CVE.report
CVE.report is the most up-to-date database of common vulnerabilities and exposures. Information is pulled in from several sources and processed in to a mobile friendly, easy to use page. Use the site to quickly check for vulnerabilities in products such as operating systems, applications, hardware, networks, databases, browsers, e-mail clients and more.
CVEs provide a unique and common naming scheme for publicly known cyber security vulnerabilities in order to quickly identify and share these vulnerabilities. You can use the search below to look for vulnerabilities based on product, vendor, or common tags
The form you will see after following this link allows you to fill out the various variables in the CVSS scoring system and receive the corresponding score. The description of each of the variables is also included for additional information.
cve.report now provides a free read-only JSON API for CVE details. Each record combines the CVE Program JSON record, NVD enrichment, KEV, and EPSS when available.
Recent CVEs
| CVE | Description | Updated |
|---|---|---|
| CVE-2026-110910 json | ### Summary `qs.stringify` with `allowEmptyArrays: true` writes the key of an empty array without encoding it, even though... | |
| CVE-2026-106174 json | A improper locking vulnerability in Fortinet FortiOS 8.0.0, FortiOS 7.6.4 through 7.6.6 may allow an unauthenticated attacker... | |
| CVE-2026-105946 json | Out-of-bounds read in the QAuthenticator NTLM authentication handling in the Qt Network module in Qt Group Qt allows remote a... | |
| CVE-2026-103359 json | The PayDunya WooCommerce Payment Gateway WordPress plugin through 1.1.6 does not verify the authenticity of incoming payment ... | |
| CVE-2026-103325 json | The TiendaCrypto para WooCommerce WordPress plugin through 1.2.1 does not correctly verify the authenticity of its payment we... | |
| CVE-2026-75891 json | The Kirki plugin for WordPress is vulnerable to Privilege Escalation via PHP Object Injection in all versions up to, and incl... | |
| CVE-2026-117472 json | Psono Server CE && EE versions 4.0.33 through 7.2.3 compared the request path for the bulk-secret-read endpoint with a hard-c... | |
| CVE-2026-117471 json | Psono Server CE && EE versions 0.1.0 through 7.2.3 accepted a user-controlled host when configuring a personal Duo device and... | |
| CVE-2026-117470 json | Psono Server CE & EE versions 3.1.0 through 7.2.3 did not consume a stored WebAuthn challenge after assertion verification. A... | |
| CVE-2026-117469 json | Psono Server (CE & EE) versions 1.0.0 through 7.2.3 did not enforce the direction of file-transfer credentials on file-reposi... | |
| CVE-2026-117468 json | Psono Server versions 5.3.5 through 7.2.3 used a permission class that did not enforce token write scope when claiming a devi... | |
| CVE-2026-116638 json | The Windows Recovery Environment (WinRE) in Windows 10 and 11 may allow an attacker to bypass firmware security controls, inc... | |
| CVE-2026-116370 json | A security flaw has been discovered in 2K Games Sid Meier's Civilization VI 1.0.12.68. The affected element is the function l... | |
| CVE-2026-114236 json | storage/pkg/archive.ApplyLayer and ApplyUncompressedLayer may, when processing corrupt or malicious inputs, leak a file descr... | |
| CVE-2026-111820 json | The Analytics Insights – Google Analytics Dashboard for WordPress plugin for WordPress is vulnerable to Stored Cross-Site S... | |
| CVE-2026-103332 json | The Payex Payment Gateway for Woocommerce WordPress plugin through 1.2.10 does not properly verify the authenticity of incomi... | |
| CVE-2026-103312 json | The Payment Integration Wompi WordPress plugin through 4.0.1 does not verify the authenticity of incoming payment notificatio... | |
| CVE-2025-8556 json | A flaw was found in CIRCL's implementation of the FourQ elliptic curve. This vulnerability allows an attacker to compromise s... | |
| CVE-2024-9355 json | A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer... | |
| CVE-2026-96280 json | The OCI delta stream parser read sizes as guint64 but passed them to GLib I/O and allocation functions expecting gsize (32 bi... | |
| CVE-2025-14874 json | A flaw was found in Nodemailer. This vulnerability allows a denial of service (DoS) via a crafted email address header that t... | |
| CVE-2025-11395 json | A flaw was found in Podman. If an attacker can pass a crafted tar archive to the `podman load` command, they can create files... | |
| CVE-2024-11831 json | A flaw was found in npm-serialize-javascript. The vulnerability occurs because the serialize-javascript module does not prope... | |
| CVE-2023-6717 json | A flaw was found in the SAML client registration in Keycloak that could allow an administrator to register malicious JavaScri... | |
| CVE-2026-113947 json | This issue was addressed with improved access restrictions. This issue is fixed in macOS Golden Gate 27.2. Unpacking a malici... | |
