Hunt List
12,859 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-6057 |
9.8 | 0.0093 | NET NO AUTH LOW CX NO UI | FalkorDB Browser 1.9.3 contains an unauthenticated path traversal vulnerability | |
|
80
|
CVE-2026-85809 |
9.8 | 0.0093 | NET NO AUTH LOW CX NO UI | Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows | |
|
80
|
CVE-2026-85814 |
9.8 | 0.0093 | NET NO AUTH LOW CX NO UI | Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unaut | |
|
80
|
CVE-2026-0685 |
9.8 | 0.0093 | NET NO AUTH LOW CX NO UI | Server side template inject (SSTI) in the expression evaluation component in Gen | |
|
80
|
CVE-2026-43867 |
9.8 | 0.0093 | NET NO AUTH LOW CX NO UI | Deserialization of Untrusted Data vulnerability in Apache Camel PQC Component. | |
|
80
|
CVE-2026-52200 |
9.8 | 0.0093 | NET NO AUTH LOW CX NO UI | An issue in Generic OEM UZ801_v2.1 4G LTE Router V3.4.3 allows a remote attacker | |
|
80
|
CVE-2026-67919 |
9.8 | 0.0093 | NET NO AUTH LOW CX NO UI | An issue in Halo 2.25.4 allows a remote attacker to execute arbitrary code via t | |
|
80
|
CVE-2026-32871 |
10.0 | 0.0092 | NET NO AUTH LOW CX NO UI | FastMCP is a Pythonic way to build MCP servers and clients. Prior to version 3.2 | |
|
80
|
CVE-2026-58275 |
10.0 | 0.0092 | NET NO AUTH LOW CX NO UI | Missing authorization in Azure DNS allows an unauthorized attacker to elevate pr | |
|
80
|
CVE-2026-62825 |
10.0 | 0.0092 | NET NO AUTH LOW CX NO UI | Improper authentication in Azure Key Vault allows an unauthorized attacker to el | |
|
80
|
CVE-2026-17436 |
9.8 | 0.0092 | NET NO AUTH LOW CX NO UI | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to e | |
|
80
|
CVE-2026-18832 |
9.8 | 0.0092 | NET NO AUTH LOW CX NO UI | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to e | |
|
80
|
CVE-2026-17142 |
9.8 | 0.0092 | NET NO AUTH LOW CX NO UI | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to e | |
|
79
|
CVE-2024-58351 |
9.3 | 0.0093 | NET NO AUTH LOW CX NO UI | Flowise before 2.1.4 allows configuration to be injected into the Chainflow duri | |
|
79
|
CVE-2026-113736 |
9.3 | 0.0092 | NET NO AUTH LOW CX NO UI | A vulnerability has been found in D-Link DHP-W610AV 1.02EUb03. The impacted elem | |
|
78
|
CVE-2026-69095 |
8.7 | 0.0093 | NET NO AUTH LOW CX NO UI | OpenWrt luci-app-bmx7 before commit 5890760a454dad2cb00389dba2cdc5e779e0ffdd con | |
|
78
|
CVE-2026-58465 |
8.7 | 0.0092 | NET NO AUTH LOW CX NO UI | Eclipse Wakaama before snapshot/2026-05-26 contains an unbounded memory allocati | |
|
78
|
CVE-2026-60109 |
8.7 | 0.0092 | NET NO AUTH LOW CX NO UI | Zeek before 8.0.9 contains a null pointer dereference vulnerability in its Kerbe | |
|
75
|
CVE-2022-47762 |
7.5 | 0.0093 | NET NO AUTH LOW CX NO UI | In gin-vue-admin < 2.5.5, the download module has a Path Traversal vulnerability | |
|
75
|
CVE-2026-85891 |
7.5 | 0.0092 | NET NO AUTH LOW CX NO UI | Exposure of sensitive information to an unauthorized actor in Azure HDInsight al | |
|
75
|
CVE-2026-50519 |
7.5 | 0.0092 | NET NO AUTH LOW CX NO UI | Initialization of a resource with an insecure default in GitHub Copilot and Visu | |
|
68
|
CVE-2026-96202 |
8.8 | 0.0093 | NET NO AUTH LOW CX | Heap-based buffer overflow in Windows Raw Image Extension allows an unauthorized | |
|
68
|
CVE-2026-100220 |
8.8 | 0.0093 | NET NO AUTH LOW CX | Heap-based buffer overflow in Windows Media Video Decoder allows an unauthorized | |
|
68
|
CVE-2026-70215 |
8.8 | 0.0093 | NET NO AUTH LOW CX | Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to | |
|
68
|
CVE-2026-88144 |
