CVE.report
CVE.report is the most up-to-date database of common vulnerabilities and exposures. Information is pulled in from several sources and processed in to a mobile friendly, easy to use page. Use the site to quickly check for vulnerabilities in products such as operating systems, applications, hardware, networks, databases, browsers, e-mail clients and more.
CVEs provide a unique and common naming scheme for publicly known cyber security vulnerabilities in order to quickly identify and share these vulnerabilities. You can use the search below to look for vulnerabilities based on product, vendor, or common tags
The form you will see after following this link allows you to fill out the various variables in the CVSS scoring system and receive the corresponding score. The description of each of the variables is also included for additional information.
cve.report now provides a free read-only JSON API for CVE details. Each record combines the CVE Program JSON record, NVD enrichment, KEV, and EPSS when available.
Recent CVEs
| CVE | Description | Updated |
|---|---|---|
| CVE-2026-126663 json | Contao 4.0.0 before 5.3.54, 5.4.0 before 5.7.17, and 6.0.0 before 6.0.6 contains a path traversal vulnerability that allows c... | |
| CVE-2026-126662 json | Contao 4.0.0 before 5.3.54, 5.4.0 before 5.7.17, and 6.0.0 before 6.0.6 contains an access control bypass vulnerability that ... | |
| CVE-2026-126659 json | BlueprintUE Self-Hosted Edition 1.0.0 before 4.3.5 contains a resource exhaustion vulnerability that allows unauthenticated a... | |
| CVE-2026-94125 json | Nimbus returns the worker placement of every topology running on a supervisor, including the host, port, owner and resource a... | |
| CVE-2026-126658 json | ByteStash 1.5.10 before 1.6.2 contains an insufficient session expiration vulnerability that allows holders of API keys to ke... | |
| CVE-2026-126537 json | The Ninja Forms - File Uploads add-on for WordPress is vulnerable to Arbitrary File Deletion (and arbitrary file read via S3/... | |
| CVE-2026-125782 json | Missing Authorization vulnerability in Blubrry Podcasting PowerPress Podcasting powerpress allows Exploiting Incorrectly Conf... | |
| CVE-2026-125778 json | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in myCred myCred mycred allows Co... | |
| CVE-2026-125776 json | Missing Authorization vulnerability in Cozmoslabs Profile Builder profile-builder allows Exploiting Incorrectly Configured Ac... | |
| CVE-2026-125767 json | Insertion of Sensitive Information Into Sent Data vulnerability in NerdPress Hubbub Lite social-pug allows Retrieve Embedded ... | |
| CVE-2026-125766 json | Insertion of Sensitive Information Into Sent Data vulnerability in WPZOOM WPZOOM Social Feed Widget & Block instagram-widget-... | |
| CVE-2026-125763 json | Missing Authorization vulnerability in Brainstorm Force SureForms sureforms allows Exploiting Incorrectly Configured Access C... | |
| CVE-2026-125762 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LeapWorx Premium Addons... | |
| CVE-2026-125746 json | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in ProPluginsLab Back In Stock No... | |
| CVE-2026-125743 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPVibes Elementor Addon... | |
| CVE-2026-125708 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Element Pack E... | |
| CVE-2026-125454 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Passster conte... | |
| CVE-2026-125450 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureRa... | |
| CVE-2026-125448 json | Missing Authorization vulnerability in Kaliforms Kali Forms kali-forms allows Exploiting Incorrectly Configured Access Contro... | |
| CVE-2026-125446 json | Cross-Site Request Forgery (CSRF) vulnerability in WisdmLabs Edwiser Bridge edwiser-bridge allows Cross Site Request Forgery.... | |
| CVE-2026-125445 json | Cross-Site Request Forgery (CSRF) vulnerability in Infomaniak Network VOD Infomaniak vod-infomaniak allows Cross Site Request... | |
