Hunt List
12,843 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
90
|
CVE-2026-105192 |
9.8 | 0.0102 | NET NO AUTH LOW CX NO UI | 1 PoC | LMCache multiprocess mode, also called distributed mode, opens an unauthenticate |
|
80
|
CVE-2026-28323 |
9.8 | 0.0103 | NET NO AUTH LOW CX NO UI | SolarWinds Web Help Desk is found to be affected by a SAML authentication bypass | |
|
80
|
CVE-2026-69845 |
9.8 | 0.0102 | NET NO AUTH LOW CX NO UI | Heap-based buffer overflow in Windows DHCP Server allows an unauthorized attacke | |
|
80
|
CVE-2026-68839 |
9.8 | 0.0102 | NET NO AUTH LOW CX NO UI | Heap-based buffer overflow in Windows USB Mass Storage Class Driver allows an un | |
|
80
|
CVE-2026-24227 |
9.8 | 0.0102 | NET NO AUTH LOW CX NO UI | NVIDIA TensorRT for contains a vulnerability where a user might cause a deserial | |
|
80
|
CVE-2026-76008 |
10.0 | 0.0102 | NET NO AUTH LOW CX NO UI | A flaw has been found in Comfast CF-N1-S 2.6.0.1. This affects the function get_ | |
|
80
|
CVE-2026-14522 |
9.8 | 0.0102 | NET NO AUTH LOW CX NO UI | IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0. | |
|
79
|
CVE-2026-119706 |
9.3 | 0.0103 | NET NO AUTH LOW CX NO UI | InternLM LMDeploy 0.9.0 through 0.18.0 contains an unauthenticated remote code e | |
|
79
|
CVE-2026-67192 |
9.2 | 0.0103 | NET NO AUTH LOW CX NO UI | Xlight FTP Server before 3.9.5 contains a pre-authentication stack buffer overfl | |
|
79
|
CVE-2026-112346 |
9.3 | 0.0101 | NET NO AUTH LOW CX NO UI | OpenHands Software Agent SDK before 1.52.0 contains an unauthenticated remote co | |
|
78
|
CVE-2026-43871 |
8.7 | 0.0103 | NET NO AUTH LOW CX NO UI | Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache T | |
|
78
|
CVE-2026-48586 |
8.7 | 0.0103 | NET NO AUTH LOW CX NO UI | Improper Handling of Highly Compressed Data (Data Amplification) vulnerability i | |
|
78
|
CVE-2026-55968 |
8.7 | 0.0103 | NET NO AUTH LOW CX NO UI | Inefficient Algorithmic Complexity, Allocation of Resources Without Limits or Th | |
|
78
|
CVE-2026-55969 |
8.7 | 0.0103 | NET NO AUTH LOW CX NO UI | Integer Overflow or Wraparound vulnerability in Apache Thrift C++, c_glib, Go, n | |
|
78
|
CVE-2026-58389 |
8.7 | 0.0103 | NET NO AUTH LOW CX NO UI | Allocation of Resources Without Limits or Throttling vulnerability in Apache Thr | |
|
77
|
CVE-2026-69519 |
8.6 | 0.0103 | NET NO AUTH LOW CX NO UI | Observable response discrepancy in Azure Stack HCI allows an unauthorized attack | |
|
75
|
CVE-2026-45815 |
7.5 | 0.0103 | NET NO AUTH LOW CX NO UI | Reachable Assertion vulnerability in Apache NimBLE. A specially crafted ATT Read | |
|
75
|
CVE-2026-45816 |
7.5 | 0.0103 | NET NO AUTH LOW CX NO UI | NULL Pointer Dereference vulnerability in Apache NimBLE in LE Long Term Key Requ | |
|
75
|
CVE-2026-41608 |
7.5 | 0.0103 | NET NO AUTH LOW CX NO UI | Improper Handling of Highly Compressed Data (Data Amplification) vulnerability i | |
|
75
|
CVE-2026-49158 |
7.5 | 0.0103 | NET NO AUTH LOW CX NO UI | Improper Handling of Highly Compressed Data (Data Amplification) vulnerability i | |
|
75
|
CVE-2026-61483 |
7.5 | 0.0103 | NET NO AUTH LOW CX NO UI | ** UNSUPPORTED WHEN ASSIGNED ** Uncontrolled Recursion vulnerability in Apache L | |
|
75
|
CVE-2026-32952 |
7.5 | 0.0103 | NET NO AUTH LOW CX NO UI | go-ntlmssp is a Go package that provides NTLM/Negotiate authentication over HTTP | |
|
75
|
CVE-2026-47633 |
7.5 | 0.0103 | NET NO AUTH LOW CX NO UI | Exposure of sensitive information to an unauthorized actor in Cost Management In | |
|
75
|
CVE-2026-62898 |
7.5 | 0.0103 | NET NO AUTH LOW CX NO UI | Use after free in Microsoft QUIC allows an unauthorized attacker to disclose inf | |
|
75
|
CVE-2026-50463 |
