CVE.report
CVE.report is the most up-to-date database of common vulnerabilities and exposures. Information is pulled in from several sources and processed in to a mobile friendly, easy to use page. Use the site to quickly check for vulnerabilities in products such as operating systems, applications, hardware, networks, databases, browsers, e-mail clients and more.
CVEs provide a unique and common naming scheme for publicly known cyber security vulnerabilities in order to quickly identify and share these vulnerabilities. You can use the search below to look for vulnerabilities based on product, vendor, or common tags
The form you will see after following this link allows you to fill out the various variables in the CVSS scoring system and receive the corresponding score. The description of each of the variables is also included for additional information.
cve.report now provides a free read-only JSON API for CVE details. Each record combines the CVE Program JSON record, NVD enrichment, KEV, and EPSS when available.
Recent CVEs
| CVE | Description | Updated |
|---|---|---|
| CVE-2025-62453 json | Improper validation of generative ai output in GitHub Copilot and Visual Studio Code allows an authorized attacker to bypass ... | |
| CVE-2025-61830 json | Adobe Pass versions 3.7.3 and earlier are affected by an Incorrect Authorization vulnerability. An attacker could leverage th... | |
| CVE-2025-62449 json | Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code CoPilot Chat Extension a... | |
| CVE-2025-62222 json | Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code CoPilot Chat Extens... | |
| CVE-2025-62220 json | Heap-based buffer overflow in Windows Subsystem for Linux GUI allows an unauthorized attacker to execute code over a network. | |
| CVE-2025-62219 json | Double free in Microsoft Wireless Provisioning System allows an authorized attacker to elevate privileges locally. | |
| CVE-2025-62218 json | Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Wireless Provisionin... | |
| CVE-2025-62216 json | Use after free in Microsoft Office allows an unauthorized attacker to execute code locally. | |
| CVE-2025-62214 json | Improper neutralization of special elements used in a command ('command injection') in Visual Studio allows an authorized att... | |
| CVE-2025-62211 json | Improper neutralization of input during web page generation ('cross-site scripting') in Dynamics 365 Field Service (online) a... | |
| CVE-2025-62210 json | Improper neutralization of input during web page generation ('cross-site scripting') in Dynamics 365 Field Service (online) a... | |
| CVE-2025-62206 json | Exposure of sensitive information to an unauthorized actor in Microsoft Dynamics 365 (on-premises) allows an unauthorized att... | |
| CVE-2025-62205 json | Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally. | |
| CVE-2025-62204 json | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network... | |
| CVE-2025-62203 json | Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | |
| CVE-2025-62202 json | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. | |
| CVE-2025-62201 json | Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | |
| CVE-2025-62200 json | Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | |
| CVE-2025-62199 json | Use after free in Microsoft Office allows an unauthorized attacker to execute code locally. | |
| CVE-2025-61836 json | Illustrator on iPad versions 3.0.9 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that c... | |
| CVE-2025-61831 json | Illustrator versions 28.7.10, 29.8.2 and earlier are affected by an out-of-bounds write vulnerability that could result in ar... | |
| CVE-2025-61829 json | Illustrator on iPad versions 3.0.9 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result i... | |
| CVE-2025-61828 json | Illustrator on iPad versions 3.0.9 and earlier are affected by an out-of-bounds write vulnerability that could result in arbi... | |
| CVE-2025-61827 json | Illustrator on iPad versions 3.0.9 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result i... | |
| CVE-2025-61826 json | Illustrator on iPad versions 3.0.9 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that c... | |
| CVE-2025-61820 json | Illustrator versions 28.7.10, 29.8.2 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result... | |
| CVE-2025-61819 json | Photoshop Desktop versions 26.8.1 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in... | |
| CVE-2025-60728 json | Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to disclose information over a networ... | |
| CVE-2025-60727 json | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | |
| CVE-2025-60726 json | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. | |
| CVE-2025-60722 json | Improper limitation of a pathname to a restricted directory ('path traversal') in OneDrive for Android allows an authorized a... | |
| CVE-2025-60721 json | Privilege context switching error in Windows Administrator Protection allows an authorized attacker to elevate privileges loc... | |
