CVE.report
CVE.report is the most up-to-date database of common vulnerabilities and exposures. Information is pulled in from several sources and processed in to a mobile friendly, easy to use page. Use the site to quickly check for vulnerabilities in products such as operating systems, applications, hardware, networks, databases, browsers, e-mail clients and more.
CVEs provide a unique and common naming scheme for publicly known cyber security vulnerabilities in order to quickly identify and share these vulnerabilities. You can use the search below to look for vulnerabilities based on product, vendor, or common tags
The form you will see after following this link allows you to fill out the various variables in the CVSS scoring system and receive the corresponding score. The description of each of the variables is also included for additional information.
cve.report now provides a free read-only JSON API for CVE details. Each record combines the CVE Program JSON record, NVD enrichment, KEV, and EPSS when available.
Recent CVEs
| CVE | Description | Updated |
|---|---|---|
| CVE-2026-97350 json | Securepoint SSL VPN Client v2 on Windows contains vulnerabilities in the handling of OpenVPN configurations and proxy setting... | |
| CVE-2026-73328 json | Volmarg Personal Management System through 2.1.0 contains an unrestricted file upload vulnerability that allows authenticated... | |
| CVE-2026-65168 json | NVIDIA Slurm contains an attacker-controlled heap-based buffer overflow in the slurmstepd socket handling code. | |
| CVE-2026-65165 json | NVIDIA Slurm contains a vulnerability where a user could deliberately alter the provided nodelist alongside the --distributio... | |
| CVE-2026-65140 json | NVIDIA Slurm contains some inconsistent authorization checks against the Operator permission level in the SlurmDBD that can b... | |
| CVE-2026-65139 json | NVIDIA Slurm contains an attacker-controlled SQL injection attack in certain SlurmDBD RPCs that can lead to arbitrary code ex... | |
| CVE-2026-121578 json | Tactical RMM contains a stored XSS vulnerability caused by improperly validated input or encode output for various fields, en... | |
| CVE-2026-121564 json | Incomplete Comparison with Missing Factors (CWE-1023) in merge_chats() (whatstk/utils/chat_merge.py), reached from BaseChat.m... | |
| CVE-2026-121562 json | CTFd 3.1.0 before 3.8.7 contains an information disclosure vulnerability in the /api/v1/teams list endpoint that exposes non-... | |
| CVE-2026-121561 json | Label Studio before 1.23.2 (label-studio-sdk before 2.1.2) contains a server-side request forgery vulnerability that allows a... | |
| CVE-2026-121560 json | LogChimp 0.9.0-alpha.1 before 0.9.3 contains an authorization bypass vulnerability that allows authenticated post authors to ... | |
| CVE-2026-121558 json | AuditPilot before commit 4669c93 contains an authorization bypass vulnerability in _metadata_allowed in rag/agentic_rag.py th... | |
| CVE-2026-121557 json | WPPConnect Server through 2.10.74 contains a missing authentication vulnerability that allows unauthenticated attackers to se... | |
| CVE-2026-121555 json | Foxel through 2.4.0 contains a missing authentication vulnerability that allows unauthenticated attackers to read files by re... | |
| CVE-2026-65138 json | NVIDIA Slurm contains an attacker-controlled arbitrary-memory read in the slurmstepd socket API that could be used to ex-filt... | |
| CVE-2026-65109 json | NVIDIA Slurm is subject to a symlink resolution issue in the container cleanup code that could allow an attacker to remove fi... | |
| CVE-2026-65108 json | NVIDIA Slurm contains an attacker-controlled heap-based buffer overflow in the slurmstepd process while the slurmstepd is run... | |
| CVE-2026-65107 json | NVIDIA Slurm contains a vulnerability where a user could alter the supplemental group list as part of an sbcast file transmis... | |
| CVE-2026-121554 json | cordova-plugin-advanced-http 1.5.0 through 3.3.1 contains an information disclosure vulnerability that leaks cookies to third... | |
