CVE.report
CVE.report is the most up-to-date database of common vulnerabilities and exposures. Information is pulled in from several sources and processed in to a mobile friendly, easy to use page. Use the site to quickly check for vulnerabilities in products such as operating systems, applications, hardware, networks, databases, browsers, e-mail clients and more.
CVEs provide a unique and common naming scheme for publicly known cyber security vulnerabilities in order to quickly identify and share these vulnerabilities. You can use the search below to look for vulnerabilities based on product, vendor, or common tags
The form you will see after following this link allows you to fill out the various variables in the CVSS scoring system and receive the corresponding score. The description of each of the variables is also included for additional information.
cve.report now provides a free read-only JSON API for CVE details. Each record combines the CVE Program JSON record, NVD enrichment, KEV, and EPSS when available.
Recent CVEs
| CVE | Description | Updated |
|---|---|---|
| CVE-2026-123786 json | Agenta before 0.122.5 contains a server-side request forgery vulnerability that allows workspace members with workflow edit r... | |
| CVE-2026-123785 json | Fluxbox through 1.3.7 contains an infinite loop vulnerability in Menu::updateMenu() in src/FbTk/Menu.cc that allows attackers... | |
| CVE-2026-123784 json | Fluxbox through 1.3.7 contains an OS command injection vulnerability in RootTheme::reconfigTheme() that allows attackers to e... | |
| CVE-2026-123783 json | Skyvern through 1.0.56 contains a sandbox bypass vulnerability that allows authenticated users to execute code by reconstruct... | |
| CVE-2026-123782 json | ChatWiki before 2.10.0 contains an insecure direct object reference vulnerability in SaveFormField and UpdateFormRequired tha... | |
| CVE-2026-123665 json | A weakness has been identified in kubescape up to 4.0.15. Impacted is the function GetWriter of the file core/pkg/resultshand... | |
| CVE-2026-123664 json | A security flaw has been discovered in nasa-gcn gcn.nasa.gov up to b299b562af665878964b981a459f0a9c04b11adf. This issue affec... | |
| CVE-2026-123624 json | ChatWiki before 2.10.0 contains an insecure direct object reference vulnerability that allows authenticated users to modify o... | |
| CVE-2026-123622 json | Usermin through 2.570 contains a cross-site scripting vulnerability in mailbox/detach.cgi that allows remote attackers to exe... | |
| CVE-2026-123621 json | Usermin through 2.570 contains a path traversal vulnerability in mailbox/detachall.cgi that allows remote unauthenticated att... | |
| CVE-2026-123620 json | Usermin through 2.570 contains an OS command injection vulnerability in the Read Mail module that allows authenticated users ... | |
| CVE-2026-123619 json | Lektor through 3.3.14 and 3.4.0b15 contains an absolute path traversal vulnerability in the admin API on Windows that allows ... | |
| CVE-2026-123618 json | ABP Framework before 10.7.1 contains an authentication bypass vulnerability that skips account state and two-factor checks wh... | |
| CVE-2026-123617 json | Openwhyd before 1.65.1 contains a NoSQL injection vulnerability that allows unauthenticated attackers to manipulate user look... | |
| CVE-2026-123492 json | SiYuan before 3.8.9 contains a nil pointer dereference vulnerability in privateCacheMiddleware that allows authenticated atta... | |
| CVE-2026-123491 json | Craft CMS 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2 contains an SQL injection vulnerability in GraphQL eager-loading: argum... | |
| CVE-2026-87045 json | The HTTP/2 server in subsys/net/lib/http/http_server_http2.c clears the connection's stream binding at the start of every fra... | |
| CVE-2026-64894 json | Inclusion of functionality from untrusted control sphere vulnerability in Johnson Controls EasyIO Neo IOManager and Tools Ins... | |
| CVE-2026-59105 json | Jumis (formerly Tildes Jumis) creates and uses a Microsoft SQL Server login named ##Tilde_JumisAdmin## whose password is deri... | |
| CVE-2026-53980 json | Charmbracelet wish before 2.0.5 contains a path traversal vulnerability in the git middleware (charm.land/wish/v2) that allow... | |
| CVE-2026-123490 json | Craft CMS from 5.8.17 before 5.11.2 contains a privilege escalation vulnerability because getOwners() applies caller criteria... | |
| CVE-2026-123489 json | Craft CMS 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2 contains a blind SQL injection vulnerability because the sandbox-expose... | |
| CVE-2026-123488 json | Craft CMS 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2 contains an unauthenticated SQL injection vulnerability in the element ... | |
| CVE-2026-123487 json | Parse Server before 8.6.115 and 9.0.0 before 9.10.7-alpha.1 validates user email address format with a regular expression who... | |
| CVE-2026-123486 json | WWBN AVideo 29.0 through 29.4.0 contains a race condition vulnerability in plugin/PayPalYPT/ipn.php that allows attackers to ... | |
| CVE-2026-123485 json | Ground Station from 0.6.0 before 0.8.20 does not restrict the get-orbital-sources Socket.IO handler (also exposed as get-tle-... | |
