CVE.report
CVE.report is the most up-to-date database of common vulnerabilities and exposures. Information is pulled in from several sources and processed in to a mobile friendly, easy to use page. Use the site to quickly check for vulnerabilities in products such as operating systems, applications, hardware, networks, databases, browsers, e-mail clients and more.
CVEs provide a unique and common naming scheme for publicly known cyber security vulnerabilities in order to quickly identify and share these vulnerabilities. You can use the search below to look for vulnerabilities based on product, vendor, or common tags
The form you will see after following this link allows you to fill out the various variables in the CVSS scoring system and receive the corresponding score. The description of each of the variables is also included for additional information.
cve.report now provides a free read-only JSON API for CVE details. Each record combines the CVE Program JSON record, NVD enrichment, KEV, and EPSS when available.
Recent CVEs
| CVE | Description | Updated |
|---|---|---|
| CVE-2026-115281 json | The Recipe Card Blocks Lite WordPress plugin before 3.6.4 does not sanitize and cast a block and shortcode attribute before c... | |
| CVE-2026-115255 json | The WP Roster WordPress plugin before 2.35 does not perform any capability or nonce checks on one of its AJAX actions, allowi... | |
| CVE-2026-115225 json | The Customer Engagement System WordPress plugin before 2.0.2 does not restrict access to its MailChimp interest-group lookup... | |
| CVE-2026-115224 json | The Customer Engagement System WordPress plugin before 2.0.2 does not safely build the SQL statements that store a popup's p... | |
| CVE-2026-113813 json | The PayPlug for WooCommerce (Official) WordPress plugin before 3.1.1 does not perform any capability or ownership check on a ... | |
| CVE-2026-113494 json | The GeoDirectory WordPress plugin before 2.8.195 does not perform any status or ownership check when rendering a listing ref... | |
| CVE-2026-113488 json | The GeoDirectory WordPress plugin before 2.8.196 does not properly escape a post badge shortcode attribute for a JavaScript ... | |
| CVE-2026-113487 json | The GeoDirectory WordPress plugin before 2.8.196 does not properly sanitise or escape a post badge click-through link value ... | |
| CVE-2026-15323 json | The Product Designer for WooCommerce WordPress | Lumise plugin for WordPress is vulnerable to Directory Traversal in all vers... | |
| CVE-2026-113486 json | The Media Library Assistant WordPress plugin before 3.42 does not verify a CSRF nonce on its Empty Trash media action, so a f... | |
| CVE-2026-113485 json | The Media Library Assistant WordPress plugin before 3.42 does not consistently validate its CSRF nonce on the Media Library b... | |
| CVE-2026-111967 json | The MP3 Audio Player WordPress plugin before 5.16 does not escape one of its audio player shortcode attributes before output... | |
| CVE-2026-111961 json | The Royal MCP WordPress plugin before 1.5.10 does not perform an object-level permission check before duplicating a requeste... | |
| CVE-2026-111960 json | The Royal MCP WordPress plugin before 1.5.10 does not perform object-level or post-type authorisation checks in one of its s... | |
| CVE-2026-111577 json | The GoSMTP WordPress plugin before 1.2.5 does not perform a settings-management authorization check on its SMTP configuratio... | |
| CVE-2026-111032 json | The Welcart e-Commerce WordPress plugin before 2.12.6 does not properly verify authorization against the targeted product bef... | |
| CVE-2026-111031 json | The Welcart e-Commerce WordPress plugin before 2.12.6 does not validate a user-supplied URL before using it in a redirect, al... | |
| CVE-2026-111027 json | The Welcart e-Commerce WordPress plugin before 2.12.6 does not properly sanitise and escape a parameter before using it in a ... | |
| CVE-2026-111021 json | The افزونه پیامک ووکامرس | Persian WooCommerce SMS WordPress plugin before 7.3.2 does not sanitise and esca... | |
| CVE-2026-110691 json | The WPOrLogin WordPress plugin before 3.1.0 does not perform a capability check or validate a nonce before updating its hidd... | |
| CVE-2026-110524 json | The Copy Anything to Clipboard for WordPress WordPress plugin before 5.5.5 does not sanitize and escape a shortcode attribut... | |
| CVE-2026-110509 json | The Essential Addons for Elementor WordPress plugin before 6.8.7 does not restrict the post type or meta query an unauthenti... | |
| CVE-2026-110507 json | The Page Builder by SiteOrigin WordPress plugin before 2.38.0 does not restrict the query arguments users can add to its Post... | |
| CVE-2026-110506 json | The Page Builder by SiteOrigin WordPress plugin before 2.38.0 does not sanitize or escape a widget property before storing it... | |
| CVE-2026-110292 json | The PayPlug for WooCommerce (Official) WordPress plugin before 3.1.1 does not verify that the requester owns the WooCommerce ... | |
| CVE-2026-109236 json | The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass via a Predictable... | |
| CVE-2026-107100 json | The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not verify that a requested post is publicly viewable b... | |
