Hunt List
12,786 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-40114 |
10.0 | 0.0024 | NET NO AUTH LOW CX NO UI | PraisonAI is a multi-agent teams system. Prior to 4.5.128, the /api/v1/runs endp | |
|
79
|
CVE-2026-42755 |
9.3 | 0.0024 | NET NO AUTH LOW CX NO UI | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti | |
|
79
|
CVE-2026-115607 |
9.3 | 0.0024 | NET NO AUTH LOW CX NO UI | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti | |
|
79
|
CVE-2026-93291 |
9.3 | 0.0024 | NET NO AUTH LOW CX NO UI | Omni C20 lacks proper certificate validation which could allow an attacker to pe | |
|
78
|
CVE-2026-64993 |
9.1 | 0.0024 | NET NO AUTH LOW CX NO UI | Dell RVTools versions prior to 4.8.1, contains an improper certificate validatio | |
|
78
|
CVE-2026-115216 |
9.1 | 0.0024 | NET NO AUTH LOW CX NO UI | In Eclipse ioFog Operator versions 3.8.0 before 3.9.2, TLS certificate verificat | |
|
78
|
CVE-2026-105210 |
8.8 | 0.0024 | NET NO AUTH LOW CX NO UI | ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains a missing authenticatio | |
|
77
|
CVE-2026-91534 |
8.6 | 0.0024 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Business Intelligence Enterprise Edition product of | |
|
76
|
CVE-2026-107325 |
8.2 | 0.0024 | NET NO AUTH LOW CX NO UI | Improper validation of a BSON array length in the MongoDB Go Driver can cause an | |
|
76
|
CVE-2026-111814 |
7.8 | 0.0024 | NET NO AUTH LOW CX NO UI | Apache Traffic Server's default outbound session-sharing policy can reuse a pool | |
|
76
|
CVE-2026-111815 |
7.8 | 0.0024 | NET NO AUTH LOW CX NO UI | Apache Traffic Server can resume a TLS session across SNI virtual hosts without | |
|
75
|
CVE-2026-94266 |
7.5 | 0.0024 | NET NO AUTH LOW CX NO UI | libcurl could accidentally return a URL for `curl_easy_getinfo()`'s `CURLINFO_EF | |
|
75
|
CVE-2026-105765 |
7.5 | 0.0024 | NET NO AUTH LOW CX NO UI | HashiCorp Consul and Consul Enterprise 1.17.0 up to 2.0.4 are vulnerable to an a | |
|
75
|
CVE-2026-40394 |
7.5 | 0.0024 | NET NO AUTH LOW CX NO UI | Varnish Cache 9 before 9.0.1 and Varnish Enterprise before 6.0.16r11 allows a "w | |
|
75
|
CVE-2026-40395 |
7.5 | 0.0024 | NET NO AUTH LOW CX NO UI | Varnish Enterprise before 6.0.16r12 allows a "workspace overflow" denial of serv | |
|
75
|
CVE-2026-49110 |
7.5 | 0.0024 | NET NO AUTH LOW CX NO UI | Unauthenticated Broken Authentication in Upsell Order Bump Offer for WooCommerce | |
|
75
|
CVE-2026-54810 |
7.5 | 0.0024 | NET NO AUTH LOW CX NO UI | Missing Authorization vulnerability in Nexi Payments Nexi XPay allows Exploiting | |
|
74
|
CVE-2026-109995 |
7.2 | 0.0024 | NET NO AUTH LOW CX NO UI | The Advanced Views – Display Framework for Gutenberg & Elementor plugin for Word | |
|
74
|
CVE-2026-97019 |
7.2 | 0.0024 | NET NO AUTH LOW CX NO UI | The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to | |
|
74
|
CVE-2026-96741 |
7.2 | 0.0024 | NET NO AUTH LOW CX NO UI | The DSGVO All in one for WP plugin for WordPress is vulnerable to Stored Cross-S | |
|
68
|
CVE-2026-45831 |
8.8 | 0.0024 | NET LOW CX NO UI | The SimpleRBACAuthorizationProvider authorization provider in versions 0.5.0 or | |
|
68
|
CVE-2026-117574 |
9.1 | 0.0024 | NET LOW CX NO UI | A flaw was found in ai-gateway-payload-processing. An authenticated remote attac | |
|
68
|
CVE-2026-119262 |
8.8 | 0.0024 | NET NO AUTH LOW CX | Improper input validation in V8 in Google Chrome prior to 156.0.8078.79 allowed | |
|
68
|
CVE-2026-32658 |
8.8 | 0.0024 | NET LOW CX NO UI | Dell Automation Platform versions prior to 2.0.0.0, contains a missing authoriza | |
