CVE.report
CVE.report is the most up-to-date database of common vulnerabilities and exposures. Information is pulled in from several sources and processed in to a mobile friendly, easy to use page. Use the site to quickly check for vulnerabilities in products such as operating systems, applications, hardware, networks, databases, browsers, e-mail clients and more.
CVEs provide a unique and common naming scheme for publicly known cyber security vulnerabilities in order to quickly identify and share these vulnerabilities. You can use the search below to look for vulnerabilities based on product, vendor, or common tags
The form you will see after following this link allows you to fill out the various variables in the CVSS scoring system and receive the corresponding score. The description of each of the variables is also included for additional information.
cve.report now provides a free read-only JSON API for CVE details. Each record combines the CVE Program JSON record, NVD enrichment, KEV, and EPSS when available.
Recent CVEs
| CVE | Description | Updated |
|---|---|---|
| CVE-2026-9869 json | A stack-based buffer overflow vulnerability exists in the boa formTR069Config functionality of X2000R (version(s): TOTOLINK-X... | |
| CVE-2026-9827 json | A arbitrary file write vulnerability exists in the boa formUploadFile functionality of X2000R (version(s): TOTOLINK-X2000R-Gh... | |
| CVE-2026-9817 json | A stack-based buffer overflow vulnerability exists in the boa formUploadFile functionality of X2000R (version(s): TOTOLINK-X2... | |
| CVE-2026-9814 json | An OS command injection vulnerability exists in the boa formWizard newPass functionality of X2000R (version(s): TOTOLINK-X200... | |
| CVE-2026-9660 json | Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formFilter functionality of X2000R (version... | |
| CVE-2026-9659 json | Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formFilter functionality of X2000R (version... | |
| CVE-2026-94266 json | libcurl could accidentally return a URL for `curl_easy_getinfo()`'s `CURLINFO_EFFECTIVE_URL` option containing credentials, e... | |
| CVE-2026-94265 json | When processing an HTTP redirect to a URL containing userinfo (a `username:password` component), curl might erroneously retai... | |
| CVE-2026-92391 json | A deeply nested multipart MIME structure constructed via the public API causes a stack overflow in libcurl during normal clea... | |
| CVE-2026-92390 json | When invoked with `--remote-header-name` (`-J`), curl fails to preserve its documented anti-clobbering protection if an inter... | |
| CVE-2026-92389 json | libcurl's TFTP state machine fails to validate state transitions against the requested transfer direction, accepting opening ... | |
| CVE-2026-92388 json | When an FTP wildcard `LIST` operation fails, libcurl omits the restoration path meant for successful listings, leaving the wr... | |
| CVE-2026-92387 json | By permanently omitting the final control-response line, a malicious FTP, IMAP, POP3, or SMTP server can exploit libcurl and ... | |
| CVE-2026-92386 json | When writing a long cookie name and value to a Netscape cookie jar, a remote HTTP server can make `curl` write a record that ... | |
| CVE-2026-87866 json | When built with wolfSSL, curl can successfully validate a pinned public key hash against a key the TLS peer does not possess.... | |
| CVE-2026-87865 json | When libcurl uses libssh2 with a hashed `known_hosts` file, an unrelated initial entry can cause host key validation to repor... | |
| CVE-2026-87864 json | Enabling `CURLOPT_CRLF` causes curl to advertise the raw input byte count in the `IMAP APPEND {N}` literal while transmitting... | |
| CVE-2026-87863 json | An authenticated HTTPS origin can supply an HSTS `max-age` value that the parser accepts, but time serialization later fails ... | |
| CVE-2026-87862 json | Importing a `includeSubDomains` parent HSTS entry before a longer-lived child entry, silently drops the child. Consequently, ... | |
| CVE-2026-87861 json | When using ambient user credentials, an HTTP request directed to one origin may be dispatched over a connection previously au... | |
| CVE-2026-86415 json | libcurl's connection cache match function never considers the automatic client certificate option, so a cached, already authe... | |
| CVE-2026-86414 json | An HTTP proxy can trick libcurl into sending the origin's credentials (Basic password, or a Negotiate/Kerberos ticket) to the... | |
| CVE-2026-42026 json | Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup dhcp_dns functionality of X20... | |
| CVE-2026-42025 json | Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup dhcp_dns functionality of X20... | |
| CVE-2026-42024 json | Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functionalit... | |
| CVE-2026-42023 json | Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functionalit... | |
| CVE-2026-42022 json | Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functionalit... | |
| CVE-2026-42021 json | Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functionalit... | |
| CVE-2026-42020 json | Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup pppoe functionality of Totolink X2000R TO... | |
| CVE-2026-42019 json | Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup pppoe functionality of Totolink X2000R TO... | |
