CVE.report
CVE.report is the most up-to-date database of common vulnerabilities and exposures. Information is pulled in from several sources and processed in to a mobile friendly, easy to use page. Use the site to quickly check for vulnerabilities in products such as operating systems, applications, hardware, networks, databases, browsers, e-mail clients and more.
CVEs provide a unique and common naming scheme for publicly known cyber security vulnerabilities in order to quickly identify and share these vulnerabilities. You can use the search below to look for vulnerabilities based on product, vendor, or common tags
The form you will see after following this link allows you to fill out the various variables in the CVSS scoring system and receive the corresponding score. The description of each of the variables is also included for additional information.
cve.report now provides a free read-only JSON API for CVE details. Each record combines the CVE Program JSON record, NVD enrichment, KEV, and EPSS when available.
Recent CVEs
| CVE | Description | Updated |
|---|---|---|
| CVE-2026-124553 json | BabelDOC from 0.3.61 before 0.7.0 contains a resource exhaustion vulnerability that allows remote attackers to exhaust CPU an... | |
| CVE-2026-124552 json | Webmin through 2.670 contains a stored cross-site scripting vulnerability in the Shorewall and Shorewall6 modules' list.cgi, ... | |
| CVE-2026-124551 json | ClassroomIO through 1.0.0 contains an authorization bypass vulnerability that allows authenticated users of any organization ... | |
| CVE-2026-124494 json | SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability because the html.clean() sanitizer's _normalizeUR... | |
| CVE-2026-124493 json | SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability in the DocumentType constructor that injects head... | |
| CVE-2026-124492 json | SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability in ModalAnchorEditor's #createBookmarkList, which... | |
| CVE-2026-124491 json | SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability in the FileUpload plugin create() method that ass... | |
| CVE-2026-124490 json | OpenEMR before 8.3.0 contains a path traversal vulnerability in the RingCentral RCFaxClient disposeDocument() method of oe-mo... | |
| CVE-2026-124489 json | OpenEMR before 8.3.0 contains a broken access control vulnerability in portal/portal_payment.php that allows low-privilege au... | |
| CVE-2026-124488 json | OpenEMR before 8.3.0 contains an authorization bypass vulnerability that allows authenticated clinicians lacking high-sensiti... | |
| CVE-2026-124487 json | OpenEMR before 8.4.0 contains an improper authorization vulnerability in the non-patient POST /fhir/DocumentReference/$docref... | |
| CVE-2026-124486 json | OpenEMR before 8.3.0 contains a missing authorization vulnerability in the classic document controller that allows low-privil... | |
| CVE-2026-124485 json | OpenEMR before 8.3.0 contains an authorization bypass vulnerability in the patient portal onsitedocuments API that allows aut... | |
| CVE-2026-124484 json | OpenEMR before 8.4.0 contains a missing authorization vulnerability in portal onsite-document APIs that allows any authentica... | |
| CVE-2026-124483 json | OpenEMR before 8.4.0 contains an incorrect authorization vulnerability because the prescription REST API routes check the pat... | |
| CVE-2026-124482 json | OpenEMR before 8.4.0 contains an authorization bypass allowing low-privileged SMART standalone-launch users to bind arbitrary... | |
| CVE-2026-124481 json | OpenEMR before 8.4.0 contains an improper authorization vulnerability in Rainforest patient portal payments that trusts brows... | |
| CVE-2026-124480 json | OpenEMR before 8.4.0 contains an authorization bypass vulnerability that allows low-privileged authenticated users to read cr... | |
| CVE-2026-124479 json | OpenEMR before 8.4.0 contains an arbitrary local file read vulnerability in REST document download, where the controller pass... | |
| CVE-2026-124478 json | OpenEMR before 8.3.0 contains a missing authorization vulnerability in the addRecall action of /interface/main/messages/save.... | |