| CVE-2026-112677 json | An authorization issue was addressed with improved access control. This issue is fixed in macOS Golden Gate 27.2, macOS Sequo... | |
| CVE-2026-112659 json | A type confusion issue was addressed with improved memory handling. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS... | |
| CVE-2026-86929 json | An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27, macOS ... | |
| CVE-2026-86916 json | A use after free issue was addressed with improved memory management. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27... | |
| CVE-2026-65327 json | A logic issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS ... | |
| CVE-2026-64759 json | An integer overflow was addressed with improved input validation. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27... | |
| CVE-2026-116612 json | A flaw was found in GStreamer Editing Services (gst-editing-services). A GES project file can embed an arbitrary GStreamer pi... | |
| CVE-2026-112655 json | A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPad... | |
| CVE-2026-112651 json | A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPad... | |
| CVE-2026-112623 json | A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPad... | |
| CVE-2026-112484 json | This issue was addressed with improved file handling. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, ma... | |
| CVE-2026-112438 json | A logic issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8... | |
| CVE-2026-112427 json | An authentication issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27.2. A remote... | |
| CVE-2026-110063 json | Improper link resolution before file access ('link following') in VM Inspector for Azure Virtual Machines allows an unauthori... | |
| CVE-2026-107656 json | An authentication bypass using an alternate path or channel vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.6, Forti... | |
| CVE-2026-91506 json | Vulnerability in the Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer). Supported versio... | |
| CVE-2026-91505 json | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Porting). Supported versions... | |
| CVE-2026-91474 json | Vulnerability in the PeopleSoft Enterprise FIN Common Objects Brazil product of Oracle PeopleSoft (component: eProcurement). ... | |
| CVE-2026-91466 json | Vulnerability in the PeopleSoft Enterprise FIN Common Objects Argentina product of Oracle PeopleSoft (component: Asset Manage... | |
| CVE-2026-91323 json | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that a... | |
| CVE-2026-87408 json | Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Personalization). Supporte... | |
| CVE-2026-87349 json | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Security). Supported version... | |
| CVE-2026-87302 json | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that a... | |
| CVE-2026-83427 json | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Multichannel Framework). Sup... | |
| CVE-2026-83393 json | Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Internal Operations). Supported versi... | |
| CVE-2026-83379 json | Vulnerability in the Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: WebLogic Server Pro... | |
| CVE-2026-10757 json | There is a SQL injection vulnerability in Esri ArcGIS Server versions 12.1 and earlier on Windows and Linux that may allow a ... | |
| CVE-2026-101842 json | Vulnerability in the Strategic Network Optimization product of Oracle E-Business Suite (component: Installation of SNO). Sup... | |
| CVE-2026-101841 json | Vulnerability in the Global Order Promising product of Oracle E-Business Suite (component: Web Service). Supported versions ... | |
| CVE-2026-101834 json | Vulnerability in the Oracle Shipping Execution product of Oracle E-Business Suite (component: Workflow Events). Supported ve... | |
| CVE-2026-101831 json | Vulnerability in the Oracle Quality product of Oracle E-Business Suite (component: Internal Operations). Supported versions ... | |
| CVE-2026-101824 json | Vulnerability in the Document Management and Collaboration product of Oracle E-Business Suite (component: Attachments). Supp... | |
| CVE-2026-101704 json | Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: Other). Supported versions ... | |
| CVE-2026-101700 json | Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Core). Supported versi... | |
| CVE-2026-101684 json | Vulnerability in the Oracle E-Business Suite Integrated SOA Gateway product of Oracle E-Business Suite (component: Internal O... | |
| CVE-2026-101672 json | Vulnerability in the Oracle Call Center Technology product of Oracle E-Business Suite (component: Internal Operations). Supp... | |
| CVE-2026-101665 json | Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Admin UI). Supported version... | |
| CVE-2026-101648 json | Vulnerability in the Oracle Partner Management product of Oracle E-Business Suite (component: Internal Operations). Supporte... | |
| CVE-2026-101429 json | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: SQR). Supported versions tha... | |