| CVE-2026-123339 json | Improper trust of forwarded headers in RouterListener::onKernelFinishRequest() in Symfony HttpKernel versions prior to 5.4.... | |
| CVE-2026-119170 json | There was a regression in how FIPS algorithms were enforced for the hashlib module. Only users that are using OpenSSL in FIPS... | |
| CVE-2026-118514 json | In Symfony http-foundation prior to versions 5.4.56, 6.4.50, 7.4.23, and 8.1.11, Symfony\Component\HttpFoundation\RequestMat... | |
| CVE-2026-113618 json | The ZSIRep client library (ZSIREP.CLIENT.DLL) is vulnerable to improper server certificate validation. It registers a proces... | |
| CVE-2026-112341 json | Wazuh versions from 4.0.0 before 4.14.9 contain a sql injection vulnerability in WazuhDBBackend._substitute_params due to seq... | |
| CVE-2026-112340 json | Wazuh dashboard plugins from 4.9.0 before 4.14.9 contain an authorization bypass vulnerability that allows authenticated dash... | |
| CVE-2026-112339 json | Wazuh from 3.9.0 before 4.14.9 contains a missing TLS hostname verification vulnerability in the fluent-forward module's wm_f... | |
| CVE-2026-112338 json | Wazuh from 4.3.0 before 4.14.9 contains a server-side request forgery vulnerability in the GitHub module (wm_github.c) that t... | |
| CVE-2026-112337 json | Wazuh from 3.7.0 before 4.14.9 contains a server-side request forgery vulnerability in the Azure wodle get_graph_events() fun... | |
| CVE-2026-112336 json | Wazuh Manager from 3.0.0 before 4.14.9 contains a memory leak vulnerability in the generic JSON decoder that allows remote at... | |
| CVE-2026-112335 json | Wazuh agent from 1.0.0 before 4.14.9 contains a stack-based buffer overflow in the logcollector snort-full log reader that mi... | |
| CVE-2026-112334 json | Wazuh from 1.0.0 before 4.14.9 contains an out-of-bounds write vulnerability in wazuh-execd that allows privileged manager-co... | |
| CVE-2026-106022 json | Cleartext storage of sensitive information in memory vulnerability in Johnson Controls EasyIO Neo IOManager and Tools Install... | |
| CVE-2026-106020 json | Improper neutralization of input used for LLM prompting vulnerability in Johnson Controls EasyIO Neo IO Manager and Tools Ins... | |
| CVE-2026-123655 json | A flaw was found in Moodle. Insufficient access control checks on H5P content files allow unauthenticated remote attackers to... | |
| CVE-2026-123337 json | In JetBrains YouTrack before 2026.2.19656 users without update permission could change issue visibility | |
| CVE-2026-123336 json | In JetBrains YouTrack before 2026.2.19728 the attachment size limit could be bypassed via AI assistant thread conversion | |
| CVE-2026-123326 json | In JetBrains YouTrack before 2026.2.19197 incorrect authorisation in the scripts debugger allowed workflow script disclosure ... | |
| CVE-2026-123325 json | In JetBrains YouTrack before 2025.3.170763, 2026.1.14150, 2026.2.19656 inclusion of untrusted remote code was possible via ... | |
| CVE-2026-123324 json | In JetBrains YouTrack before 2026.2.19562 information disclosure via shared mailbox message history was possible | |
| CVE-2026-123316 json | In JetBrains Junie CLI before 26.6.29 sensitive environment variables were exposed in session event logs | |
| CVE-2026-123314 json | In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 xXE attack was possible via an XML response to an HTTP Client request | |
| CVE-2026-120035 json | The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vu... | |
| CVE-2026-119211 json | The AAA Autoload Optimizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'option_page' parameter ... | |
| CVE-2026-119178 json | The Smart Cookie Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all ver... | |
| CVE-2026-116551 json | The WP Customer Area plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name' parameter in al... | |
| CVE-2026-116545 json | The All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos plugin for WordPress is vul... | |
| CVE-2026-115952 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPMU DEV Forminator for... | |
| CVE-2026-109884 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Elementor Elementor Web... | |
| CVE-2026-109883 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Elementor Elementor Web... | |
| CVE-2026-107658 json | The BuddyForms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'bf_post_type (and buddyforms_form_c... | |
| CVE-2026-106019 json | Insertion of sensitive information into log file vulnerability in Johnson Controls C-CURE 9000, Victor allows Use of Known Op... | |
| CVE-2026-123311 json | In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 command execution via a hidden run control in the Markdown preview was po... | |
| CVE-2026-123309 json | In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 stored XSS was possible on the built-in web server via Markdown preview | |
| CVE-2026-123308 json | In JetBrains IntelliJ IDEA before 2026.3 code execution via the document import was possible in untrusted projects | |
| CVE-2026-123305 json | In JetBrains IntelliJ IDEA before 2026.3 path traversal was possible via unpacking Dev Container archives from a remote host | |
