Hunt List
18,712 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
79
|
CVE-2026-39574 |
9.3 | 0.0023 | NET NO AUTH LOW CX NO UI | Unauthenticated SQL Injection in InPost Gallery <= 2.1.4.6 versions. | |
|
79
|
CVE-2026-54809 |
9.3 | 0.0023 | NET NO AUTH LOW CX NO UI | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti | |
|
78
|
CVE-2026-44726 |
9.1 | 0.0023 | NET NO AUTH LOW CX NO UI | Deno is a JavaScript, TypeScript, and WebAssembly runtime. From 2.0.0 until 2.7. | |
|
78
|
CVE-2026-55953 |
9.1 | 0.0023 | NET NO AUTH LOW CX NO UI | The Erlang/OTP ssl TLS 1.2 (and earlier) and DTLS client does not verify that th | |
|
76
|
CVE-2026-107325 |
8.2 | 0.0024 | NET NO AUTH LOW CX NO UI | Improper validation of a BSON array length in the MongoDB Go Driver can cause an | |
|
76
|
CVE-2026-111814 |
7.8 | 0.0024 | NET NO AUTH LOW CX NO UI | Apache Traffic Server's default outbound session-sharing policy can reuse a pool | |
|
76
|
CVE-2026-111815 |
7.8 | 0.0024 | NET NO AUTH LOW CX NO UI | Apache Traffic Server can resume a TLS session across SNI virtual hosts without | |
|
76
|
CVE-2026-46415 |
8.2 | 0.0023 | NET NO AUTH LOW CX NO UI | The Caddy Defender plugin is a middleware for Caddy that allows users to block o | |
|
75
|
CVE-2026-18089 |
7.5 | 0.0023 | NET NO AUTH LOW CX NO UI | Net::SAML2 versions before 0.86 for Perl allow SAML authentication bypass by ver | |
|
69
|
CVE-2026-8511 |
9.6 | 0.0023 | NET NO AUTH LOW CX | Use after free in UI in Google Chrome prior to 148.0.7778.168 allowed a remote a | |
|
69
|
CVE-2026-52843 |
9.3 | 0.0023 | NET NO AUTH LOW CX | Lightpanda is a headless browser designed for AI and automation. Prior to 0.2.9, | |
|
69
|
CVE-2026-58426 |
9.6 | 0.0023 | NET LOW CX NO UI | Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository art | |
|
68
|
CVE-2026-8519 |
8.8 | 0.0023 | NET NO AUTH LOW CX | Integer overflow in ANGLE in Google Chrome on Windows prior to 148.0.7778.168 al | |
|
68
|
CVE-2026-113119 |
8.8 | 0.0023 | NET NO AUTH LOW CX | Improper certificate validation in Network in Google Chrome on on Windows prior | |
|
68
|
CVE-2026-90717 |
9.1 | 0.0023 | NET LOW CX NO UI | Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1. | |
|
68
|
CVE-2026-76028 |
8.8 | 0.0023 | NET NO AUTH LOW CX | Incorrect authorization in FileSystem in Google Chrome prior to 156.0.8078.79 al | |
|
68
|
CVE-2026-76030 |
8.8 | 0.0023 | NET NO AUTH LOW CX | Incorrect authorization in FileSystem in Google Chrome prior to 156.0.8078.79 al | |
|
67
|
CVE-2026-121452 |
8.3 | 0.0024 | NET NO AUTH NO UI | bbs-go through 4.4.6 contains an improper certificate validation vulnerability t | |
|
67
|
CVE-2026-8654 |
8.7 | 0.0023 | NET LOW CX NO UI | Improper input validation in Delphix Continuous Data connectors allows an authen | |
|
67
|
CVE-2026-59713 |
8.6 | 0.0023 | NET NO AUTH LOW CX | Leantime contains an OIDC login CSRF vulnerability in the verifyState() method t | |
|
67
|
CVE-2026-41270 |
8.3 | 0.0023 | NET LOW CX NO UI | Flowise is a drag & drop user interface to build a customized large language mod | |
|
67
|
CVE-2026-41271 |
8.3 | 0.0023 | NET LOW CX NO UI | Flowise is a drag & drop user interface to build a customized large language mod | |
|
66
|
CVE-2026-40113 |
8.1 | 0.0024 | NET LOW CX NO UI | PraisonAI is a multi-agent teams system. Prior to 4.5.128, deploy.py constructs | |
|
66
|
CVE-2026-12740 |
8.1 | 0.0023 | NET NO AUTH LOW CX | Plack::Middleware::OAuth versions through 0.10 for Perl do not support the OAuth | |
|
66
|
CVE-2026-121220 |