| CVE-2026-125436 json | Missing Authorization vulnerability in Mamunur Rashid The Post Grid the-post-grid allows Exploiting Incorrectly Configured Ac... | |
| CVE-2026-125435 json | Insertion of Sensitive Information Into Sent Data vulnerability in IdeaBox Creations PowerPack Addons for Elementor powerpack... | |
| CVE-2026-125433 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FuturioWP Futurio Extra... | |
| CVE-2026-125431 json | Missing Authorization vulnerability in Mamunur Rashid Food Menu – Restaurant Menu & Online Ordering for WooCommerce tlp-foo... | |
| CVE-2026-125046 json | Missing Authorization vulnerability in John-Michael L'Allier Create mediavine-create allows Exploiting Incorrectly Configured... | |
| CVE-2026-125045 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in John-Michael L'Allier C... | |
| CVE-2026-124745 json | A flaw was found in BusyBox. When extracting an archive, the tar utility improperly resolves deferred hardlink targets across... | |
| CVE-2026-124744 json | A flaw was found in BusyBox. When extracting files using the cpio utility with path traversal protection enabled, hardlink ta... | |
| CVE-2026-124496 json | The DRPC HTTP endpoint lets an authenticated client act as another user without applying the configured impersonation authori... | |
| CVE-2026-124495 json | When workers run as the topology owner, the Logviewer serves files that a worker has placed in its own log directory as links... | |
| CVE-2026-124417 json | Missing Authorization vulnerability in Ahmad WP Job Portal wp-job-portal allows Exploiting Incorrectly Configured Access Cont... | |
| CVE-2026-124416 json | Missing Authorization vulnerability in Ahmad WP Job Portal wp-job-portal allows Exploiting Incorrectly Configured Access Cont... | |
| CVE-2026-124411 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureCa... | |
| CVE-2026-124269 json | Missing Authorization vulnerability in weDevs Happy Addons for Elementor happy-elementor-addons allows Exploiting Incorrectly... | |
| CVE-2026-124263 json | Cross-Site Request Forgery (CSRF) vulnerability in plainware Locatoraid Store Locator locatoraid allows Cross Site Request Fo... | |
| CVE-2026-124262 json | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Igor Funa Ad Inserter ad-inser... | |
| CVE-2026-124261 json | Missing Authorization vulnerability in Magepeople inc. Taxi Booking Manager for WooCommerce ecab-taxi-booking-manager allows ... | |
| CVE-2026-123481 json | Missing Authorization vulnerability in WP Extended The Ultimate WordPress Toolkit – WP Extended wpextended allows Exploitin... | |
| CVE-2026-123480 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Fullworks Plugins Displ... | |
| CVE-2026-123374 json | Deserialization of Untrusted Data vulnerability in Apache Roller. When Roller sends a weblog update ping, its XML-RPC client ... | |
| CVE-2026-122300 json | Missing Authorization vulnerability in Apache Roller 4.0 through 6.1.6 allows a weblog member with the Limited role to remove... | |
| CVE-2026-122096 json | Uncontrolled Resource Consumption vulnerability in the sketch deserialization of Apache DataSketches Java. Several deseria... | |
| CVE-2026-118414 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.2 through 6.1.6 all... | |
| CVE-2026-119528 json | A flaw was found in GIMP. The PSD plug-in’s image resource header loader uses an incorrect destination size when copying a ... | |
| CVE-2026-118413 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 4.0 through 6.1.6 allow... | |
| CVE-2026-118412 json | Improper Authentication in Apache Roller 5.1.0 through 6.1.6 allows a user whose account an administrator has disabled to sig... | |
| CVE-2026-118411 json | Cross-Site Request Forgery (CSRF) in Apache Roller 5.0.1 through 6.1.6 allows an unauthenticated attacker to create an admini... | |
| CVE-2026-118410 json | Exposure of Resource to Wrong Sphere in Apache Roller 4.0 through 6.1.6 allows an unauthenticated visitor to read an entry af... | |