| CVE-2026-124477 json | OpenEMR before 8.3.0 contains a missing authorization vulnerability that allows low-privileged authenticated users to delete ... | |
| CVE-2026-124476 json | OpenEMR before 8.3.0 contains an insecure direct object reference in portal/lib/paylib.php, which writes the request-supplied... | |
| CVE-2026-124475 json | OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in portal/lib/persist.php that allows authent... | |
| CVE-2026-124474 json | MRBS (Meeting Room Booking System) before 1.12.3 contains a reflected cross-site scripting vulnerability that allows unauthen... | |
| CVE-2026-124473 json | OpenEMR before 8.3.0 contains a broken object-level authorization vulnerability in the SOAP note update API, which does not v... | |
| CVE-2026-124472 json | OpenEMR before 8.3.0 contains a missing authorization vulnerability in interface/billing/sl_eob_patient_note.php that allows ... | |
| CVE-2026-124471 json | OpenEMR before 8.3.0 contains a missing authorization vulnerability in interface/billing/sl_eob_invoice.php that allows any a... | |
| CVE-2026-124470 json | OpenEMR before 8.3.0 contains a broken object level authorization vulnerability in portal/report/portal_custom_report.php tha... | |
| CVE-2026-124469 json | OpenEMR before 8.3.0 contains an SQL injection vulnerability in the Fee Sheet drug-inventory lookup (DrugSalesService::sellDr... | |
| CVE-2026-124468 json | OpenEMR before 8.3.0 contains an SQL injection vulnerability in the Standard REST API patient insurance and employer search, ... | |
| CVE-2026-124467 json | OpenEMR before 8.4.0 contains a local file inclusion in the ESign router (library/ESign/Router.php), which passes the unsanit... | |
| CVE-2026-124466 json | OpenEMR before 8.4.0 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the s... | |
| CVE-2026-124465 json | Trendyol kafka-konsumer from 2.3.3 before 2.6.18 contains a denial of service vulnerability in batch_consumer.go that panics ... | |
| CVE-2026-124464 json | OpenEMR before 8.4.0 contains an authorization bypass vulnerability that allows patient-scoped SMART tokens to read other pat... | |
| CVE-2026-124463 json | OpenEMR before 8.3.0 contains a stored cross-site scripting vulnerability that allows authenticated users with CAMOS access t... | |
| CVE-2026-124462 json | OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in OnsiteDocumentController::Query() that all... | |
| CVE-2026-124461 json | OpenEMR before 8.3.0 contains a missing authorization vulnerability in library/ajax/upload.php that allows any authenticated ... | |
| CVE-2026-124460 json | OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in PortalPatientController::Read() that allow... | |
| CVE-2026-124459 json | OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in many encounter-form view and save endpoint... | |
| CVE-2026-124458 json | OpenEMR before 8.4.0 contains an authorization bypass vulnerability in the FHIR GET /fhir/Person/:uuid route that allows pati... | |
| CVE-2026-124457 json | OpenEMR before 8.3.0 contains a path traversal vulnerability in interface/billing/sl_eob_process.php that allows authenticate... | |
| CVE-2026-124456 json | OpenEMR before 8.3.0 contains missing authorization and insecure direct object reference vulnerabilities in the oe-module-pri... | |
| CVE-2026-124455 json | OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in OnsiteDocumentController::Query() that all... | |
| CVE-2026-124453 json | OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in portal/lib/persist.php that allows authent... | |
| CVE-2026-124452 json | OpenEMR before 8.3.0 contains a stored cross-site scripting vulnerability in interface/forms/eye_mag/report.php that allows a... | |
| CVE-2026-124451 json | OpenEMR before 8.4.0 contains an authorization bypass vulnerability in its SMART on FHIR implementation because checkUserHasA... | |
| CVE-2026-124450 json | OpenEMR before 8.3.0 contains a broken access control and path traversal vulnerability in the fax/sms module disposeDocument ... | |
