Hunt List
12,861 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-84015 |
9.8 | 0.0087 | NET NO AUTH LOW CX NO UI | Heap-based buffer overflow in Remote Access Point-to-Point Protocol (PPP) EAP-TL | |
|
80
|
CVE-2026-8505 |
9.8 | 0.0087 | NET NO AUTH LOW CX NO UI | IBM Langflow OSS 1.0.0 through 1.10.0 has a vulnerability in Langflow's webhook | |
|
80
|
CVE-2026-96113 |
9.8 | 0.0087 | NET NO AUTH LOW CX NO UI | Heap-based buffer overflow in DNS Server allows an unauthorized attacker to exec | |
|
80
|
CVE-2026-97815 |
9.8 | 0.0087 | NET NO AUTH LOW CX NO UI | Heap-based buffer overflow in Windows Error Reporting allows an unauthorized att | |
|
80
|
CVE-2026-38165 |
9.8 | 0.0087 | NET NO AUTH LOW CX NO UI | A Server-Side Template Injection (SSTI) vulnerability in the Velocity template e | |
|
80
|
CVE-2026-58630 |
10.0 | 0.0086 | NET NO AUTH LOW CX NO UI | Improper access control in Azure App Service allows an unauthorized attacker to | |
|
79
|
CVE-2026-54733 |
9.3 | 0.0088 | NET NO AUTH LOW CX NO UI | The Microsoft 365 and Microsoft Entra ID Plugins for Moodle provide Office 365 a | |
|
79
|
CVE-2026-53805 |
9.3 | 0.0087 | NET NO AUTH LOW CX NO UI | NVIDIA Spatial Intelligence Lab's (SIL) GEN3C contains an unauthenticated remote | |
|
79
|
CVE-2026-65687 |
9.3 | 0.0087 | NET NO AUTH LOW CX NO UI | Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepa | |
|
79
|
CVE-2026-65688 |
9.3 | 0.0087 | NET NO AUTH LOW CX NO UI | Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepa | |
|
79
|
CVE-2026-65689 |
9.3 | 0.0087 | NET NO AUTH LOW CX NO UI | Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepa | |
|
78
|
CVE-2026-62916 |
9.1 | 0.0086 | NET NO AUTH LOW CX NO UI | Authentication bypass using an alternate path or channel in Microsoft Entra ID a | |
|
75
|
CVE-2022-31810 |
7.5 | 0.0088 | NET NO AUTH LOW CX NO UI | A vulnerability has been identified in SiPass integrated (All versions < V2.90.3 | |
|
75
|
CVE-2026-97788 |
7.5 | 0.0088 | NET NO AUTH LOW CX NO UI | Observable discrepancy in Active Directory Federation Services (AD FS) allows an | |
|
75
|
CVE-2026-33811 |
7.5 | 0.0088 | NET NO AUTH LOW CX NO UI | When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can | |
|
75
|
CVE-2026-48399 |
7.5 | 0.0087 | NET NO AUTH LOW CX NO UI | Adobe Campaign Classic (ACC) is affected by a Violation of Secure Design Princip | |
|
75
|
CVE-2026-54428 |
7.5 | 0.0087 | NET NO AUTH LOW CX NO UI | Allocation of resources without limits or throttling in the HTTP/2 HPACK decoder | |
|
75
|
CVE-2026-8023 |
7.5 | 0.0087 | NET NO AUTH LOW CX NO UI | Zephyr's HTTP server (subsys/net/lib/http) provides a static-filesystem resource | |
|
75
|
CVE-2023-2829 |
7.5 | 0.0087 | NET NO AUTH LOW CX NO UI | A `named` instance configured to run as a DNSSEC-validating recursive resolver w | |
|
75
|
CVE-2023-35920 |
7.5 | 0.0087 | NET NO AUTH LOW CX NO UI | A vulnerability has been identified in SIMATIC MV540 H (All versions < V3.3.4), | |
|
75
|
CVE-2023-35921 |
7.5 | 0.0087 | NET NO AUTH LOW CX NO UI | A vulnerability has been identified in SIMATIC MV540 H (All versions < V3.3.4), | |
|
70
|
CVE-2026-63294 |
9.9 | 0.0088 | NET LOW CX NO UI | A link following vulnerability in LXD allows an attacker to achieve root command | |
|
70
|
CVE-2026-8481 |
9.9 | 0.0088 | NET LOW CX NO UI | IBM Langflow OSS 1.0.0 through 1.10.0 contain a critical remote code execution v | |
|
70
|
CVE-2026-73268 |
9.9 | 0.0088 | NET LOW CX NO UI | A flaw was found in the cluster-curator-controller component of multicluster eng | |
|
69
|
CVE-2026-106629 |
