CVE.report
CVE.report is the most up-to-date database of common vulnerabilities and exposures. Information is pulled in from several sources and processed in to a mobile friendly, easy to use page. Use the site to quickly check for vulnerabilities in products such as operating systems, applications, hardware, networks, databases, browsers, e-mail clients and more.
CVEs provide a unique and common naming scheme for publicly known cyber security vulnerabilities in order to quickly identify and share these vulnerabilities. You can use the search below to look for vulnerabilities based on product, vendor, or common tags
The form you will see after following this link allows you to fill out the various variables in the CVSS scoring system and receive the corresponding score. The description of each of the variables is also included for additional information.
cve.report now provides a free read-only JSON API for CVE details. Each record combines the CVE Program JSON record, NVD enrichment, KEV, and EPSS when available.
Recent CVEs
| CVE | Description | Updated |
|---|---|---|
| CVE-2026-115303 json | The Contact Form by Supsystic WordPress plugin before 1.11.1 does not strip CR/LF characters or re-validate submitted field v... | |
| CVE-2026-114358 json | This vulnerability exists in the Radius Xenia M2M Platform due to insufficient validation of user supplied input in the passw... | |
| CVE-2026-114236 json | storage/pkg/archive.ApplyLayer and ApplyUncompressedLayer may, when processing corrupt or malicious inputs, leak a file descr... | |
| CVE-2026-85498 json | A flaw was found in polkit. When processing input that begins with a null byte, an arithmetic error in the authentication age... | |
| CVE-2026-7190 json | A cross-site scripting (XSS) vulnerability in the ICTBroadcast software, which affects the demo environment. The vulnerabilit... | |
| CVE-2025-49794 json | A use-after-free vulnerability was found in libxml2. This issue occurs when parsing XPath elements under certain circumstance... | |
| CVE-2026-117174 json | Rejected reason: VUL-2026-008368 為先回報之相同問題 | |
| CVE-2025-62841 json | An use of hard-coded cryptographic key vulnerability has been reported to affect HBS 3 Hybrid Backup Sync and Hybrid Backup S... | |
| CVE-2025-62839 json | An use of hard-coded cryptographic key vulnerability has been reported to affect HBS 3 Hybrid Backup Sync and Hybrid Backup S... | |
| CVE-2026-32557 json | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BookingWP WooCommerce A... | |
| CVE-2024-0340 json | A vulnerability was found in vhost_new_msg in drivers/vhost/vhost.c in the Linux kernel, which does not properly initialize m... | |
| CVE-2026-118030 json | A flaw was found in the HOTP authentication mechanism of the keycloak-services component, which provides identity and access ... | |
| CVE-2026-117859 json | A flaw was found in the Pushed Authorization Request PAR implementation of the keycloak-services component. The issue occurs ... | |
| CVE-2026-117688 json | A flaw was found in the client registration component of Keycloak, an open-source identity and access management solution. Wh... | |
| CVE-2026-117627 json | A flaw was found in the JWT Authorization Grant implementation of the keycloak-services component. When an OIDC or Google ide... | |
| CVE-2026-117548 json | A NULL pointer dereference flaw was found in 389-ds-base. This flaw occurs when a ModifyDN (rename) operation uses an attribu... | |
| CVE-2026-97320 json | A flaw has been found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. The affected element is the function AiKnowledgeDo... | |
| CVE-2024-3727 json | A flaw was found in the github.com/containers/image library. This flaw allows attackers to trigger unexpected authenticated r... | |
| CVE-2024-3056 json | A flaw was found in Podman. This issue may allow an attacker to create a specially crafted container that, when configured to... | |
| CVE-2024-1394 json | A memory leak flaw was found in Golang in the RSA encrypting/decrypting code, which might lead to a resource exhaustion vulne... | |
| CVE-2026-93293 json | The Password Protected plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the bundled Freemius SDK's purch... | |
| CVE-2026-118905 json | Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.31.2 thr... | |
| CVE-2026-115302 json | The Contact Form by Supsystic WordPress plugin before 1.11.1 does not restrict access to an AJAX action that deletes stored ... | |
| CVE-2026-115301 json | The Contact Form by Supsystic WordPress plugin before 1.11.1 does not sandbox the template engine used to render its forms a... | |
| CVE-2026-115300 json | The Contact Form by Supsystic WordPress plugin before 1.11.1 does not validate a CSRF token or request origin on two adminis... | |
| CVE-2026-115299 json | The Contact Form by Supsystic WordPress plugin before 1.11.1 does not verify a CSRF nonce before saving its mail settings, a... | |
| CVE-2026-115282 json | The Recipe Card Blocks Lite WordPress plugin before 3.6.4 does not perform an authorization check before rendering posts thro... | |
| CVE-2026-115259 json | The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.6.0 does not have proper authorization checks when u... | |
