Hunt List
12,844 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
90
|
CVE-2026-56190 |
9.8 | 0.0097 | NET NO AUTH LOW CX NO UI | 2 PoC | Use of uninitialized resource in Windows RDP allows an unauthorized attacker to |
|
90
|
CVE-2026-62878 |
9.8 | 0.0097 | NET NO AUTH LOW CX NO UI | 1 PoC | Stack-based buffer overflow in Windows DNS allows an unauthorized attacker to ex |
|
80
|
CVE-2026-1555 |
9.8 | 0.0098 | NET NO AUTH LOW CX NO UI | The WebStack theme for WordPress is vulnerable to arbitrary file uploads due to | |
|
80
|
CVE-2026-47140 |
10.0 | 0.0098 | NET NO AUTH LOW CX NO UI | vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, NodeVM bl | |
|
80
|
CVE-2026-65816 |
10.0 | 0.0097 | NET NO AUTH LOW CX NO UI | Use of incorrectly-resolved name or reference in Azure Arc allows an unauthorize | |
|
80
|
CVE-2023-29531 |
9.8 | 0.0097 | NET NO AUTH LOW CX NO UI | An attacker could have caused an out of bounds memory access using WebGL APIs, l | |
|
80
|
CVE-2026-55010 |
9.8 | 0.0097 | NET NO AUTH LOW CX NO UI | Heap-based buffer overflow in Minecraft Bedrock Dedicated Server allows an unaut | |
|
80
|
CVE-2026-56165 |
9.8 | 0.0097 | NET NO AUTH LOW CX NO UI | Heap-based buffer overflow in Microsoft Account allows an unauthorized attacker | |
|
80
|
CVE-2026-65791 |
9.8 | 0.0097 | NET NO AUTH LOW CX NO UI | Heap-based buffer overflow in Windows iSCSI Target Service allows an unauthorize | |
|
80
|
CVE-2026-42990 |
9.8 | 0.0097 | NET NO AUTH LOW CX NO UI | Heap-based buffer overflow in SQL Server ODBC driver allows an unauthorized atta | |
|
80
|
CVE-2026-49172 |
9.8 | 0.0097 | NET NO AUTH LOW CX NO UI | Heap-based buffer overflow in Windows FTP Service allows an unauthorized attacke | |
|
80
|
CVE-2026-50447 |
9.8 | 0.0097 | NET NO AUTH LOW CX NO UI | Heap-based buffer overflow in Windows Message Queuing allows an unauthorized att | |
|
80
|
CVE-2026-50518 |
9.8 | 0.0097 | NET NO AUTH LOW CX NO UI | Heap-based buffer overflow in Windows DHCP Server allows an unauthorized attacke | |
|
80
|
CVE-2026-56159 |
9.8 | 0.0097 | NET NO AUTH LOW CX NO UI | Heap-based buffer overflow in Windows DHCP Server allows an unauthorized attacke | |
|
80
|
CVE-2026-62815 |
9.8 | 0.0097 | NET NO AUTH LOW CX NO UI | Use after free in Microsoft QUIC allows an unauthorized attacker to execute code | |
|
80
|
CVE-2026-62893 |
9.8 | 0.0097 | NET NO AUTH LOW CX NO UI | Use after free in Windows Deployment Services allows an unauthorized attacker to | |
|
80
|
CVE-2026-67631 |
9.8 | 0.0097 | NET NO AUTH LOW CX NO UI | Heap-based buffer overflow in SQL Server allows an unauthorized attacker to exec | |
|
80
|
CVE-2026-66302 |
9.8 | 0.0097 | NET NO AUTH LOW CX NO UI | External control of file name or path in Skype for Business allows an unauthoriz | |
|
80
|
CVE-2026-69493 |
9.8 | 0.0097 | NET NO AUTH LOW CX NO UI | Out-of-bounds read in Windows Event Logging Service allows an unauthorized attac | |
|
80
|
CVE-2026-69586 |
9.8 | 0.0097 | NET NO AUTH LOW CX NO UI | Integer overflow or wraparound in Microsoft Windows PDF allows an unauthorized a | |
|
80
|
CVE-2026-69590 |
9.8 | 0.0097 | NET NO AUTH LOW CX NO UI | Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows | |
|
80
|
CVE-2026-69595 |
9.8 | 0.0097 | NET NO AUTH LOW CX NO UI | Use after free in Windows Services for NFS ONCRPC XDR Driver allows an unauthori | |
|
80
|
CVE-2026-69715 |
9.8 | 0.0097 | NET NO AUTH LOW CX NO UI | Out-of-bounds read in Windows Direct Show allows an unauthorized attacker to exe | |
|
80
|
CVE-2026-69768 |
9.8 | 0.0097 | NET NO AUTH LOW CX NO UI | Heap-based buffer overflow in Windows RNDIS allows an unauthorized attacker to e | |
|
80
|
CVE-2026-69769 |
