CVE.report
CVE.report is the most up-to-date database of common vulnerabilities and exposures. Information is pulled in from several sources and processed in to a mobile friendly, easy to use page. Use the site to quickly check for vulnerabilities in products such as operating systems, applications, hardware, networks, databases, browsers, e-mail clients and more.
CVEs provide a unique and common naming scheme for publicly known cyber security vulnerabilities in order to quickly identify and share these vulnerabilities. You can use the search below to look for vulnerabilities based on product, vendor, or common tags
The form you will see after following this link allows you to fill out the various variables in the CVSS scoring system and receive the corresponding score. The description of each of the variables is also included for additional information.
cve.report now provides a free read-only JSON API for CVE details. Each record combines the CVE Program JSON record, NVD enrichment, KEV, and EPSS when available.
Recent CVEs
| CVE | Description | Updated |
|---|---|---|
| CVE-2026-116055 json | A vulnerability was detected in SourceCodester Performance Indicator System 1.0. This impacts an unknown function of the file... | |
| CVE-2026-116171 json | SiYuan 3.5.4 before 3.8.7 on Windows contains a sensitive-path denylist bypass in IsSensitivePath because the Windows extende... | |
| CVE-2026-116170 json | SiYuan before v3.8.7 contains an sql injection vulnerability that allows admin-token holders to read history.db by injecting ... | |
| CVE-2026-116169 json | SiYuan from 2.10.0 before 3.8.7 contains a stored cross-site scripting vulnerability that allows users with edit permission t... | |
| CVE-2026-116168 json | SiYuan before 3.8.7 contains a path traversal vulnerability in the MCP asset tool because validateAssetUploadPaths relies on ... | |
| CVE-2026-116054 json | A security vulnerability has been detected in SH3. This affects an unknown function of the component Módulo de Gestão/Módu... | |
| CVE-2026-56375 json | ImageMagick through 7.1.2-18 contains a memory leak vulnerability in the ASHLAR coder when an action fails. Attackers can tri... | |
| CVE-2026-56349 json | n8n before version 2.10.0 contains an input validation vulnerability in the Guardrail node that allows attackers to bypass de... | |
| CVE-2026-56313 json | Capgo before 12.128.2 contains a cross-organization account disruption vulnerability in the SSO prelink endpoint that allows ... | |
| CVE-2026-56308 json | Capgo before 12.128.2 allows email address changes without requiring current password re-authentication or verification of th... | |
| CVE-2026-56271 json | Flowise before 3.1.0 (affected versions 3.0.13 and earlier) uses weak hardcoded default JWT secrets ('auth_token', 'refresh_t... | |
| CVE-2026-56252 json | Capgo before 12.128.2 contains a scope isolation vulnerability in the POST /webhooks/test endpoint that allows app-scoped API... | |
| CVE-2026-56241 json | Capgo before 12.128.2 contains a privilege escalation vulnerability where demoted super_admin users retain access to delete_n... | |
| CVE-2026-56238 json | Capgo before 12.128.2 contains an information disclosure vulnerability in the Supabase PostgREST global_stats endpoint that a... | |
| CVE-2026-15497 json | A vulnerability was determined in SonicCloudOrg sonic-agent up to 2.7.2. This affects an unknown function of the file sonic-s... | |
| CVE-2026-15496 json | A vulnerability was found in SonicCloudOrg sonic-agent up to 2.7.2. The impacted element is the function evalIsFailed of the ... | |
| CVE-2026-15495 json | A vulnerability has been found in SonicCloudOrg sonic-agent up to 2.7.2. The affected element is an unknown function of the f... | |
| CVE-2026-15494 json | A flaw has been found in AMTT Hotel Broadband Operation System 1.0. Impacted is an unknown function of the file manager/netwo... | |
