CVE.report
CVE.report is the most up-to-date database of common vulnerabilities and exposures. Information is pulled in from several sources and processed in to a mobile friendly, easy to use page. Use the site to quickly check for vulnerabilities in products such as operating systems, applications, hardware, networks, databases, browsers, e-mail clients and more.
CVEs provide a unique and common naming scheme for publicly known cyber security vulnerabilities in order to quickly identify and share these vulnerabilities. You can use the search below to look for vulnerabilities based on product, vendor, or common tags
The form you will see after following this link allows you to fill out the various variables in the CVSS scoring system and receive the corresponding score. The description of each of the variables is also included for additional information.
cve.report now provides a free read-only JSON API for CVE details. Each record combines the CVE Program JSON record, NVD enrichment, KEV, and EPSS when available.
Recent CVEs
| CVE | Description | Updated |
|---|---|---|
| CVE-2026-128067 json | Pillow is a Python imaging library. From 2.3.0 through 12.3.0, Pillow applications that save compressed TIFF images through l... | |
| CVE-2026-128066 json | Pillow is a Python imaging library. From 1.0 through 12.3.0, ImageFileDirectory_v2.load() in src/PIL/TiffImagePlugin.py retai... | |
| CVE-2026-128065 json | @grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. From 1.14.0 through 1.14.1... | |
| CVE-2026-127275 json | A vulnerability was determined in Linksys EA8100 1.0.3.216940. This issue affects the function SetRemoteSetting/SetUnsecuredW... | |
| CVE-2026-127274 json | A vulnerability was found in Linksys EA8100 1.0.3.216940. This vulnerability affects unknown code of the file /jnap/core/Chec... | |
| CVE-2026-127273 json | A vulnerability has been found in Linksys EA8100 1.0.3.216940. This affects the function GetWANStatus/GetWANStatus3/IsAdminPa... | |
| CVE-2026-93335 json | Vault Community Edition and Vault Enterprise did not consistently apply explicit ACL policy deny rules to request paths that ... | |
| CVE-2026-93333 json | Vault's audit devices did not validate the contents of a configured audit log prefix and did not consistently enforce the ser... | |
| CVE-2026-92735 json | HashiCorp Vault and Vault Enterprise are vulnerable to an issue in the integrated storage join process that may allow an unau... | |
| CVE-2026-127212 json | Dokploy before 0.31.1 contains a missing ownership check vulnerability in the readAppMonitoring tRPC procedure that allows au... | |
| CVE-2026-126982 json | A type allow-list bypass in the BSON serialization library of the MongoDB C# Driver allows a type-restriction check to be cir... | |
| CVE-2026-126839 json | A deserialization type-restriction control in the BSON serialization component can be bypassed because the check used to reco... | |
| CVE-2026-126792 json | A memory-safety flaw in the key-management request-building component of the library can lead to an out-of-bounds write on th... | |
| CVE-2026-126367 json | @grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Before 1.13.2, and from 1.... | |
| CVE-2026-126366 json | MessagePack for Ruby is an implementation of the MessagePack binary serialization format. Prior to 1.8.7, the Java-platform m... | |
| CVE-2026-126365 json | Astro is a web framework for content-driven websites. Prior to @astrojs/prism 4.1.2, and from @astrojs/markdoc 0.3.0 until 2.... | |
| CVE-2026-126364 json | Astro is a web framework for content-driven websites. From 5.14.3 until 7.4.7, Astro's /_image endpoint compared the requeste... | |
| CVE-2026-126363 json | Astro is a web framework for content-driven websites. From 0.2.0 until 7.1.2, the @astrojs/solid-js renderer inserted a named... | |
| CVE-2026-126362 json | Astro is a web framework for content-driven websites. From 5.7.3 until 9.1.2, the @astrojs/svelte renderer inserted a named s... | |
