Hunt List
15,669 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
79
|
CVE-2026-39574 |
9.3 | 0.0023 | NET NO AUTH LOW CX NO UI | Unauthenticated SQL Injection in InPost Gallery <= 2.1.4.6 versions. | |
|
79
|
CVE-2026-54809 |
9.3 | 0.0023 | NET NO AUTH LOW CX NO UI | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti | |
|
78
|
CVE-2026-44726 |
9.1 | 0.0023 | NET NO AUTH LOW CX NO UI | Deno is a JavaScript, TypeScript, and WebAssembly runtime. From 2.0.0 until 2.7. | |
|
78
|
CVE-2026-55953 |
9.1 | 0.0023 | NET NO AUTH LOW CX NO UI | The Erlang/OTP ssl TLS 1.2 (and earlier) and DTLS client does not verify that th | |
|
76
|
CVE-2026-107325 |
8.2 | 0.0024 | NET NO AUTH LOW CX NO UI | Improper validation of a BSON array length in the MongoDB Go Driver can cause an | |
|
76
|
CVE-2026-111814 |
7.8 | 0.0024 | NET NO AUTH LOW CX NO UI | Apache Traffic Server's default outbound session-sharing policy can reuse a pool | |
|
76
|
CVE-2026-111815 |
7.8 | 0.0024 | NET NO AUTH LOW CX NO UI | Apache Traffic Server can resume a TLS session across SNI virtual hosts without | |
|
76
|
CVE-2026-46415 |
8.2 | 0.0023 | NET NO AUTH LOW CX NO UI | The Caddy Defender plugin is a middleware for Caddy that allows users to block o | |
|
75
|
CVE-2026-18089 |
7.5 | 0.0023 | NET NO AUTH LOW CX NO UI | Net::SAML2 versions before 0.86 for Perl allow SAML authentication bypass by ver | |
|
75
|
CVE-2026-1940 |
7.5 | 0.0023 | NET NO AUTH LOW CX NO UI | An incomplete fix for CVE-2024-47778 allows an out-of-bounds read in gst_wavpars | |
|
69
|
CVE-2026-8511 |
9.6 | 0.0023 | NET NO AUTH LOW CX | Use after free in UI in Google Chrome prior to 148.0.7778.168 allowed a remote a | |
|
69
|
CVE-2026-52843 |
9.3 | 0.0023 | NET NO AUTH LOW CX | Lightpanda is a headless browser designed for AI and automation. Prior to 0.2.9, | |
|
69
|
CVE-2026-58426 |
9.6 | 0.0023 | NET LOW CX NO UI | Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository art | |
|
68
|
CVE-2026-32658 |
8.8 | 0.0024 | NET LOW CX NO UI | Dell Automation Platform versions prior to 2.0.0.0, contains a missing authoriza | |
|
68
|
CVE-2026-8519 |
8.8 | 0.0023 | NET NO AUTH LOW CX | Integer overflow in ANGLE in Google Chrome on Windows prior to 148.0.7778.168 al | |
|
68
|
CVE-2026-113119 |
8.8 | 0.0023 | NET NO AUTH LOW CX | Improper certificate validation in Network in Google Chrome on on Windows prior | |
|
68
|
CVE-2026-90717 |
9.1 | 0.0023 | NET LOW CX NO UI | Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1. | |
|
68
|
CVE-2026-76028 |
8.8 | 0.0023 | NET NO AUTH LOW CX | Incorrect authorization in FileSystem in Google Chrome prior to 156.0.8078.79 al | |
|
68
|
CVE-2026-76030 |
8.8 | 0.0023 | NET NO AUTH LOW CX | Incorrect authorization in FileSystem in Google Chrome prior to 156.0.8078.79 al | |
|
67
|
CVE-2026-47678 |
8.7 | 0.0024 | NET LOW CX NO UI | GLPI is a free asset and IT management software package. From 9.4.0 until 10.0.2 | |
|
67
|
CVE-2026-121452 |
8.3 | 0.0024 | NET NO AUTH NO UI | bbs-go through 4.4.6 contains an improper certificate validation vulnerability t | |
|
67
|
CVE-2026-8654 |
8.7 | 0.0023 | NET LOW CX NO UI | Improper input validation in Delphix Continuous Data connectors allows an authen | |
|
67
|
CVE-2026-59713 |
8.6 | 0.0023 | NET NO AUTH LOW CX | Leantime contains an OIDC login CSRF vulnerability in the verifyState() method t | |
|
67
|
CVE-2026-41270 |
8.3 | 0.0023 | NET LOW CX NO UI | Flowise is a drag & drop user interface to build a customized large language mod | |
|
67
|
CVE-2026-122308 |