| CVE-2026-41223 json | A stack-based buffer overflow vulnerability exists in the boa formMapDelDevice macstr functionality of X2000R (version(s): TO... | |
| CVE-2026-41222 json | A stack-based buffer overflow vulnerability exists in the boa formParentControl url functionality of X2000R (version(s): TOTO... | |
| CVE-2026-40627 json | An os command injection vulnerability exists in the boa formWsc targetAPSsid functionality of Totolink X2000R TOTOLINK-X2000R... | |
| CVE-2026-40615 json | A stack-based buffer overflow vulnerability exists in the boa formParentControl deviceName functionality of X2000R (version(s... | |
| CVE-2026-112712 json | @fastify/middie is the Express-style middleware engine for Fastify. In versions from 9.0.0 through 9.3.5, the use() function ... | |
| CVE-2026-112407 json | Incorrect privilege assignment in the IAM policy of AWS CICD-toolchain-for-serverless-applications 1.0.7 through 1.0.10 allow... | |
| CVE-2026-111758 json | markdown-it is a Markdown parser. From versions 14.1.0 to before 14.3.3, and 15.0.0 to before 15.0.3, a link reference defini... | |
| CVE-2026-110322 json | The PEAK-System PCAN type 0x4030 processing path fails to validate a selected/returned object pointer before dereferencing fi... | |
| CVE-2026-35499 json | An os command injection vulnerability exists in the boa formWsc peerRptPin functionality of Totolink X2000R TOTOLINK-X2000R-G... | |
| CVE-2026-33568 json | A OS command injection vulnerability exists in the boa formMapDelDevice macstr functionality of X2000R (version(s): TOTOLINK-... | |
| CVE-2026-28763 json | A stack-based buffer overflow vulnerability exists in the boa formMapDelDevice hostname functionality of X2000R (version(s): ... | |
| CVE-2026-10141 json | A Unsigned Firmware vulnerability exists in the boa Firmware Update functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V... | |
| CVE-2026-10139 json | A stack-based buffer overflow vulnerability exists in the Mcli functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0... | |
| CVE-2026-10138 json | A OS command injection vulnerability exists in the boa formUpload() functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V... | |
| CVE-2026-10137 json | A stack-based buffer overflow vulnerability exists in the boa formUpload() functionality of X2000R (version(s): TOTOLINK-X200... | |
| CVE-2026-10136 json | A heap-based buffer overflow vulnerability exists in the boa formUpload() functionality of X2000R (version(s): TOTOLINK-X2000... | |
| CVE-2026-10135 json | A OS command injection vulnerability exists in the batchupg functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B2... | |
| CVE-2026-10133 json | A stack-based buffer overflow vulnerability exists in the batchupg functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1... | |
| CVE-2026-10132 json | A stack-based buffer overflow vulnerability exists in the boa formIpQos mac functionality of X2000R (version(s): TOTOLINK-X20... | |
| CVE-2026-10131 json | An OS command injection vulnerability exists in the boa formPasswordSetup functionality of X2000R (version(s): TOTOLINK-X2000... | |
| CVE-2026-109576 json | The parser in PEAK-System PCAN driver correctly detected the malformed record, but the loop iterating the record list advance... | |
| CVE-2026-107929 json | When `CURLOPT_INTERFACE` (or the command line tool's `--interface` option) is set with one of the documented prefixes (`if!`,... | |
| CVE-2026-107928 json | When curl is built with GnuTLS, a malicious WebSocket server can make curl send memory past its send buffer. This is due to a... | |
| CVE-2026-105960 json | PEAK-System PCAN contains a vulnerable operation involving a variable-length receive-record copy. The driver uses a requested... | |
| CVE-2026-103672 json | The PEAK-System PCAN parser indexes a length table using attacker-controlled DLC without enforcing DLC <= 0x0f, then copies a... | |
| CVE-2026-101103 json | The PEAK-System PCAN diagnostic call did not validate that the caller-supplied output buffer was large enough to hold the out... | |
| CVE-2016-20104 json | EyeLock nano NXT 3.05.1193, 3.04.1108, 3.03.944, and 3.01.646 contain a path traversal vulnerability that allows unauthentica... | |
| CVE-2016-20103 json | Cherry Plugin for WordPress before 1.2.7 contains a path traversal vulnerability that allows unauthenticated attackers to dow... | |
| CVE-2016-20102 json | JavaMelody before 1.60.0 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inj... | |
| CVE-2016-20101 json | Issuu Panel plugin for WordPress before 1.6.6 contains a PHP file inclusion vulnerability that allows unauthenticated attacke... | |
| CVE-2016-20100 json | Memphis Documents Library plugin for WordPress before 3.1.6 contains a path traversal vulnerability that allows unauthenticat... | |
| CVE-2015-20128 json | FooSun DotNetCMS 1.0 and 2.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate MSSQ... | |
| CVE-2015-20125 json | Aspose PDF Exporter plugin for WordPress before 2.0 contains a path traversal vulnerability that allows unauthenticated attac... | |
| CVE-2015-20124 json | Aspose Importer & Exporter plugin for WordPress before 3.0 contains a path traversal vulnerability that allows unauthenticate... | |
| CVE-2015-20123 json | Aspose Doc Exporter plugin for WordPress before 2.0 contains a path traversal vulnerability that allows unauthenticated attac... | |