| CVE-2026-126361 json | Astro is a web framework for content-driven websites. Prior to 7.4.5, Astro rendered a string used as a dynamic element name ... | |
| CVE-2026-126360 json | OpenTelemetry Python provides the Python API and SDK for OpenTelemetry. Prior to 1.45.2, TraceContextTextMapPropagator.extrac... | |
| CVE-2026-126359 json | Hono is a Web application framework that provides support for any JavaScript runtime. From 3.12.0 until 4.13.16, the css help... | |
| CVE-2026-126358 json | Hono is a Web application framework that provides support for any JavaScript runtime. From 4.1.4 until 4.13.16, RegExpRouter ... | |
| CVE-2026-126357 json | Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.13.16, mount() and app.mount... | |
| CVE-2026-126356 json | Hono is a Web application framework that provides support for any JavaScript runtime. From 4.5.1 until 4.13.16, validator('fo... | |
| CVE-2026-126355 json | Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.13.16, csrf() limits origin ... | |
| CVE-2026-120868 json | Memory overflow in Packet Processing can lead to unpredictable or erroneous behavior or Denial of Service in NetScaler ADC an... | |
| CVE-2026-111456 json | A missing authorization check has been found in ConsumerResource.setupOwner() function of consumer registration module in the... | |
| CVE-2026-86322 json | A flaw was found in Foreman’s Api::V2::PersonalAccessTokensController, where Foreman::Controller::UserAware#find_user resol... | |
| CVE-2026-126772 json | OpsTree REMS through 1.0.0 contains an improper attribution vulnerability that allows authenticated users to post comments as... | |
| CVE-2026-123710 json | A flaw was found in Red Hat Quay. An unauthenticated client can obtain an anonymous registry token with an audience it contro... | |
| CVE-2026-111190 json | The ARForms plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, 7.2.4 via its f... | |
| CVE-2026-110697 json | A flaw was found in Quay where the robot account listing function constructs a SQL LIKE pattern from user-controlled namespac... | |
| CVE-2026-108472 json | A flaw was found in the xfs_admin utility in xfsprogs. The tool does not properly validate user-supplied parameters, allowing... | |
| CVE-2026-107443 json | A flaw was found in Foreman. An authenticated user with view_hosts privileges can retrieve rendered provisioning template con... | |
| CVE-2026-107360 json | A flaw was found in rubygem-safemode. Compound assignment expressions in sandboxed code are evaluated without mediating metho... | |
| CVE-2026-107152 json | An improper authentication vulnerability has been found in the task console in the smart_proxy_dynflow package. The console a... | |
| CVE-2026-48479 json | Use of uninitialized or invalid state in AMD Graphics Driver could allow a local attacker to write out of bounds, potentially... | |
| CVE-2026-40670 json | Improper check for unusual or exceptional conditions in AMD Secure Encrypted Virtualization - Secure Nested Paging (SEV-SNP) ... | |
| CVE-2026-40669 json | An off-by-one error in AMD Secure Encrypted Virtualization (SEV) firmware could allow an attacker with hypervisor access to c... | |
| CVE-2026-18379 json | A flaw was found in yggdrasil-worker-package-manager. An authenticated attacker can exploit this issue to achieve arbitrary f... | |
| CVE-2026-0480 json | Missing Authentication for Critical Function in AMD Secure Encrypted Virtualization (SEV) firmware could allow a malicious hy... | |
| CVE-2026-0470 json | Null pointer dereference in AMD Embedded SPI Flash driver could allow a local user to potentially cause a loss of availabilit... | |
| CVE-2026-0454 json | An out-of-bounds write in the AMD Secure Encrypted Virtualization (SEV) firmware could allow a malicious hypervisor to corrup... | |
| CVE-2026-0435 json | Operation on a resource after expiration or release in the AMD Secure Encrypted Virtualization (SEV) firmware could allow an ... | |
