Hunt List
12,862 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-83748 |
9.8 | 0.0091 | NET NO AUTH LOW CX NO UI | Heap-based buffer overflow in Windows Error Reporting allows an unauthorized att | |
|
79
|
CVE-2026-69098 |
9.3 | 0.0091 | NET NO AUTH LOW CX NO UI | kotaemon through 0.12.0 contains an insecure deserialization vulnerability in th | |
|
79
|
CVE-2018-25254 |
9.3 | 0.0091 | NET NO AUTH LOW CX NO UI | NICO-FTP 3.0.1.19 contains a structured exception handler buffer overflow vulner | |
|
75
|
CVE-2023-32214 |
7.5 | 0.0092 | NET NO AUTH LOW CX NO UI | Protocol handlers `ms-cxh` and `ms-cxh-full` could have been leveraged to trigge | |
|
75
|
CVE-2024-33288 |
7.3 | 0.0092 | NET NO AUTH LOW CX NO UI | Prison Management System Using PHP v1.0 was discovered to contain a SQL injectio | |
|
75
|
CVE-2026-45798 |
7.5 | 0.0092 | NET NO AUTH LOW CX NO UI | Wazuh is a free and open source platform used for threat prevention, detection, | |
|
70
|
CVE-2026-57092 |
9.9 | 0.0091 | NET LOW CX NO UI | Use after free in Windows VMSwitch allows an authorized attacker to elevate priv | |
|
68
|
CVE-2026-56748 |
8.7 | 0.0092 | NET LOW CX NO UI | Improper validation of symbolic links in the Pack Git import feature in Cribl St | |
|
68
|
CVE-2026-48584 |
8.8 | 0.0091 | NET LOW CX NO UI | Execution with unnecessary privileges in Azure Synapse allows an authorized atta | |
|
68
|
CVE-2026-56642 |
8.8 | 0.0091 | NET LOW CX NO UI | Stack-based buffer overflow in Microsoft Fabric Data Warehouse allows an authori | |
|
68
|
CVE-2026-59133 |
8.8 | 0.0091 | NET LOW CX NO UI | Execution with unnecessary privileges in Microsoft High Performance Computing (H | |
|
68
|
CVE-2026-70174 |
8.8 | 0.0091 | NET NO AUTH LOW CX | Improperly implemented security check for standard in .NET allows an unauthorize | |
|
68
|
CVE-2026-62790 |
8.8 | 0.0091 | NET LOW CX NO UI | Heap-based buffer overflow in Windows SMB Server allows an authorized attacker t | |
|
68
|
CVE-2026-48564 |
8.8 | 0.0091 | NET LOW CX NO UI | Heap-based buffer overflow in Windows DHCP Server allows an authorized attacker | |
|
68
|
CVE-2026-49178 |
8.8 | 0.0091 | NET LOW CX NO UI | Heap-based buffer overflow in Active Directory Domain Services allows an authori | |
|
68
|
CVE-2026-50666 |
8.8 | 0.0091 | NET LOW CX NO UI | Use after free in Windows Remote Access Connection Manager allows an authorized | |
|
68
|
CVE-2026-55002 |
8.8 | 0.0091 | NET LOW CX NO UI | External control of file name or path in SQL Server allows an authorized attacke | |
|
68
|
CVE-2026-56194 |
8.8 | 0.0091 | NET LOW CX NO UI | Heap-based buffer overflow in Windows Network File System allows an authorized a | |
|
68
|
CVE-2026-56647 |
8.8 | 0.0091 | NET LOW CX NO UI | Integer overflow or wraparound in Windows Remote Access Service Infrastructure a | |
|
68
|
CVE-2026-58626 |
8.8 | 0.0091 | NET LOW CX NO UI | Use after free in Windows Remote Desktop Services allows an authorized attacker | |
|
68
|
CVE-2026-62784 |
8.8 | 0.0091 | NET LOW CX NO UI | Heap-based buffer overflow in Microsoft Local Security Authority Server (lsasrv) | |
|
68
|
CVE-2026-62818 |
8.8 | 0.0091 | NET LOW CX NO UI | Use after free in Active Directory Certificate Services (AD CS) allows an author | |
|
68
|
CVE-2026-62913 |
8.8 | 0.0091 | NET LOW CX NO UI | Heap-based buffer overflow in Microsoft Exchange Server allows an authorized att | |
|
68
|
CVE-2026-67373 |
8.8 | 0.0091 | NET LOW CX NO UI | Heap-based buffer overflow in SQL Server allows an authorized attacker to execut | |
|
68
|
CVE-2026-69464 |
