CVE.report
CVE.report is the most up-to-date database of common vulnerabilities and exposures. Information is pulled in from several sources and processed in to a mobile friendly, easy to use page. Use the site to quickly check for vulnerabilities in products such as operating systems, applications, hardware, networks, databases, browsers, e-mail clients and more.
CVEs provide a unique and common naming scheme for publicly known cyber security vulnerabilities in order to quickly identify and share these vulnerabilities. You can use the search below to look for vulnerabilities based on product, vendor, or common tags
The form you will see after following this link allows you to fill out the various variables in the CVSS scoring system and receive the corresponding score. The description of each of the variables is also included for additional information.
cve.report now provides a free read-only JSON API for CVE details. Each record combines the CVE Program JSON record, NVD enrichment, KEV, and EPSS when available.
Recent CVEs
| CVE | Description | Updated |
|---|---|---|
| CVE-2026-105903 json | ColdFusion is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arb... | |
| CVE-2026-105901 json | ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the conte... | |
| CVE-2026-105900 json | ColdFusion is affected by an Improper Input Validation vulnerability that could result in an application denial-of-service. A... | |
| CVE-2026-105897 json | ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Explo... | |
| CVE-2026-105751 json | Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem... | |
| CVE-2026-102779 json | Joomla Extension - joomlafry.com - Unauthenticated forced execution of published automation tasks in TF Content 2.9.0 - 2.9.4... | |
| CVE-2026-96915 json | Integer overflow or wraparound in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-105760 json | vLLM is an inference and serving engine for large language models. Prior to 0.30.0, a caller can use the request-level media_... | |
| CVE-2026-105759 json | vLLM is an inference and serving engine for large language models. Prior to 0.30.0, the Rust frontend's track_http_metrics mi... | |
| CVE-2026-93590 json | ImageMagick before 7.1.2-31 contains a policy bypass vulnerability in the UHDR encoder that fails to perform policy checks du... | |
| CVE-2026-77396 json | PJSIP is a free and open source multimedia communication library written in C. In 2.17 and earlier, the PJSIP AVI parser in p... | |
| CVE-2024-9375 json | The WordPress Captcha Plugin by Captcha Bank plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the ... | |
| CVE-2026-96620 json | Claude Agent SDK is a Python SDK for Claude Code. Prior to 0.2.121, the resume option is passed to the Claude CLI as a separa... | |
| CVE-2026-69080 json | Exposure of SQL Black List to an Unauthorized Actor vulnerability in Apache Kylin. This issue affects Apache Kylin: from 4... | |
| CVE-2026-69077 json | Exposure of unauthorized cross-project job manipulation vulnerability in Apache Kylin. Impact most to the kylin services th... | |
| CVE-2026-69076 json | Exposure of Job Discard to an Unauthorized Actor vulnerability in Apache Kylin. Impact most to the kylin services that are d... | |
| CVE-2026-68573 json | Improper Authentication vulnerability in Apache Kylin. Unauthenticated user may access to system cleanup actions. Impact mos... | |
| CVE-2026-68572 json | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Kylin. This issue affects Apache Kylin:... | |
| CVE-2026-61726 json | Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.12, StepVie... | |
| CVE-2026-111718 json | AipexBase through commit 690adb9 contains a sql injection vulnerability that allows attackers to inject SQL through the order... | |
| CVE-2026-111708 json | WhaTicket Community through commit cf04795 contains an authentication bypass vulnerability that allows unauthenticated attack... | |
| CVE-2026-111703 json | yshop-crm through 2.1.3 contains an insecure direct object reference vulnerability that allows authenticated sales users to a... | |
| CVE-2026-111698 json | HUIZHI ChargeOS cloud through 3.0.9 contains a missing authorization vulnerability in the hcp-mp PayController.xcxRecharge en... | |
| CVE-2026-108743 json | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Kylin. Im... | |
| CVE-2026-108709 json | Authentication bypass within in-house network in Apache Kylin. Impact most to the kylin services that are directly exposed t... | |
| CVE-2026-102834 json | JavaCV provides Java interfaces to OpenCV, FFmpeg, and other multimedia libraries. Prior to 1.5.14, IPCameraFrameGrabber doub... | |
| CVE-2026-102608 json | ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.38.3, downloadEvents() manually ... | |
| CVE-2026-102607 json | ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.38.3, the exportEvents() functio... | |
| CVE-2026-85231 json | A flaw was found in libtirpc. An authenticated remote attacker could exploit this vulnerability by sending oversized wrapped ... | |
| CVE-2026-59970 json | Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, passes ... | |