8.4 | 0.0023 | NET LOW CX NO UI | Kyverno before 1.19.2 contains an authorization bypass vulnerability in the Gene | |
|
67
|
CVE-2026-41271 |
8.3 | 0.0023 | NET LOW CX NO UI | Flowise is a drag & drop user interface to build a customized large language mod | |
|
66
|
CVE-2026-40113 |
8.1 | 0.0024 | NET LOW CX NO UI | PraisonAI is a multi-agent teams system. Prior to 4.5.128, deploy.py constructs | |
|
66
|
CVE-2026-12740 |
8.1 | 0.0023 | NET NO AUTH LOW CX | Plack::Middleware::OAuth versions through 0.10 for Perl do not support the OAuth | |
|
65
|
CVE-2026-24177 |
7.7 | 0.0024 | NET LOW CX NO UI | NVIDIA KAI Scheduler contains a vulnerability where an attacker could access API | |
|
65
|
CVE-2026-45012 |
7.6 | 0.0024 | NET LOW CX NO UI | ApostropheCMS is an open-source Node.js content management system. Versions up t | |
|
65
|
CVE-2026-109245 |
7.4 | 0.0023 | NET NO AUTH LOW CX | FreeRDP 3.0.0 before 3.32.0 contains an improper certificate validation vulnerab | |
|
65
|
CVE-2026-4982 |
7.3 | 0.0023 | NET LOW CX NO UI | A user with permission "update world" in any Venueless world is able to exfiltra | |
|
64
|
CVE-2026-115450 |
7.1 | 0.0024 | NET LOW CX NO UI | External Control of Assumed-Immutable Web Parameter (CWE-472) in the cart and ch | |
|
64
|
CVE-2026-116492 |
7.1 | 0.0024 | NET LOW CX NO UI | Frappe CRM app before 1.89.1 contains a missing authorization vulnerability that | |
|
64
|
CVE-2026-119734 |
7.1 | 0.0024 | NET LOW CX NO UI | Munshi (by Petpooja) before 2026-06-17 contained a broken object level authoriza | |
|
64
|
CVE-2026-82029 |
7.1 | 0.0024 | NET LOW CX NO UI | Invoice Ninja before 5.13.28 contains a broken access control vulnerability that | |
|
64
|
CVE-2026-55550 |
7.1 | 0.0023 | NET LOW CX NO UI | NextCRM is open-source customer relationship management (CRM) software. The CRM | |
|
64
|
CVE-2026-18687 |
7.1 | 0.0023 | NET LOW CX NO UI | MongoDB Server's handling of a Queryable Encryption maintenance operation did no | |
|
64
|
CVE-2026-116812 |
7.1 | 0.0023 | NET LOW CX NO UI | OpenPanel before 3.0.0 contains a sql injection vulnerability in profileColumnAc | |
|
64
|
CVE-2026-116813 |
7.1 | 0.0023 | NET LOW CX NO UI | OpenPanel before 3.0.0 contains an sql injection vulnerability in ConversionServ | |
|
64
|
CVE-2026-22618 |
7.1 | 0.0023 | NET NO AUTH LOW CX | A security misconfiguration was identified in Eaton Intelligent Power Protector | |
|
62
|
CVE-2026-32673 |
8.5 | 0.0024 | NET LOW CX NO UI | A vulnerability exists in BIG-IP scripted monitors that may allow an authenticat | |
|
62
|
CVE-2026-40061 |
8.5 | 0.0024 | NET LOW CX NO UI | When BIG-IP DNS is provisioned, a vulnerability exists in an undisclosed iContro | |
|
62
|
CVE-2026-40698 |
8.5 | 0.0024 | NET LOW CX NO UI | A vulnerability exists in BIG-IP and BIG-IQ systems where a highly privileged, a | |
|
58
|
CVE-2026-61707 |
9.0 | 0.0024 | NET LOW CX | SOCFortress CoPilot focuses on providing a single pane of glass for all your sec | |
|
57
|
CVE-2026-14400 |
8.3 | 0.0024 | NET NO AUTH | Out of bounds write in ANGLE in Google Chrome prior to 150.0.7871.46 allowed a r | |
|
57
|
CVE-2026-8573 |
8.3 | 0.0023 | NET NO AUTH | Integer overflow in Codecs in Google Chrome on Windows prior to 148.0.7778.168 a | |
|
55
|
CVE-2026-91515 |
7.5 | 0.0024 | NET NO UI | Vulnerability in the Oracle Agile Product Lifecycle Management for Process produ | |
|
54
|
CVE-2026-44694 |
7.2 | 0.0024 | NET NO UI | n8n-MCP is an MCP server that provides AI assistants access to n8n node document | |
|
52
|
CVE-2026-34561 |
8.4 | 0.0023 | NET LOW CX | CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, mo |