| CVE-2026-15493 json | A vulnerability was detected in Akpali9 Attendance-Management-System up to 70b91fe38f4195b701a45f0edcd4f42d5f64aeee. This iss... | |
| CVE-2026-15492 json | A security vulnerability has been detected in igweze wizgrade up to b1d55f22b90cd7e7a6e5002f006d7c649e8086d6. This vulnerabil... | |
| CVE-2026-15491 json | A weakness has been identified in RafyMrX TOKO-ONLINE-ROTI up to ddfe1cd587be0a0b5135d8b6e85cce2ec3aece99. This affects an un... | |
| CVE-2026-15490 json | A security flaw has been discovered in RafyMrX TOKO-ONLINE-ROTI up to ddfe1cd587be0a0b5135d8b6e85cce2ec3aece99. Affected by t... | |
| CVE-2026-15489 json | A vulnerability was identified in RafyMrX TOKO-ONLINE-ROTI up to ddfe1cd587be0a0b5135d8b6e85cce2ec3aece99. Affected by this v... | |
| CVE-2026-15488 json | A vulnerability was determined in hcr707305003 shiroiAdmin 1.1/1.3. Affected is the function FileController::upload of the fi... | |
| CVE-2026-15487 json | A vulnerability was found in TRENDnet TEW-821DAP 1.11B03. This impacts the function sub_41FBD0 of the file /goform/system_ntp... | |
| CVE-2026-15486 json | A vulnerability has been found in TRENDnet TEW-821DAP 1.11B03. This affects the function sub_42026C of the file /goform/tools... | |
| CVE-2026-15485 json | A flaw has been found in TRENDnet TEW-821DAP 1.11B03. The impacted element is the function sub_43F2C4 of the file /goform/too... | |
| CVE-2026-15484 json | A vulnerability was detected in TRENDnet TEW-821DAP 1.12B01. The affected element is the function sub_41EC14 of the file /gof... | |
| CVE-2026-15483 json | A security vulnerability has been detected in TRENDnet TEW-821DAP 1.12B01. Impacted is the function sub_41EC14 of the file /g... | |
| CVE-2026-15482 json | A weakness has been identified in Aster Telecom Azcall 10/11. This issue affects some unknown processing of the file /azcall/... | |
| CVE-2026-15481 json | A security flaw has been discovered in Trendnet TEW-635BRM up to 1.00.03. This vulnerability affects the function ipoa_test o... | |
| CVE-2026-15480 json | A vulnerability was identified in Trendnet TEW-635BRM up to 1.00.03. This affects the function start_httpd of the file /sbin/... | |
| CVE-2026-15479 json | A vulnerability was found in H3C NX15 V100R017. Affected by this vulnerability is the function change_passwd of the file /api... | |
| CVE-2026-15477 json | A vulnerability was detected in Bahmni bahmnicore up to 0.93. This affects the function additionalParams of the file /openmrs... | |
| CVE-2026-15476 json | A security vulnerability has been detected in QILING Disk Master 6.0.0.0. The impacted element is an unknown function in the ... | |
| CVE-2026-15475 json | A weakness has been identified in MiniTool Partition Wizard up to 13.6. The affected element is an unknown function in the li... | |
| CVE-2026-15474 json | A security flaw has been discovered in Eleveo Call Recording Software 9.7.0. Impacted is an unknown function of the file /cal... | |
| CVE-2026-15473 json | A vulnerability was identified in Eleveo Call Recording Software 9.7.0. This issue affects some unknown processing of the fil... | |
| CVE-2026-15472 json | A vulnerability was determined in Eleveo Call Recording Software 9.7.0. This vulnerability affects unknown code of the file /... | |
| CVE-2026-15471 json | A vulnerability was found in Eleveo Call Recording Software 9.7.0. This affects an unknown part of the file /callrec/pci_dss_... | |
| CVE-2026-15470 json | A vulnerability has been found in Eleveo Call Recording Software 9.7.0. Affected by this issue is some unknown functionality ... | |
| CVE-2026-61454 json | The Grav Admin2 plugin (getgrav/grav-plugin-admin2) before 2.0.4 embeds a global JavaScript variable window.__GRAV_CONFIG__ i... | |
| CVE-2026-61447 json | PraisonAI before 1.6.78 contains a remote code execution vulnerability in CodeAgent._execute_python() that executes LLM-gener... | |