| CVE-2026-121552 json | Dromara domain-admin before 1.6.79 contains a missing authorization vulnerability in the POST /api/getGroupUserList handler t... | |
| CVE-2026-121551 json | PostfixAdmin through 4.0.5 contains a stored cross-site scripting vulnerability that allows authenticated mailbox users to in... | |
| CVE-2026-121550 json | nnn through 5.3 contains an insecure file handling vulnerability that allows local attackers to redirect writes because main(... | |
| CVE-2026-121549 json | nnn through 5.3 contains an insecure temporary file vulnerability in the pdfread and nuke plugins that allows local attackers... | |
| CVE-2026-121548 json | Jarun nnn through 5.3 contains an OS command injection vulnerability in plugins/togglex that allows attackers to execute comm... | |
| CVE-2026-121547 json | Canop dysk before 3.8.2 contains a terminal escape sequence injection vulnerability that allows local users to inject control... | |
| CVE-2026-121546 json | ruTorrent before 5.3.20 contains a path traversal vulnerability in the datadir plugin that allows authenticated users to esca... | |
| CVE-2026-121545 json | Dreeve before 5.8.0 contains a missing authentication vulnerability in StravaWebhookRequestHandler::handleEvent that allows u... | |
| CVE-2026-121544 json | Koodo Reader through 2.4.6 contains a path traversal vulnerability in the self-hosted HTTP server's OPDS handlers that allows... | |
| CVE-2026-121454 json | Padloc through 4.3.0 contains a missing authentication vulnerability in ScimServer._handleScimGet() that allows unauthenticat... | |
| CVE-2026-121451 json | AB Download Manager before 1.11.2 contains a cross-site request forgery vulnerability in its unauthenticated browser-integrat... | |
| CVE-2026-121450 json | CFNext before 3.1.0 contains a weak cryptographic derivation vulnerability that allows subscription link holders to recover t... | |
| CVE-2026-120758 json | HDF5 through 2.2.0 contains a NULL pointer dereference vulnerability in H5HL_unprotect() in src/H5HL.c. H5HL_protect() pins a... | |
| CVE-2026-121449 json | Dockhand from 1.0.47 before 1.0.54 exposes plaintext stack secrets because deployStack() attaches resolved secret values to i... | |
| CVE-2026-121448 json | Dockhand before 1.0.54 contains a path traversal vulnerability that allows authenticated users to read, overwrite, and delete... | |
| CVE-2026-121442 json | Frappe HRMS before 15.61.0 contains a permission bypass vulnerability that allows authenticated employees to view other emplo... | |
| CVE-2026-121426 json | Nodemailer from 3.0.0 before 10.1.4 contains an address parsing vulnerability in addressparser that ends an angle-addr at a '... | |
| CVE-2026-121425 json | Nodemailer from 3.0.0 before 10.1.4 contains a parsing flaw in addressparser that ends an RFC 5322 group at a semicolon insid... | |
| CVE-2026-121424 json | Nodemailer from 3.0.0 before 10.1.4 contains an address parsing vulnerability in addressparser that allows remote attackers t... | |
| CVE-2026-120757 json | HDF5 through 2.2.0 contains a heap buffer over-read vulnerability in H5L__extern_traverse() in src/H5Lexternal.c, the default... | |
| CVE-2026-120756 json | HDF5 through 2.2.0 contains a heap buffer over-read vulnerability in H5O__chunk_deserialize() in src/H5Ocache.c. When decodin... | |
| CVE-2026-120755 json | HDF5 through 2.2.0 contains an out-of-bounds read vulnerability in H5Z__filter_szip() in src/H5Zszip.c. When decoding a szip-... | |
| CVE-2026-120754 json | HDF5 through 2.2.0 contains an uninitialized memory read vulnerability in H5Z__filter_scaleoffset() in src/H5Zscaleoffset.c. ... | |
| CVE-2026-119741 json | rsync through 3.5.1 contains a denial of service vulnerability in the delta-transfer sender's hash_search() in match.c that a... | |
| CVE-2026-118487 json | In Eclipse Vert.x versions [4.0.0, 4.5.35] or [5.0.0, 5.2.2], the `FrameParser` in vertx-stomp creates a `RecordParser` wi... | |
| CVE-2026-106991 json | hustoj >=24.09.10 and <=26.08.19 is vulnerable to Incorrect Access Control. Any registered user can delete, lock, or sticky a... | |
| CVE-2026-121458 json | Instatic before 0.0.21 contains a missing authorization vulnerability in its AI/MCP content read tools that allows low-privil... | |