| CVE-2026-0003 json | Use of a per-part static key in the ASP Bootloader could allow an attacker to downgrade the Secure Encrypted Virtualization (... | |
| CVE-2025-48504 json | Operation on a resource after expiration or release in the Secure Encrypted Virtualization (SEV) firmware could allow a malic... | |
| CVE-2025-29941 json | Incorrect usage of seeds in pseudo-random number generator in the Secure Encrypted Virtualization (SEV) firmware could allow ... | |
| CVE-2025-0008 json | Insufficient verification of data authenticity may allow a local attacker to bypass Secure Debug Unlock (SDU), potentially re... | |
| CVE-2024-36309 json | Missing Lock Bit Protection in the Northbridge IO (NBIO) could allow a privileged attacker to use an intentionally disabled d... | |
| CVE-2026-119079 json | decode_sequence_of() in lib/krb5/asn.1/asn1_encode.c in MIT Kerberos 5 (aka krb5) 1.11 and later grows the decoded element ar... | |
| CVE-2026-118740 json | Missing authorization in Aspire allows an unauthorized attacker to bypass a security feature over a network. | |
| CVE-2026-112323 json | The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) 1.5.2 and later allows remote attackers to ... | |
| CVE-2026-112322 json | clean_client() in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) restarts its scan from the head of the client list a... | |
| CVE-2026-112321 json | The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) does not free decoded arguments on certain ... | |
| CVE-2026-112320 json | The GSS-RPC transport layer in MIT Kerberos 5 (aka krb5) 1.4 and later does not release the previous authentication context w... | |
| CVE-2026-40668 json | Authentication bypass by spoofing in AMD Secure Encrypted Virtualization (SEV) firmware could allow a malicious hypervisor to... | |
| CVE-2026-28249 json | Improper preservation of consistency between independent representations of shared state in AMD Secure Encrypted Virtualizati... | |
| CVE-2026-28248 json | Improper enforcement of behavioral workflow in AMD Secure Encrypted Virtualization (SEV) firmware could allow a malicious hyp... | |
| CVE-2026-28247 json | Improper Access Control Applied to Mirrored or Aliased Memory Regions in AMD Secure Encrypted Virtualization (SEV) firmware c... | |
| CVE-2025-62621 json | Expected behavior violation in AMD Secure Encrypted Virtualization (SEV) firmware could allow a malicious hypervisor to bypas... | |
| CVE-2025-62620 json | Improper validation of unsafe equivalence in input could allow an attacker with high privileges to reclaim the ring buffer qu... | |
| CVE-2025-54508 json | Improper validation of Reverse Map Table (RMP) entries in the Secure Encrypted Virtualization (SEV) firmware could allow a pr... | |
| CVE-2025-54506 json | A time-of-check to time-of-use (TOCTOU) race condition in the AMD SEV Secure Encrypted Virtualization (SEV) firmware could al... | |
| CVE-2025-54504 json | Insufficient Granularity of Access Control in AMD Secure Encrypted Virtualization (SEV) firmware could allow an attacker with... | |
| CVE-2025-54503 json | Improper handling of overlap between protected memory ranges in the Secure Encrypted Virtualization (SEV) firmware could allo... | |
| CVE-2025-52537 json | Improper access control within the AMD Secure Encrypted Virtualization (SEV) firmware could allow an attacker with administra... | |
| CVE-2025-52535 json | Improper resource reuse in the AMD Secure Encrypted Virtualization (SEV) firmware could allow an attacker with hypervisor acc... | |
| CVE-2025-29940 json | Unverified ownership in Secure Encrypted Virtualization (SEV) firmware could allow a privileged attacker with access to a mal... | |
| CVE-2025-0027 json | Improper access control in AMD Secure Encrypted Virtualization (SEV) firmware could allow a malicious hypervisor to bypass Re... | |
| CVE-2026-112319 json | The GSS-RPC layer in MIT Kerberos 5 (aka krb5) does not enforce size limits on XDR-decoded data, which allows remote authenti... | |