| CVE-2026-61445 json | PraisonAI before 4.6.78 contains arbitrary file write and command execution vulnerabilities in the AICoder component due to m... | |
| CVE-2026-61442 json | PraisonAI Platform (praisonai-platform) before 0.1.9 fails to enforce owner/admin authorization on the PATCH routes for proje... | |
| CVE-2026-61439 json | PraisonAI versions before 4.6.78 contain a prompt injection defense misconfiguration where the block threshold defaults to CR... | |
| CVE-2026-61429 json | PraisonAI versions before 1.6.78 contain a server-side request forgery vulnerability in the Crawl4AI/Chromium backend that al... | |
| CVE-2026-61428 json | PraisonAI AgentMail versions before 4.6.78 lack signature verification in webhook mode, allowing unauthenticated attackers to... | |
| CVE-2026-61426 json | PraisonAI before 1.7.3 contains an insecure default configuration that binds to all interfaces with no API key requirement an... | |
| CVE-2026-60088 json | PraisonAI before 4.6.78 fails to validate file path references in custom command templates, allowing attackers to read files ... | |
| CVE-2026-58281 json | Deserialization of untrusted data in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a n... | |
| CVE-2026-56763 json | Hono before 4.12.7 allows __proto__ key in parseBody with dot option enabled, permitting specially crafted form field names t... | |
| CVE-2026-56372 json | ImageMagick before 7.1.2-19 contains a heap buffer overflow vulnerability in the magnify operation that allows attackers to r... | |
| CVE-2026-10660 json | The Bluetooth BAP Broadcast Assistant GATT client in subsys/bluetooth/audio/bap_broadcast_assistant.c reassembled remote Broa... | |
| CVE-2026-57828 json | Joomla Extension - phoca.cz - Authenticated file upload in Phoca Downloads component < 6.1.3 - The Joomla extension Phoca Dow... | |
| CVE-2026-57827 json | Joomla Extension - rsjoomla.com - Unauthenticated file upload in RSFiles component < 1.17.12 - The Joomla extension RSFiles i... | |
| CVE-2026-56296 json | Cap-go before 12.128.2 contains an information disclosure vulnerability in the public.transfer_app RPC function that returns ... | |
| CVE-2026-56240 json | Capgo before 12.128.12 contains a billing authorization bypass vulnerability in the plan_valid calculation that allows organi... | |
| CVE-2026-44383 json | Multiple connections to the backend using the same charging station ID are allowed, which could allow an attacker to deploy ... | |
| CVE-2026-42952 json | Previously, there was no throttling on repeated authentication attempts to the charging station backend, which could allow a... | |
| CVE-2026-20744 json | The charging station websocket endpoint accepts connections without proper authentication, which could lead to privilege esc... | |
| CVE-2026-15089 json | Vulnerability in Drupal Commerce guest registration. This issue affects Commerce guest registration versions: *.*. | |
| CVE-2026-15087 json | vulnerability in Drupal Clean RESTful allows . This issue affects Clean RESTful versions: *.*. | |
| CVE-2026-15086 json | vulnerability in Drupal Raw Formatter [Meta Tag Formatter] allows . This issue affects Raw Formatter [Meta Tag Formatter] ver... | |
| CVE-2026-11915 json | vulnerability in Drupal Brute force attack protection allows . This issue affects Brute force attack protection versions: *.*... | |
| CVE-2026-11914 json | vulnerability in Drupal Composer allows . This issue affects Composer versions: *.*. | |
| CVE-2026-6801 json | The Context Blog theme for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.... | |
| CVE-2026-59155 json | Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. Prior to 2.2.5, the GET /api/... | |
| CVE-2026-58591 json | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Colorbox allows ... | |
| CVE-2026-58590 json | Missing Authorization vulnerability in Drupal FlowDrop allows Forceful Browsing. This issue affects FlowDrop versions: from 0... | |
