CVE.report
CVE.report is the most up-to-date database of common vulnerabilities and exposures. Information is pulled in from several sources and processed in to a mobile friendly, easy to use page. Use the site to quickly check for vulnerabilities in products such as operating systems, applications, hardware, networks, databases, browsers, e-mail clients and more.
CVEs provide a unique and common naming scheme for publicly known cyber security vulnerabilities in order to quickly identify and share these vulnerabilities. You can use the search below to look for vulnerabilities based on product, vendor, or common tags
The form you will see after following this link allows you to fill out the various variables in the CVSS scoring system and receive the corresponding score. The description of each of the variables is also included for additional information.
cve.report now provides a free read-only JSON API for CVE details. Each record combines the CVE Program JSON record, NVD enrichment, KEV, and EPSS when available.
Recent CVEs
| CVE | Description | Updated |
|---|---|---|
| CVE-2026-111865 json | A security flaw has been discovered in THU-MIG yoloe up to 40cd606cabdbe2b566d6f14a6b162c89206e9a1b. This affects the functio... | |
| CVE-2026-85977 json | A flaw was found in libtirpc. A remote attacker can exploit this vulnerability by sending specially crafted PMAPPROC_DUMP rep... | |
| CVE-2026-111934 json | Coder before 2.34.7 contains an IP spoofing vulnerability in the ExtractRealIPAddress middleware that trusts the leftmost, cl... | |
| CVE-2026-111933 json | Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contains a user enumeration vulner... | |
| CVE-2026-111932 json | Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contains a stored HTML injection v... | |
| CVE-2026-111931 json | Coder from 2.0.0 before 2.34.8 contains an open redirect vulnerability in handleAPIKeySmuggling that allows attackers to redi... | |
| CVE-2026-111930 json | Coder from 2.26.0 before 2.34.8 contains an incorrect authorization flaw in the GET /api/v2/workspaces/{id}/acl endpoint, whi... | |
| CVE-2026-111929 json | Coder from 2.30.0 before 2.34.8 contains an authorization bypass vulnerability in the provisioner daemon DownloadFile gRPC ha... | |
| CVE-2026-111928 json | Coder from 2.0.0 before 2.34.8 contains an incorrect authorization vulnerability in the acl_allow rule of coderd/rbac/policy.... | |
| CVE-2026-111927 json | Coder before 2.29.20, 2.33.0 before 2.33.12, 2.34.0 before 2.34.8, and 2.35.0 before 2.35.4 contains an improper hostname val... | |
| CVE-2026-111926 json | Coder from 2.10.0 before 2.34.8 has an unauthenticated agent debug HTTP server on 127.0.0.1:2113 whose /debug/manifest handle... | |
| CVE-2026-111924 json | Fleet before 4.83.0 contains a denial of service vulnerability that allows unauthenticated attackers to exhaust server memory... | |
| CVE-2026-111923 json | Fleet before 4.89.0 contains an unbounded recursion vulnerability in Apple MDM enrollment property list parsing that allows u... | |
| CVE-2026-111922 json | Vikunja from 2.2.0 before 2.7.0 contains a permissive CORS configuration that trusts every localhost and 127.0.0.1 port with ... | |
| CVE-2026-111921 json | Vikunja 0.13.0 before 2.7.0 contains an incorrect authorization vulnerability that allows project members with Write permissi... | |
| CVE-2026-111920 json | Vikunja 2.6.0 contains a broken access control flaw in getProjectAccessForUser (pkg/models/project_access.go), which resolves... | |
| CVE-2026-111919 json | Vikunja 0.22.0 before 2.7.0 contains an improper access revocation vulnerability that allows removed collaborators to keep re... | |
| CVE-2026-111918 json | Vikunja from 1.0.0-rc0 before 2.7.0 contains an improper authorization vulnerability in RecalculateTaskPositions that allows ... | |
| CVE-2026-111917 json | Vikunja 2.3.0 before 2.7.0 contains an improper session validation vulnerability that allows attackers to keep WebSocket acce... | |
| CVE-2026-111916 json | Admidio before 5.0.16 contains an information disclosure vulnerability that allows unauthenticated attackers to view role-res... | |
| CVE-2026-111914 json | Admidio from 5.0.11 before 5.0.16 contains a broken access control vulnerability in modules/inventory/inventory_data.php that... | |
| CVE-2026-111913 json | Admidio from 5.0.0 before 5.0.16 contains an authorization bypass vulnerability that allows authenticated users to export lis... | |
| CVE-2026-111912 json | Admidio from 5.0.0 before 5.0.16 contains an insecure direct object reference vulnerability in ForumService::saveTopic() that... | |
| CVE-2026-111911 json | phpMyFAQ 4.0.0 before 4.1.9 contains an authentication bypass vulnerability where WebAuthn registration endpoints attach cred... | |
| CVE-2026-111910 json | phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an authorization bypass vulnerability in attachment.php that... | |
| CVE-2026-111909 json | phpMyFAQ before 4.1.9 contains a missing authorization vulnerability in the deleteUser() API that allows authenticated non-su... | |
| CVE-2026-111908 json | phpMyFAQ 4.0.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a broken object-level authorization vulnerability in t... | |
