Hunt List
12,786 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-34841 |
9.8 | 0.0023 | NET NO AUTH LOW CX NO UI | Bruno is an open source IDE for exploring and testing APIs. Prior to 3.2.1, Brun | |
|
80
|
CVE-2026-40446 |
9.8 | 0.0023 | NET NO AUTH LOW CX NO UI | Access of resource using incompatible type ('type confusion') vulnerability in S | |
|
80
|
CVE-2026-53407 |
9.8 | 0.0023 | NET NO AUTH LOW CX NO UI | Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace before | |
|
79
|
CVE-2026-39574 |
9.3 | 0.0023 | NET NO AUTH LOW CX NO UI | Unauthenticated SQL Injection in InPost Gallery <= 2.1.4.6 versions. | |
|
79
|
CVE-2026-54809 |
9.3 | 0.0023 | NET NO AUTH LOW CX NO UI | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti | |
|
78
|
CVE-2026-44726 |
9.1 | 0.0023 | NET NO AUTH LOW CX NO UI | Deno is a JavaScript, TypeScript, and WebAssembly runtime. From 2.0.0 until 2.7. | |
|
78
|
CVE-2026-55953 |
9.1 | 0.0023 | NET NO AUTH LOW CX NO UI | The Erlang/OTP ssl TLS 1.2 (and earlier) and DTLS client does not verify that th | |
|
77
|
CVE-2026-22312 |
8.6 | 0.0023 | NET NO AUTH LOW CX NO UI | The device has a webserver that exposes a REST API authenticated with a constant | |
|
76
|
CVE-2026-46415 |
8.2 | 0.0023 | NET NO AUTH LOW CX NO UI | The Caddy Defender plugin is a middleware for Caddy that allows users to block o | |
|
76
|
CVE-2026-107324 |
8.2 | 0.0023 | NET NO AUTH LOW CX NO UI | An integer overflow in BSON value-length handling in the MongoDB Go Driver can c | |
|
76
|
CVE-2026-103602 |
8.2 | 0.0023 | NET NO AUTH LOW CX NO UI | Improper certificate validation in PkixNameConstraintValidator in Legion of the | |
|
75
|
CVE-2026-18089 |
7.5 | 0.0023 | NET NO AUTH LOW CX NO UI | Net::SAML2 versions before 0.86 for Perl allow SAML authentication bypass by ver | |
|
75
|
CVE-2026-81755 |
7.5 | 0.0023 | NET NO AUTH LOW CX NO UI | Uncontrolled resource consumption in the streaming RPC component of Apache bRPC | |
|
75
|
CVE-2023-42346 |
7.5 | 0.0023 | NET NO AUTH LOW CX NO UI | Alkacon OpenCms before 16 allows XXE when the <!DOCTYPE> refers to an external h | |
|
75
|
CVE-2026-14114 |
7.5 | 0.0023 | NET NO AUTH LOW CX NO UI | Inappropriate implementation in WebAppInstalls in Google Chrome on Android prior | |
|
70
|
CVE-2026-40089 |
9.9 | 0.0023 | NET LOW CX NO UI | Sonicverse is a Self-hosted Docker Compose stack for live radio streaming. The S | |
|
69
|
CVE-2026-8511 |
9.6 | 0.0023 | NET NO AUTH LOW CX | Use after free in UI in Google Chrome prior to 148.0.7778.168 allowed a remote a | |
|
69
|
CVE-2026-52843 |
9.3 | 0.0023 | NET NO AUTH LOW CX | Lightpanda is a headless browser designed for AI and automation. Prior to 0.2.9, | |
|
69
|
CVE-2026-58426 |
9.6 | 0.0023 | NET LOW CX NO UI | Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository art | |
|
68
|
CVE-2026-8519 |
8.8 | 0.0023 | NET NO AUTH LOW CX | Integer overflow in ANGLE in Google Chrome on Windows prior to 148.0.7778.168 al | |
|
68
|
CVE-2026-90717 |
9.1 | 0.0023 | NET LOW CX NO UI | Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1. | |
|
68
|
CVE-2026-0151 |
8.8 | 0.0023 | NET LOW CX NO UI | In IntfGraphCreate of intfgraph.c, there is a possible out of bounds write due t | |
|
68
|
CVE-2026-0154 |
8.8 | 0.0023 | NET LOW CX NO UI | In Modem, there is a possible way to trigger a modem crash during a SIP REFER re | |
|
68
|
CVE-2026-0160 |
8.8 | 0.0023 | NET LOW CX NO UI | In TextRtpPayloadDecoderNode::DecodeT140 of TextRtpPayloadDecoderNode.cpp, there | |
|
68
|
CVE-2026-0161 |