|
67
|
CVE-2026-58202 |
8.3 | 0.0024 | NET NO AUTH LOW CX | OpenReception's appointment booking software provides an end-to-end encrypted ap | |
|
66
|
CVE-2026-7978 |
8.1 | 0.0024 | NET NO AUTH NO UI | Inappropriate implementation in Companion in Google Chrome on Mac prior to 148.0 | |
|
65
|
CVE-2026-49440 |
7.4 | 0.0024 | NET NO AUTH NO UI | Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.8.1, node: | |
|
65
|
CVE-2026-24177 |
7.7 | 0.0024 | NET LOW CX NO UI | NVIDIA KAI Scheduler contains a vulnerability where an attacker could access API | |
|
65
|
CVE-2026-45012 |
7.6 | 0.0024 | NET LOW CX NO UI | ApostropheCMS is an open-source Node.js content management system. Versions up t | |
|
64
|
CVE-2026-115963 |
7.1 | 0.0024 | NET LOW CX NO UI | Missing Authorization vulnerability in VideoWhisper.com Broadcast Live Video vid | |
|
64
|
CVE-2026-42261 |
7.1 | 0.0024 | NET LOW CX NO UI | PromptHub is an all-in-one AI toolbox for prompt, skill, and agent management. F | |
|
64
|
CVE-2026-23970 |
7.1 | 0.0024 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in Redirection for Contact Form 7 <= | |
|
64
|
CVE-2026-39447 |
7.1 | 0.0024 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in Simply Schedule Appointments <= 1. | |
|
64
|
CVE-2026-48838 |
7.1 | 0.0024 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in Post SMTP <= 3.6.2 versions. | |
|
64
|
CVE-2017-20238 |
7.1 | 0.0024 | NET LOW CX NO UI | Hirschmann Industrial HiVision versions 06.0.00 and 07.0.00 prior to 06.0.06 and | |
|
64
|
CVE-2026-61988 |
7.1 | 0.0024 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in Auction Nudge – Your eBay on Your | |
|
62
|
CVE-2026-32673 |
8.5 | 0.0024 | NET LOW CX NO UI | A vulnerability exists in BIG-IP scripted monitors that may allow an authenticat | |
|
62
|
CVE-2026-40061 |
8.5 | 0.0024 | NET LOW CX NO UI | When BIG-IP DNS is provisioned, a vulnerability exists in an undisclosed iContro | |
|
62
|
CVE-2026-40698 |
8.5 | 0.0024 | NET LOW CX NO UI | A vulnerability exists in BIG-IP and BIG-IQ systems where a highly privileged, a | |
|
58
|
CVE-2026-61719 |
8.9 | 0.0024 | NET LOW CX | WeGIA is a web manager for charitable institutions. Prior to 3.8.7, a stored cro | |
|
58
|
CVE-2026-61707 |
9.0 | 0.0024 | NET LOW CX | SOCFortress CoPilot focuses on providing a single pane of glass for all your sec | |
|
57
|
CVE-2026-7967 |
8.3 | 0.0024 | NET NO AUTH | Insufficient validation of untrusted input in Navigation in Google Chrome prior | |
|
57
|
CVE-2026-14401 |
8.3 | 0.0024 | NET NO AUTH | Insufficient validation of untrusted input in ANGLE in Google Chrome on Android | |
|
57
|
CVE-2026-14400 |
8.3 | 0.0024 | NET NO AUTH | Out of bounds write in ANGLE in Google Chrome prior to 150.0.7871.46 allowed a r | |
|
55
|
CVE-2026-115334 |
7.6 | 0.0024 | NET NO UI | Lotus through 0.10.2 contains an authorization bypass vulnerability in ChangeUse | |
|
55
|
CVE-2026-91504 |
7.5 | 0.0024 | NET NO UI | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middlewar | |
|
55
|
CVE-2026-91515 |
7.5 | 0.0024 | NET NO UI | Vulnerability in the Oracle Agile Product Lifecycle Management for Process produ | |
|
55
|
CVE-2026-91227 |
7.5 | 0.0024 | NET NO UI | Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (compo | |
|
54
|
CVE-2026-54301 |
7.0 | 0.0024 | NET LOW CX | n8n is an open source workflow automation platform. Prior to 1.123.55, 2.25.7, a | |
|
44
|
CVE-2026-40875 |
7.0 | 0.0024 | NET | mailcow: dockerized is an open source groupware/email suite based on docker. In |