Hunt List
12,879 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-63508 |
10.0 | 0.0080 | NET NO AUTH LOW CX NO UI | Missing authentication for critical function in Microsoft Planetary Computer Pro | |
|
80
|
CVE-2026-65667 |
10.0 | 0.0080 | NET NO AUTH LOW CX NO UI | Missing authorization in Microsoft Teams allows an unauthorized attacker to elev | |
|
80
|
CVE-2026-69502 |
10.0 | 0.0080 | NET NO AUTH LOW CX NO UI | Server-side request forgery (ssrf) in Azure SQL Database allows an unauthorized | |
|
80
|
CVE-2026-69555 |
10.0 | 0.0080 | NET NO AUTH LOW CX NO UI | Incorrect authorization in Azure Arc allows an unauthorized attacker to elevate | |
|
80
|
CVE-2026-69865 |
10.0 | 0.0080 | NET NO AUTH LOW CX NO UI | Authorization bypass through user-controlled key in Microsoft Container Registry | |
|
80
|
CVE-2026-83711 |
10.0 | 0.0080 | NET NO AUTH LOW CX NO UI | Authorization bypass through user-controlled key in Microsoft Azure Active Direc | |
|
80
|
CVE-2026-63455 |
9.8 | 0.0080 | NET NO AUTH LOW CX NO UI | Multiple vulnerabilities in the REST API interface of HPE Networking SD-WAN Orch | |
|
80
|
CVE-2026-63456 |
9.8 | 0.0080 | NET NO AUTH LOW CX NO UI | Multiple vulnerabilities in the REST API interface of HPE Networking SD-WAN Orch | |
|
80
|
CVE-2026-17218 |
9.8 | 0.0080 | NET NO AUTH LOW CX NO UI | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to execute arbitrary | |
|
80
|
CVE-2026-16840 |
9.8 | 0.0080 | NET NO AUTH LOW CX NO UI | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to e | |
|
80
|
CVE-2026-16917 |
9.8 | 0.0080 | NET NO AUTH LOW CX NO UI | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to e | |
|
80
|
CVE-2026-16919 |
9.8 | 0.0080 | NET NO AUTH LOW CX NO UI | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to e | |
|
80
|
CVE-2026-17118 |
9.8 | 0.0080 | NET NO AUTH LOW CX NO UI | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to e | |
|
80
|
CVE-2026-17136 |
9.8 | 0.0080 | NET NO AUTH LOW CX NO UI | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to e | |
|
80
|
CVE-2026-17160 |
9.8 | 0.0080 | NET NO AUTH LOW CX NO UI | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to e | |
|
78
|
CVE-2022-51022 |
8.8 | 0.0079 | NET NO AUTH LOW CX NO UI | YiShaAdmin 2.2 through 3.1, fixed in commit 025b062, contains an unauthenticated | |
|
78
|
CVE-2026-41473 |
8.8 | 0.0079 | NET NO AUTH LOW CX NO UI | CyberPanel versions prior to 2.4.5 contain an authentication bypass vulnerabilit | |
|
78
|
CVE-2026-59094 |
8.7 | 0.0079 | NET NO AUTH LOW CX NO UI | Pathway through 0.31.1, fixed in commit d09722e, document store applies a caller | |
|
78
|
CVE-2026-60108 |
8.7 | 0.0079 | NET NO AUTH LOW CX NO UI | Zeek before 8.0.9 contains an uncontrolled memory consumption vulnerability in t | |
|
75
|
CVE-2026-50273 |
7.5 | 0.0079 | NET NO AUTH LOW CX NO UI | Datadog .NET Tracer is a client library for Datadog APM for .NET applications. P | |
|
75
|
CVE-2026-50271 |
7.5 | 0.0079 | NET NO AUTH LOW CX NO UI | Datadog dd-trace-py is the Datadog Python APM client. Prior to 4.8.2, Datadog tr | |
|
75
|
CVE-2026-50272 |
7.5 | 0.0079 | NET NO AUTH LOW CX NO UI | dd-trace is the Datadog APM client for Node.js. Prior to 5.100.0, W3C baggage pr | |
|
75
|
CVE-2026-50274 |
7.5 | 0.0079 | NET NO AUTH LOW CX NO UI | Datadog dd-trace-go is a Go client library for Datadog application performance m | |
|
70
|
CVE-2026-34048 |
9.9 | 0.0080 | NET LOW CX NO UI | Coolify is an open-source and self-hostable tool for managing servers, applicati | |
|
70
|
CVE-2026-15068 |
