Hunt List
12,858 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-70024 |
9.8 | 0.0096 | NET NO AUTH LOW CX NO UI | Stack-based buffer overflow in Windows Internet Information Services allows an u | |
|
80
|
CVE-2026-57878 |
9.8 | 0.0095 | NET NO AUTH LOW CX NO UI | An unauthenticated stack-based buffer overflow vulnerability exists in thttpd in | |
|
80
|
CVE-2026-58115 |
10.0 | 0.0095 | NET NO AUTH LOW CX NO UI | A vulnerability has been identified in SIMATIC IoT2050 Advanced (6ES7647-0BA00-1 | |
|
80
|
CVE-2026-69634 |
9.8 | 0.0095 | NET NO AUTH LOW CX NO UI | Heap-based buffer overflow in Windows iSCSI allows an unauthorized attacker to e | |
|
80
|
CVE-2026-69639 |
9.8 | 0.0095 | NET NO AUTH LOW CX NO UI | Heap-based buffer overflow in Windows Libarchive allows an unauthorized attacker | |
|
80
|
CVE-2026-69883 |
9.8 | 0.0095 | NET NO AUTH LOW CX NO UI | Use after free in Windows iSCSI allows an unauthorized attacker to execute code | |
|
80
|
CVE-2026-69886 |
9.8 | 0.0095 | NET NO AUTH LOW CX NO UI | Heap-based buffer overflow in Windows Imaging Component allows an unauthorized a | |
|
80
|
CVE-2026-48331 |
10.0 | 0.0095 | NET NO AUTH LOW CX NO UI | Adobe Campaign Classic (ACC) is affected by a Server-Side Request Forgery (SSRF) | |
|
80
|
CVE-2023-34844 |
9.8 | 0.0095 | NET NO AUTH LOW CX NO UI | Play With Docker < 0.0.2 has an insecure CAP_SYS_ADMIN privileged mode causing t | |
|
80
|
CVE-2026-48333 |
9.8 | 0.0095 | NET NO AUTH LOW CX NO UI | Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerabi | |
|
79
|
CVE-2026-57517 |
9.3 | 0.0096 | NET NO AUTH LOW CX NO UI | Control Web Panel before 0.9.8.1225 contains a blind SQL injection vulnerability | |
|
79
|
CVE-2026-67191 |
9.3 | 0.0096 | NET NO AUTH LOW CX NO UI | Xlight FTP Server before 3.9.5 contains a pre-authentication heap buffer overflo | |
|
79
|
CVE-2026-8634 |
9.3 | 0.0095 | NET NO AUTH LOW CX NO UI | Crabbox prior to v0.12.0 contains an environment variable exposure vulnerability | |
|
78
|
CVE-2026-73487 |
9.0 | 0.0096 | NET NO AUTH LOW CX NO UI | Flowise before 3.1.3 contains a regex-based Python code validator bypass in CSV | |
|
78
|
CVE-2026-56388 |
9.1 | 0.0095 | NET NO AUTH LOW CX NO UI | The Redis server command parser in Apache bRPC accepts an empty RESP array as a | |
|
78
|
CVE-2026-112350 |
8.7 | 0.0095 | NET NO AUTH LOW CX NO UI | Sunhillo SureLine before 9.1.5 contains a path traversal vulnerability in the ra | |
|
78
|
CVE-2026-96230 |
8.8 | 0.0095 | NET NO AUTH LOW CX | 1 PoC | Improper neutralization of input during web page generation ('cross-site scripti |
|
77
|
CVE-2026-57206 |
8.6 | 0.0096 | NET NO AUTH LOW CX NO UI | SimpleChat is a secure AI conversation application with personal and group works | |
|
76
|
CVE-2026-63520 |
8.1 | 0.0096 | NET NO AUTH NO UI | 1 PoC | Improper input validation in Microsoft Office SharePoint allows an unauthorized |
|
75
|
CVE-2026-70186 |
7.5 | 0.0096 | NET NO AUTH LOW CX NO UI | Deadlock in ASP.NET Core allows an unauthorized attacker to deny service over a | |
|
75
|
CVE-2022-43768 |
7.5 | 0.0095 | NET NO AUTH LOW CX NO UI | A vulnerability has been identified in SIMATIC CP 1242-7 V2 (6GK7242-7KX31-0XE0) | |
|
75
|
CVE-2026-109468 |
7.5 | 0.0095 | NET NO AUTH LOW CX NO UI | Allocation of resources without limits or throttling in ASP.NET Core allows an u | |
|
70
|
CVE-2026-54120 |
9.9 | 0.0096 | NET LOW CX NO UI | Improper input validation in Microsoft Surface allows an authorized attacker to | |
|
68
|
CVE-2026-70158 |
8.8 | 0.0096 | NET LOW CX NO UI | Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows | |
|
68
|
CVE-2026-18420 |