| CVE-2026-59966 json | Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, execute... | |
| CVE-2026-59963 json | Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, recipe ... | |
| CVE-2026-30971 json | ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.39.2, 1.38.2, and 1.36.40, ZoneM... | |
| CVE-2026-17275 json | IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote attacker to perform unauthorized manipulation of distributed transactions d... | |
| CVE-2026-111692 json | DataBuff ai-apm-web through 0.1.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to f... | |
| CVE-2026-111688 json | Exrick XBoot through 3.3.4 contains an authorization bypass vulnerability that allows authenticated users to evade role data-... | |
| CVE-2026-111687 json | WeRSS (we-mp-rss) through 1.5.3 contains a remote code execution vulnerability that allows unauthenticated attackers to run c... | |
| CVE-2026-111682 json | EFAK 5.0.0 through 5.1.0 contains a missing authorization vulnerability that allows authenticated low-privilege users to read... | |
| CVE-2026-111673 json | IceCMS through 4.1.5 contains a missing authentication vulnerability that allows unauthenticated attackers to modify, delete,... | |
| CVE-2026-111662 json | Chaskiq through 2.0.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the ... | |
| CVE-2026-111657 json | BeikeShop through 2.0.0.31 contains an insecure direct object reference vulnerability in the markAsShipped handler of RmaCont... | |
| CVE-2026-111652 json | Engineercms through 2.0.5 contains a missing authorization vulnerability in AttachController.Attachment that allows unauthent... | |
| CVE-2026-111647 json | PickMall lilishop through 5.0.0 contains an insecure direct object reference vulnerability that allows authenticated buyers t... | |
| CVE-2026-111642 json | FastapiAdmin through 3.0 contains a hard-coded JWT signing secret in backend/app/config/setting.py that allows low-privileged... | |
| CVE-2026-111637 json | NexoPOS through 6.2.4 contains a missing authentication vulnerability that allows unauthenticated attackers to read accountin... | |
| CVE-2026-111632 json | Aureus ERP through 1.6.0 contains an authorization bypass vulnerability that allows authenticated API users to create or move... | |
| CVE-2026-111627 json | HestiaCP before 1.10.5 contains an authorization bypass vulnerability that allows non-ROOT_USER administrators to perform wri... | |
| CVE-2026-111622 json | smart-sso through 2.1.1 contains an open redirect vulnerability in the /login handler that allows unauthenticated attackers t... | |
| CVE-2026-111617 json | WHartTest through 2.8.1 contains a missing authentication vulnerability that allows unauthenticated attackers to connect to t... | |
| CVE-2026-111612 json | netdisk-fast-download through 0.4.8 contains an information disclosure vulnerability that allows unauthenticated attackers to... | |
| CVE-2026-111607 json | Jeepay through 3.2.9 contains an insecure direct object reference vulnerability that allows authenticated merchant users to o... | |
| CVE-2026-111392 json | SGLang through 0.5.21 trusts caller-supplied mm_hashes values as the multimodal prefix-cache key, allowing remote attackers t... | |
| CVE-2026-111322 json | Archon 0.2.13 through 0.11.1 contains a missing authentication vulnerability that allows unauthenticated attackers to access ... | |
| CVE-2026-111284 json | Aureus ERP through 1.6.0 contains a stored cross-site scripting vulnerability in HolidayAction.php that allows authenticated ... | |
| CVE-2026-111279 json | Dragonfly through 2.0.2 contains an unbounded memory allocation vulnerability that allows unauthenticated clients to exhaust ... | |
| CVE-2026-111273 json | unarr through 1.1.1 contains an off-by-one heap-based buffer overflow in tar_get_name() in tar/parse-tar.c, reachable through... | |
| CVE-2026-109839 json | IBM Db2 Genius Hub 1.0 could allow a remote authenticated attacker to bypass security restrictions due to a missing initializ... | |
| CVE-2026-109838 json | IBM Db2 Genius Hub 1.0 could allow a local attacker to obtain sensitive information due to improper verification of cryptogr... | |
| CVE-2026-102693 json | RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. P... | |
| CVE-2026-88755 json | Z.ai ZCode v3.11.2.6792 was discovered to automatically establish connections with MCP servers declared inside a repository's... | |
| CVE-2026-57488 json | pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.2, raw_to_int in upnp/src/genlib/... | |
| CVE-2026-55862 json | pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.0, multiple ixml DOM traversal fu... | |
| CVE-2024-58397 json | MP4v2 through 2.1.3 contains a heap-based out-of-bounds read in MP4File::GetChapters() that allows attackers to read past hea... | |
| CVE-2026-111252 json | A denial of service vulnerability exists in the XML parsing of multiple versions of OpenNMS Meridian and Horizon. OpenNMS par... | |
| CVE-2026-111235 json | An authorization bypass vulnerability exists in the REST API of multiple versions of OpenNMS Meridian and Horizon. The /rest/... | |
| CVE-2026-111169 json | La Suite Docs through 6.0.1 contains an authorization bypass vulnerability that allows authenticated users to write comments ... | |