| CVE-2026-107098 json | The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not sanitise and escape one of its map widget's size se... | |
| CVE-2026-107097 json | The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not perform any authorization check before using the si... | |
| CVE-2026-106647 json | The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not scope a contact form's email delivery configuration... | |
| CVE-2026-106003 json | The Court Reservation WordPress plugin before 1.12.4 does not perform any authorization, authentication or nonce validation ... | |
| CVE-2026-106002 json | The Court Reservation WordPress plugin before 1.12.4 does not perform any authorisation or nonce verification on one of its ... | |
| CVE-2026-105997 json | The Booking Package WordPress plugin before 1.7.33 does not restrict who can trigger its booking verification-code emails nor... | |
| CVE-2026-105972 json | The Menu Cart for WooCommerce WordPress plugin before 3.2.1 does not sanitise and escape cart item variation data before outp... | |
| CVE-2026-104694 json | The Thrive Automator WordPress plugin before 11.2 does not properly sanitize and escape a parameter's array key before using ... | |
| CVE-2026-103688 json | The Checkout Files Upload for WooCommerce WordPress plugin before 2.4.0 does not validate uploaded file types when its accept... | |
| CVE-2026-103382 json | The Casso Flow WordPress plugin before 4.2.0 does not properly authenticate incoming bank-transfer payment notifications, as... | |
| CVE-2026-103372 json | The Payconiq WordPress plugin through 1.0.4 does not check that a visitor is allowed to see an order before returning its con... | |
| CVE-2026-103331 json | The UniPAY Payment Gateway For WooCommerce WordPress plugin through 2.3 does not properly verify the authenticity of payment ... | |
| CVE-2026-115522 json | Exposure of Resource to Wrong Sphere (CWE-668) in FileArtifactService in Google Agent Development Kit (ADK) for Python (googl... | |
| CVE-2026-104384 json | Insufficiently Protected Credentials in tunnel gateway and provisioning interfaces in EagleCloud Aquila versions through 2.6.... | |
| CVE-2026-104383 json | Improper Control of Generation of Code in Pigeon MFA service in EagleCloud Aquila versions through 2.6.7.2 on on-premises pla... | |
| CVE-2026-118276 json | A vulnerability was determined in a2ui-project a2ui up to 0.10.6. This vulnerability affects the function formatString of the... | |
| CVE-2026-118275 json | A vulnerability was found in a2ui-project a2ui up to 0.10.6. This affects the function DataContext.resolveSignal of the file ... | |
| CVE-2026-118008 json | Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 159 and Thunderbird 159. | |
| CVE-2026-116613 json | The Animated Text Block plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including... | |
| CVE-2026-111727 json | The Appointment Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'vs_text_submitbtn... | |
| CVE-2026-111497 json | A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all p... | |
| CVE-2026-111255 json | The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin for WordPress is vulnerable to Arbitrary Fi... | |
| CVE-2026-99100 json | In the Linux kernel, the following vulnerability has been resolved: wifi: p54: validate firmware record lengths The p54 fir... | |
| CVE-2026-1928 json | The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to PHP Object Injection in all... | |
| CVE-2026-48356 json | Adobe Commerce is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary... | |
| CVE-2026-118384 json | GNU mtools through 4.0.49 has an out-of-bounds write in parse_vses in vfat.c. | |
| CVE-2026-97019 json | The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'headline-*... | |
| CVE-2026-84999 json | The Pie Register Premium plugin for WordPress is vulnerable to Unrestricted File Type Upload in all versions up to, and inclu... | |
| CVE-2026-118378 json | Tabularis before 0.28.0 contains an SQL injection vulnerability in its SQLite driver that allows MCP clients to execute stack... | |
| CVE-2026-118377 json | mews/pos through 2.0.0 contains an insufficient verification of data authenticity vulnerability that allows unauthenticated a... | |
| CVE-2026-118376 json | WeKnora before 0.8.2 contains a server-side request forgery vulnerability in isRestrictedIP() that misclassifies NAT64-prefix... | |
| CVE-2026-118375 json | llama.cpp b8841 before b11865 contains an out-of-bounds write vulnerability in the ggml-rpc RDMA transport rdma_recv() functi... | |
| CVE-2026-118374 json | LibreSSL ocspcheck through 4.4.0 contains a memory exhaustion vulnerability that allows malicious OCSP responders to exhaust ... | |
| CVE-2026-118373 json | LibreSSL ocspcheck through 4.4.0 contains a cleartext transmission vulnerability because url2host() discards the OCSP URL sch... | |
| CVE-2026-118372 json | LibreSSL ocspcheck through 4.4.0 contains a CRLF injection vulnerability that allows attackers to inject HTTP headers by embe... | |
| CVE-2026-118371 json | LibreSSL through 4.4.0 contains a CRLF injection vulnerability in the libcrypto OCSP_sendreq_new() and OCSP_parse_url() funct... | |
| CVE-2026-118370 json | libexpat through 2.9.0 contains a signed integer overflow vulnerability in storeAtts() in lib/xmlparse.c that allows attacker... | |