| CVE-2026-111907 json | phpMyFAQ 4.0.0 before 4.1.9 contains a cross-site request forgery vulnerability in the POST /admin/api/update-database endpoi... | |
| CVE-2026-111906 json | phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a cross-site request forgery vulnerability in the Elasticsea... | |
| CVE-2026-111905 json | phpMyFAQ 3.2.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an insecure direct object reference vulnerability in G... | |
| CVE-2026-111904 json | phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an information disclosure vulnerability that allows unauthenticated attackers... | |
| CVE-2026-111903 json | phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains a stored cross-site scripting vulnerability in SvgSanitizer that allows users... | |
| CVE-2026-111902 json | phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authorization bypass vulnerability in isFaqAccessibleForUser() that treats... | |
| CVE-2026-111901 json | phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an uncontrolled resource consumption vulnerability in the unauthenticated faq... | |
| CVE-2026-111900 json | phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an improper authorization vulnerability in attachment.php th... | |
| CVE-2026-111898 json | phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authentication bypass vulnerability that allows Keycloak users to take ove... | |
| CVE-2026-111897 json | phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authorization bypass vulnerability that allows category-restricted editors... | |
| CVE-2026-111896 json | phpMyFAQ from 4.2.0-alpha before 4.2.0-beta contains a stored cross-site scripting vulnerability in SvgSanitizer that allows ... | |
| CVE-2026-111895 json | phpMyFAQ 3.2.0 before 4.0.0 and 4.0.2 before 4.2.0-beta contains an authentication bypass in its Microsoft Entra ID login flo... | |
| CVE-2026-111894 json | phpMyFAQ 3.2.1 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a stored cross-site scripting vulnerability that allow... | |
| CVE-2026-111893 json | phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains a privilege escalation vulnerability in GroupController::saveCategoryRestrict... | |
| CVE-2026-111892 json | phpMyFAQ 4.2.0-alpha before 4.2.0-beta lacks effective rate limiting on the unauthenticated user/password/update and user/pas... | |
| CVE-2026-111891 json | phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta contains a privilege escalation vulnerability in the group permission API, whos... | |
| CVE-2026-111890 json | phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta contains a privilege escalation vulnerability in UserController::updateUserRigh... | |
| CVE-2026-111889 json | phpMyFAQ from 4.1.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a missing authorization vulnerability in the admi... | |
| CVE-2026-111888 json | phpMyFAQ from 4.0.0 before 4.1.9 contains an incorrect authorization vulnerability that allows delegated admins lacking the e... | |
| CVE-2026-111887 json | phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an account enumeration vulnerability that allows unauthentic... | |
| CVE-2026-111886 json | phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta lacks brute-force lockout in the removeTwofactorConfig() 2FA removal endpoint, ... | |
| CVE-2026-111885 json | phpMyFAQ from 4.2.0-alpha before 4.2.0-beta contains a missing authorization vulnerability in GroupController::deleteGroup() ... | |
| CVE-2026-111884 json | phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta does not require the current password when changing an account e-mail... | |
| CVE-2026-111882 json | phpMyFAQ 3.2.0-alpha before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an authentication bypass vulnerability that allo... | |
| CVE-2026-111881 json | FreeRDP from 3.14.1 before 3.32.0 contains an integer underflow in the WinPR BMP writer, where a mismatched stride calculatio... | |
| CVE-2026-111880 json | FreeRDP versions from 2.0.0 before 3.32.0 contain a heap out-of-bounds write in the server hash-callback NTLM path that fails... | |
| CVE-2026-110882 json | Missing Authorization vulnerability in Cozy Vision Technologies Pvt. Ltd. SMS Alert Order Notifications sms-alert allows Expl... | |
| CVE-2025-71435 json | Coder before 2.23.0 contains a session expiration bypass vulnerability that allows authenticated users to retain access after... | |
| CVE-2024-58398 json | Coder 2.3.1 before 2.14.4, 2.15.x before 2.15.3, and 2.16.0 before 2.16.1 contains an open redirect vulnerability in the logi... | |
| CVE-2025-55640 json | A heap buffer overflow in the stbl_AddSize function (isomedia/stbl_write.c) of GPAC MP4Box v2.4 allows attackers to cause a D... | |
| CVE-2026-109701 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PAYCOMET PAYCOMET for W... | |
| CVE-2026-17591 json | A flaw was found in libarchive. An attacker can cause a Denial of Service (DoS) or potential information disclosure due to a ... | |
| CVE-2026-108334 json | A flaw was found in the internal WebAssembly (WASM) shim used by the Kuadrant operator. When generating the CEL predicate tha... | |