9.9 | 0.0079 | NET LOW CX NO UI | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 NIM could allow a remote authentic | |
|
70
|
CVE-2026-16816 |
9.9 | 0.0079 | NET LOW CX NO UI | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote authenticated | |
|
70
|
CVE-2026-18835 |
9.9 | 0.0079 | NET LOW CX NO UI | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote authenticated | |
|
69
|
CVE-2026-64878 |
9.4 | 0.0080 | NET LOW CX NO UI | Unvalidated input in asset filter parameters allows shell metacharacters to esca | |
|
68
|
CVE-2026-69521 |
8.8 | 0.0080 | NET NO AUTH LOW CX | Integer overflow or wraparound in Windows iSCSI allows an unauthorized attacker | |
|
68
|
CVE-2026-69765 |
8.8 | 0.0080 | NET NO AUTH LOW CX | Use after free in Windows Storport Miniport Driver allows an unauthorized attack | |
|
68
|
CVE-2026-69985 |
8.8 | 0.0080 | NET NO AUTH LOW CX | Heap-based buffer overflow in Windows Libarchive allows an unauthorized attacker | |
|
68
|
CVE-2026-62895 |
8.8 | 0.0080 | NET NO AUTH LOW CX | Permissive cross-domain policy with untrusted domains in Azure Arc allows an una | |
|
68
|
CVE-2026-119713 |
8.7 | 0.0080 | NET LOW CX NO UI | Paperclip 2026.403.0 before 2026.416.0 contains a remote code execution vulnerab | |
|
68
|
CVE-2026-17623 |
8.8 | 0.0079 | NET LOW CX NO UI | IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote authenticated attacke | |
|
68
|
CVE-2026-16906 |
8.8 | 0.0079 | NET LOW CX NO UI | IBM i 7.6, and 7.5 could allow a remote authenticated attacker to execute arbitr | |
|
68
|
CVE-2026-17417 |
8.8 | 0.0079 | NET LOW CX NO UI | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to exec | |
|
68
|
CVE-2026-17642 |
8.8 | 0.0079 | NET LOW CX NO UI | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to exec | |
|
68
|
CVE-2026-57087 |
8.8 | 0.0079 | NET NO AUTH LOW CX | Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unaut | |
|
68
|
CVE-2026-15484 |
8.7 | 0.0079 | NET LOW CX NO UI | A vulnerability was detected in TRENDnet TEW-821DAP 1.12B01. The affected elemen | |
|
68
|
CVE-2026-16097 |
8.7 | 0.0079 | NET LOW CX NO UI | A vulnerability was found in Shibby Tomato 1.28. This vulnerability affects the | |
|
67
|
CVE-2026-76003 |
8.6 | 0.0079 | NET LOW CX NO UI | A weakness has been identified in UTT HiPER 1200GW up to 2.5.3-170306. Affected | |
|
67
|
CVE-2026-76004 |
8.6 | 0.0079 | NET LOW CX NO UI | A security vulnerability has been detected in UTT HiPER 1250GW up to 3.2.7-21090 | |
|
66
|
CVE-2026-70340 |
8.1 | 0.0080 | NET LOW CX NO UI | Missing authorization in Azure CycleCloud allows an authorized attacker to eleva | |
|
66
|
CVE-2026-85888 |
7.7 | 0.0080 | NET LOW CX NO UI | Out-of-bounds read in SQL Server allows an authorized attacker to disclose infor | |
|
66
|
CVE-2026-88081 |
7.7 | 0.0080 | NET LOW CX NO UI | Out-of-bounds read in SQL Server allows an authorized attacker to disclose infor | |
|
66
|
CVE-2026-49164 |
8.1 | 0.0079 | NET NO AUTH NO UI | Heap-based buffer overflow in Active Directory Domain Services allows an unautho | |
|
66
|
CVE-2026-50439 |
8.1 | 0.0079 | NET NO AUTH NO UI | Use after free in Microsoft Message Queuing Queue Manager allows an unauthorized | |
|
66
|
CVE-2026-50487 |
8.1 | 0.0079 | NET NO AUTH NO UI | Use after free in Microsoft Windows DNS allows an unauthorized attacker to eleva | |
|
66
|
CVE-2026-50694 |
8.1 | 0.0079 | NET NO AUTH NO UI | Use after free in Windows Secure Socket Tunneling Protocol (SSTP) allows an unau | |
|
64
|
CVE-2026-114720 |
7.1 | 0.0079 | NET LOW CX NO UI | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an IMAP co |