Hunt List
13,139 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-5443 |
9.8 | 0.0057 | NET NO AUTH LOW CX NO UI | A heap buffer overflow vulnerability exists during the decoding of `PALETTE COLO | |
|
80
|
CVE-2026-16361 |
9.8 | 0.0057 | NET NO AUTH LOW CX NO UI | Memory safety bugs present in Thunderbird ESR 140.12. Some of these bugs showed | |
|
80
|
CVE-2026-16368 |
9.8 | 0.0057 | NET NO AUTH LOW CX NO UI | Incorrect boundary conditions in the JavaScript: WebAssembly component. This vul | |
|
80
|
CVE-2026-74989 |
9.8 | 0.0057 | NET NO AUTH LOW CX NO UI | Internally found bugs present in Firefox 153. Some of these bugs showed evidence | |
|
78
|
CVE-2026-40525 |
9.1 | 0.0057 | NET NO AUTH LOW CX NO UI | OpenViking prior to version 0.3.9 contains an authentication bypass vulnerabilit | |
|
78
|
CVE-2026-70461 |
8.8 | 0.0057 | NET NO AUTH LOW CX NO UI | rsync 3.2.5 before 3.5.0 contains a heap out-of-bounds write vulnerability that | |
|
78
|
CVE-2026-6947 |
8.7 | 0.0057 | NET NO AUTH LOW CX NO UI | DWM-222W USB Wi-Fi Adapter developed by D-Link has a Brute-Force Protection Bypa | |
|
78
|
CVE-2026-54722 |
8.7 | 0.0057 | NET NO AUTH LOW CX NO UI | DSSRF is a Node.js library that provides a wide range of utilities and advanced | |
|
77
|
CVE-2026-13577 |
8.2 | 0.0057 | NET NO AUTH LOW CX NO UI | Dancer2 versions before 2.2.0 for Perl generate insecure session ids when requir | |
|
75
|
CVE-2026-58064 |
7.5 | 0.0057 | NET NO AUTH LOW CX NO UI | The Redis protocol implementation in Apache bRPC allowed inline command parsing | |
|
75
|
CVE-2026-61916 |
7.5 | 0.0057 | NET NO AUTH LOW CX NO UI | Out-of-bounds reads in URL parsing and case-insensitive header lookup in Apache | |
|
75
|
CVE-2026-74755 |
7.5 | 0.0057 | NET NO AUTH LOW CX NO UI | An integer underflow in the mcpack2pb component of Apache bRPC (version < 1.18.0 | |
|
75
|
CVE-2026-80463 |
7.5 | 0.0057 | NET NO AUTH LOW CX NO UI | Unbounded memory accumulation in the stream message reassembly path of Apache bR | |
|
68
|
CVE-2026-81352 |
8.8 | 0.0057 | NET NO AUTH LOW CX | Heap-based buffer overflow in Microsoft Windows Codecs Library allows an unautho | |
|
68
|
CVE-2026-42359 |
8.8 | 0.0057 | NET LOW CX NO UI | A bug in Apache Airflow's XCom PATCH endpoint `PATCH /api/v2/xcomEntries/{key}` | |
|
68
|
CVE-2026-16420 |
8.8 | 0.0057 | NET NO AUTH LOW CX | Type Confusion in WebAudio in Google Chrome prior to 150.0.7871.182 allowed a re | |
|
68
|
CVE-2026-15483 |
8.7 | 0.0057 | NET LOW CX NO UI | A security vulnerability has been detected in TRENDnet TEW-821DAP 1.12B01. Impac | |
|
67
|
CVE-2026-49248 |
8.3 | 0.0057 | NET LOW CX NO UI | OneDev is a Git server with CI/CD, kanban, and packages. In versions 15.0.6 and | |
|
65
|
CVE-2026-95508 |
7.4 | 0.0057 | NET NO AUTH NO UI | A heap-based buffer overflow was found in the DHCPv6 and TFTP response builders | |
|
64
|
CVE-2026-14904 |
7.1 | 0.0057 | NET LOW CX NO UI | AWS Research and Engineering Studio (RES) is an open-source solution that enable | |
|
64
|
CVE-2026-18192 |
7.1 | 0.0057 | NET LOW CX NO UI | VIN-DS783E-E6 developed by Vacron has an Arbitrary File Read vulnerability, allo | |
|
60
|
CVE-2026-66015 |
7.2 | 0.0057 | NET LOW CX NO UI | An authenticated privilege-escalation vulnerability in JFrog Platform may be exp | |
|
55
|
CVE-2026-96280 |
7.5 | 0.0057 | NET NO AUTH | The OCI delta stream parser read sizes as guint64 but passed them to GLib I/O an | |
|
54
|
CVE-2026-69451 |
