Hunt List
12,881 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-64606 |
9.8 | 0.0078 | NET NO AUTH LOW CX NO UI | Deserialization of untrusted data vulnerability that may allow class-registratio | |
|
80
|
CVE-2026-67282 |
10.0 | 0.0078 | NET NO AUTH LOW CX NO UI | Joomla Extension - fabrikar.com - Unauthenticated remote code execution in Fabri | |
|
80
|
CVE-2026-63887 |
9.8 | 0.0078 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: scsi: targe | |
|
80
|
CVE-2026-63888 |
9.8 | 0.0078 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: scsi: targe | |
|
79
|
CVE-2026-63382 |
9.2 | 0.0078 | NET NO AUTH LOW CX NO UI | Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, the | |
|
78
|
CVE-2026-66729 |
8.7 | 0.0078 | NET NO AUTH LOW CX NO UI | facil.io 0.6.0 through 0.7.6 contains an integer underflow vulnerability in the | |
|
78
|
CVE-2026-66730 |
8.7 | 0.0078 | NET NO AUTH LOW CX NO UI | facil.io 0.6.0 through 0.7.6 contains a denial-of-service vulnerability in the m | |
|
78
|
CVE-2026-66731 |
8.7 | 0.0078 | NET NO AUTH LOW CX NO UI | facil.io 0.7.5 through 0.7.6 contains a denial-of-service vulnerability in the H | |
|
78
|
CVE-2026-18140 |
8.7 | 0.0078 | NET NO AUTH LOW CX NO UI | Uncontrolled recursion in the unknown-key skip path of the aws-smithy-json runti | |
|
78
|
CVE-2026-50234 |
8.7 | 0.0078 | NET NO AUTH LOW CX NO UI | Lyrion Music Server 9.2.0 contains a path traversal vulnerability that allows un | |
|
78
|
CVE-2026-69223 |
9.1 | 0.0078 | NET NO AUTH LOW CX NO UI | Apache Allura's webhooks are vulnerable to Server-Side Request Forgery (SSRF). | |
|
78
|
CVE-2026-47301 |
8.8 | 0.0078 | NET LOW CX NO UI | 1 PoC | Improper access control in Microsoft Configuration Manager allows an authorized |
|
78
|
CVE-2026-54121 |
8.8 | 0.0078 | NET LOW CX NO UI | 16 PoC | Improper authorization in Active Directory Certificate Services (AD CS) allows a |
|
77
|
CVE-2026-59250 |
8.3 | 0.0078 | NET NO AUTH LOW CX NO UI | Classic buffer overflow in the Erlang/OTP megaco flex scanner C driver allows a | |
|
75
|
CVE-2026-39820 |
7.5 | 0.0078 | NET NO AUTH LOW CX NO UI | Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were | |
|
75
|
CVE-2026-67432 |
7.5 | 0.0078 | NET NO AUTH LOW CX NO UI | MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and cli | |
|
75
|
CVE-2026-11595 |
7.5 | 0.0078 | NET NO AUTH LOW CX NO UI | IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to o | |
|
75
|
CVE-2026-54399 |
7.5 | 0.0078 | NET NO AUTH LOW CX NO UI | Uncontrolled Resource Consumption vulnerability in the HTTP/1.1 message parser i | |
|
75
|
CVE-2026-67260 |
7.3 | 0.0078 | NET NO AUTH LOW CX NO UI | Apache Airflow 3.3.0 moved human-in-the-loop tasks from the triggerer to a new ` | |
|
70
|
CVE-2026-47647 |
9.9 | 0.0078 | NET LOW CX NO UI | Improper access control in Microsoft Dynamics 365 allows an authorized attacker | |
|
70
|
CVE-2026-45499 |
9.9 | 0.0078 | NET LOW CX NO UI | Server-side request forgery (ssrf) in Azure OpenAI allows an authorized attacker | |
|
70
|
CVE-2026-57100 |
9.9 | 0.0078 | NET LOW CX NO UI | Server-side request forgery (ssrf) in Microsoft Entra Provisioning Service (Sync | |
|
70
|
CVE-2026-62830 |
9.9 | 0.0078 | NET LOW CX NO UI | Missing authorization in Azure SRE Agent allows an authorized attacker to elevat | |
|
70
|
CVE-2026-69851 |
9.9 | 0.0078 | NET LOW CX NO UI | Server-side request forgery (ssrf) in Azure Active Directory allows an authorize | |
|
70
|
CVE-2026-83941 |
9.9 | 0.0078 | NET LOW CX NO UI | Missing authorization in Entra ID allows an authorized attacker to elevate privi | |