| CVE-2026-120333 json | The actions linked in the emails of the extension (e.g. to confirm a registration or the deletion of an account) do not rejec... | |
| CVE-2026-120332 json | The HTML content of mails and tracked URLs are rendered unescaped in the backend module. Backend users with access to the mai... | |
| CVE-2026-120331 json | Content of external URL mails, their stylesheets and images to embed is fetched by the server without validating the target h... | |
| CVE-2026-120330 json | Backend actions and ajax routes of the mail module do not check whether the backend user has access to the page of the reques... | |
| CVE-2026-120329 json | Saving the configuration of the mail backend module writes submitted settings to the page TSconfig without restricting them t... | |
| CVE-2026-119742 json | Nagios XI before 2026R2 contains an OS command injection vulnerability in the MIB upload feature where the install_mib() func... | |
| CVE-2026-89229 json | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in the ShareActivity component of BlueLM Copil... | |
| CVE-2026-120328 json | The click tracking middleware does not validate the authentication code of a recipient if the code is omitted. Unauthenticate... | |
| CVE-2026-120327 json | The click tracking middleware accepts an arbitrary target URL and redirects to it. Attackers can misuse links to the website ... | |
| CVE-2026-109161 json | Insufficient bounds checking in the Digital I/O function may allow a remote attacker with high privileges to cause a denial o... | |
| CVE-2026-105982 json | Improper input validation in the IPsec VPN function may allow a remote attacker with high privileges to inject system command... | |
| CVE-2026-105981 json | Improper input validation in the Digital I/O function may allow a remote attacker with high privileges to inject operating sy... | |
| CVE-2026-105980 json | Improper input validation in the WireGuard VPN function may allow a remote attacker with high privileges to inject system com... | |
| CVE-2026-105979 json | Improper input validation in the ZeroTier VPN function may allow a remote attacker with high privileges to inject system comm... | |
| CVE-2026-105978 json | Improper input validation in management control functions may allow a remote attacker with high privileges to inject operatin... | |
| CVE-2026-91075 json | The Eupago Gateway For Woocommerce WordPress plugin from 4.5.0 through 4.7.5 does not verify the authenticity of incoming pay... | |
| CVE-2026-120988 json | billboard.js before 4.1.3 allows an attacker to execute malicious JavaScript due to improper sanitization of series ids durin... | |
| CVE-2026-120987 json | Whale Browser before 5.39.412.57 allows an attacker to bypass the iframe sandbox in a dual-tab environment. | |
| CVE-2026-103653 json | An out-of-bounds read vulnerability in the Qt CoAP message parsing (QCoapInternalReply::createFromFrame()) of the Qt CoAP mod... | |
| CVE-2026-103327 json | The CryptoCloud WordPress plugin from 3.0.0 through 3.0.1 does not verify the authenticity of the payment notifications recei... | |
| CVE-2026-74846 json | Catalyst::Plugin::Authentication versions before 0.10029 for Perl allow timing attacks on stored passwords via eq comparisons... | |
| CVE-2026-115205 json | The AZEXO Store Locator WordPress plugin through 1.4 does not have a capability check or any authorization control when delet... | |
| CVE-2026-106004 json | The DT LMS WordPress plugin through 1.2 does not perform capability or nonce checks on one of its AJAX actions, allowing una... | |
| CVE-2026-105993 json | The DT Directory Lite Addon WordPress plugin through 1.1 does not perform nonce or capability checks on its settings handlers... | |
| CVE-2026-105967 json | The Gallery for Social Photo WordPress plugin through 1.0.0.41 does not validate a user-supplied URL before using it to perfo... | |
| CVE-2026-120833 json | labbench before 0.46.1 contains a deserialization of untrusted data vulnerability in read() and read_relational() that passes... | |