| CVE-2026-115245 json | The Chat AI with Dispatcher WordPress plugin before 2.4 does not properly validate uploaded files, relying only on a spoofabl... | |
| CVE-2026-114488 json | A flaw was found in Wildfly. A remote attacker can bypass authentication on IIOP EJB invocations as the CSIv2 security interc... | |
| CVE-2026-114270 json | The GeoDirectory WordPress plugin before 2.8.197 does not honour post password protection when rendering a listing, allowing... | |
| CVE-2026-113617 json | The Automated Import Products to Cart WordPress plugin before 1.0.4 does not sanitize a user-supplied file path before using ... | |
| CVE-2026-113616 json | The LogixFast Auth WordPress plugin before 1.0.4 does not deliver its password-reset one-time code to the resolved account's ... | |
| CVE-2026-111739 json | The Two Factor Authentication WordPress plugin before 1.17.0, All-In-One Security (AIOS) WordPress plugin before 5.5.0 do no... | |
| CVE-2026-110983 json | The WP Photo Album Plus WordPress plugin before 9.3.04.004 does not verify the origin or a security token for one of its comm... | |
| CVE-2026-110505 json | The Enable SVG, WebP, and ICO Upload WordPress plugin before 1.1.6 does not prevent animation elements in uploaded SVG files ... | |
| CVE-2026-89216 json | The vTables WordPress plugin before 0.3 does not properly sanitise and escape a parameter before using it in a SQL statement... | |
| CVE-2026-88928 json | The PAYCOMET for WooCommerce WordPress plugin before 5.46 does not verify the cryptographic signature on its payment notifica... | |
| CVE-2026-86794 json | The Community Events WordPress plugin before 1.6.0 does not have authorisation or nonce checks when processing public event s... | |
| CVE-2026-85007 json | The Video Player for YouTube WordPress plugin before 2.1.4 does not perform a capability check on its player-preset AJAX han... | |
| CVE-2026-78396 json | The Link Library WordPress plugin before 7.10.0 does not verify that a requested link belongs to the settings set whose displ... | |
| CVE-2026-78395 json | The Link Library WordPress plugin before 7.10.0 does not re-check the selected library's own login requirement when processin... | |
| CVE-2026-19610 json | A flaw was found in the platform-mbean component of JBoss EAP, which provides management access to JVM-level metrics and conf... | |
| CVE-2026-15564 json | Wildfly's IIOP listener may permit deserialization of input streams before authentication is performed. An attacker who can g... | |
| CVE-2026-110504 json | The Enable SVG, WebP, and ICO Upload WordPress plugin before 1.1.6 does not sanitize uploaded SVG files whose content is not ... | |
| CVE-2026-110030 json | The Hide Price Until Login WordPress plugin before 1.1.2 does not restrict a guest-registration handler and does not honour t... | |
| CVE-2026-108763 json | The Wallet System for WooCommerce WordPress plugin before 2.8.2 does not restrict its KYC document submission handler to the... | |
| CVE-2026-108686 json | The WP Post Author WordPress plugin before 4.2.0 does not restrict the integration settings it returns to visitors, allowing... | |
| CVE-2026-108685 json | The WP Post Author WordPress plugin before 4.2.0 does not check that the account was created before updating its profile dur... | |
| CVE-2026-105258 json | The Appointment Booking Plugin WordPress plugin before 5.7.6 does not escape several booking-form step content settings befo... | |
| CVE-2026-103693 json | The Frontend Dashboard WordPress plugin before 3.0.5, ProfileGrid WordPress plugin before 6.0.0.5 do not prevent an unauthen... | |
| CVE-2026-102010 json | A flaw was found in GCC. When an application calls the erase_if function on a binary heap priority queue in libstdc++, the li... | |
| CVE-2026-87853 json | A flaw was found in SSSD's IdP authentication provider. The eval_access_token_buf() function compares the OIDC subject identi... | |
| CVE-2026-58014 json | A flaw was found in GLib. An off-by-one error can occur in the g_key_file_get_locale_string_list function in the gkeyfile.c f... | |
| CVE-2026-42013 json | A flaw was found in gnutls. When validating certificates, an oversized Subject Alternative Name (SAN) could cause the validat... | |
| CVE-2026-5260 json | A flaw was found in libgnutls. A remote attacker, by sending an extremely short premaster secret during an RSA key exchange t... | |
| CVE-2024-3586 json | The LetterPress WordPress plugin before 2.4.0 does not sanitise and escape some of its settings, which could allow high priv... | |
| CVE-2026-42012 json | A flaw was found in gnutls. A remote attacker could exploit this vulnerability by presenting a specially crafted certificate ... | |
| CVE-2026-42011 json | A flaw was found in gnutls. This vulnerability occurs because permitted name constraints were incorrectly ignored when previo... | |
| CVE-2024-9355 json | A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer... | |
| CVE-2026-96741 json | The DSGVO All in one for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Output ... | |
| CVE-2026-96669 json | The Food Store – Online Food Delivery & Pickup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'servi... | |
