Hunt List
12,861 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-41900 |
10.0 | 0.0091 | NET NO AUTH LOW CX NO UI | OpenLearnX is an open-source, decentralized learning and assessment platform. Pr | |
|
80
|
CVE-2026-85806 |
9.8 | 0.0091 | NET NO AUTH LOW CX NO UI | Integer underflow (wrap or wraparound) in Network Policy Server (NPS) allows an | |
|
80
|
CVE-2026-8984 |
10.0 | 0.0091 | NET NO AUTH LOW CX NO UI | Autel Maxi Charger Single firmware through V1.03.51 allows unauthenticated remot | |
|
80
|
CVE-2026-45480 |
10.0 | 0.0090 | NET NO AUTH LOW CX NO UI | Improper authentication in Azure Active Directory allows an unauthorized attacke | |
|
80
|
CVE-2026-56191 |
10.0 | 0.0090 | NET NO AUTH LOW CX NO UI | Improper authentication in Microsoft Exchange Online allows an unauthorized atta | |
|
80
|
CVE-2026-56163 |
10.0 | 0.0090 | NET NO AUTH LOW CX NO UI | Missing authentication for critical function in Microsoft Azure Kubernetes Servi | |
|
80
|
CVE-2026-57106 |
10.0 | 0.0090 | NET NO AUTH LOW CX NO UI | Server-side request forgery (ssrf) in Data Quality allows an unauthorized attack | |
|
80
|
CVE-2026-66803 |
10.0 | 0.0090 | NET NO AUTH LOW CX NO UI | Improper access control in Azure Cosmos DB allows an unauthorized attacker to ex | |
|
80
|
CVE-2026-56162 |
10.0 | 0.0090 | NET NO AUTH LOW CX NO UI | Improper authentication in Azure SQL Database allows an unauthorized attacker to | |
|
80
|
CVE-2026-65801 |
10.0 | 0.0090 | NET NO AUTH LOW CX NO UI | Server-side request forgery (ssrf) in Microsoft Exchange Online allows an unauth | |
|
80
|
CVE-2026-69843 |
10.0 | 0.0090 | NET NO AUTH LOW CX NO UI | Authentication bypass by spoofing in Microsoft Fabric allows an unauthorized att | |
|
80
|
CVE-2026-70352 |
10.0 | 0.0090 | NET NO AUTH LOW CX NO UI | Missing authentication for critical function in Azure AI Language allows an unau | |
|
80
|
CVE-2026-73025 |
9.8 | 0.0090 | NET NO AUTH LOW CX NO UI | Weak authentication in Windows iSCSI allows an unauthorized attacker to bypass a | |
|
80
|
CVE-2026-114278 |
9.8 | 0.0090 | NET NO AUTH LOW CX NO UI | The che-machine-exec service constructs a shell command by concatenating user-co | |
|
79
|
CVE-2026-68770 |
9.3 | 0.0091 | NET NO AUTH LOW CX NO UI | sentence-transformers contains a security control bypass vulnerability that allo | |
|
79
|
CVE-2026-58116 |
9.3 | 0.0090 | NET NO AUTH LOW CX NO UI | LLaMA-Factory through 0.9.5 contains a remote code execution vulnerability that | |
|
78
|
CVE-2026-43947 |
8.9 | 0.0091 | NET NO AUTH LOW CX NO UI | FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Versio | |
|
78
|
CVE-2026-29063 |
8.7 | 0.0090 | NET NO AUTH LOW CX NO UI | Immutable.js provides many Persistent Immutable data structures. Prior to versio | |
|
78
|
CVE-2026-40324 |
9.1 | 0.0090 | NET NO AUTH LOW CX NO UI | Hot Chocolate is an open-source GraphQL server. Prior to versions 12.22.7, 13.9. | |
|
78
|
CVE-2026-5598 |
8.9 | 0.0090 | NET NO AUTH LOW CX NO UI | Covert timing channel vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA | |
|
75
|
CVE-2026-40379 |
7.5 | 0.0091 | NET NO AUTH LOW CX NO UI | Exposure of sensitive information to an unauthorized actor in Azure Entra ID all | |
|
75
|
CVE-2026-18907 |
7.5 | 0.0091 | NET NO AUTH LOW CX NO UI | Path Traversal in Download File Feature in com.talpa.hibrowser 2.23.1.1 on Andro | |
|
69
|
CVE-2026-81376 |
9.6 | 0.0090 | NET NO AUTH LOW CX | Incomplete comparison with missing factors in Visual Studio Code allows an unaut | |
|
68
|
CVE-2026-69628 |