| CVE-2026-123304 json | In JetBrains IntelliJ IDEA before 2026.3 code execution in untrusted projects via a configured ShellCheck path | |
| CVE-2026-123302 json | In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4, 2026.1.5.1, 2025.3.6.2 code execution was possible in untrusted projec... | |
| CVE-2026-123300 json | In JetBrains Hub before 2026.2.52519 missing authorisation allowed users with read-only access to modify auth module group ma... | |
| CVE-2026-123299 json | In JetBrains Hub before 2026.2.52519 information disclosure via user search queries was possible | |
| CVE-2026-123298 json | In JetBrains Hub before 2026.2.52556 sMTP command injection via email verification was possible | |
| CVE-2026-123296 json | In JetBrains Hub before 2026.2.52519 privilege escalation via forged email verification was possible | |
| CVE-2026-123294 json | In JetBrains Hub before 2026.2.52556 privilege escalation was possible by changing email authentication details during the ve... | |
| CVE-2026-123293 json | In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 code execution was possible in untrusted projects via the Terraform tool... | |
| CVE-2026-123292 json | In JetBrains Datalore before 2026.4 aPI tokens and sessions of removed or banned users remained valid | |
| CVE-2026-123291 json | In JetBrains Datalore before 2026.4 improper owner validation allowed reading another workspace's issues and runs notebook | |
| CVE-2026-123290 json | In JetBrains Datalore before 2026.4 hidden notebook code was exposed to unauthenticated users via the public interactive repo... | |
| CVE-2026-123289 json | In JetBrains Datalore before 2026.4 improper authorisation allowed notebook viewers to modify files | |
| CVE-2026-123288 json | In JetBrains Datalore before 2026.4 stored XSS in notebook charts was possible via Vega editor link | |
| CVE-2026-123278 json | In JetBrains IntelliJ IDEA before 2026.3 code execution was possible via the unauthenticated JDBC worker RMI endpoint | |
| CVE-2026-123277 json | In JetBrains CLion before 2026.3, 2026.2.4.1 missing authentication allowed local users to obtain the debug session environm... | |
| CVE-2026-123276 json | In JetBrains CLion before 2026.3, 2026.2.4.1 code execution was possible in Safe Mode via a crafted GDB server debug profile | |
| CVE-2026-120550 json | The WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory plugin for WordPress is vulner... | |
| CVE-2026-110776 json | The MDTF – Meta Data and Taxonomies Filter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'vars'... | |
| CVE-2026-97642 json | The Wp Parsidate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the calendar Gutenberg block's 'theme'... | |
| CVE-2026-122222 json | The Permalink Manager Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'slug' parameter in all ... | |
| CVE-2026-120843 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Barn2 Plugins Posts Tab... | |
| CVE-2026-120671 json | The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP plugin for WordPress ... | |
| CVE-2026-119521 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cozmoslabs Paid Member ... | |
| CVE-2026-119488 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Shamim Rajani Pie Regis... | |
| CVE-2026-119472 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Anderson Redux Fr... | |
| CVE-2026-118189 json | The Posts Table with Search & Sort plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'date_format' pa... | |
| CVE-2026-111089 json | Apache Wicket reads texts from the application's resource bundles — a localized label, a css class name — and writes some... | |
| CVE-2026-110291 json | The Graphina – Charts and Graphs For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'i... | |
| CVE-2026-95863 json | Improper neutralization of input during web page generation in Apache Wicket. Apache Wicket generates JavaScript that refers... | |
| CVE-2026-87718 json | Apache Wicket 10.10.0, 10.11.0 and 9.24.0 do not set the Content-Security-Policy headers on a page whose render request handl... | |
| CVE-2026-84231 json | Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.markup.html.link.ExternalLin... | |
| CVE-2026-84177 json | Incorrect behavior order in Apache Wicket: a file path is validated before the framework appends the attributes that complete... | |
| CVE-2026-84172 json | Files accessible to external parties in Apache Wicket. org.apache.wicket.markup.html.PackageResourceGuard decides whether a ... | |
| CVE-2026-84170 json | Allocation of resources without limits or throttling in Apache Wicket. org.apache.wicket.markup.html.form.upload.resource.Ab... | |
| CVE-2026-83594 json | Memory allocation with an excessive size value in Apache Wicket. org.apache.wicket.markup.html.form.upload.resource.FileUplo... | |
| CVE-2026-83559 json | Improper encoding or escaping of output in Apache Wicket. org.apache.wicket.core.util.string.JavaScriptUtils#escapeQuotes() ... | |
| CVE-2026-83539 json | Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.extensions.markup.html.basic... | |
| CVE-2026-83493 json | A flaw was found in distributed-workloads. A remote attacker could exploit a vulnerability in the pull_request_target workflo... |