| CVE-2026-109932 json | undici is an HTTP client library for Node.js. In versions 5.15.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12... | |
| CVE-2026-107794 json | ExtUtils::Typemaps::STL::List versions before 1.07 for Perl allocate a 32 GiB array on an empty list. The OUTPUT typemaps ca... | |
| CVE-2026-105040 json | The EnergizeLab Eilik NestJS auth service accepts a user-controlled user ID in account update requests (mass assignment). A r... | |
| CVE-2026-105039 json | EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 do not check user roles on administrative APIs. Any... | |
| CVE-2026-105038 json | The EnergizeLab Eilik and EilikO FastAPI AI inference and profiling services expose AI model administration functions without... | |
| CVE-2026-105037 json | EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 allow any registered, low-privilege account to read... | |
| CVE-2026-105036 json | EnergizeLab AI Station firmware, EilikO Linux robot firmware v2.1_20260617182218_release, and the EnergizeLab Windows desktop... | |
| CVE-2026-105035 json | The EnergizeLab FirmwareUpdater (AArch64 ELF, distributed in the CDN bin.zip) uses a single hard-coded AES key shared by all ... | |
| CVE-2026-105034 json | The EnergizeLab Eilik NestJS auth service issues device tokens for arbitrary robot serial numbers without authentication. An ... | |
| CVE-2026-105033 json | The EnergizeLab AI Station (RK3562) firmware image ships with default root credentials and SSH enabled. An attacker with netw... | |
| CVE-2026-105032 json | The EnergizeLab Eilik and EilikO AI skill upload endpoint, served by the FastAPI AI inference and profiling services, does no... | |
| CVE-2026-89912 json | In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-its: Don't dereference a NULL collectio... | |
| CVE-2026-89763 json | In the Linux kernel, the following vulnerability has been resolved: KEYS: trusted: Fix TPM teardown ordering trusted_tpm_ex... | |
| CVE-2026-87029 json | undici is an HTTP client library for Node.js. In versions 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1, its decompress inte... | |
| CVE-2026-87018 json | undici is an HTTP client library for Node.js. In versions 4.2.1 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.... | |
| CVE-2026-89713 json | In the Linux kernel, the following vulnerability has been resolved: NFSD: check truncate permission under inode lock nfsd_s... | |
| CVE-2026-89711 json | In the Linux kernel, the following vulnerability has been resolved: NFSD: remove flawed WARN_ON_ONCE from nfsd_mode_check T... | |
| CVE-2026-89709 json | In the Linux kernel, the following vulnerability has been resolved: lockd, nfsd: RCU-protect nlmsvc_ops dispatch nlmsvc_ops... | |
| CVE-2026-89708 json | In the Linux kernel, the following vulnerability has been resolved: nfsd: RCU-protect cl_cb_session to fix use-after-free on... | |
| CVE-2026-89707 json | In the Linux kernel, the following vulnerability has been resolved: nfsd: release path refs on follow_down() error nfsd_cro... | |
| CVE-2026-89699 json | In the Linux kernel, the following vulnerability has been resolved: nfsd: validate symlink target length in NFSv4 CREATE nf... | |
| CVE-2026-89697 json | In the Linux kernel, the following vulnerability has been resolved: nfsd: add fh_want_write() for early-verified SETATTR in ... | |
| CVE-2026-89686 json | In the Linux kernel, the following vulnerability has been resolved: nfsd: fix BUG_ON in nfsd4_alloc_layout_stateid on racing... | |
| CVE-2026-89685 json | In the Linux kernel, the following vulnerability has been resolved: nfsd: fix clock domain mismatch in clients_still_reclaim... | |
| CVE-2026-89676 json | In the Linux kernel, the following vulnerability has been resolved: nfsd: fix stale s2s_cp_stateids IDR entry for async COPY... | |
| CVE-2026-89675 json | In the Linux kernel, the following vulnerability has been resolved: nfsd: fix UAF in async copy cancel and shutdown An asyn... | |
| CVE-2026-89672 json | In the Linux kernel, the following vulnerability has been resolved: nfsd: gate nfs2 setacl by argp->mask The NFSACL v2 SETA... | |
| CVE-2026-89671 json | In the Linux kernel, the following vulnerability has been resolved: nfsd: gate nfs3 setacl by argp->mask nfsd3_proc_setacl(... | |
| CVE-2026-89665 json | In the Linux kernel, the following vulnerability has been resolved: nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREA... | |
| CVE-2026-89662 json | In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent lock owner use-after-free during client te... | |
| CVE-2026-89659 json | In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during delegation re... | |
| CVE-2026-89656 json | In the Linux kernel, the following vulnerability has been resolved: libceph: reject buckets with mismatched CRUSH ids crush... | |
| CVE-2026-89655 json | In the Linux kernel, the following vulnerability has been resolved: ceph: fix UAF in __kick_flushing_caps() on cf entry free... | |
| CVE-2026-89654 json | In the Linux kernel, the following vulnerability has been resolved: ceph: fix UAF in check_new_map() on session freed during... |