8.8 | 0.0091 | NET LOW CX NO UI | Heap-based buffer overflow in Windows iSCSI allows an authorized attacker to exe | |
|
68
|
CVE-2026-69712 |
8.8 | 0.0091 | NET LOW CX NO UI | Use after free in Windows Key Distribution Center allows an authorized attacker | |
|
68
|
CVE-2026-69729 |
8.8 | 0.0091 | NET LOW CX NO UI | Heap-based buffer overflow in Windows Credential Providers allows an authorized | |
|
68
|
CVE-2026-71336 |
8.8 | 0.0091 | NET LOW CX NO UI | Integer overflow or wraparound in Windows Work Folder Service allows an authoriz | |
|
68
|
CVE-2026-100212 |
8.8 | 0.0091 | NET NO AUTH LOW CX | Use after free in Microsoft Office Excel allows an unauthorized attacker to exec | |
|
68
|
CVE-2026-70343 |
8.8 | 0.0091 | NET NO AUTH LOW CX | Heap-based buffer overflow in Microsoft MPEG-2 Video Extension allows an unautho | |
|
68
|
CVE-2026-70256 |
8.8 | 0.0091 | NET NO AUTH LOW CX | Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized at | |
|
68
|
CVE-2026-70257 |
8.8 | 0.0091 | NET NO AUTH LOW CX | Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized at | |
|
68
|
CVE-2026-70268 |
8.8 | 0.0091 | NET NO AUTH LOW CX | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attac | |
|
68
|
CVE-2026-70282 |
8.8 | 0.0091 | NET NO AUTH LOW CX | Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized at | |
|
68
|
CVE-2026-70287 |
8.8 | 0.0091 | NET NO AUTH LOW CX | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attac | |
|
68
|
CVE-2026-70301 |
8.8 | 0.0091 | NET NO AUTH LOW CX | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attac | |
|
68
|
CVE-2026-70302 |
8.8 | 0.0091 | NET NO AUTH LOW CX | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attac | |
|
68
|
CVE-2026-83778 |
8.8 | 0.0091 | NET NO AUTH LOW CX | Heap-based buffer overflow in Microsoft Internet Messaging API allows an unautho | |
|
68
|
CVE-2026-97756 |
8.8 | 0.0091 | NET NO AUTH LOW CX | Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized atta | |
|
68
|
CVE-2026-27775 |
8.8 | 0.0091 | NET LOW CX NO UI | Gitea 1.25.5 caches a branch-specific write-permission result across multiple re | |
|
68
|
CVE-2026-102870 |
8.8 | 0.0091 | NET NO AUTH LOW CX | Improper control of generation of code ('code injection') in ASP.NET Core allows | |
|
68
|
CVE-2026-108400 |
8.8 | 0.0091 | NET NO AUTH LOW CX | Integer overflow or wraparound in Microsoft Windows Codecs Library allows an una | |
|
68
|
CVE-2026-102857 |
8.8 | 0.0090 | NET NO AUTH LOW CX | Heap-based buffer overflow in Microsoft Office Visio allows an unauthorized atta | |
|
68
|
CVE-2026-96952 |
8.8 | 0.0090 | NET NO AUTH LOW CX | Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unaut | |
|
68
|
CVE-2026-97769 |
8.8 | 0.0090 | NET NO AUTH LOW CX | Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized atta | |
|
68
|
CVE-2026-83891 |
8.8 | 0.0090 | NET NO AUTH LOW CX | Stack-based buffer overflow in Microsoft Office Word allows an unauthorized atta | |
|
68
|
CVE-2026-65690 |
8.7 | 0.0090 | NET LOW CX NO UI | Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepa | |
|
66
|
CVE-2026-22828 |
8.1 | 0.0090 | NET NO AUTH NO UI | A heap-based buffer overflow vulnerability in Fortinet FortiAnalyzer Cloud 7.6.2 | |
|
65
|
CVE-2026-45233 |
7.2 | 0.0090 | NET LOW CX NO UI | HTMLy CMS through 3.1.1 contains a path traversal vulnerability that allows low- | |
|
62
|
CVE-2025-34506 |
8.6 | 0.0091 | NET LOW CX NO UI | WBCE CMS version 1.6.3 and prior contains an authenticated remote code execution | |
|
60
|
CVE-2023-29095 |
7.2 | 0.0090 | NET LOW CX NO UI | Auth. (admin+) SQL Injection (SQLi) vulnerability in David F. Carr RSVPMaker plu |