| CVE-2026-112318 json | The policy RPC stubs in kadmin/server/server_stubs.c in MIT Kerberos 5 (aka krb5) 1.5.3 and later do not reject a NULL policy... | |
| CVE-2026-112317 json | krb5_ktkdb_get_entry() in lib/kdb/keytab.c in MIT Kerberos 5 (aka krb5) 1.2.8 and later does not free decrypted key material ... | |
| CVE-2026-112316 json | xdr_krb5_tl_data() in lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) does not free partially decoded data on failure, ... | |
| CVE-2026-112315 json | The RPCSEC_GSS authentication routines in lib/rpc/authgss_prot.c in MIT Kerberos 5 (aka krb5) 1.4 and later do not free parti... | |
| CVE-2026-106471 json | A flaw was found in Candlepin. The central authorization filter incorrectly grants access when any one of multiple @Verify-an... | |
| CVE-2026-103963 json | A flaw was found in glib-networking. When establishing connections using Transport Layer Security (TLS) version 1.3, the clie... | |
| CVE-2026-90959 json | A path traversal vulnerability was found in pulpcore. The content upload API accepts a 'file_url' parameter that allows users... | |
| CVE-2026-42784 json | A flaw was found in sequoia-openpgp. The library incorrectly infers key flags for older certificates when a key flags subpack... | |
| CVE-2026-32591 json | A flaw was found in Red Hat Quay's Proxy Cache configuration feature. When an organization administrator configures an upstre... | |
| CVE-2026-18963 json | A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and ... | |
| CVE-2026-127211 json | MultiVendorX plugin for WordPress before 5.0.22 contains a broken access control vulnerability in the /wp-json/multivendorx/v... | |
| CVE-2026-127209 json | Xiaomi Mi Browser Android Application (com.mi.globalbrowser) before 14.66.0-gn contains a path traversal vulnerability in the... | |
| CVE-2026-126823 json | A local user with an ordinary account on the same host can place a file in a shared temporary location that the JDBC driver's... | |
| CVE-2026-126354 json | Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.2.5 un... | |
| CVE-2026-126353 json | Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.3.0 un... | |
| CVE-2026-126352 json | Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.3.0 un... | |
| CVE-2026-126351 json | Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. Prior to 2.9.... | |
| CVE-2026-126350 json | Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.3.0 un... | |
| CVE-2026-126349 json | Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.0.0 un... | |
| CVE-2026-126348 json | Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.0.0 un... | |
| CVE-2026-126347 json | Tornado is a Python web framework and asynchronous networking library. In versions through 6.6.0, applications using tornad... | |
| CVE-2026-126346 json | basic-ftp is an FTP client for Node.js. Prior to 6.2.3, FTPContext.send() throws when a command contains carriage return, lin... | |
| CVE-2026-126345 json | basic-ftp is an FTP client for Node.js. Prior to 6.2.4, the MLSD directory-listing parser in src/parseListMLSD.ts uses untrus... | |
| CVE-2026-126344 json | @hono/node-server allows running the Hono application on Node.js. From 2.0.0 until 2.1.6, the WebSocket upgrade path resolves... | |
| CVE-2026-91141 json | A vulnerability in the default configuration of vsomeip allows a remote, unauthenticated attacker to trigger massive memory a... | |
| CVE-2026-126793 json | An untrusted search path issue in Aurora PostgreSQL dialect detection in the AWS Advanced Go Wrapper from release 2026-04-06 ... | |
| CVE-2026-126343 json | @hono/node-server allows running the Hono application on Node.js. From 2.0.0 until 2.1.6, the WebSocket upgrade handler waits... | |
| CVE-2026-126210 json | @hono/node-server allows running the Hono application on Node.js. Prior to 1.19.18 and from 2.0.0 until 2.1.6, the server pas... | |
| CVE-2026-120471 json | Joomla Extension - acymailing.com - Site modules rendered outside their access level in AcyMailing 1.0.0 - 11.1.1 - An unauth... |