| CVE-2025-60718 json | Untrusted search path in Windows Administrator Protection allows an authorized attacker to elevate privileges locally. | |
| CVE-2025-60710 json | Improper link resolution before file access ('link following') in Host Process for Windows Tasks allows an authorized attacke... | |
| CVE-2025-59504 json | Heap-based buffer overflow in Azure Monitor Agent allows an unauthorized attacker to execute code locally. | |
| CVE-2025-61832 json | InDesign Desktop versions 20.5, 19.5.5 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could resu... | |
| CVE-2025-61824 json | InDesign Desktop versions 20.5, 19.5.5 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could resu... | |
| CVE-2025-61818 json | InCopy versions 20.5, 19.5.5 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code e... | |
| CVE-2025-61817 json | InCopy versions 20.5, 19.5.5 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code e... | |
| CVE-2025-61816 json | InCopy versions 20.5, 19.5.5 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbi... | |
| CVE-2025-61815 json | InDesign Desktop versions 20.5, 19.5.5 and earlier are affected by a Use After Free vulnerability that could result in arbitr... | |
| CVE-2025-61814 json | InDesign Desktop versions 20.5, 19.5.5 and earlier are affected by a Use After Free vulnerability that could result in arbitr... | |
| CVE-2025-59240 json | Exposure of sensitive information to an unauthorized actor in Microsoft Office Excel allows an unauthorized attacker to discl... | |
| CVE-2025-47179 json | Improper access control in Microsoft Configuration Manager allows an authorized attacker to elevate privileges locally. | |
| CVE-2025-33202 json | NVIDIA Triton Inference Server for Linux and Windows contains a vulnerability where an attacker could cause a stack overflow ... | |
| CVE-2025-30398 json | Missing authorization in Nuance PowerScribe allows an unauthorized attacker to disclose information over a network. | |
| CVE-2025-33186 json | NVIDIA AIStore contains a vulnerability in AuthN. A successful exploit of this vulnerability might lead to escalation of priv... | |
| CVE-2025-33185 json | NVIDIA AIStore contains a vulnerability in AuthN where an unauthenticated user may cause information disclosure. A successf... | |
| CVE-2025-33178 json | NVIDIA NeMo Framework for all platforms contains a vulnerability in the bert services component where malicious data created ... | |
| CVE-2025-23361 json | NVIDIA NeMo Framework for all platforms contains a vulnerability in a script, where malicious input created by an attacker ma... | |
| CVE-2025-23357 json | NVIDIA Megatron-LM for all platforms contains a vulnerability in a script, where malicious data created by an attacker may ca... | |
| CVE-2025-13032 json | Double fetch in sandbox kernel driver in Avast/AVG Antivirus <25.3 on windows allows local attacker to escalate privelages ... | |
| CVE-2025-12944 json | Improper input validation in NETGEAR DGN2200v4 (N300 Wireless ADSL2+ Modem Router) allows attackers with direct network acces... | |
| CVE-2025-12943 json | Improper certificate validation in firmware update logic in NETGEAR RAX30 (Nighthawk AX5 5-Stream AX2400 WiFi 6 Router) and R... | |
| CVE-2025-12942 json | Improper Input Validation vulnerability in NETGEAR R6260 and NETGEAR R6850 allows unauthenticated attackers connected to LAN ... | |
| CVE-2025-12940 json | Login credentials are inadvertently recorded in logs if a Syslog Server is configured in NETGEAR WAX610 and WAX610Y (AX1800 D... | |
| CVE-2025-9408 json | System call entry on Cortex M (and possibly R and A, but I think not) has a race which allows very practical privilege escala... | |
| CVE-2025-64773 json | In JetBrains YouTrack before 2025.3.104432 a race condition allowed bypass of helpdesk Agent limit | |
| CVE-2025-13027 json | Memory safety bugs present in Firefox 144 and Thunderbird 144. Some of these bugs showed evidence of memory corruption and we... | |
| CVE-2025-13026 json | Sandbox escape due to incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability was fixed in Firefo... | |
| CVE-2025-13025 json | Incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 145 and Thunderbird ... | |
| CVE-2025-13024 json | JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 145 and Thunderbird 145. | |
| CVE-2025-13023 json | Sandbox escape due to incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability was fixed in Firefo... | |
| CVE-2025-13022 json | Incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 145 and Thunderbird ... | |
| CVE-2025-13021 json | Incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 145 and Thunderbird ... | |
| CVE-2025-13020 json | Use-after-free in the WebRTC: Audio/Video component. This vulnerability was fixed in Firefox 145, Firefox ESR 140.5, Thunderb... | |
| CVE-2025-13019 json | Same-origin policy bypass in the DOM: Workers component. This vulnerability was fixed in Firefox 145, Firefox ESR 140.5, Thun... | |
