CVE.report
CVE.report is the most up-to-date database of common vulnerabilities and exposures. Information is pulled in from several sources and processed in to a mobile friendly, easy to use page. Use the site to quickly check for vulnerabilities in products such as operating systems, applications, hardware, networks, databases, browsers, e-mail clients and more.
CVEs provide a unique and common naming scheme for publicly known cyber security vulnerabilities in order to quickly identify and share these vulnerabilities. You can use the search below to look for vulnerabilities based on product, vendor, or common tags
The form you will see after following this link allows you to fill out the various variables in the CVSS scoring system and receive the corresponding score. The description of each of the variables is also included for additional information.
cve.report now provides a free read-only JSON API for CVE details. Each record combines the CVE Program JSON record, NVD enrichment, KEV, and EPSS when available.
Recent CVEs
| CVE | Description | Updated |
|---|---|---|
| CVE-2026-97209 json | Insecure Temporary File vulnerability in Mix deps.partition in Elixir allows a local user to execute code as another user via... | |
| CVE-2026-65874 json | This issue affects Apache Fineract versions up to and including 1.15.0. The Center read endpoint (GET /api/v1/centers) and th... | |
| CVE-2026-64618 json | Improper Neutralization of Special Elements used in an SQL Command ("SQL Injection") vulnerability exists in Apache Fineract ... | |
| CVE-2026-59396 json | A denial-of-service vulnerability exists in UAA's private_key_jwt client-authentication mechanism. When UAA retrieves a remot... | |
| CVE-2026-59388 json | Cloud Controller (CAPI) leaks sensitive data into audit logs in multiple instances: custom buildpack credentials are exposed ... | |
| CVE-2026-59387 json | The Nginx routing configuration for Cloud Controller blocks unauthenticated access to /internal/v4/ and /internal/v5/ endpoin... | |
| CVE-2026-59386 json | A SpaceSupporter could improperly modify an application's start command and buildpack—actions requiring SpaceDeveloper priv... | |
| CVE-2026-59385 json | A user with SpaceDeveloper privileges could modify the URL of a space-scoped broker without altering its credentials, enablin... | |
| CVE-2026-115456 json | A flaw was found in gcc. An attacker could cause a Denial of Service (DoS) by passing a string that is not null-terminated to... | |
| CVE-2026-115274 json | Improper Validation of Specified Quantity in Input vulnerability in the Elixir standard library's JSON module allows an unaut... | |
| CVE-2026-114406 json | The system certificate authority (CA) store in Red Hat products, distributed via ca-certificates RPM packages, included multi... | |
| CVE-2026-114236 json | storage/pkg/archive.ApplyLayer and ApplyUncompressedLayer may, when processing corrupt or malicious inputs, leak a file descr... | |
| CVE-2026-109976 json | A flaw was found in the clevis PKCS#11 pin. The clevis-pkcs11-afunix-socket-unlock daemon crashes when an AF_UNIX client conn... | |
| CVE-2026-109821 json | Improper Validation of Specified Quantity in Input vulnerability in the Elixir standard library's URI module allows an attack... | |
| CVE-2026-101295 json | Path traversal / arbitrary file write in oc-mirror's operator catalog image extraction. When mirroring operator catalogs usin... | |
| CVE-2026-115455 json | A flaw was found in GCC libstdc++. When an application extracts data into a bitset from a wide-character stream, internal sta... | |
| CVE-2026-114691 json | A flaw was found in the libstdc++ component of GCC. An attacker who can provide an excessively large element count to a boole... | |
| CVE-2026-114690 json | A flaw was found in GCC. An out-of-bounds memory access vulnerability exists in the libstdc++ parallel search implementation ... | |
| CVE-2026-113496 json | A flaw was found in cockpit-machines. When saving Virtual Network Computing (VNC) console settings, the configured password i... | |
| CVE-2026-113495 json | A flaw was found in cockpit-machines. Red Hat Subscription Management (RHSM) authentication tokens are passed as command-line... | |
| CVE-2026-109971 json | A flaw was found in the clevis PKCS#11 pin. The clevis-decrypt-pkcs11 script passes the PKCS#11 token PIN as a command-line a... | |
| CVE-2026-109970 json | A flaw was found in the clevis PKCS#11 pin. The clevis-luks-pkcs11-askpin script writes the PKCS#11 token PIN in plaintext to... | |
| CVE-2026-109969 json | A flaw was found in the clevis PKCS#11 pin. The clevis-pkcs11-afunix-socket-unlock daemon creates AF_UNIX sockets without exp... | |
| CVE-2026-109968 json | A flaw was found in the clevis PKCS#11 pin. The clevis-pkcs11-afunix-socket-unlock daemon logs LUKS disk encryption passphras... | |
| CVE-2026-107176 json | A flaw was found in the cluster-samples-operator. The RBAC Role coreos-pull-secret-reader in namespace openshift-config grant... | |
| CVE-2026-102010 json | A flaw was found in GCC. When an application calls the erase_if function on a binary heap priority queue in libstdc++, the li... | |
| CVE-2026-93010 json | A flaw was found in dnsmasq. When DHCP leasequery is enabled without listing allowed source addresses, the server does not ch... | |
