Hunt List
12,857 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-57879 |
9.8 | 0.0095 | NET NO AUTH LOW CX NO UI | An unauthenticated stack-based buffer overflow vulnerability exists in ssvr in G | |
|
80
|
CVE-2026-57880 |
9.8 | 0.0095 | NET NO AUTH LOW CX NO UI | An unauthenticated stack-based buffer overflow vulnerability exists in ssvr in G | |
|
80
|
CVE-2026-12940 |
9.8 | 0.0094 | NET NO AUTH LOW CX NO UI | IBM Langflow OSS 1.0.0 through 1.10.1 are vulnerable to unauthenticated remote | |
|
80
|
CVE-2023-29542 |
9.8 | 0.0094 | NET NO AUTH LOW CX NO UI | A newline in a filename could have been used to bypass the file extension securi | |
|
80
|
CVE-2026-57572 |
10.0 | 0.0094 | NET NO AUTH LOW CX NO UI | Crawl4AI is an open-source LLM-friendly web crawler and scraper. Prior to 0.9.0, | |
|
80
|
CVE-2026-96934 |
9.8 | 0.0094 | NET NO AUTH LOW CX NO UI | Use after free in Windows DHCP Server allows an unauthorized attacker to execute | |
|
80
|
CVE-2026-3960 |
9.8 | 0.0094 | NET NO AUTH LOW CX NO UI | A critical remote code execution vulnerability exists in the unauthenticated RES | |
|
80
|
CVE-2023-34416 |
9.8 | 0.0093 | NET NO AUTH LOW CX NO UI | Memory safety bugs present in Firefox 113, Firefox ESR 102.11, and Thunderbird 1 | |
|
80
|
CVE-2026-20160 |
9.8 | 0.0093 | NET NO AUTH LOW CX NO UI | A vulnerability in Cisco Smart Software Manager On-Prem (SSM On-Prem) could allo | |
|
79
|
CVE-2026-112403 |
9.2 | 0.0095 | NET NO AUTH LOW CX NO UI | Pillow is a Python imaging library. Prior to 13.0.0, Pillow's JPEG decoder can w | |
|
79
|
CVE-2026-42097 |
9.3 | 0.0094 | NET NO AUTH LOW CX NO UI | Sparx Pro Cloud Server requires authentication based on requested URL. An attack | |
|
79
|
CVE-2026-88092 |
9.4 | 0.0093 | NET NO AUTH LOW CX NO UI | Inconsistent interpretation of http requests ('http request/response smuggling') | |
|
79
|
CVE-2026-34106 |
9.3 | 0.0093 | NET NO AUTH LOW CX NO UI | Guardian language-system passes the id GET parameter directly into a PHP exec() | |
|
79
|
CVE-2026-34107 |
9.3 | 0.0093 | NET NO AUTH LOW CX NO UI | Guardian language-system passes the id GET parameter directly into a PHP exec() | |
|
79
|
CVE-2026-34108 |
9.3 | 0.0093 | NET NO AUTH LOW CX NO UI | Guardian language-system passes the id GET parameter directly into a PHP exec() | |
|
79
|
CVE-2026-34109 |
9.3 | 0.0093 | NET NO AUTH LOW CX NO UI | Guardian language-system passes the id GET parameter directly into a PHP exec() | |
|
79
|
CVE-2026-34110 |
9.3 | 0.0093 | NET NO AUTH LOW CX NO UI | Guardian language-system passes the id GET parameter directly into a PHP exec() | |
|
79
|
CVE-2026-34111 |
9.3 | 0.0093 | NET NO AUTH LOW CX NO UI | Guardian language-system passes the id GET parameter directly into a PHP exec() | |
|
79
|
CVE-2026-34112 |
9.3 | 0.0093 | NET NO AUTH LOW CX NO UI | Guardian language-system passes the id GET parameter directly into a PHP exec() | |
|
79
|
CVE-2026-34113 |
9.3 | 0.0093 | NET NO AUTH LOW CX NO UI | Guardian language-system passes the id GET parameter directly into a PHP exec() | |
|
79
|
CVE-2026-34114 |
9.3 | 0.0093 | NET NO AUTH LOW CX NO UI | Guardian language-system passes the id GET parameter directly into a PHP exec() | |
|
79
|
CVE-2026-34115 |
9.3 | 0.0093 | NET NO AUTH LOW CX NO UI | Guardian language-system passes the id GET parameter directly into a PHP exec() | |
|
79
|
CVE-2026-34116 |
9.3 | 0.0093 | NET NO AUTH LOW CX NO UI | Guardian language-system passes the id GET parameter directly into a PHP exec() | |
|
79
|
CVE-2026-34117 |
9.3 | 0.0093 | NET NO AUTH LOW CX NO UI | Guardian language-system passes the id GET parameter directly into a PHP exec() | |
|