| CVE-2026-58589 json | Missing Authorization vulnerability in Drupal FlowDrop allows Forceful Browsing. This issue affects FlowDrop versions: from 0... | |
| CVE-2026-57584 json | Phalcon is a high-performance, full-stack PHP framework. Prior to 5.15.0, every Phalcon MVC application built with a default ... | |
| CVE-2026-55884 json | Tilt defines dev environments as code for microservice apps on Kubernetes. From 0.20.8 through 0.37.3, the Tilt HUD HTTP serv... | |
| CVE-2026-55883 json | Tilt defines dev environments as code for microservice apps on Kubernetes. From 0.24.0 through 0.37.3, the Tilt HUD WebSocket... | |
| CVE-2026-55882 json | Tilt defines dev environments as code for microservice apps on Kubernetes. From 0.19.5 through 0.37.3, the Tilt HUD server mo... | |
| CVE-2026-55810 json | Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Plotly.js Graphing all... | |
| CVE-2026-55809 json | Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Flag attendance field ... | |
| CVE-2026-11913 json | vulnerability in Drupal Mother May I allows . This issue affects Mother May I versions: *.*. | |
| CVE-2026-55187 json | Mailpit is an email testing tool and API for developers. Prior to 1.30.2, the remediation shipped for CVE-2026-27808 is incom... | |
| CVE-2026-54736 json | Phalcon is a high-performance, full-stack PHP framework. Prior to 5.14.1, Phalcon\Encryption\Crypt::decrypt compares the atta... | |
| CVE-2026-52761 json | ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.0 thr... | |
| CVE-2026-52747 json | ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Prior to 3.0.1... | |
| CVE-2026-49844 json | Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces outpu... | |
| CVE-2026-49213 json | TypeBot is a chatbot builder tool. Prior to 3.17.2, Typebot's shared SSRF validator in packages/lib/src/ssrf/validateHttpReqU... | |
| CVE-2026-15085 json | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI SEO/GEO Analy... | |
| CVE-2026-15084 json | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal UI Patterns (SDC... | |
| CVE-2026-15082 json | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Siteimprove Anal... | |
| CVE-2026-15081 json | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Location Selecto... | |
| CVE-2026-15079 json | Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Login Disable allows Brute Force. This issu... | |
| CVE-2026-13244 json | Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Tealium iQ Tag Managem... | |
| CVE-2026-13243 json | Cross-Site Request Forgery (CSRF) vulnerability in Drupal Salesforce Suite allows Cross Site Request Forgery. This issue affe... | |
| CVE-2026-13242 json | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Geolocation Fiel... | |
| CVE-2026-13241 json | Missing Authorization vulnerability in Drupal Paragraphs allows Forceful Browsing. This issue affects Paragraphs versions: fr... | |
| CVE-2026-13240 json | Missing Authorization vulnerability in Drupal Paragraphs allows Forceful Browsing. This issue affects Paragraphs versions: fr... | |
| CVE-2026-13239 json | Missing Authorization vulnerability in Drupal WissKI allows Forceful Browsing. This issue affects WissKI versions: from 0.0.0... | |
| CVE-2026-13238 json | Incorrect Authorization vulnerability in Drupal Commerce Realex / Global Payments allows Forceful Browsing. This issue affect... | |
| CVE-2026-13232 json | Incorrect Authorization vulnerability in Drupal Advanced Content Feedback (aka admin_feedback) allows Forceful Browsing. This... | |
| CVE-2026-13231 json | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Advanced Content... | |
| CVE-2026-12535 json | Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Formatter Field allows... | |
| CVE-2026-11909 json | Missing Authorization vulnerability in Drupal Examples for Developers allows Forceful Browsing. This issue affects Examples f... |