| CVE-2026-101428 json | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: SQR). Supported versions tha... | |
| CVE-2026-83361 json | Vulnerability in the Oracle Contract Lifecycle Management for Public Sector product of Oracle E-Business Suite (component: Aw... | |
| CVE-2026-60885 json | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Push Notifications). Support... | |
| CVE-2026-88781 json | Untrusted Pointer Dereference in ASUS certain motherboards firmware allows a kernel-level privileges user can supply an arb... | |
| CVE-2024-1249 json | A flaw was found in Keycloak's OIDC component in the "checkLoginIframe," which allows unvalidated cross-origin messages. This... | |
| CVE-2026-116640 json | A flaw has been found in Saruf-Ratul HR-Payroll-Management-System e7cd81477001afdee95b843fd4137894d9418c9f/3fd6f45ead9f819751... | |
| CVE-2026-116639 json | A vulnerability was detected in MD-MAFUJUL-HASAN Online-Payroll-Management-System up to a8902bf64575e325f6d6bf93a55f7bd273ec5... | |
| CVE-2026-111147 json | Libyal libesedb through 20260704 contains a heap out-of-bounds read vulnerability in libesedb_record_get_multi_value() that a... | |
| CVE-2026-110613 json | youlai-mall through commit 9f62de8 contains a missing authorization vulnerability that allows authenticated members to view e... | |
| CVE-2026-109564 json | LearnHouse before 1.4.0 contains a missing authorization vulnerability in POST /api/v1/playgrounds/{uuid}/duplicate that skip... | |
| CVE-2026-116844 json | Fclairamb ftpserverlib through 0.32.4 contains a cleartext transmission vulnerability because TransferOpen checks only the tr... | |
| CVE-2026-116843 json | Mistral Vibe before 3.0.3 contains a remote code execution vulnerability that allows attackers to run commands by defining gi... | |
| CVE-2026-116842 json | DevilutionX 1.4.0 through 1.5.5 contains a heap buffer overflow vulnerability in the bundled libmpq libmpq__archive_dup routi... | |
| CVE-2026-116841 json | DevilutionX 1.4.0 through 1.5.5 contains an out-of-bounds read vulnerability in the bundled libmpq libmpq__file_number_from_h... | |
| CVE-2026-116840 json | llama.cpp b5854 before b11275 contains an integer overflow vulnerability in gguf_init_from_reader that bypasses the CVE-2025-... | |
| CVE-2026-116839 json | A malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Site Request Forgery (CSRF) vulne... | |
| CVE-2026-116838 json | A malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Site Request Forgery (CSRF) vulne... | |
| CVE-2026-116837 json | A malicious actor with access to the adjacent network could exploit a Heap-based Buffer Overflow vulnerability found in airMA... | |
| CVE-2026-116836 json | A malicious actor with access to the adjacent network and under certain conditions could exploit a Stored Cross-Site Scriptin... | |
| CVE-2026-116829 json | llama.cpp b10398 before b11301 contains an integer overflow vulnerability in gguf_init_from_reader that allows attackers to b... | |
| CVE-2026-116816 json | llama.cpp b5899 before b10261 contains a heap out-of-bounds write vulnerability in llm_tokenizer_plamo2::build that allows at... | |
| CVE-2026-116623 json | A vulnerability was detected in code-projects Simple Content Management System 1.0. Impacted is an unknown function of the fi... | |
| CVE-2026-116620 json | A security vulnerability has been detected in Tencent RapidJSON up to 1.1.0. This issue affects the function GenericStringStr... | |
| CVE-2026-116608 json | A security vulnerability has been detected in DAMO Academy VideoLLaMA2 up to 1.1. Affected by this issue is the function load... | |
| CVE-2026-116605 json | A vulnerability was found in SourceCodester Online Food Ordering System 1.0. The impacted element is an unknown function of t... | |
| CVE-2026-113943 json | An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2. Moun... | |
| CVE-2026-113939 json | An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2. Moun... | |
| CVE-2026-113913 json | An input validation issue was addressed with improved input validation. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, ... | |
| CVE-2026-113907 json | A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS... | |
| CVE-2026-112708 json | A race condition was addressed with improved locking. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, ma... | |
| CVE-2026-112646 json | An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2... | |
| CVE-2026-111422 json | In apache-airflow-providers-ssh before 7.0.1, SSHRemoteJobOperator quoted the values of its templated `environment` parameter... | |
| CVE-2026-97028 json | Rejected reason: Maintainers determined it is not a vulnerability. | |
| CVE-2026-86971 json | An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2... | |
| CVE-2026-84496 json | An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2, macO... | |
| CVE-2025-71439 json | llama.cpp before b5649 contains a heap out-of-bounds read vulnerability in llama_vocab::impl::print_info() that allows attack... |