| CVE-2026-96666 json | The Schema App Structured Data plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via 'Rem... | |
| CVE-2026-96228 json | SSL Wireless SMS Notification for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 3.8.... | |
| CVE-2026-93904 json | The Social Web Suite – Social Media Auto Post, Social Media Auto Publish plugin for WordPress is vulnerable to generic SQL ... | |
| CVE-2026-93855 json | The SendPress Newsletters plugin for WordPress is vulnerable to time-based SQL Injection via the 'subscriberid' parameter in ... | |
| CVE-2026-118426 json | In affected versions of Octopus Server with the LDAP authentication provider enabled, any authenticated user could call the L... | |
| CVE-2026-114173 json | The Ortto plugin for WordPress before 1.0.25 did not filter the WooCommerce product data it embedded in public storefront pag... | |
| CVE-2026-113409 json | The Ortto plugin for WordPress before 1.0.25 did not escape stored settings on its admin settings page, leading to stored cro... | |
| CVE-2026-113387 json | The Ortto plugin for WordPress before 1.0.25 did not authenticate configuration update requests, relying only on a secret exp... | |
| CVE-2026-109516 json | The Bot for Telegram on WooCommerce plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover i... | |
| CVE-2026-93757 json | The Wild Apricot Login plugin for WordPress is vulnerable to Authentication Bypass via SSO Email-Collision Account Binding in... | |
| CVE-2026-78674 json | The BPMN System REST APIs do not sufficiently validate input parameters, allowing authenticated users to submit crafted reque... | |
| CVE-2026-76418 json | A vulnerability in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and ... | |
| CVE-2026-66092 json | In openEQUELLA before 2026.2, the pre-login notice is stored as HTML and rendered on the legacy logon page without encoding o... | |
| CVE-2026-66091 json | In openEQUELLA before 2026.1, the GET /api/userquery/userinfobackup endpoint performs no authentication or authorisation chec... | |
| CVE-2026-66090 json | In openEQUELLA before 2026.1, the XML parser used for item metadata does not disable external entity resolution. A user permi... | |
| CVE-2026-66089 json | In openEQUELLA before 2026.1, the SOAP API parses XML supplied in the stopEdit operation with a parser that resolves external... | |
| CVE-2026-66088 json | In openEQUELLA before 2026.1, the system.execute() function available to the scripting engine runs supplied operating system ... | |
| CVE-2026-42949 json | A authorization bypass vulnerability exists in the /api/runscript functionality of FUXA (version(s): 1.3.2-2809). A specially... | |
| CVE-2026-42922 json | A authorization bypass vulnerability exists in the /nodered functionality of FUXA (version(s): 1.3.2-2809). A specially craft... | |
| CVE-2026-40063 json | A information disclosure vulnerability exists in the /nodered/fuxa/scripts functionality of FUXA (version(s): 1.3.2-2809). A ... | |
| CVE-2026-16889 json | In openEQUELLA before 2026.1, the pre-login notice image upload endpoint (PUT /api/preloginnotice/image/{name}) does not vali... | |
| CVE-2026-6647 json | In deployments of WSO2 Identity Server configured with a case-insensitive user store and a case-sensitive database for identi... | |
| CVE-2026-3583 json | When the `allowed_scopes` configuration is enabled, the OAuth2 token introspection mechanism does not immediately invalidate ... | |
| CVE-2026-118359 json | Memory corruption in V8 in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary co... | |
| CVE-2026-110541 json | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1... | |
| CVE-2026-103792 json | Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.... | |
| CVE-2026-103780 json | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1... | |
| CVE-2026-103779 json | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1... | |
| CVE-2026-87880 json | Sensitive information disclosure due to missing SSL certificate verification affecting one component. The following products ... | |
| CVE-2026-87878 json | Linux binaries have executable stack attribute enabled. The following products are affected: Acronis Cyber Protect 17 (Linux)... | |
| CVE-2026-87103 json | Sensitive information disclosure and manipulation due to improper token validation. The following products are affected: Acro... | |
| CVE-2026-87102 json | Sensitive information disclosure and manipulation due to improper token validation. The following products are affected: Acro... | |
| CVE-2026-86385 json | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, contain an Improper Check for Dropped Privileges... | |
| CVE-2026-86384 json | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1... | |
| CVE-2026-86380 json | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1... | |
| CVE-2026-86379 json | Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.... | |
| CVE-2026-86378 json | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1... | |
| CVE-2026-81472 json | Dell iDRAC Service Module (iSM) for Windows, Dell iDRAC Service Module (iSM) for Linux, and Dell iDRAC Service Module (iSM) f... |