| CVE-2026-118409 json | Exposure of Sensitive Information to an Unauthorized Actor in Apache Roller 4.0 through 6.1.6 allows an unauthenticated visit... | |
| CVE-2026-118408 json | Missing Authorization in Apache Roller 4.0 through 6.1.6 allows any logged-in user to read unpublished entries of a weblog th... | |
| CVE-2026-118405 json | Exposure of Sensitive Information to an Unauthorized Actor in Apache Roller 4.0 through 6.1.6 allows any logged-in user to le... | |
| CVE-2026-115456 json | A flaw was found in gcc. An attacker could cause a Denial of Service (DoS) by passing a string that is not null-terminated to... | |
| CVE-2026-115455 json | A flaw was found in GCC libstdc++. When an application extracts data into a bitset from a wide-character stream, internal sta... | |
| CVE-2026-114691 json | A flaw was found in the libstdc++ component of GCC. An attacker who can provide an excessively large element count to a boole... | |
| CVE-2026-112201 json | A flaw was found in the login-failure storage component of Keycloak, the identity and access management solution. This issue ... | |
| CVE-2026-111824 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.6 allows an authent... | |
| CVE-2026-108338 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 5.0.1 through 6.1.6 all... | |
| CVE-2026-105154 json | Cross-Site Request Forgery (CSRF) in the Planet feed aggregator administration of Apache Roller 4.0 through 6.1.6 allows an u... | |
| CVE-2026-105153 json | Improper Restriction of XML External Entity Reference in Apache Roller 4.0 through 6.1.6 allows an authenticated user with no... | |
| CVE-2026-105152 json | Exposure of Sensitive Information to an Unauthorized Actor in Apache Roller 4.0 through 6.1.6 allows a weblog administrator t... | |
| CVE-2026-91075 json | The Eupago Gateway For Woocommerce WordPress plugin from 4.5.0 before 4.7.6 does not verify the authenticity of incoming paym... | |
| CVE-2026-114690 json | A flaw was found in GCC. An out-of-bounds memory access vulnerability exists in the libstdc++ parallel search implementation ... | |
| CVE-2026-112261 json | A flaw was found in GIMP. Opening a crafted XCF that selects a path and then fails to load that path can cause a use-after-fr... | |
| CVE-2026-112260 json | A flaw was found in GIMP. Opening a crafted XCF with a malformed text-layer parasite can cause a heap out-of-bounds read, dis... | |
| CVE-2026-112258 json | A flaw was found in GIMP. The XCF loader can leave a dangling pointer in the linked-channels list when a linked channel is la... | |
| CVE-2026-112257 json | A flaw was found in GIMP. The PSD thumbnail resource loader performs a BGR-to-RGB channel swap with a fixed 3-byte stride and... | |
| CVE-2026-92982 json | A flaw was found in Ansible Operator Plugins. A low-privileged Kubernetes user can exploit a Jinja2 template injection vulner... | |
| CVE-2026-86856 json | A flaw was found in the DPDK nfp vDPA driver. Stack and heap buffers sized for a single queue pair can be overflowed when mor... | |
| CVE-2026-86849 json | A flaw was found in DPDK lib/vhost vhost-crypto. Integer overflow in chain length checks, and missing length checks on the RS... | |
| CVE-2026-86848 json | A flaw was found in DPDK lib/vhost vhost-crypto. The indirect-descriptor snapshot double-fetches a guest descriptor next inde... | |
| CVE-2026-86847 json | A flaw was found in DPDK lib/vhost vhost-crypto. Write-back chain cleanup can follow an uninitialized next pointer when mappi... | |
| CVE-2026-86846 json | A flaw was found in DPDK lib/vhost vhost-crypto. A guest can supply an avail-ring descriptor index that is used without bound... | |
| CVE-2026-86845 json | A flaw was found in DPDK lib/vhost vhost-crypto. Session cleanup can leave a stale cached session pointer, and the data path ... | |
| CVE-2026-86567 json | A flaw was found in DPDK lib/vhost. The VDUSE handler fails to invalidate vring pointers when the IOTLB is invalidated, leadi... | |