8.8 | 0.0023 | NET LOW CX NO UI | In numberOfReportBlocks of RtpSession.cpp, there is a possible out of bounds wri | |
|
68
|
CVE-2026-0162 |
8.8 | 0.0023 | NET LOW CX NO UI | In ParsePayloads of AudioSdpParser.cpp, there is a possible memory corruption du | |
|
68
|
CVE-2026-0164 |
8.8 | 0.0023 | NET LOW CX NO UI | In Modem, there is a possible out of bounds write due to a missing bounds check. | |
|
68
|
CVE-2026-57786 |
8.8 | 0.0023 | NET NO AUTH LOW CX | Cross-Site Request Forgery (CSRF) vulnerability in purethemes WorkScout-Core wor | |
|
67
|
CVE-2026-8654 |
8.7 | 0.0023 | NET LOW CX NO UI | Improper input validation in Delphix Continuous Data connectors allows an authen | |
|
67
|
CVE-2026-59713 |
8.6 | 0.0023 | NET NO AUTH LOW CX | Leantime contains an OIDC login CSRF vulnerability in the verifyState() method t | |
|
67
|
CVE-2026-41270 |
8.3 | 0.0023 | NET LOW CX NO UI | Flowise is a drag & drop user interface to build a customized large language mod | |
|
67
|
CVE-2026-41271 |
8.3 | 0.0023 | NET LOW CX NO UI | Flowise is a drag & drop user interface to build a customized large language mod | |
|
67
|
CVE-2026-5781 |
8.5 | 0.0023 | NET LOW CX NO UI | An authorization vulnerability in MphRx's Minerva V3.6.0, specifically in the '/ | |
|
67
|
CVE-2026-73292 |
8.3 | 0.0023 | NET NO AUTH LOW CX | Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.21, the | |
|
66
|
CVE-2026-12740 |
8.1 | 0.0023 | NET NO AUTH LOW CX | Plack::Middleware::OAuth versions through 0.10 for Perl do not support the OAuth | |
|
66
|
CVE-2026-40113 |
8.1 | 0.0023 | NET LOW CX NO UI | PraisonAI is a multi-agent teams system. Prior to 4.5.128, deploy.py constructs | |
|
65
|
CVE-2026-4982 |
7.3 | 0.0023 | NET LOW CX NO UI | A user with permission "update world" in any Venueless world is able to exfiltra | |
|
64
|
CVE-2026-115450 |
7.1 | 0.0024 | NET LOW CX NO UI | External Control of Assumed-Immutable Web Parameter (CWE-472) in the cart and ch | |
|
64
|
CVE-2026-116492 |
7.1 | 0.0024 | NET LOW CX NO UI | Frappe CRM app before 1.89.1 contains a missing authorization vulnerability that | |
|
64
|
CVE-2026-116876 |
7.1 | 0.0024 | NET LOW CX NO UI | Semantic MediaWiki from 2.5.0 before 7.3.1 contains an improper authorization vu | |
|
64
|
CVE-2026-55550 |
7.1 | 0.0023 | NET LOW CX NO UI | NextCRM is open-source customer relationship management (CRM) software. The CRM | |
|
64
|
CVE-2026-18687 |
7.1 | 0.0023 | NET LOW CX NO UI | MongoDB Server's handling of a Queryable Encryption maintenance operation did no | |
|
64
|
CVE-2026-116812 |
7.1 | 0.0023 | NET LOW CX NO UI | OpenPanel before 3.0.0 contains a sql injection vulnerability in profileColumnAc | |
|
64
|
CVE-2026-116813 |
7.1 | 0.0023 | NET LOW CX NO UI | OpenPanel before 3.0.0 contains an sql injection vulnerability in ConversionServ | |
|
64
|
CVE-2026-22618 |
7.1 | 0.0023 | NET NO AUTH LOW CX | A security misconfiguration was identified in Eaton Intelligent Power Protector | |
|
64
|
CVE-2026-40522 |
7.1 | 0.0023 | NET LOW CX NO UI | FrontAccounting before 2.4.20 contains a SQL injection vulnerability in the Bank | |
|
57
|
CVE-2026-8573 |
8.3 | 0.0023 | NET NO AUTH | Integer overflow in Codecs in Google Chrome on Windows prior to 148.0.7778.168 a | |
|
57
|
CVE-2026-2336 |
8.7 | 0.0023 | NET NO UI | A privilege escalation vulnerability in Microchip IStaX allows an authenticated | |
|
54
|
CVE-2026-44694 |
7.2 | 0.0024 | NET NO UI | n8n-MCP is an MCP server that provides AI assistants access to n8n node document | |
|
52
|
CVE-2026-34561 |
8.4 | 0.0023 | NET LOW CX | CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, mo |