7.5 | 0.0103 | NET NO AUTH LOW CX NO UI | Out-of-bounds read in Windows Kernel allows an unauthorized attacker to disclose | |
|
75
|
CVE-2026-50470 |
7.5 | 0.0103 | NET NO AUTH LOW CX NO UI | Out-of-bounds read in Windows Network Policy Server SNMP allows an unauthorized | |
|
75
|
CVE-2026-85322 |
7.5 | 0.0103 | NET NO AUTH LOW CX NO UI | Use of uninitialized resource in Windows Routing and Remote Access Service (RRAS | |
|
75
|
CVE-2026-70579 |
7.5 | 0.0103 | NET NO AUTH LOW CX NO UI | Out-of-bounds read in Windows Mobile Broadband allows an unauthorized attacker t | |
|
75
|
CVE-2026-72932 |
7.5 | 0.0103 | NET NO AUTH LOW CX NO UI | Buffer over-read in Windows Message Queuing Queue Manager allows an unauthorized | |
|
75
|
CVE-2026-72989 |
7.5 | 0.0103 | NET NO AUTH LOW CX NO UI | Use of uninitialized resource in Windows Failover Cluster allows an unauthorized | |
|
75
|
CVE-2026-69443 |
7.5 | 0.0103 | NET NO AUTH LOW CX NO UI | Out-of-bounds read in Microsoft Azure Attestation service and Device Health Atte | |
|
75
|
CVE-2026-70587 |
7.5 | 0.0103 | NET NO AUTH LOW CX NO UI | Improper null termination in Windows Remote Desktop Protocol allows an unauthori | |
|
75
|
CVE-2026-71330 |
7.5 | 0.0103 | NET NO AUTH LOW CX NO UI | Exposure of sensitive system information to an unauthorized control sphere in Wi | |
|
70
|
CVE-2026-65974 |
9.9 | 0.0103 | NET LOW CX NO UI | ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15 | |
|
70
|
CVE-2026-59115 |
9.9 | 0.0102 | NET LOW CX NO UI | '.../...//' in Microsoft Entra Provisioning Service (SyncFabric) allows an autho | |
|
70
|
CVE-2026-63509 |
9.9 | 0.0102 | NET LOW CX NO UI | Relative path traversal in Microsoft Fabric allows an authorized attacker to ele | |
|
69
|
CVE-2026-48315 |
9.3 | 0.0103 | NET NO AUTH LOW CX | ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Inpu | |
|
69
|
CVE-2026-83662 |
9.3 | 0.0103 | NET NO AUTH LOW CX | Adobe Experience Manager is affected by a reflected Cross-Site Scripting (XSS) v | |
|
69
|
CVE-2026-114625 |
9.4 | 0.0103 | NET LOW CX NO UI | KEV | Arista VeloCloud Orchestrator on-prem contains a SQL injection vulnerability tha |
|
69
|
CVE-2026-112393 |
9.2 | 0.0102 | NET NO AUTH NO UI | Pillow is a Python imaging library. From 2.0.0 until 13.0.0, Pillow has a heap b | |
|
68
|
CVE-2026-49970 |
8.7 | 0.0103 | NET LOW CX NO UI | Laravel-Mediable before 7.0.0 contains a path traversal vulnerability in the Fil | |
|
68
|
CVE-2026-56196 |
8.8 | 0.0102 | NET LOW CX NO UI | Relative path traversal in Windows Admin Center allows an authorized attacker to | |
|
68
|
CVE-2026-49163 |
8.8 | 0.0102 | NET LOW CX NO UI | Improper limitation of a pathname to a restricted directory ('path traversal') i | |
|
68
|
CVE-2026-67368 |
8.8 | 0.0102 | NET LOW CX NO UI | Improper link resolution before file access ('link following') in SQL Server all | |
|
68
|
CVE-2026-102863 |
8.8 | 0.0102 | NET LOW CX NO UI | Improper control of generation of code ('code injection') in Microsoft Office Sh | |
|
68
|
CVE-2026-83923 |
8.8 | 0.0102 | NET NO AUTH LOW CX | Relative path traversal in OpenSSH for Windows allows an unauthorized attacker t | |
|
68
|
CVE-2026-69100 |
8.7 | 0.0102 | NET LOW CX NO UI | LAMP Rapid Development Platform through 5.6.2, fixed in commit 84b0c27, contains | |
|
67
|
CVE-2024-9341 |
8.2 | 0.0103 | NET NO AUTH LOW CX | A flaw was found in Go. When FIPS mode is enabled on a system, container runtime | |
|
62
|
CVE-2026-61524 |
8.6 | 0.0103 | NET LOW CX NO UI | WebsiteBaker CMS before 2.13.10 contains an unrestricted file upload vulnerabili | |
|
60
|
CVE-2026-70267 |
7.2 | 0.0101 | NET LOW CX NO UI | Inclusion of functionality from untrusted control sphere in Microsoft Office Sha |