9.8 | 0.0097 | NET NO AUTH LOW CX NO UI | Heap-based buffer overflow in Windows HTTP Print Provider allows an unauthorized | |
|
80
|
CVE-2026-69824 |
9.8 | 0.0097 | NET NO AUTH LOW CX NO UI | Integer underflow (wrap or wraparound) in Microsoft Standard XPS allows an unaut | |
|
80
|
CVE-2026-69829 |
9.8 | 0.0097 | NET NO AUTH LOW CX NO UI | Heap-based buffer overflow in Windows Shell allows an unauthorized attacker to e | |
|
80
|
CVE-2026-69910 |
9.8 | 0.0097 | NET NO AUTH LOW CX NO UI | Stack-based buffer overflow in Windows Hyper-V allows an unauthorized attacker t | |
|
80
|
CVE-2026-70296 |
9.8 | 0.0097 | NET NO AUTH LOW CX NO UI | Out-of-bounds write in Windows Imaging Component allows an unauthorized attacker | |
|
80
|
CVE-2026-73009 |
9.8 | 0.0097 | NET NO AUTH LOW CX NO UI | Use after free in Windows Secure Socket Tunneling Protocol (SSTP) allows an unau | |
|
79
|
CVE-2026-55971 |
9.3 | 0.0098 | NET NO AUTH LOW CX NO UI | Heap-based Buffer Overflow vulnerability in Apache Thrift C++ bindings. This is | |
|
75
|
CVE-2026-85353 |
7.5 | 0.0098 | NET NO AUTH LOW CX NO UI | Out-of-bounds read in Windows Print Spooler Components allows an unauthorized at | |
|
75
|
CVE-2026-85334 |
7.5 | 0.0098 | NET NO AUTH LOW CX NO UI | Out-of-bounds read in Windows Message Queuing Queue Manager allows an unauthoriz | |
|
75
|
CVE-2026-96245 |
7.5 | 0.0098 | NET NO AUTH LOW CX NO UI | Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an | |
|
75
|
CVE-2026-96246 |
7.5 | 0.0098 | NET NO AUTH LOW CX NO UI | Out-of-bounds read in Network Policy Server (NPS) allows an unauthorized attacke | |
|
75
|
CVE-2026-103558 |
7.5 | 0.0098 | NET NO AUTH LOW CX NO UI | Deadlock in Windows Routing and Remote Access Service (RRAS) allows an unauthori | |
|
70
|
CVE-2026-8476 |
9.9 | 0.0097 | NET LOW CX NO UI | IBM Langflow OSS 1.0.0 through 1.10.0 contain a critical remote code execution v | |
|
68
|
CVE-2026-66819 |
8.8 | 0.0099 | NET LOW CX NO UI | Improper neutralization of special elements used in an sql command ('sql injecti | |
|
68
|
CVE-2026-66820 |
8.8 | 0.0099 | NET LOW CX NO UI | Improper neutralization of special elements used in an sql command ('sql injecti | |
|
68
|
CVE-2026-69716 |
8.8 | 0.0099 | NET LOW CX NO UI | Improper neutralization of special elements used in an sql command ('sql injecti | |
|
68
|
CVE-2026-77908 |
8.8 | 0.0099 | NET LOW CX NO UI | Improper control of generation of code ('code injection') in Microsoft Dynamics | |
|
68
|
CVE-2026-12935 |
8.7 | 0.0099 | NET NO AUTH LOW CX | The TL-WR940N v6 router contains a vulnerability in its RTSP connection tracking | |
|
68
|
CVE-2026-70167 |
8.8 | 0.0098 | NET LOW CX NO UI | Access of resource using incompatible type ('type confusion') in DNS Server allo | |
|
68
|
CVE-2025-57282 |
8.8 | 0.0098 | NET LOW CX NO UI | ngrok v4.3.3 and 5.0.0-beta.2 is vulnerable to Command Injection. | |
|
68
|
CVE-2024-7557 |
8.8 | 0.0098 | NET LOW CX NO UI | A vulnerability was found in OpenShift AI that allows for authentication bypass | |
|
68
|
CVE-2023-23917 |
8.8 | 0.0098 | NET LOW CX NO UI | A prototype pollution vulnerability exists in Rocket.Chat server <5.2.0 that cou | |
|
68
|
CVE-2026-72538 |
8.8 | 0.0098 | NET LOW CX NO UI | An argument injection vulnerability in PrefectHQ Prefect through 3.8.2 allows au | |
|
68
|
CVE-2026-40521 |
8.7 | 0.0098 | NET LOW CX NO UI | FrontAccounting before 2.4.20 contains a path traversal vulnerability in the att | |
|
66
|
CVE-2026-43865 |
8.1 | 0.0098 | NET NO AUTH NO UI | Deserialization of Untrusted Data vulnerability in Apache Camel Hazelcast compon | |
|
55
|
CVE-2026-43003 |
7.5 | 0.0098 | NET NO UI | An issue was discovered in OpenStack ironic-python-agent 1.0.0 through 11.5.0. I |