Hunt List
8,130 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-40114 |
10.0 | 0.0024 | NET NO AUTH LOW CX NO UI | PraisonAI is a multi-agent teams system. Prior to 4.5.128, the /api/v1/runs endp | |
|
80
|
CVE-2026-34841 |
9.8 | 0.0023 | NET NO AUTH LOW CX NO UI | Bruno is an open source IDE for exploring and testing APIs. Prior to 3.2.1, Brun | |
|
80
|
CVE-2026-40446 |
9.8 | 0.0023 | NET NO AUTH LOW CX NO UI | Access of resource using incompatible type ('type confusion') vulnerability in S | |
|
79
|
CVE-2026-42755 |
9.3 | 0.0024 | NET NO AUTH LOW CX NO UI | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti | |
|
79
|
CVE-2026-115607 |
9.3 | 0.0024 | NET NO AUTH LOW CX NO UI | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti | |
|
79
|
CVE-2026-39574 |
9.3 | 0.0023 | NET NO AUTH LOW CX NO UI | Unauthenticated SQL Injection in InPost Gallery <= 2.1.4.6 versions. | |
|
79
|
CVE-2026-54809 |
9.3 | 0.0023 | NET NO AUTH LOW CX NO UI | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti | |
|
78
|
CVE-2026-64993 |
9.1 | 0.0024 | NET NO AUTH LOW CX NO UI | Dell RVTools versions prior to 4.8.1, contains an improper certificate validatio | |
|
78
|
CVE-2026-115216 |
9.1 | 0.0024 | NET NO AUTH LOW CX NO UI | In Eclipse ioFog Operator versions 3.8.0 before 3.9.2, TLS certificate verificat | |
|
78
|
CVE-2026-105210 |
8.8 | 0.0024 | NET NO AUTH LOW CX NO UI | ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains a missing authenticatio | |
|
78
|
CVE-2026-44726 |
9.1 | 0.0023 | NET NO AUTH LOW CX NO UI | Deno is a JavaScript, TypeScript, and WebAssembly runtime. From 2.0.0 until 2.7. | |
|
78
|
CVE-2026-55953 |
9.1 | 0.0023 | NET NO AUTH LOW CX NO UI | The Erlang/OTP ssl TLS 1.2 (and earlier) and DTLS client does not verify that th | |
|
77
|
CVE-2026-91534 |
8.6 | 0.0024 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Business Intelligence Enterprise Edition product of | |
|
77
|
CVE-2026-22312 |
8.6 | 0.0023 | NET NO AUTH LOW CX NO UI | The device has a webserver that exposes a REST API authenticated with a constant | |
|
76
|
CVE-2026-107325 |
8.2 | 0.0024 | NET NO AUTH LOW CX NO UI | Improper validation of a BSON array length in the MongoDB Go Driver can cause an | |
|
76
|
CVE-2026-111814 |
7.8 | 0.0024 | NET NO AUTH LOW CX NO UI | Apache Traffic Server's default outbound session-sharing policy can reuse a pool | |
|
76
|
CVE-2026-111815 |
7.8 | 0.0024 | NET NO AUTH LOW CX NO UI | Apache Traffic Server can resume a TLS session across SNI virtual hosts without | |
|
76
|
CVE-2026-46415 |
8.2 | 0.0023 | NET NO AUTH LOW CX NO UI | The Caddy Defender plugin is a middleware for Caddy that allows users to block o | |
|
76
|
CVE-2026-107324 |
8.2 | 0.0023 | NET NO AUTH LOW CX NO UI | An integer overflow in BSON value-length handling in the MongoDB Go Driver can c | |
|
75
|
CVE-2026-105765 |
7.5 | 0.0024 | NET NO AUTH LOW CX NO UI | HashiCorp Consul and Consul Enterprise 1.17.0 up to 2.0.4 are vulnerable to an a | |
|
75
|
CVE-2026-40394 |
7.5 | 0.0024 | NET NO AUTH LOW CX NO UI | Varnish Cache 9 before 9.0.1 and Varnish Enterprise before 6.0.16r11 allows a "w | |
|
75
|
CVE-2026-40395 |
7.5 | 0.0024 | NET NO AUTH LOW CX NO UI | Varnish Enterprise before 6.0.16r12 allows a "workspace overflow" denial of serv | |
|
75
|
CVE-2026-49110 |
7.5 | 0.0024 | NET NO AUTH LOW CX NO UI | Unauthenticated Broken Authentication in Upsell Order Bump Offer for WooCommerce | |
|
75
|
CVE-2026-54810 |
7.5 | 0.0024 | NET NO AUTH LOW CX NO UI | Missing Authorization vulnerability in Nexi Payments Nexi XPay allows Exploiting | |
|
75
|
CVE-2026-18089 |
