW CX NO UI | Absolute path traversal in Skype for Business and Microsoft Lync allows an autho | |
|
64
|
CVE-2026-49069 |
7.1 | 0.0117 | NET NO AUTH LOW CX | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti | |
|
60
|
CVE-2026-22761 |
7.2 | 0.0116 | NET LOW CX NO UI | Dell PowerProtect Data Domain, versions 8.5 through 8.6 contain a command inject | |
|
60
|
CVE-2026-95705 |
7.2 | 0.0115 | NET LOW CX NO UI | Command injection vulnerabilities in the affected interface of AOS-8 could allow | |
|
60
|
CVE-2026-95706 |
7.2 | 0.0115 | NET LOW CX NO UI | Command injection vulnerabilities in the affected interface of AOS-8 could allow | |
|
60
|
CVE-2026-23778 |
7.2 | 0.0114 | NET LOW CX NO UI | Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Featu | |
|
60
|
CVE-2024-23690 |
7.2 | 0.0113 | NET LOW CX NO UI | The end-of-life Netgear FVS336Gv2 and FVS336Gv3 are affected by a command inject |