78
|
CVE-2026-70188 |
9.1 | 0.0094 | NET NO AUTH LOW CX NO UI | Inconsistent interpretation of http requests ('http request/response smuggling') | |
|
77
|
CVE-2026-42946 |
8.3 | 0.0093 | NET NO AUTH LOW CX NO UI | A vulnerability exists in the ngx_http_scgi_module and ngx_http_uwsgi_module mod | |
|
69
|
CVE-2026-48317 |
9.6 | 0.0094 | NET LOW CX NO UI | Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Direct | |
|
69
|
CVE-2026-69400 |
9.6 | 0.0094 | NET NO AUTH LOW CX | Improper limitation of a pathname to a restricted directory ('path traversal') i | |
|
69
|
CVE-2026-13368 |
9.2 | 0.0094 | NET NO AUTH NO UI | WatchGuard Fireware OS contains a race condition leading to a use-after-free vul | |
|
69
|
CVE-2026-35428 |
9.6 | 0.0093 | NET NO AUTH LOW CX | Improper neutralization of special elements used in a command ('command injectio | |
|
68
|
CVE-2026-67920 |
8.8 | 0.0094 | NET LOW CX NO UI | An issue in Halo 2.25.4 allows a remote attacker to execute arbitrary code via t | |
|
68
|
CVE-2026-64921 |
8.8 | 0.0094 | NET LOW CX NO UI | Missing authentication for critical function in Microsoft Office SharePoint allo | |
|
68
|
CVE-2026-55052 |
8.8 | 0.0094 | NET LOW CX NO UI | Missing authorization in Microsoft Office SharePoint allows an authorized attack | |
|
68
|
CVE-2026-58277 |
8.8 | 0.0094 | NET LOW CX NO UI | Improper authorization in Microsoft Office SharePoint allows an authorized attac | |
|
68
|
CVE-2026-62827 |
8.8 | 0.0094 | NET LOW CX NO UI | Improper authentication in Microsoft Office SharePoint allows an authorized atta | |
|
68
|
CVE-2026-70324 |
8.8 | 0.0094 | NET LOW CX NO UI | Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an auth | |
|
68
|
CVE-2026-50663 |
8.8 | 0.0094 | NET NO AUTH LOW CX | Relative path traversal in Age of Empires II: Definitive Edition Game allows an | |
|
68
|
CVE-2026-65768 |
8.8 | 0.0094 | NET NO AUTH LOW CX | Improper limitation of a pathname to a restricted directory ('path traversal') i | |
|
68
|
CVE-2026-7569 |
8.8 | 0.0094 | NET NO AUTH LOW CX | Quest NetVault Backup viewclient Cross-Site Scripting Authentication Bypass Vuln | |
|
68
|
CVE-2026-9780 |
8.8 | 0.0094 | NET NO AUTH LOW CX | Quest NetVault Backup addclient3 Cross-Site Scripting Authentication Bypass Vuln | |
|
68
|
CVE-2026-100210 |
8.8 | 0.0093 | NET NO AUTH LOW CX | Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized atta | |
|
68
|
CVE-2026-100211 |
8.8 | 0.0093 | NET NO AUTH LOW CX | Use after free in Microsoft Office Excel allows an unauthorized attacker to exec | |
|
68
|
CVE-2026-96202 |
8.8 | 0.0093 | NET NO AUTH LOW CX | Heap-based buffer overflow in Windows Raw Image Extension allows an unauthorized | |
|
67
|
CVE-2026-27650 |
8.6 | 0.0094 | NET NO AUTH LOW CX | OS Command Injection vulnerability exists in BUFFALO Wi-Fi router products. If t | |
|
66
|
CVE-2026-54512 |
8.1 | 0.0094 | NET NO AUTH NO UI | jackson-databind contains the general-purpose data-binding functionality and tre | |
|
66
|
CVE-2017-20289 |
7.7 | 0.0093 | NET LOW CX NO UI | Broadstreet Ad Widget plugin for WordPress 2.2.0 before 2.12.0 contains a local | |
|
63
|
CVE-2026-68823 |
9.1 | 0.0093 | NET LOW CX NO UI | Exposed dangerous method or function in Azure Confidential Ledger allows an auth | |
|
55
|
CVE-2026-55034 |
7.3 | 0.0095 | NET LOW CX | Improper neutralization of input during web page generation ('cross-site scripti | |
|
54
|
CVE-2026-48997 |
7.1 | 0.0095 | NET NO UI | e107 is a content management system (CMS). Versions 2.3.5 and earlier contain a | |
|
50
|
CVE-2026-111221 |
7.5 | 0.0094 | NET NO UI | Netgate pfSense CE through 2.9.0 contains a configuration injection vulnerabilit |