9.3 | 0.0087 | NET NO AUTH LOW CX | Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vuln | |
|
69
|
CVE-2026-106630 |
9.3 | 0.0087 | NET NO AUTH LOW CX | Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vuln | |
|
69
|
CVE-2026-8043 |
9.6 | 0.0087 | NET LOW CX NO UI | External control of a file name in Ivanti Xtraction before version 2026.2 allows | |
|
69
|
CVE-2026-113380 |
9.3 | 0.0087 | NET NO AUTH LOW CX | In the RingRTC library before 2.72.0 for Signal, a peer that saturates a call's | |
|
68
|
CVE-2026-72767 |
8.7 | 0.0088 | NET LOW CX NO UI | n8n before 1.123.67, 2.x before 2.31.5, and 2.32.x before 2.32.1 contain a remot | |
|
68
|
CVE-2026-85169 |
8.7 | 0.0088 | NET LOW CX NO UI | n8n versions before 1.123.73, 2.35.4, and 2.36.2 contain an expression sandbox e | |
|
68
|
CVE-2026-105717 |
8.8 | 0.0088 | NET NO AUTH LOW CX | Heap-based buffer overflow in Microsoft Office Access allows an unauthorized att | |
|
68
|
CVE-2026-69370 |
8.8 | 0.0088 | NET NO AUTH LOW CX | Improper neutralization of special elements used in a command ('command injectio | |
|
68
|
CVE-2026-17632 |
8.8 | 0.0088 | NET LOW CX NO UI | IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote authenticated attacke | |
|
68
|
CVE-2026-59260 |
8.7 | 0.0088 | NET LOW CX NO UI | OpenWrt luci-app-samba4 read ACL grants file.exec permission on /usr/sbin/smbd, | |
|
68
|
CVE-2026-17603 |
8.7 | 0.0087 | NET LOW CX NO UI | Nexus Repository 3 did not sufficiently restrict which HikariCP connection-pool | |
|
68
|
CVE-2026-77910 |
8.8 | 0.0087 | NET LOW CX NO UI | Incorrect authorization in Microsoft Exchange Server allows an authorized attack | |
|
68
|
CVE-2026-70246 |
8.8 | 0.0086 | NET LOW CX NO UI | Incorrect authorization in Microsoft Office SharePoint allows an authorized atta | |
|
65
|
CVE-2026-57993 |
7.4 | 0.0088 | NET NO AUTH LOW CX | Server-side request forgery (ssrf) in Microsoft Edge (Chromium-based) allows an | |
|
65
|
CVE-2026-58612 |
7.4 | 0.0087 | NET NO AUTH LOW CX | Server-side request forgery (ssrf) in Microsoft PowerShell Core allows an unauth | |
|
64
|
CVE-2026-56623 |
7.1 | 0.0087 | NET LOW CX NO UI | Path traversal on Windows in Apache MINA SSHD component sshd-git. Apache MINA SS | |
|
63
|
CVE-2026-40484 |
9.1 | 0.0087 | NET LOW CX NO UI | ChurchCRM is an open-source church management system. In versions prior to 7.2.0 | |
|
62
|
CVE-2026-104082 |
8.6 | 0.0087 | NET LOW CX NO UI | SmarterMail before build 9777 contains a remote code execution vulnerability tha | |
|
60
|
CVE-2026-16521 |
7.2 | 0.0088 | NET LOW CX NO UI | An OS command injection vulnerability exists because of insufficient input filte | |
|
60
|
CVE-2026-49506 |
7.2 | 0.0087 | NET LOW CX NO UI | Dell Wyse Management Suite, versions prior to WMS 5.5 HF1, contain an Improper L | |
|
60
|
CVE-2026-63454 |
7.2 | 0.0087 | NET LOW CX NO UI | An authenticated path traversal vulnerability exists in AOS-CX. Successful explo | |
|
60
|
CVE-2026-85798 |
7.2 | 0.0087 | NET LOW CX NO UI | Heap-based buffer overflow in Windows Distributed File System (DFS) allows an au | |
|
57
|
CVE-2023-3932 |
8.2 | 0.0088 | NET NO UI | An issue has been discovered in GitLab EE affecting all versions starting from 1 | |
|
56
|
CVE-2026-69807 |
8.0 | 0.0087 | NET LOW CX | Improper limitation of a pathname to a restricted directory ('path traversal') i | |
|
55
|
CVE-2026-57200 |
7.5 | 0.0088 | NET NO UI | Asterisk is an open source private branch exchange and telephony toolkit. Prior | |
|
49
|
CVE-2026-4622 |
7.1 | 0.0088 | NET LOW CX | OS Command Injection vulnerability in NEC Platforms, Ltd. Aterm Series allows a |