| CVE-2026-105770 json | Octo STS (github.com/octo-sts/app) before 0.11.2 returns trust policy configuration to callers whose OIDC token does not sati... | |
| CVE-2026-104648 json | The weMail WordPress plugin through 2.1.6 does not restrict a site-wide third-party email-service API key to administrators,... | |
| CVE-2026-104647 json | The weMail WordPress plugin through 2.1.6 does not correctly verify user capabilities in its REST API permission checks, tre... | |
| CVE-2026-103379 json | The WATI Chat and Notification WordPress plugin through 1.1.8 does not require a valid, non-empty secret on a public endpoint... | |
| CVE-2026-120752 json | PyMuPDF 1.25.3 before 2.0 contains a stack-based buffer overflow vulnerability in JM_set_annot_callout_line() that copies a c... | |
| CVE-2026-120091 json | Temporal Server compiles a Worker Controller Instance module, go.temporal.io/auto-scaled-workers, into its Worker Service, an... | |
| CVE-2026-105476 json | Improper link resolution before file access in cPanel allows remote authenticated users to write arbitrary root-owned files a... | |
| CVE-2026-105475 json | Improper neutralization of a NUL byte in cPanel allows remote attackers to read any mail account's calendar and contact data. | |
| CVE-2026-71450 json | Authentication bypass using an alternate path or channel vulnerability in Johnson Controls EasyIO Neo EC and CW Edge Controll... | |
| CVE-2026-29508 json | ReadyMedia (formerly MiniDLNA) versions 1.3.0 through 1.3.3 contain a stack-based buffer overflow vulnerability that allows r... | |
| CVE-2026-16305 json | Local privilege escalation in `SmartUpdate.exe` and `SmartExecute.exe` in INFINITT Healthcare Co., Ltd. INFINITT PACS allows ... | |
| CVE-2026-120689 json | HDF5 through 2.2.0 contains an uncontrolled recursion vulnerability in H5B__iterate_helper() in src/H5B.c. When iterating a v... | |
| CVE-2026-119740 json | Nexbox A95X TV boxes built on the Amlogic S905X platform contain an unauthenticated console exposed via an internal UART head... | |
| CVE-2026-119739 json | The VobSub subtitle decoder libsub_vob (part of the Amlogic DroidLogic SubTitleService), as shipped on Nexbox A95X (Amlogic S... | |
| CVE-2026-119738 json | The VobSub subtitle decoder libsub_vob (part of the Amlogic DroidLogic SubTitleService), as shipped on Nexbox A95X (Amlogic S... | |
| CVE-2026-119737 json | The pppoe_wrapper vendor daemon from the Amlogic Android SDK, as shipped on Nexbox A95X (Amlogic S905/S905X) TV boxes, contai... | |
| CVE-2026-117082 json | An authentication bypass vulnerability in the Universal Plug and Play (UPnP) framework of the Sercomm AOT-4221SR 4.6 Dual Ban... | |
| CVE-2026-112350 json | Sunhillo SureLine before 9.1.5 contains a path traversal vulnerability in the radarUpdater.cgi endpoint that allows unauthent... | |
| CVE-2026-116890 json | Semantic MediaWiki from 3.0.0 before 7.3.0 contains a missing authorization vulnerability in the api.php smwtask module that ... | |
| CVE-2026-116887 json | Semantic MediaWiki from 3.0.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows users with page-e... | |
| CVE-2026-112692 json | This issue was addressed with additional entitlement checks. This issue is fixed in iOS 27.2 and iPadOS 27.2, tvOS 27.2, visi... | |
| CVE-2026-112687 json | This issue was addressed by removing the vulnerable code. This issue is fixed in iOS 27.2 and iPadOS 27.2, tvOS 27.2. An atta... | |
| CVE-2026-91501 json | Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: Installer). Supported versions ... | |
| CVE-2026-91408 json | Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: End User Self Service). Support... | |
| CVE-2026-109258 json | ImageMagick 7.1.0-20 before 7.1.2-32 contains an invalid memory free vulnerability in the fx operation that occurs when initi... | |
| CVE-2026-91407 json | Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: REST WebServices). Supported ve... | |
| CVE-2026-91259 json | Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI). Supported versi... | |
| CVE-2026-83403 json | Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI). Supported versi... |