8.1 | 0.0023 | NET NO AUTH LOW CX | Incorrect authorization in Core in Google Chrome prior to 157.0.8103.38 allowed | |
|
66
|
CVE-2026-126903 |
8.1 | 0.0023 | NET NO AUTH LOW CX | Improper state validation in ANGLE in Google Chrome on on Windows prior to 157.0 | |
|
65
|
CVE-2026-24177 |
7.7 | 0.0024 | NET LOW CX NO UI | NVIDIA KAI Scheduler contains a vulnerability where an attacker could access API | |
|
65
|
CVE-2026-45012 |
7.6 | 0.0024 | NET LOW CX NO UI | ApostropheCMS is an open-source Node.js content management system. Versions up t | |
|
65
|
CVE-2026-109245 |
7.4 | 0.0023 | NET NO AUTH LOW CX | FreeRDP 3.0.0 before 3.32.0 contains an improper certificate validation vulnerab | |
|
65
|
CVE-2026-125336 |
7.4 | 0.0023 | NET NO AUTH NO UI | Forge (also called node-forge) is a native implementation of Transport Layer Sec | |
|
64
|
CVE-2026-0234 |
7.2 | 0.0024 | NET NO AUTH NO UI | An improper verification of cryptographic signature vulnerability exists in Cort | |
|
64
|
CVE-2026-115450 |
7.1 | 0.0024 | NET LOW CX NO UI | External Control of Assumed-Immutable Web Parameter (CWE-472) in the cart and ch | |
|
64
|
CVE-2026-116492 |
7.1 | 0.0024 | NET LOW CX NO UI | Frappe CRM app before 1.89.1 contains a missing authorization vulnerability that | |
|
64
|
CVE-2026-119734 |
7.1 | 0.0024 | NET LOW CX NO UI | Munshi (by Petpooja) before 2026-06-17 contained a broken object level authoriza | |
|
64
|
CVE-2026-82029 |
7.1 | 0.0024 | NET LOW CX NO UI | Invoice Ninja before 5.13.28 contains a broken access control vulnerability that | |
|
64
|
CVE-2026-59079 |
7.1 | 0.0024 | NET LOW CX NO UI | Edito CMS restricts the ability to upload files via the UI to specific file type | |
|
64
|
CVE-2026-114359 |
7.0 | 0.0024 | NET LOW CX NO UI | Eclipse Kura downloads deployment packages (DPs) from a remote URL without any l | |
|
64
|
CVE-2026-55550 |
7.1 | 0.0023 | NET LOW CX NO UI | NextCRM is open-source customer relationship management (CRM) software. The CRM | |
|
64
|
CVE-2026-18687 |
7.1 | 0.0023 | NET LOW CX NO UI | MongoDB Server's handling of a Queryable Encryption maintenance operation did no | |
|
64
|
CVE-2026-116812 |
7.1 | 0.0023 | NET LOW CX NO UI | OpenPanel before 3.0.0 contains a sql injection vulnerability in profileColumnAc | |
|
64
|
CVE-2026-116813 |
7.1 | 0.0023 | NET LOW CX NO UI | OpenPanel before 3.0.0 contains an sql injection vulnerability in ConversionServ | |
|
64
|
CVE-2026-40522 |
7.1 | 0.0023 | NET LOW CX NO UI | FrontAccounting before 2.4.20 contains a SQL injection vulnerability in the Bank | |
|
62
|
CVE-2026-40061 |
8.5 | 0.0024 | NET LOW CX NO UI | When BIG-IP DNS is provisioned, a vulnerability exists in an undisclosed iContro | |
|
62
|
CVE-2026-40698 |
8.5 | 0.0024 | NET LOW CX NO UI | A vulnerability exists in BIG-IP and BIG-IQ systems where a highly privileged, a | |
|
57
|
CVE-2026-14400 |
8.3 | 0.0024 | NET NO AUTH | Out of bounds write in ANGLE in Google Chrome prior to 150.0.7871.46 allowed a r | |
|
57
|
CVE-2026-8573 |
8.3 | 0.0023 | NET NO AUTH | Integer overflow in Codecs in Google Chrome on Windows prior to 148.0.7778.168 a | |
|
55
|
CVE-2026-91515 |
7.5 | 0.0024 | NET NO UI | Vulnerability in the Oracle Agile Product Lifecycle Management for Process produ | |
|
55
|
CVE-2026-95747 |
7.5 | 0.0024 | NET NO UI | A privilege escalation vulnerability exists in the SSH interface of HPE Networki | |
|
54
|
CVE-2026-44694 |
7.2 | 0.0024 | NET NO UI | n8n-MCP is an MCP server that provides AI assistants access to n8n node document | |
|
52
|
CVE-2026-34561 |
8.4 | 0.0023 | NET LOW CX | CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, mo |