|
70
|
CVE-2026-85878 |
9.9 | 0.0078 | NET LOW CX NO UI | Improper authorization in Azure Database for PostgreSQL allows an authorized att | |
|
69
|
CVE-2026-48519 |
9.6 | 0.0078 | NET NO AUTH LOW CX | Langflow is a tool for building and deploying AI-powered agents and workflows. P | |
|
68
|
CVE-2025-10533 |
8.8 | 0.0078 | NET LOW CX NO UI | Integer overflow in the SVG component. This vulnerability was fixed in Firefox 1 | |
|
68
|
CVE-2026-32157 |
8.8 | 0.0078 | NET NO AUTH LOW CX | Use after free in Remote Desktop Client allows an unauthorized attacker to execu | |
|
68
|
CVE-2026-54998 |
8.8 | 0.0078 | NET LOW CX NO UI | Incorrect authorization in Microsoft Exchange Online allows an authorized attack | |
|
68
|
CVE-2026-57969 |
8.8 | 0.0078 | NET LOW CX NO UI | Missing authentication for critical function in Azure CycleCloud allows an autho | |
|
68
|
CVE-2026-47300 |
8.8 | 0.0078 | NET LOW CX NO UI | Incorrect implementation of authentication algorithm in ASP.NET Core allows an a | |
|
68
|
CVE-2026-65668 |
8.8 | 0.0078 | NET LOW CX NO UI | Improper access control in Microsoft Purview eDiscovery allows an authorized att | |
|
68
|
CVE-2026-70326 |
8.8 | 0.0078 | NET LOW CX NO UI | Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an auth | |
|
68
|
CVE-2026-62872 |
8.8 | 0.0078 | NET LOW CX NO UI | Incorrect authorization in .NET Framework allows an authorized attacker to eleva | |
|
68
|
CVE-2026-50360 |
8.8 | 0.0078 | NET LOW CX NO UI | Incorrect implementation of authentication algorithm in Windows SMB Server allow | |
|
68
|
CVE-2026-50444 |
8.8 | 0.0078 | NET LOW CX NO UI | Missing authentication for critical function in Windows Server Update Service al | |
|
68
|
CVE-2026-69465 |
8.8 | 0.0078 | NET LOW CX NO UI | Missing authorization in Microsoft Office SharePoint allows an authorized attack | |
|
68
|
CVE-2026-73028 |
8.8 | 0.0078 | NET LOW CX NO UI | Improper access control in SQL Server allows an authorized attacker to elevate p | |
|
68
|
CVE-2026-77480 |
8.8 | 0.0078 | NET LOW CX NO UI | Insufficient granularity of access control in SQL Server allows an authorized at | |
|
68
|
CVE-2026-77483 |
8.8 | 0.0078 | NET LOW CX NO UI | Weak authentication in SQL Server allows an authorized attacker to elevate privi | |
|
68
|
CVE-2026-77487 |
8.8 | 0.0078 | NET LOW CX NO UI | Improper access control in SQL Server allows an authorized attacker to elevate p | |
|
68
|
CVE-2026-66814 |
8.8 | 0.0078 | NET LOW CX NO UI | Insufficient granularity of access control in SQL Server allows an authorized at | |
|
68
|
CVE-2026-66818 |
8.8 | 0.0078 | NET LOW CX NO UI | Improper privilege management in SQL Server allows an authorized attacker to ele | |
|
66
|
CVE-2026-88185 |
8.1 | 0.0078 | NET NO AUTH NO UI | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attac | |
|
66
|
CVE-2026-70187 |
8.1 | 0.0078 | NET NO AUTH NO UI | Use after free in Remote Desktop Gateway Service allows an unauthorized attacker | |
|
66
|
CVE-2026-13308 |
8.1 | 0.0078 | NET NO AUTH NO UI | Autel MaxiCharger AC Elite Home WebSockets Integer Underflow Remote Code Executi | |
|
65
|
CVE-2026-5984 |
7.4 | 0.0078 | NET LOW CX NO UI | A vulnerability was identified in D-Link DIR-605L 2.13B01. Impacted is the funct | |
|
63
|
CVE-2026-48024 |
9.1 | 0.0078 | NET LOW CX NO UI | Wazuh is a free and open source platform used for threat prevention, detection, | |
|
55
|
CVE-2026-70355 |
7.3 | 0.0078 | NET LOW CX | Improper neutralization of input during web page generation ('cross-site scripti |