7.5 | 0.0023 | NET NO AUTH LOW CX NO UI | Net::SAML2 versions before 0.86 for Perl allow SAML authentication bypass by ver | |
|
75
|
CVE-2026-81755 |
7.5 | 0.0023 | NET NO AUTH LOW CX NO UI | Uncontrolled resource consumption in the streaming RPC component of Apache bRPC | |
|
75
|
CVE-2023-42346 |
7.5 | 0.0023 | NET NO AUTH LOW CX NO UI | Alkacon OpenCms before 16 allows XXE when the <!DOCTYPE> refers to an external h | |
|
75
|
CVE-2026-14114 |
7.5 | 0.0023 | NET NO AUTH LOW CX NO UI | Inappropriate implementation in WebAppInstalls in Google Chrome on Android prior | |
|
74
|
CVE-2026-109995 |
7.2 | 0.0024 | NET NO AUTH LOW CX NO UI | The Advanced Views – Display Framework for Gutenberg & Elementor plugin for Word | |
|
74
|
CVE-2026-97019 |
7.2 | 0.0024 | NET NO AUTH LOW CX NO UI | The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to | |
|
74
|
CVE-2026-96741 |
7.2 | 0.0024 | NET NO AUTH LOW CX NO UI | The DSGVO All in one for WP plugin for WordPress is vulnerable to Stored Cross-S | |
|
69
|
CVE-2026-8511 |
9.6 | 0.0023 | NET NO AUTH LOW CX | Use after free in UI in Google Chrome prior to 148.0.7778.168 allowed a remote a | |
|
69
|
CVE-2026-52843 |
9.3 | 0.0023 | NET NO AUTH LOW CX | Lightpanda is a headless browser designed for AI and automation. Prior to 0.2.9, | |
|
68
|
CVE-2026-119262 |
8.8 | 0.0024 | NET NO AUTH LOW CX | Improper input validation in V8 in Google Chrome prior to 156.0.8078.79 allowed | |
|
68
|
CVE-2026-8519 |
8.8 | 0.0023 | NET NO AUTH LOW CX | Integer overflow in ANGLE in Google Chrome on Windows prior to 148.0.7778.168 al | |
|
67
|
CVE-2026-58202 |
8.3 | 0.0024 | NET NO AUTH LOW CX | OpenReception's appointment booking software provides an end-to-end encrypted ap | |
|
67
|
CVE-2026-59713 |
8.6 | 0.0023 | NET NO AUTH LOW CX | Leantime contains an OIDC login CSRF vulnerability in the verifyState() method t | |
|
67
|
CVE-2026-73292 |
8.3 | 0.0023 | NET NO AUTH LOW CX | Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.21, the | |
|
66
|
CVE-2026-7978 |
8.1 | 0.0024 | NET NO AUTH NO UI | Inappropriate implementation in Companion in Google Chrome on Mac prior to 148.0 | |
|
66
|
CVE-2026-12740 |
8.1 | 0.0023 | NET NO AUTH LOW CX | Plack::Middleware::OAuth versions through 0.10 for Perl do not support the OAuth | |
|
65
|
CVE-2026-49440 |
7.4 | 0.0024 | NET NO AUTH NO UI | Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.8.1, node: | |
|
64
|
CVE-2026-23970 |
7.1 | 0.0024 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in Redirection for Contact Form 7 <= | |
|
64
|
CVE-2026-39447 |
7.1 | 0.0024 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in Simply Schedule Appointments <= 1. | |
|
64
|
CVE-2026-48838 |
7.1 | 0.0024 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in Post SMTP <= 3.6.2 versions. | |
|
64
|
CVE-2026-61988 |
7.1 | 0.0024 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in Auction Nudge – Your eBay on Your | |
|
64
|
CVE-2026-22618 |
7.1 | 0.0023 | NET NO AUTH LOW CX | A security misconfiguration was identified in Eaton Intelligent Power Protector | |
|
57
|
CVE-2026-7967 |
8.3 | 0.0024 | NET NO AUTH | Insufficient validation of untrusted input in Navigation in Google Chrome prior | |
|
57
|
CVE-2026-14401 |
8.3 | 0.0024 | NET NO AUTH | Insufficient validation of untrusted input in ANGLE in Google Chrome on Android | |
|
57
|
CVE-2026-14400 |
8.3 | 0.0024 | NET NO AUTH | Out of bounds write in ANGLE in Google Chrome prior to 150.0.7871.46 allowed a r | |
|
57
|
CVE-2026-8573 |
8.3 | 0.0023 | NET NO AUTH | Integer overflow in Codecs in Google Chrome on Windows prior to 148.0.7778.168 a |