Hunt List
13,049 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
89
|
CVE-2026-97631 |
9.5 | 0.0063 | NET NO AUTH LOW CX NO UI | 3 PoC | EDK2 contains a vulnerability in BIOS where a user may cause “Out-of-bounds Writ |
|
80
|
CVE-2026-27780 |
9.8 | 0.0064 | NET NO AUTH LOW CX NO UI | Gitea versions before 1.26.0 do not fail closed on bufio.Scanner errors while pr | |
|
80
|
CVE-2026-85928 |
9.8 | 0.0063 | NET NO AUTH LOW CX NO UI | Heap-based buffer overflow in Windows Volume Manager Extension Driver allows an | |
|
80
|
CVE-2026-96864 |
9.8 | 0.0063 | NET NO AUTH LOW CX NO UI | Double free in Microsoft Failover Cluster Virtual Driver allows an unauthorized | |
|
80
|
CVE-2026-88102 |
9.8 | 0.0063 | NET NO AUTH LOW CX NO UI | Use after free in Windows Failover Cluster allows an unauthorized attacker to ex | |
|
79
|
CVE-2026-59705 |
9.3 | 0.0064 | NET NO AUTH LOW CX NO UI | mem0's openmemory/api component contains an unauthenticated access vulnerability | |
|
78
|
CVE-2026-39806 |
8.7 | 0.0064 | NET NO AUTH LOW CX NO UI | Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in mtrudel | |
|
78
|
CVE-2026-49128 |
8.7 | 0.0064 | NET NO AUTH LOW CX NO UI | Music Player Daemon (MPD) before version 0.24.11 contains a path traversal vulne | |
|
78
|
CVE-2026-8805 |
8.7 | 0.0064 | NET NO AUTH LOW CX NO UI | Integer Overflow or Wraparound vulnerability in the EtherNet/IP function of Mits | |
|
78
|
CVE-2026-8806 |
8.7 | 0.0064 | NET NO AUTH LOW CX NO UI | Expected Behavior Violation vulnerability in Mitsubishi Electric MELSEC iQ-F Ser | |
|
78
|
CVE-2026-15308 |
8.7 | 0.0064 | NET NO AUTH LOW CX NO UI | The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-se | |
|
78
|
CVE-2026-56124 |
8.7 | 0.0064 | NET NO AUTH LOW CX NO UI | phpUploader before 2.0.2 contains an unauthenticated information disclosure vuln | |
|
78
|
CVE-2026-44628 |
8.7 | 0.0064 | NET NO AUTH LOW CX NO UI | An unauthenticated attacker can crash the worklist server with a single crafted | |
|
78
|
CVE-2026-24013 |
9.1 | 0.0063 | NET NO AUTH LOW CX NO UI | Authentication Bypass by Spoofing vulnerability in Apache IoTDB. Certain Thrift | |
|
78
|
CVE-2026-112688 |
8.8 | 0.0063 | NET NO AUTH LOW CX | 1 PoC | A memory corruption issue was addressed with improved memory handling. This issu |
|
78
|
CVE-2026-32145 |
8.7 | 0.0063 | NET NO AUTH LOW CX NO UI | Allocation of Resources Without Limits or Throttling vulnerability in gleam-wisp | |
|
78
|
CVE-2026-58375 |
8.7 | 0.0063 | NET NO AUTH LOW CX NO UI | JimuReport through 2.5.0 exposes the POST /jmreport/auto/export endpoint without | |
|
77
|
CVE-2026-64400 |
8.6 | 0.0064 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: ksmbd: prev | |
|
77
|
CVE-2026-34327 |
8.2 | 0.0064 | NET NO AUTH LOW CX NO UI | Externally controlled reference to a resource in another sphere in Microsoft Par | |
|
77
|
CVE-2026-64642 |
8.3 | 0.0063 | NET NO AUTH LOW CX NO UI | Next.js is a React framework for building full-stack web applications. In versio | |
|
75
|
CVE-2026-48619 |
7.5 | 0.0064 | NET NO AUTH LOW CX NO UI | A flaw in Node.js HTTP/2 client allows a server to send an unlimited number of O | |
|
75
|
CVE-2026-57098 |
7.5 | 0.0064 | NET NO AUTH LOW CX NO UI | Improper verification of cryptographic signature in Windows RDP Client allows an | |
|
75
|
CVE-2026-44241 |
7.5 | 0.0064 | NET NO AUTH LOW CX NO UI | Micronaut Framework is a JVM-based full stack Java framework designed for buildi | |
|
75
|
CVE-2026-59725 |
7.5 | 0.0064 | NET NO AUTH LOW CX NO UI | Socket.IO enables bidirectional and low-latency communication for every platform | |
|
75
|
CVE-2026-70646 |