| CVE-2026-93009 json | A flaw was found in dnsmasq. The DHCPv6 client hostname parser can read one byte past the end of a crafted FQDN option becaus... | |
| CVE-2026-93007 json | A flaw was found in dnsmasq. The TCP DNS service uses a small fixed pool of child processes and does not set a receive timeou... | |
| CVE-2026-85231 json | A flaw was found in libtirpc. An authenticated remote attacker could exploit this vulnerability by sending oversized wrapped ... | |
| CVE-2026-82104 json | In Teltonika Networks RUTOS devices running versions from 7.22 through 7.24.2 and TSWOS devices running versions 1.9 through ... | |
| CVE-2026-79705 json | A flaw was found in the buildah/copier Go package. When used outside of Buildah by a non-root caller, a crafted tar archive c... | |
| CVE-2026-19730 json | The 'podman quadlet install --replace' command opens the existing destination file with O_CREATE|O_WRONLY but omits O_TRUNC. ... | |
| CVE-2026-15588 json | A denial-of-service and resource exhaustion vulnerability exists within the `GDBus` component of GLib. The `gdbusauth` authen... | |
| CVE-2026-58015 json | A flaw was found in GLib. The D-Bus client-side implementation of the DBUS_COOKIE_SHA1 SASL authentication mechanism does not... | |
| CVE-2026-58014 json | A flaw was found in GLib. An off-by-one error can occur in the g_key_file_get_locale_string_list function in the gkeyfile.c f... | |
| CVE-2026-55655 json | A flaw was found in OpenSSH. A local unprivileged attacker on a Linux client host can hijack client-side X11 forwarding conne... | |
| CVE-2026-55653 json | A flaw was found in OpenSSH. A malicious SSH server can exploit a double free vulnerability in the Diffie-Hellman Group Excha... | |
| CVE-2026-42013 json | A flaw was found in gnutls. When validating certificates, an oversized Subject Alternative Name (SAN) could cause the validat... | |
| CVE-2026-42011 json | A flaw was found in gnutls. This vulnerability occurs because permitted name constraints were incorrectly ignored when previo... | |
| CVE-2026-14324 json | RAOP module accepts unbounded Content-Length values and does not check the pw_array_add() return. | |
| CVE-2026-5260 json | A flaw was found in libgnutls. A remote attacker, by sending an extremely short premaster secret during an RSA key exchange t... | |
| CVE-2026-118952 json | A flaw was found in the Kroxylicious ACL authorizer. Its prefix-matching logic may apply a rule to a principal of a different... | |
| CVE-2026-118593 json | A flaw was found in Red Hat Enterprise Linux 9 kernel builds. An incomplete backport of the CVE-2026-46099 fix in RHEL 9.6 th... | |
| CVE-2026-116622 json | The Food Store – Online Food Delivery & Pickup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 's... | |
| CVE-2026-110732 json | The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Missing Authorization i... | |
| CVE-2026-103039 json | The Gravity Forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.1.2 via ... | |
| CVE-2026-97645 json | The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via List Field in all versions up to, and... | |
| CVE-2026-93011 json | A flaw was found in dnsmasq. After a reduction of internal domain-name buffer sizes, the DNSSEC validator can write a few byt... | |
| CVE-2026-92824 json | A flaw was found in libmodulemd. In the module stream v2 rpm-map emission path, an inner loop incorrectly uses the count of d... | |
| CVE-2026-92823 json | A flaw was found in libmodulemd. In builds with rpmio support enabled, compressed modulemd YAML is decompressed through a cus... | |
| CVE-2026-92822 json | A flaw was found in libmodulemd. When parsing module metadata, the xmd field is converted into nested GVariant values through... | |
| CVE-2026-90437 json | The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Post Excerpt / Post Custom Field / Ri... | |
| CVE-2026-89435 json | The Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More plugin for WordPress is vulner... | |
| CVE-2026-76781 json | A flaw was found in libxml2. A local user or an attacker providing a specially crafted XML catalog can trigger a NULL pointer... | |
| CVE-2026-42012 json | A flaw was found in gnutls. A remote attacker could exploit this vulnerability by presenting a specially crafted certificate ... | |
| CVE-2026-14330 json | Multiple unbounded alloca() calls in the PulseAudio protocol server. | |
| CVE-2026-119087 json | The Content Egg – Affiliate Product Importer & Price Comparison plugin for WordPress is vulnerable to authorization bypass ... | |
| CVE-2026-119059 json | The Content Egg plugin for WordPress is vulnerable to unauthorized modification of data due to a missing per-post capability ... | |
| CVE-2026-118698 json | The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to generic SQL Inject... | |
| CVE-2026-118634 json | The Events Made Easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'width' parameter in all versi... | |
| CVE-2026-118500 json | The Cool FormKit Lite – Advanced Form Builder for Elementor plugin for WordPress is vulnerable to Stored DOM-Based Cross-Si... | |
| CVE-2026-118194 json | The Page and Post Restriction plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and includin... | |
| CVE-2026-118165 json | The Firelight Lightbox WordPress plugin before 2.3.23 does not escape the URL of links it opens in its Classic lightbox befor... | |