| CVE-2026-118274 json | A vulnerability has been found in a2ui-project a2ui up to 0.10.6. Affected by this issue is some unknown functionality of the... | |
| CVE-2026-118273 json | A flaw has been found in a2ui-project a2ui up to 0.10.6. Affected by this vulnerability is the function DataModel.set of the ... | |
| CVE-2026-117610 json | libexpat through 2.9.0 contains a NULL pointer dereference vulnerability in externalEntityInitProcessor2() in lib/xmlparse.c ... | |
| CVE-2026-117609 json | rtl_433 through 25.12 contains a stack-based buffer overflow vulnerability in proflame2_mc() that allows nearby attackers to ... | |
| CVE-2026-117608 json | Assimp through 6.0.5 contains an integer overflow vulnerability in MD2Importer::ValidateHeader() that allows attackers to byp... | |
| CVE-2026-117607 json | Xerte Online Toolkits through 3.15.5 contains a remote code execution vulnerability that allows authenticated users with syst... | |
| CVE-2026-117606 json | NexoPOS through 6.3.0 contains a missing authorization vulnerability that allows authenticated cashiers to manipulate other c... | |
| CVE-2026-117605 json | nopCommerce before 5.00.0 contains a missing authorization vulnerability in the admin ProductController RelatedProductAddPopu... | |
| CVE-2026-115624 json | GROWI contains a missing authorization check vulnerability in its collaborative editing feature. By exploiting this vulnerabi... | |
| CVE-2026-111314 json | The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin for WordPress is vulnerable to Stored Cross... | |
| CVE-2026-109999 json | The AI Marketing Expert — AI Email Marketing, AI Content Generator, SEO Analyzer, AI Workflow Automation, Social Media & Ai... | |
| CVE-2026-109974 json | The All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos plugin for WordPress is vul... | |
| CVE-2026-109848 json | GROWI contains an authorization bypass vulnerability in its tag update API and the page update API due to improper use of a u... | |
| CVE-2026-109209 json | The All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos plugin for WordPress is vul... | |
| CVE-2026-107745 json | The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to limited media file dele... | |
| CVE-2026-115207 json | A flaw was found in GNU patch. An attacker can achieve arbitrary file creation outside the intended working directory by enti... | |
| CVE-2026-114730 json | Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a server-side request forgery filter bypass. The... | |
| CVE-2026-114726 json | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability in the Bounce (re... | |
| CVE-2026-114722 json | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSS scoping bypass in HTML messages. rcube_utils::mod... | |
| CVE-2026-114718 json | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a cross-site scripting vulnerability in the password pl... | |
| CVE-2026-114661 json | OpenRemote 1.2.0 before 1.31.0 contains a missing authorization vulnerability in GatewayServiceResource that allows any authe... | |
| CVE-2026-114657 json | Grav from 2.0.0 before 2.2.5 contains an information disclosure vulnerability that allows page authors to capture visitors' H... | |
| CVE-2026-114640 json | Traefik from v3.7.0 before v3.7.14 contains an authentication bypass vulnerability in its Kubernetes Ingress-NGINX provider t... | |
| CVE-2026-114636 json | Traefik v3.7.13 before v3.7.14 contains an access-control bypass in the Kubernetes Ingress NGINX provider, where the HTTP rou... | |
| CVE-2026-114577 json | A vulnerability was found in oretnom23 php-travel-agency-system. This vulnerability affects unknown code of the file admin/in... | |
| CVE-2026-107625 json | The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin f... | |
| CVE-2026-105272 json | GROWI contains an authorization bypass vulnerability in its page viewing and commenting functionality due to improper use of ... | |
| CVE-2015-20129 json | CrushFTP before 7.3.0 contains a cross-site request forgery vulnerability that allows attackers to perform administrative act... | |
| CVE-2014-125138 json | C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engine through 3.0.0 contain an unrestricted file ... | |
| CVE-2014-125137 json | C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engine through 3.0.0 contain a local file inclusio... | |
| CVE-2014-125136 json | C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engine through 3.0.0 contain an information disclo... | |
| CVE-2013-20009 json | Linksys WAG200G through 1.01.06 contains a stored cross-site scripting vulnerability that allows authenticated attackers to i... | |
| CVE-2013-20008 json | Linksys WAG200G through 1.01.06 contains a weak password change mechanism that allows attackers to change the administrator p... | |
| CVE-2013-20007 json | Linksys WAG200G through 1.01.06 contains an OS command injection vulnerability that allows authenticated attackers to execute... | |
| CVE-2026-114714 json | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a path traversal vulnerability in the squirrelmail_user... | |
| CVE-2026-114574 json | A security vulnerability has been detected in massCodeIO massCode 5.10. Affected is an unknown function of the file src/main/... |