7.5 | 0.0064 | NET NO AUTH LOW CX NO UI | aiosend is a synchronous and asynchronous Crypto Pay API client. Pror to version | |
|
75
|
CVE-2026-39836 |
7.5 | 0.0063 | NET NO AUTH LOW CX NO UI | The Dial and LookupPort functions panic on Windows when provided with an input c | |
|
74
|
CVE-2026-39999 |
7.0 | 0.0063 | NET NO AUTH LOW CX NO UI | Authentication Bypass by Spoofing vulnerability in Apache APISIX. The attacker | |
|
69
|
CVE-2026-8987 |
9.4 | 0.0064 | NET LOW CX NO UI | Autel Maxi Charger Single firmware through V1.03.51 contains a heap-based buffer | |
|
69
|
CVE-2026-34659 |
9.6 | 0.0063 | NET NO AUTH LOW CX | Adobe Connect versions 2025.9.15, 2025.8.157 and earlier are affected by a Deser | |
|
69
|
CVE-2026-66418 |
9.3 | 0.0063 | NET NO AUTH LOW CX | OpenClaw Dashboard v3.0.0 contains a stored cross-site scripting vulnerability t | |
|
68
|
CVE-2026-3821 |
8.8 | 0.0064 | NET LOW CX NO UI | Supermicro (SMC) SMASH services contain an Arbitrary code execution issue in X14 | |
|
68
|
CVE-2026-70431 |
8.8 | 0.0064 | NET LOW CX NO UI | Jenkins Multijob Plugin 669.v9d96a_d9c71b_0 and earlier provides Groovy scriptin | |
|
68
|
CVE-2026-88077 |
8.8 | 0.0064 | NET NO AUTH LOW CX | Integer overflow or wraparound in Microsoft Edge (Chromium-based) allows an unau | |
|
68
|
CVE-2024-58362 |
8.7 | 0.0064 | NET LOW CX NO UI | SurrealDB before 1.5.5 (and 2.0.0-beta before 2.0.0-beta.3) accepts an arbitrary | |
|
68
|
CVE-2026-108427 |
8.8 | 0.0063 | NET NO AUTH LOW CX | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attac | |
|
68
|
CVE-2023-3600 |
8.8 | 0.0063 | NET NO AUTH LOW CX | During the worker lifecycle, a use-after-free condition could have occurred, whi | |
|
68
|
CVE-2026-64960 |
8.7 | 0.0063 | NET LOW CX NO UI | ATutor Gameme module allows users to upload files of any type and extension with | |
|
67
|
CVE-2026-61443 |
8.6 | 0.0064 | NET LOW CX NO UI | PraisonAI before 1.6.78 contains a remote code execution vulnerability in SkillT | |
|
66
|
CVE-2026-25524 |
8.1 | 0.0063 | NET NO AUTH NO UI | Magento Long Term Support (LTS) is an unofficial, community-driven project provi | |
|
64
|
CVE-2026-57520 |
7.1 | 0.0064 | NET LOW CX NO UI | Bitwarden Server before 2026.5.0 contains a privilege escalation vulnerability t | |
|
64
|
CVE-2026-65675 |
7.1 | 0.0064 | NET NO AUTH LOW CX | No cwe for this issue in Visual Studio Code CoPilot Chat Extension allows an una | |
|
64
|
CVE-2026-6257 |
9.2 | 0.0063 | NET LOW CX NO UI | Vvveb CMS before 1.0.8.2 contains a remote code execution vulnerability in its m | |
|
63
|
CVE-2026-10059 |
9.1 | 0.0064 | NET LOW CX NO UI | A flaw was found in the Multicluster Engine for Kubernetes ClusterCurator contro | |
|
63
|
CVE-2026-41167 |
9.1 | 0.0064 | NET LOW CX NO UI | Jellystat is a free and open source Statistics App for Jellyfin. Prior to versio | |
|
63
|
CVE-2026-9827 |
9.1 | 0.0063 | NET LOW CX NO UI | A arbitrary file write vulnerability exists in the boa formUploadFile functional | |
|
62
|
CVE-2024-56839 |
8.6 | 0.0064 | NET LOW CX NO UI | A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.1 | |
|
62
|
CVE-2026-74035 |
8.6 | 0.0063 | NET LOW CX NO UI | Wazuh versions from 4.6.0 before 4.14.8 contain an authentication bypass vulnera | |
|
60
|
CVE-2024-56840 |
7.5 | 0.0064 | NET LOW CX NO UI | A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.1 | |
|
57
|
CVE-2026-70341 |
8.5 | 0.0064 | NET NO UI | Use after free in Microsoft Edge (Chromium-based) allows an authorized attacker | |
|
55
|
CVE-2026-96237 |
7.5 | 0.0064 | NET NO AUTH | Inclusion of functionality from untrusted control sphere in .NET allows an unaut |