| CVE-2026-124449 json | OpenEMR before 8.4.0 contains a missing authorization vulnerability in FHIR Media/:uuid and QuestionnaireResponse read routes... | |
| CVE-2026-124448 json | OpenEMR before 8.3.0 contains a stored cross-site scripting vulnerability in the CCDA/CCD preview stylesheets, where cda.xsl ... | |
| CVE-2026-124447 json | OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in OnsitePortalActivityController::Update() t... | |
| CVE-2026-124446 json | OpenEMR before 8.3.0 contains a path traversal vulnerability in the FaxSMS module's RCFaxClient and SignalWireClient disposeD... | |
| CVE-2026-124445 json | OpenEMR from 7.0.1 before 8.4.0 contains a flaw in src/Common/Auth/OneTimeAuth.php that ignores the enforce_onetime_use and m... | |
| CVE-2026-124444 json | OpenEMR before 8.4.0 contains a mass assignment vulnerability in the patient portal OnsiteDocument query API that lets reques... | |
| CVE-2026-124443 json | Frappe Framework before 15.121.1 and 16.x before 16.35.0 contains a broken access control vulnerability in File list and repo... | |
| CVE-2026-124442 json | AzuraCast before 0.24.0 contains a server-side request forgery vulnerability that allows users with station WebHooks permissi... | |
| CVE-2026-124441 json | Kyverno before 1.19.2 contains an authorization bypass vulnerability that allows namespaced tenants to generate any resource ... | |
| CVE-2026-124440 json | Kyverno from 1.19.1 before 1.19.2 contains an authorization bypass vulnerability in the apiCall namespace clamp that allows n... | |
| CVE-2026-124439 json | Scriban and Scriban.Signed before 7.5.3 contain uncontrolled recursion flaws in which postfix member, indexer, and call chain... | |
| CVE-2026-124438 json | Scriban before 7.5.2 contains an information disclosure and object manipulation vulnerability that allows template authors to... | |
| CVE-2026-124437 json | Scriban before 7.5.3 contains a resource exhaustion vulnerability that allows untrusted template authors to exhaust memory an... | |
| CVE-2026-124436 json | OpenRemote before 1.32.2 contains an improper authorization vulnerability that allows realm administrators to access and modi... | |
| CVE-2026-124435 json | OpenRemote before 1.32.2 contains a stored cross-site scripting vulnerability that allows authenticated users with write:admi... | |
| CVE-2026-124434 json | Grav Lightbox Gallery plugin 1.1.0 before 1.3.2 on Grav 2.x calls any medium method named in image, thumb or thumb_options sh... | |
| CVE-2026-124433 json | phpMyFAQ before 4.1.11 contains an insufficient authorization vulnerability that allows delegated administrators holding only... | |
| CVE-2026-124432 json | phpMyFAQ 4.1.9 before 4.1.11 and 4.2.0 pre-releases before 4.2.0-beta.3 contain an account enumeration vulnerability in the u... | |
| CVE-2026-124431 json | Craft CMS from 5.10.0 before 5.11.2 contains an authorization bypass vulnerability that allows authenticated low-privileged u... | |
| CVE-2026-124430 json | Craft CMS from 5.10.0 before 5.11.2 contains a remote code execution vulnerability that allows non-administrator control pane... | |
| CVE-2026-124429 json | Craft CMS from 5.0.0 before 5.11.2 contains a privilege escalation vulnerability that allows unauthenticated public registran... | |
| CVE-2026-124428 json | Craft CMS from 5.7.0 before 5.11.2 contains an arbitrary file read vulnerability that allows authenticated control panel user... | |
| CVE-2026-124427 json | Craft CMS from 5.0.0 before 5.11.2 contains an authorization bypass vulnerability that allows anonymous GraphQL clients to re... | |
| CVE-2026-124426 json | Craft CMS from 5.0.0 before 5.11.2 contains an authorization bypass vulnerability that allows unauthenticated attackers to re... | |
| CVE-2026-124425 json | Parse Server 8.6.109 before 8.6.116 and 9.10.6-alpha.1 before 9.10.7-alpha.2 contains an information disclosure vulnerability... | |
| CVE-2026-124424 json | WWBN AVideo contains a path traversal vulnerability in plugin/AI/receiveAsync.json.php that allows holders of any valid AI to... | |
| CVE-2026-124331 json | A vulnerability was identified in Jinher OA C6. This impacts an unknown function of the file /C6/JHSoft.Web.Project/OfficeRea... | |