| CVE-2014-125134 json | ChurcHope theme for WordPress before 2.2 contains a path traversal vulnerability that allows unauthenticated attackers to dow... | |
| CVE-2014-125133 json | NativeChurch theme for WordPress before 1.6.2 contains a path traversal vulnerability that allows unauthenticated attackers t... | |
| CVE-2014-125132 json | Blogroll Fun plugin for WordPress before 0.8.5 contains a reflected cross-site scripting vulnerability that allows unauthenti... | |
| CVE-2014-125131 json | DedeCMS 5.6 and 5.7 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject s... | |
| CVE-2012-20005 json | SocialFit plugin for WordPress through 1.2.2 contains a reflected cross-site scripting vulnerability that allows unauthentica... | |
| CVE-2012-20004 json | K-news plugin for WordPress before 1.1.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated ... | |
| CVE-2012-20003 json | Custom Tables plugin for WordPress before 3.4.6 contains a reflected cross-site scripting vulnerability that allows unauthent... | |
| CVE-2026-112380 json | Missing authorization in the WhatsApp group channel in Kiro Crew might allow a remote actor who is a member of an operator-co... | |
| CVE-2026-107692 json | The War Thunder game client transmits its authentication bearer token (auth_jwt) in the very first data packet after the TCP ... | |
| CVE-2026-102182 json | A Stack-based Buffer Overflow vulnerability in the kmd component of Juniper Networks Junos OS on MX Series allows an unauthen... | |
| CVE-2012-20002 json | TinyMCE Thumbnail Gallery plugin for WordPress before 1.1.0 contains a path traversal vulnerability that allows unauthenticat... | |
| CVE-2026-107886 json | OpenPrinting CUPS before 2.4.20 contains a double-free in printer-class management. When CUPS-Add-Modify-Class replaces an ex... | |
| CVE-2026-107885 json | OpenPrinting CUPS through 2.4.20 contains a resource-exhaustion vulnerability in the submission-timeout handling of cupsdChec... | |
| CVE-2026-109679 json | FreeRDP 3.0.0-beta4 before 3.32.0 contains a NULL pointer dereference in arm_handle_request_ok when an ARM endpoint returns a... | |
| CVE-2026-109678 json | FreeRDP 3.0.0-beta1 before 3.32.0, when built with verbose WinPR assertions and using smartcard emulation, has a reachable as... | |
| CVE-2026-107806 json | Nginx UI is a web user interface for the Nginx web server. From 2.3.8 until 2.5.0, an authenticated administrator with an act... | |
| CVE-2026-107890 json | OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference caused by repeated IPP group tags in job-creation request... | |
| CVE-2026-107888 json | OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference in cupsdCheckJobs() when a job marked job-held-on-create ... | |
| CVE-2026-107805 json | Nginx UI is a web user interface for the Nginx web server. From 2.5.0 until 2.6.0, the node-signature authentication path per... | |
| CVE-2026-109680 json | FreeRDP 3.18.0 before 3.32.0 has a heap-based out-of-bounds write in freerdp_interruptible_get_line, which shrinks the buffer... | |
| CVE-2026-94132 json | Joomla Extension - acymailing.com - Remote Code Execution vulnerability in mailbox action feature in AcyMailing Enterprise ex... | |
| CVE-2026-94131 json | Joomla Extension - acymailing.com - Unauthenticated arbitrary file deletion in AcyMailing Enterprise extension < 11.1.0 - A s... | |
| CVE-2026-113869 json | When Thunderbird asked for a security device password (for example a smartcard PIN or the Primary Password) while decrypting ... | |
| CVE-2026-113868 json | When authenticating to a POP3 or SMTP server using NTLM, Thunderbird did not check whether the server's challenge was valid b... | |
| CVE-2026-113867 json | Thunderbird did not escape attribute values when serializing outgoing XMPP stanzas. Because values from incoming requests wer... | |
| CVE-2026-113866 json | When setting up an account, Thunderbird's Exchange AutoDiscover lookup also queried the domain's AutoDiscover service over pl... | |
| CVE-2026-113725 json | virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.7, the bash activate script escapes th... | |
| CVE-2026-113724 json | virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the safe_delete() deletion error ha... | |
| CVE-2026-113723 json | virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, caller-supplied prompt text can bec... | |
| CVE-2026-113722 json | virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, virtualenv's ScriptMakerCustom and ... | |
| CVE-2026-113721 json | virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, ViaTemplateActivator._generate() re... | |
| CVE-2026-86413 json | When using an *ambient user* in a first transfer doing Negotiate authentication and asked to follow redirects, curl could pas... | |
| CVE-2026-86412 json | A remote HTTP server can set a cookie that curl accepts and writes to a Netscape cookie jar but cannot reload. On the next in... | |
| CVE-2026-86411 json | An `ftp://` transfer configured with `CURLUSESSL_NONE` can reuse a pooled FTP control connection that a previous easy handle ... | |
| CVE-2026-86410 json | A flaw in the curl command line tool's logic makes it only set SSH host verification options when interacting directly using ... |