| CVE-2025-13018 json | Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 145, Firefox ESR 140.5, Thunderbird... | |
| CVE-2025-13017 json | Same-origin policy bypass in the DOM: Notifications component. This vulnerability was fixed in Firefox 145, Firefox ESR 140.5... | |
| CVE-2025-13016 json | Incorrect boundary conditions in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 145, Firefox ... | |
| CVE-2025-11959 json | Files or Directories Accessible to External Parties, Exposure of Private Personal Information to an Unauthorized Actor vulner... | |
| CVE-2025-10918 json | Insecure default permissions in the agent of Ivanti Endpoint Manager before version 2024 SU4 allows a local authenticated att... | |
| CVE-2025-10905 json | Collision in MiniFilter driver in Avast Software Avast Free Antivirus before 25.9 on Windows allows a local attacker wit... | |
| CVE-2025-9227 json | Zohocorp ManageEngine OpManager versions 128609 and below are vulnerable to Stored XSS Vulnerability in the SNMP trap process... | |
| CVE-2025-41106 json | HTML injection vulnerability found in Fairsketch's RISE CRM Framework v3.8.1, which consist of an HTML code injection due to ... | |
| CVE-2025-41105 json | HTML injection vulnerability found in Fairsketch's RISE CRM Framework v3.8.1, which consist of an HTML code injection due to ... | |
| CVE-2025-41104 json | HTML injection vulnerability found in Fairsketch's RISE CRM Framework v3.8.1, which consist of an HTML code injection due to ... | |
| CVE-2025-41103 json | HTML injection vulnerability found in Fairsketch's RISE CRM Framework v3.8.1, which consist of an HTML code injection due to ... | |
| CVE-2025-12101 json | Cross-Site Scripting (XSS) in NetScaler ADC and NetScaler Gateway when the appliance is configured as a Gateway (VPN virtu... | |
| CVE-2025-11862 json | A security issue was discovered within Verve Asset Manager allowing unauthorized read-only users to read, update, and delete ... | |
| CVE-2025-11697 json | A local code execution security issue exists within Studio 5000® Simulation Interface™ via the API. This vulnerability all... | |
| CVE-2025-11696 json | A local server-side request forgery (SSRF) security issue exists within Studio 5000® Simulation Interface™ via the API. Th... | |
| CVE-2025-11085 json | A security issue exists within DataMosaix™ Private Cloud allowing for Persistent XSS. This vulnerability can result in the ... | |
| CVE-2025-11084 json | A security issue exists within DataMosaix™ Private Cloud, allowing attackers to bypass MFA during setup and obtain a valid ... | |
| CVE-2025-8324 json | Zohocorp ManageEngine Analytics Plus versions 6170 and below are vulnerable to Unauthenticated SQL Injection due to the impr... | |
| CVE-2025-41102 json | HTML injection vulnerability found in Fairsketch's RISE CRM Framework v3.8.1, which consist of an HTML code injection due to ... | |
| CVE-2025-41101 json | HTML injection vulnerability found in Fairsketch's RISE CRM Framework v3.8.1, which consist of an HTML code injection due to ... | |
| CVE-2025-12953 json | The Classified Listing – AI-Powered Classified ads & Business Directory Plugin plugin for WordPress is vulnerable to unauth... | |
| CVE-2025-12846 json | The Blocksy Companion plugin for WordPress is vulnerable to authenticated arbitrary file upload in all versions up to, and in... | |
| CVE-2025-12788 json | The Hydra Booking — Appointment Scheduling & Booking Calendar plugin for WordPress is vulnerable to missing payment verific... | |
| CVE-2025-11960 json | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Aryom Software H... | |
| CVE-2025-10161 json | Improper Restriction of Excessive Authentication Attempts, Client-Side Enforcement of Server-Side Security, Reliance on Untru... | |
| CVE-2025-7633 json | Zohocorp ManageEngine Exchange Reporter Plus versions 5723 and below are vulnerable to the Stored XSS Vulnerability in the Cu... | |
| CVE-2025-7632 json | Zohocorp ManageEngine Exchange Reporter Plus versions 5723 and below are vulnerable to the Stored XSS Vulnerability in the Pu... | |
| CVE-2025-7430 json | Zohocorp ManageEngine Exchange Reporter Plus versions 5723 and below are vulnerable to the Stored XSS Vulnerability in the Fo... | |
| CVE-2025-12787 json | The Hydra Booking — Appointment Scheduling & Booking Calendar plugin for WordPress is vulnerable to unauthorized booking ca... | |
| CVE-2025-12539 json | The TNC Toolbox: Web Performance plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, ... | |
| CVE-2025-10714 json | AXIS Optimizer was vulnerable to an unquoted search path vulnerability, which could potentially lead to privilege escalation ... | |
| CVE-2025-9524 json | The VAPIX API port.cgi did not have sufficient input validation, which may result in process crashes and impact usability. Th... | |
| CVE-2025-9055 json | The VAPIX Edge storage API that allowed a privilege escalation, enabling a VAPIX administrator-privileged user to gain Linux ... |