8.8 | 0.0093 | NET NO AUTH LOW CX | Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to | |
|
68
|
CVE-2026-97741 |
8.8 | 0.0093 | NET NO AUTH LOW CX | Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized atta | |
|
68
|
CVE-2026-97742 |
8.8 | 0.0093 | NET NO AUTH LOW CX | Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized att | |
|
68
|
CVE-2026-97745 |
8.8 | 0.0093 | NET NO AUTH LOW CX | Use after free in Microsoft Office Excel allows an unauthorized attacker to exec | |
|
68
|
CVE-2026-70068 |
8.8 | 0.0093 | NET NO AUTH LOW CX | Heap-based buffer overflow in Windows Client-Side Caching (CSC) Service allows a | |
|
68
|
CVE-2026-70089 |
8.8 | 0.0093 | NET NO AUTH LOW CX | Heap-based buffer overflow in Windows GDI allows an unauthorized attacker to exe | |
|
68
|
CVE-2026-70149 |
8.8 | 0.0093 | NET NO AUTH LOW CX | Exposure of sensitive information to an unauthorized actor in Windows Client Sid | |
|
68
|
CVE-2026-70210 |
8.8 | 0.0093 | NET NO AUTH LOW CX | Heap-based buffer overflow in Windows OLE DB allows an unauthorized attacker to | |
|
68
|
CVE-2026-70258 |
8.8 | 0.0093 | NET NO AUTH LOW CX | Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unaut | |
|
68
|
CVE-2026-70262 |
8.8 | 0.0093 | NET NO AUTH LOW CX | Heap-based buffer overflow in WebDAV allows an unauthorized attacker to elevate | |
|
68
|
CVE-2026-70275 |
8.8 | 0.0093 | NET NO AUTH LOW CX | Untrusted pointer dereference in Windows CD-ROM Driver allows an unauthorized at | |
|
68
|
CVE-2026-77496 |
8.8 | 0.0093 | NET NO AUTH LOW CX | Heap-based buffer overflow in Windows Imaging Component allows an unauthorized a | |
|
68
|
CVE-2026-83523 |
8.8 | 0.0093 | NET NO AUTH LOW CX | Heap-based buffer overflow in Windows Image Acquisition allows an unauthorized a | |
|
68
|
CVE-2026-83642 |
8.8 | 0.0093 | NET NO AUTH LOW CX | Access of resource using incompatible type ('type confusion') in DNS Server allo | |
|
68
|
CVE-2026-83643 |
8.8 | 0.0093 | NET NO AUTH LOW CX | Stack-based buffer overflow in Windows Error Reporting allows an unauthorized at | |
|
68
|
CVE-2026-83688 |
8.8 | 0.0093 | NET NO AUTH LOW CX | Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attac | |
|
68
|
CVE-2023-28663 |
8.8 | 0.0093 | NET LOW CX NO UI | The Formidable PRO2PDF WordPress Plugin, version < 3.11, is affected by an authe | |
|
68
|
CVE-2026-83759 |
8.8 | 0.0092 | NET LOW CX NO UI | Improper control of generation of code ('code injection') in Windows Encrypting | |
|
68
|
CVE-2026-62312 |
8.8 | 0.0092 | NET LOW CX NO UI | 9Router is an AI router & token saver. Prior to 0.5.2, 9Router allows a remote a | |
|
68
|
CVE-2026-72950 |
8.8 | 0.0092 | NET LOW CX NO UI | Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows | |
|
65
|
CVE-2024-12397 |
7.4 | 0.0093 | NET NO AUTH NO UI | A flaw was found in Quarkus-HTTP, which incorrectly parses cookies with certain | |
|
65
|
CVE-2026-57990 |
7.4 | 0.0092 | NET NO AUTH LOW CX | Files or directories accessible to external parties in Microsoft Edge (Chromium- | |
|
65
|
CVE-2026-65802 |
7.4 | 0.0092 | NET NO AUTH LOW CX | External control of file name or path in Microsoft Edge for Android allows an un | |
|
65
|
CVE-2026-62906 |
7.4 | 0.0092 | NET NO AUTH LOW CX | Improper neutralization of special elements in data query logic in Microsoft Dis | |
|
65
|
CVE-2026-81383 |
7.4 | 0.0092 | NET NO AUTH LOW CX | Use of incorrectly-resolved name or reference in Visual Studio Code allows an un | |
|
64
|
CVE-2026-50682 |
7.1 | 0.0093 | NET LOW CX NO UI | Out-of-bounds read in Windows Active Directory allows an authorized attacker to |