| CVE-2026-118101 json | The BuddyForms WordPress plugin before 2.10.1 does not verify that a user editing an existing entry is the author of the targ... | |
| CVE-2026-118100 json | The BuddyForms WordPress plugin before 2.10.3 does not check that the requester is allowed to manage a form before exporting ... | |
| CVE-2026-118072 json | The Fraud Prevention For WooCommerce and EDD WordPress plugin before 2.3.6 does not check that a user is allowed to manage or... | |
| CVE-2026-118071 json | The Joinchat WordPress plugin before 6.4.2 does not escape the message of its button block before outputting it in an HTML a... | |
| CVE-2026-117572 json | The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 8.8 does not sanitize and escape a parameter before usi... | |
| CVE-2026-117571 json | The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 8.8 does not sanitize and escape tracking data derived ... | |
| CVE-2026-115277 json | The User Frontend WordPress plugin before 4.3.14 does not sanitise and escape some user-supplied values before reflecting th... | |
| CVE-2026-114444 json | The Security Plugin, Firewall & Malware Scanner with Auto Removal WordPress plugin before 2.191 does not restrict its File Sy... | |
| CVE-2026-114443 json | The Security Plugin, Firewall & Malware Scanner with Auto Removal WordPress plugin before 2.191 does not verify the account p... | |
| CVE-2026-114422 json | The Enable Media Replace WordPress plugin before 4.2.3 does not restrict the classes allowed when deserializing stored metada... | |
| CVE-2026-95619 json | A flaw was found in libstdc++. An integer overflow can occur when processing large inputs to the aligned operator new in the ... | |
| CVE-2026-71226 json | Memory Corruption via Uncanceled AIO Requests on Error: libkcapi's one-shot AIO path can return an error before all submitted... | |
| CVE-2026-12080 json | A flaw was found in the QEMU Guest Agent (qga). A local unprivileged user can exploit a vulnerability in the guest-ssh-add-au... | |
| CVE-2026-104368 json | The Export and Import Users and Customers plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, a... | |
| CVE-2026-5461 json | The Forminator Forms plugin for WordPress is vulnerable to Limited File Deletion in all versions up to, and including, 1.55.0... | |
| CVE-2026-109411 json | An access control bypass flaw was identified in Samba's vfs_ceph_rgw module in it's openat() function. An authenticated user ... | |
| CVE-2026-104795 json | The insights-runtime-extractor runs as a privileged DaemonSet (`hostPID: true`) that scans container processes for runtime fi... | |
| CVE-2026-103963 json | A flaw was found in glib-networking. When establishing connections using Transport Layer Security (TLS) version 1.3, the clie... | |
| CVE-2026-94640 json | A flaw was found in rpcbind. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service (DoS) ... | |
| CVE-2026-93017 json | The `insights-operator-gather` ClusterRole grants the operator's service account read access to secrets in the core API group... | |
| CVE-2026-92574 json | A vulnerability in CRI-O checkpoint restore allows a user who can create a pod from a malicious checkpointed container to byp... | |
| CVE-2026-92092 json | A flaw was found in openshift-ansible. The installer container's `run` script downloads and executes remote inventory and dyn... | |
| CVE-2026-83589 json | A flaw was found in oauth-proxy. The application fails to properly validate the destination redirect parameter (`rd`) during ... | |
| CVE-2026-75888 json | A flaw was found in the OpenShift console. An authenticated console user can exploit a Server-Side Request Forgery (SSRF) vul... | |
| CVE-2026-49329 json | A flaw was found in openshift/oauth-server. The OAuth login and error page endpoints pass the unauthenticated Accept-Language... | |
| CVE-2026-118584 json | Incorrect Authorization vulnerability in Drupal Field Permissions allows Forceful Browsing. This issue affects Field Permissi... | |
| CVE-2026-118583 json | Incorrect Authorization vulnerability in Drupal Field Permissions allows Forceful Browsing. This issue affects Field Permissi... | |
| CVE-2026-118582 json | Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal CAPTCHA allows Functionality Bypass. This is... | |
| CVE-2026-118576 json | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Stage File Proxy... | |
| CVE-2026-118575 json | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Signature pad wi... | |
| CVE-2026-118574 json | Incorrect Permission Assignment for Critical Resource vulnerability in Drupal S3 File System allows Exploiting Incorrectly Co... | |
| CVE-2026-118573 json | Missing Authorization vulnerability in Drupal OAuth2 Token Manager allows Forceful Browsing. This issue affects OAuth2 Token ... | |
| CVE-2026-118572 json | Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal OAuth Login - OAuth OIDC SSO allows Authenti... | |
| CVE-2026-118571 json | Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Media Alias Display allows Exploiting Incor... | |
| CVE-2026-118570 json | Cross-Site Request Forgery (CSRF) vulnerability in Drupal Fasttoggle allows Cross Site Request Forgery. This issue affects Fa... | |
| CVE-2026-118569 json | Incorrect Authorization vulnerability in Drupal Fasttoggle allows Forceful Browsing. This issue affects Fasttoggle versions: ... |