| CVE-2026-86566 json | A flaw was found in DPDK lib/vhost. A guest with runt RX descriptors can underflow the copy length in vhost enqueue, causing ... | |
| CVE-2026-86565 json | A flaw was found in DPDK lib/vhost. A guest can desynchronize virtqueue size from inflight descriptor table size, causing an ... | |
| CVE-2026-86563 json | A flaw was found in DPDK lib/vhost. A double-offset bug in vhost log mapping calculation can lead to incorrect memory access. | |
| CVE-2026-86562 json | A flaw was found in DPDK lib/vhost. A TOCTOU double-fetch of control-queue descriptors allows a heap buffer overflow with att... | |
| CVE-2026-109832 json | A flaw was found in gnome-remote-desktop as shipped in Red Hat Enterprise Linux. In the VNC TLS I/O handlers, retryable GnuTL... | |
| CVE-2026-106062 json | A heap-based buffer overflow was found in GIMP’s DirectDraw Surface (DDS) loader. When loading a crafted DDS image, buffer ... | |
| CVE-2026-102560 json | A flaw was found in libsoup. When the permessage-deflate WebSocket extension compresses a very large outgoing message, trunca... | |
| CVE-2026-102559 json | A flaw was found in libsoup. When constructing a masked WebSocket client frame for a very large outgoing payload, size values... | |
| CVE-2026-102558 json | A flaw was found in libsoup. When max-incoming-payload-size is unlimited (0), SoupWebsocketConnection could grow its incoming... | |
| CVE-2026-102557 json | A flaw was found in libsoup. When reassembling fragmented WebSocket messages into a GByteArray, libsoup did not adequately ca... | |
| CVE-2026-102556 json | A flaw was found in libsoup. When handling an incoming WebSocket Pong frame, SoupWebsocketConnection emitted the ::pong signa... | |
| CVE-2026-102555 json | A flaw was found in libsoup. The soup_uri_decode_data_uri() function incorrectly treated base64 data-URI payloads as NUL-term... | |
| CVE-2026-102010 json | A flaw was found in GCC. When an application calls the erase_if function on a binary heap priority queue in libstdc++, the li... | |
| CVE-2026-100236 json | A flaw was found in the DPDK GSO library. When software GSO copies packet headers into a new mbuf, it does not check that the... | |
| CVE-2026-97185 json | A flaw was found in GIMP. When processing a specially crafted GIMPressionist preset file, the plug-in does not properly valid... | |
| CVE-2026-97024 json | A path traversal vulnerability in Flatpak's handling of the files/etc directory during app deployment allows a malicious Flat... | |
| CVE-2026-97023 json | A path traversal vulnerability in Flatpak's handling of the export/bin directory during app deployment allows a malicious Fla... | |
| CVE-2026-96889 json | A flaw was found in librsvg. When processing an SVG document containing nested XML inclusions (Xincludes) with duplicate enti... | |
| CVE-2026-96280 json | The OCI delta stream parser read sizes as guint64 but passed them to GLib I/O and allocation functions expecting gsize (32 bi... | |
| CVE-2026-93683 json | A flaw was found in the DPDK vhost library. When handling a virtio indirect descriptor table, the host reads the table length... | |
| CVE-2026-86561 json | A flaw was found in DPDK lib/vhost. Memory size is not adequately validated before mmap during vhost memory-region setup, whi... | |
| CVE-2026-96442 json | A code execution flaw was found in Emacs, affecting versions prior to 31.2. The Flymake mode using language backends other th... | |
| CVE-2026-96275 json | A malicious or compromised Flatpak repository can write attacker-controlled content to arbitrary locations on the host filesy... | |
| CVE-2026-95619 json | A flaw was found in libstdc++. An integer overflow can occur when processing large inputs to the aligned operator new in the ... | |
| CVE-2026-94184 json | A stack-based buffer overflow flaw was found in fetchmail when built with NTLM support. A malicious or compromised mail serve... |