| CVE-2026-123272 json | Mark3labs mcp-go before v1.2.1 contains an improper validation vulnerability in OAuthHandler.fetchServerMetadata that allows ... | |
| CVE-2026-123271 json | ChatCLI before v1.215.2 contains an improper validation vulnerability in the MCP OAuth login flow that uses server-supplied P... | |
| CVE-2026-116818 json | OpenPanel before 3.0.0 contains an unauthenticated ClickHouse SQL injection vulnerability that allows remote attackers to inj... | |
| CVE-2026-115718 json | Frappe Builder versions 1.33.0 before 1.36.0 contain a missing authorization vulnerability in the improve_prompt endpoint tha... | |
| CVE-2026-29001 json | TastyIgniter through 4.4.5 contains a PHP object injection vulnerability that allows authenticated administrators to achieve ... | |
| CVE-2026-124330 json | A vulnerability was determined in FlowCI flow-core-x up to 1.23.49. This affects the function exist/save/read/remove of the f... | |
| CVE-2026-124329 json | A vulnerability was found in FlowCI flow-core-x up to 1.23.49. The impacted element is the function FileHelper.unzip of the f... | |
| CVE-2026-124328 json | A vulnerability has been found in FlowCI flow-core-x up to 1.23.49. The affected element is the function ConditionManagerImpl... | |
| CVE-2026-114713 json | The labeled-response module in UnrealIRCd 6.0.0 before 6.2.7.1 does not escape the IRCv3 "label" message tag when echoing it ... | |
| CVE-2026-73440 json | On affected platforms running Arista EOS with Simple Network Management Protocol (SNMP) configured, SNMPv3 local or remote us... | |
| CVE-2026-124326 json | A flaw has been found in DataLinkDC Dinky up to 1.2.5. Impacted is the function file.getOriginalFilename of the file Catalogu... | |
| CVE-2025-68040 json | Insertion of Sensitive Information Into Sent Data vulnerability in weDevs WP Project Manager wedevs-project-manager allows Re... | |
| CVE-2024-44006 json | Missing Authorization vulnerability in OnTheGoSystems WooCommerce Multilingual & Multicurrency woocommerce-multilingual.This ... | |
| CVE-2026-122085 json | The Event Tickets Manager for WooCommerce WordPress plugin before 1.6.0 does not perform authorisation or a valid nonce check... | |
| CVE-2026-122062 json | The Pronamic Pay WordPress plugin before 11.1.0, Pronamic Pay doneren met Mollie WordPress plugin before 1.7.1 do not restric... | |
| CVE-2026-122060 json | The WP Recipe Maker WordPress plugin before 10.9.2 does not check whether the post a recipe is embedded in is password protec... | |
| CVE-2026-114432 json | The Contact Form 7 WordPress plugin before 6.2.4 does not validate the type or extension of files uploaded through a form fil... | |
| CVE-2026-110963 json | The Userplace WordPress plugin through 1.2.0 does not perform authorization checks on an AJAX action available to unauthenti... | |
| CVE-2026-97195 json | The Secure Custom Fields WordPress plugin before 6.9.8 does not sanitize a persisted field definition before emitting part of... | |
| CVE-2026-97194 json | The Secure Custom Fields WordPress plugin before 6.9.8 does not perform a read-permission check when it renders and formats t... | |
| CVE-2026-97193 json | The Secure Custom Fields WordPress plugin before 6.9.8 does not verify that a user is allowed to edit the target object befor... | |
| CVE-2026-97192 json | The Secure Custom Fields WordPress plugin before 6.9.8 does not re-apply its field-group location rules when persisting value... | |
| CVE-2026-96963 json | The Pie Register WordPress plugin through 3.8.4.15 does not perform an authorisation check in one of its AJAX actions, allow... | |
| CVE-2026-96961 json | The Pie Register WordPress plugin through 3.8.4.15 does not perform any capability, nonce or authentication check on one of ... | |
| CVE-2026-85344 json | The FV Flowplayer Video Player WordPress plugin before 7.5.57.7212 does not perform any authorization check on an AJAX action... | |
| CVE-2026-110132 json | The Sync Post With Other Site WordPress plugin before 1.9.4 does not properly authorize a content-management action for post ... |