8.8 | 0.0091 | NET LOW CX NO UI | Execution with unnecessary privileges in Microsoft Office SharePoint allows an a | |
|
68
|
CVE-2026-69547 |
8.8 | 0.0091 | NET LOW CX NO UI | Heap-based buffer overflow in Windows DHCP Server allows an authorized attacker | |
|
68
|
CVE-2026-71352 |
8.8 | 0.0091 | NET LOW CX NO UI | Integer underflow (wrap or wraparound) in Windows Remote Access Connection Manag | |
|
68
|
CVE-2026-72959 |
8.8 | 0.0091 | NET LOW CX NO UI | Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows | |
|
68
|
CVE-2026-73012 |
8.8 | 0.0091 | NET LOW CX NO UI | Heap-based buffer overflow in Windows Management Services allows an authorized a | |
|
68
|
CVE-2026-77481 |
8.8 | 0.0091 | NET LOW CX NO UI | Heap-based buffer overflow in SQL Server allows an authorized attacker to execut | |
|
68
|
CVE-2026-78456 |
8.8 | 0.0091 | NET LOW CX NO UI | Heap-based buffer overflow in SQL Server allows an authorized attacker to execut | |
|
68
|
CVE-2026-80096 |
8.8 | 0.0091 | NET LOW CX NO UI | Out-of-bounds read in Windows Remote Desktop Services allows an authorized attac | |
|
68
|
CVE-2026-67380 |
8.8 | 0.0091 | NET LOW CX NO UI | Heap-based buffer overflow in SQL Server allows an authorized attacker to execut | |
|
68
|
CVE-2026-67381 |
8.8 | 0.0091 | NET LOW CX NO UI | Heap-based buffer overflow in SQL Server allows an authorized attacker to elevat | |
|
68
|
CVE-2026-67384 |
8.8 | 0.0091 | NET LOW CX NO UI | Integer overflow or wraparound in SQL Server allows an authorized attacker to ex | |
|
68
|
CVE-2026-67385 |
8.8 | 0.0091 | NET LOW CX NO UI | Use after free in SQL Server allows an authorized attacker to execute code over | |
|
68
|
CVE-2026-67388 |
8.8 | 0.0091 | NET LOW CX NO UI | Heap-based buffer overflow in SQL Server allows an authorized attacker to execut | |
|
68
|
CVE-2026-67638 |
8.8 | 0.0091 | NET LOW CX NO UI | Heap-based buffer overflow in SQL Server allows an authorized attacker to execut | |
|
68
|
CVE-2026-67639 |
8.8 | 0.0091 | NET LOW CX NO UI | Heap-based buffer overflow in SQL Server allows an authorized attacker to execut | |
|
68
|
CVE-2026-67642 |
8.8 | 0.0091 | NET LOW CX NO UI | Heap-based buffer overflow in SQL Server allows an authorized attacker to execut | |
|
68
|
CVE-2026-68775 |
8.8 | 0.0091 | NET LOW CX NO UI | Heap-based buffer overflow in SQL Server allows an authorized attacker to execut | |
|
68
|
CVE-2026-68786 |
8.8 | 0.0091 | NET LOW CX NO UI | Heap-based buffer overflow in SQL Server allows an authorized attacker to execut | |
|
68
|
CVE-2026-69355 |
8.8 | 0.0091 | NET LOW CX NO UI | External control of file name or path in Microsoft Exchange Server allows an aut | |
|
68
|
CVE-2026-69485 |
8.8 | 0.0091 | NET LOW CX NO UI | Use of uninitialized resource in Remote Desktop Client allows an authorized atta | |
|
68
|
CVE-2026-69551 |
8.8 | 0.0091 | NET LOW CX NO UI | Use after free in Windows DNS allows an authorized attacker to execute code over | |
|
63
|
CVE-2026-22313 |
9.1 | 0.0092 | NET LOW CX NO UI | The device has a webserver that exposes a REST API authenticated with a token on | |
|
62
|
CVE-2026-67340 |
8.6 | 0.0092 | NET LOW CX NO UI | ArcadeDB before 26.7.2 (arcadedb-engine) allows trigger scripts to look up host | |
|
60
|
CVE-2026-44865 |
7.2 | 0.0092 | NET LOW CX NO UI | Command injection vulnerabilities exist in the web-based management interface of | |
|
60
|
CVE-2026-71284 |
7.2 | 0.0092 | NET LOW CX NO UI | Fledge's backup-restore upload handler, upload_backup (python/fledge/services/co | |
|
60
|
CVE-2026-48163 |
7.2 | 0.0091 | NET LOW CX NO UI | MariaDB server is a community developed fork of MySQL server. From versions 10.6 |