7.1 | 0.0057 | NET | 1 PoC | Use after free in Windows Management Instrumentation allows an authorized attack |
|
44
|
CVE-2026-69340 |
7.1 | 0.0057 | NET | Heap-based buffer overflow in Windows NTFS allows an authorized attacker to elev | |
|
44
|
CVE-2026-69357 |
7.1 | 0.0057 | NET | Use after free in Windows NDIS allows an authorized attacker to elevate privileg | |
|
44
|
CVE-2026-69358 |
7.1 | 0.0057 | NET | Use of uninitialized resource in Remote Desktop Client allows an authorized atta | |
|
44
|
CVE-2026-69396 |
7.1 | 0.0057 | NET | Use after free in Windows NDIS allows an authorized attacker to elevate privileg | |
|
44
|
CVE-2026-69460 |
7.1 | 0.0057 | NET | Use after free in Windows Modern Device Management (MDM) allows an authorized at | |
|
44
|
CVE-2026-69536 |
7.1 | 0.0057 | NET | Use after free in Windows Remote Desktop Services allows an authorized attacker | |
|
44
|
CVE-2026-69597 |
7.1 | 0.0057 | NET | Use after free in Windows HTTP.sys allows an authorized attacker to elevate priv | |
|
44
|
CVE-2026-69602 |
7.1 | 0.0057 | NET | Use after free in Windows PrintWorkflowUserSvc allows an authorized attacker to | |
|
44
|
CVE-2026-69688 |
7.1 | 0.0057 | NET | Heap-based buffer overflow in Windows Encrypting File System (EFS) allows an aut | |
|
44
|
CVE-2026-69706 |
7.1 | 0.0057 | NET | Use after free in Windows Win32K allows an authorized attacker to elevate privil | |
|
44
|
CVE-2026-69761 |
7.1 | 0.0057 | NET | Use after free in Windows TCP/IP allows an authorized attacker to elevate privil | |
|
44
|
CVE-2026-68835 |
7.1 | 0.0057 | NET | Use after free in Windows Print Spooler Components allows an authorized attacker | |
|
44
|
CVE-2026-68846 |
7.1 | 0.0057 | NET | Use after free in Windows Kernel allows an authorized attacker to elevate privil | |
|
44
|
CVE-2026-68889 |
7.1 | 0.0057 | NET | Heap-based buffer overflow in Microsoft Standard XPS allows an authorized attack | |
|
44
|
CVE-2026-68893 |
7.1 | 0.0057 | NET | Use after free in Windows Remote Desktop Licensing Service allows an authorized | |
|
44
|
CVE-2026-69272 |
7.1 | 0.0057 | NET | Heap-based buffer overflow in Microsoft Standard XPS allows an authorized attack | |
|
44
|
CVE-2026-69274 |
7.1 | 0.0057 | NET | Use after free in Windows Win32K allows an authorized attacker to elevate privil | |
|
44
|
CVE-2026-69296 |
7.1 | 0.0057 | NET | Use after free in Windows Device Association Service allows an authorized attack | |
|
44
|
CVE-2026-69305 |
7.1 | 0.0057 | NET | Use after free in Microsoft Windows Search Component allows an authorized attack | |
|
44
|
CVE-2026-69313 |
7.1 | 0.0057 | NET | Heap-based buffer overflow in Microsoft Standard XPS allows an authorized attack | |
|
44
|
CVE-2026-69314 |
7.1 | 0.0057 | NET | Use after free in Windows Device Association Broker service allows an authorized | |
|
44
|
CVE-2026-69336 |
7.1 | 0.0057 | NET | Heap-based buffer overflow in Microsoft Standard XPS allows an authorized attack | |
|
44
|
CVE-2026-69337 |
7.1 | 0.0057 | NET | Double free in Windows Registry allows an authorized attacker to elevate privile | |
|
44
|
CVE-2026-69338 |
7.1 | 0.0057 | NET | Use after free in Remote Desktop Gateway Service allows an authorized attacker t | |
|
44
|
CVE-2026-69366 |
7.1 | 0.0057 | NET | Use after free in Windows Kernel allows an authorized attacker to elevate privil | |
|
44
|
CVE-2026-69757 |
7.1 | 0.0057 | NET | Use after free in Windows TCP/IP allows an authorized attacker to elevate privil |