8.7 | 0.0096 | NET LOW CX NO UI | Improper input validation in the Time Series Visual Builder (TSVB) plugin in Ope | |
|
68
|
CVE-2026-40365 |
8.8 | 0.0096 | NET LOW CX NO UI | Deserialization of untrusted data in Microsoft Office SharePoint allows an autho | |
|
68
|
CVE-2026-47871 |
8.8 | 0.0096 | NET LOW CX NO UI | VMware Avi Load Balancer contains a directory traversal vulnerability. Flaws in | |
|
68
|
CVE-2026-65811 |
8.8 | 0.0096 | NET LOW CX NO UI | Improper input validation in Power BI allows an authorized attacker to execute c | |
|
68
|
CVE-2026-19949 |
8.8 | 0.0096 | NET LOW CX NO UI | The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to SQL | |
|
68
|
CVE-2026-105718 |
8.8 | 0.0095 | NET NO AUTH LOW CX | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to | |
|
68
|
CVE-2026-88136 |
8.8 | 0.0095 | NET LOW CX NO UI | Improper resolution of path equivalence in WebDAV allows an authorized attacker | |
|
68
|
CVE-2026-100209 |
8.8 | 0.0095 | NET NO AUTH LOW CX | Use after free in Microsoft Office Excel allows an unauthorized attacker to exec | |
|
68
|
CVE-2026-114094 |
8.7 | 0.0095 | NET NO AUTH LOW CX | Dulwich before 1.2.9 fails to validate DOS drive letter prefixes in Git tree pat | |
|
68
|
CVE-2026-88163 |
8.8 | 0.0095 | NET LOW CX NO UI | Integer overflow or wraparound in Microsoft Office SharePoint allows an authoriz | |
|
68
|
CVE-2026-88166 |
8.8 | 0.0095 | NET LOW CX NO UI | Integer overflow or wraparound in Microsoft Office SharePoint allows an authoriz | |
|
68
|
CVE-2026-7570 |
8.8 | 0.0095 | NET LOW CX NO UI | Quest NetVault Backup NVBUDashboard SQL Injection Remote Code Execution Vulnerab | |
|
68
|
CVE-2026-9781 |
8.8 | 0.0095 | NET LOW CX NO UI | Quest NetVault Backup NVBURASDevice SQL Injection Remote Code Execution Vulnerab | |
|
68
|
CVE-2026-9782 |
8.8 | 0.0095 | NET LOW CX NO UI | Quest NetVault Backup NVBUDeviceDrive SQL Injection Remote Code Execution Vulner | |
|
68
|
CVE-2026-9783 |
8.8 | 0.0095 | NET LOW CX NO UI | Quest NetVault Backup NVBURemovableMedia SQL Injection Remote Code Execution Vul | |
|
68
|
CVE-2026-9784 |
8.8 | 0.0095 | NET LOW CX NO UI | Quest NetVault Backup NVBULibraryPort SQL Injection Remote Code Execution Vulner | |
|
68
|
CVE-2026-9785 |
8.8 | 0.0095 | NET LOW CX NO UI | Quest NetVault Backup NVBULibrarySlot SQL Injection Remote Code Execution Vulner | |
|
68
|
CVE-2026-9786 |
8.8 | 0.0095 | NET LOW CX NO UI | Quest NetVault Backup NVBUDashboard SQL Injection Remote Code Execution Vulnerab | |
|
66
|
CVE-2026-79890 |
8.1 | 0.0096 | NET NO AUTH NO UI | There are command injection vulnerabilities in AOS-8 that could lead to unauthen | |
|
66
|
CVE-2026-94300 |
8.1 | 0.0095 | NET NO AUTH NO UI | Replaying GSS-TSIG signed UDP messages can result in memory corruption in "`name | |
|
65
|
CVE-2026-105013 |
7.4 | 0.0095 | NET LOW CX NO UI | Deserialization of untrusted data in Microsoft Office SharePoint allows an autho | |
|
62
|
CVE-2026-11845 |
8.6 | 0.0095 | NET LOW CX NO UI | The iVEC-IEI Virtualization Edge Computer developed by IEI Integration Corp has | |
|
60
|
CVE-2026-23823 |
7.2 | 0.0096 | NET LOW CX NO UI | A vulnerability in the command line interface of Access Points running AOS-10 co | |
|
57
|
CVE-2026-58281 |
8.3 | 0.0096 | NET NO AUTH | Deserialization of untrusted data in Microsoft Edge (Chromium-based) allows an u | |
|
56
|
CVE-2026-73623 |
7.7 | 0.0096 | NET NO UI | GitPython before 3.1.54 contains an incomplete denylist in unsafe_git_clone_opti | |
|
55
|
CVE-2026-55021 |
7.3 | 0.0095 | NET LOW CX | Improper neutralization of input during web page generation ('cross-site scripti |