| CVE-2026-110889 json | Generation of Error Message Containing Sensitive Information vulnerability in Gantry Gantry 5 Framework gantry5 allows Retrie... | |
| CVE-2026-110936 json | A vulnerability has been identified in Siemens Software Center (All versions < V4.0.9.8). The affected application loads dyna... | |
| CVE-2026-94177 json | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ruben Garcia GamiPress ... | |
| CVE-2026-93485 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic WordPress wo... | |
| CVE-2026-111110 json | The Payment forms, Buy now buttons, and Invoicing System | GetPaid plugin for WordPress is vulnerable to Stored Cross-Site Sc... | |
| CVE-2026-110253 json | The weForms – Easy Drag & Drop Contact Form Builder For WordPress plugin for WordPress is vulnerable to limited media file ... | |
| CVE-2026-109983 json | The YMC Filter plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'post_title' parameter in ... | |
| CVE-2026-100316 json | The European VAT Compliance Assistant for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via C... | |
| CVE-2026-110384 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Heateor Support Fancy C... | |
| CVE-2026-10813 json | A flaw has been found in LMCache up to 0.5.4. This affects the function hex_hash_to_int16 of the file lmcache/integration/vll... | |
| CVE-2026-110527 json | The WP User Manager WordPress plugin before 2.9.20 does not roll back the WordPress account it creates during payment-gated ... | |
| CVE-2026-106470 json | The WP Data Access WordPress plugin before 5.5.88 does not have authorisation and CSRF checks in one of its actions, allowin... | |
| CVE-2026-104246 json | The Contact Form 7 Signature Addon WordPress plugin through 4.2.2 does not sanitize a signature field value before building a... | |
| CVE-2026-104122 json | The Ukr-To-Lat WordPress plugin through 1.3.5 does not sanitize and escape a term name before using it in a SQL query, allowi... | |
| CVE-2026-103376 json | The PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net, NMI) WordPress ... | |
| CVE-2026-97314 json | The ThirstyAffiliates WordPress plugin before 3.12.1 does not check the status or type of the object requested by its link r... | |
| CVE-2026-92433 json | The Patreon WordPress plugin before 1.10.0 does not verify a nonce when connecting the site to a Patreon account, allowing at... | |
| CVE-2026-92432 json | The Patreon WordPress plugin before 1.10.0 does not validate a user-supplied redirect destination before redirecting, allowin... | |
| CVE-2026-92431 json | The Patreon WordPress plugin before 1.10.0 does not perform an authorization check on some of its functionality, allowing una... | |
| CVE-2026-91074 json | The BSK PDF Manager WordPress plugin through 3.8.1 does not properly sanitise and escape a parameter before using it in a SQL... | |
| CVE-2026-81344 json | The ACF Frontend Admin by DynamiApps WordPress plugin through 3.29.13 does not restrict which PHP classes may be instantiated... | |
| CVE-2026-81343 json | The ACF Frontend Admin by DynamiApps WordPress plugin through 3.29.13 does not perform a capability check on one of its form-... | |
| CVE-2026-111726 json | The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'visible' Shortcode Attribute in al... | |
| CVE-2026-110268 json | The Post Export Import with Media plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and includ... | |
| CVE-2026-96660 json | The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User... | |
| CVE-2026-92978 json | The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User... | |
| CVE-2026-92798 json | The User Registration & Membership plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and... | |
| CVE-2026-92715 json | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference... | |
| CVE-2026-109989 json | The Themify Popup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'popup_width_unit' parameter in a... | |
| CVE-2026-109985 json | The xSpeed Cache: AI-Powered Performance Hub with MCP, Caching & CDN plugin for WordPress is vulnerable to Stored Cross-Site ... | |
| CVE-2026-109369 json | The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to authorization bypass in all versions up to, ... | |
| CVE-2026-109368 json | The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in all versio... | |
| CVE-2026-108452 json | Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office SharePoint allows an autho... | |
| CVE-2026-108451 json | Numeric truncation error in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-108450 json | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-108449 json | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-108448 json | Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-108123 json | The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to authorization bypass in all versions up to, ... | |
| CVE-2026-107752 json | The Welcart e-Commerce plugin for WordPress is vulnerable to generic SQL Injection via the 'wp_usces_order_old (JSON fields s... | |
| CVE-2026-107744 json | The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to authorizatio... |