CVE.report
CVE.report is the most up-to-date database of common vulnerabilities and exposures. Information is pulled in from several sources and processed in to a mobile friendly, easy to use page. Use the site to quickly check for vulnerabilities in products such as operating systems, applications, hardware, networks, databases, browsers, e-mail clients and more.
CVEs provide a unique and common naming scheme for publicly known cyber security vulnerabilities in order to quickly identify and share these vulnerabilities. You can use the search below to look for vulnerabilities based on product, vendor, or common tags
The form you will see after following this link allows you to fill out the various variables in the CVSS scoring system and receive the corresponding score. The description of each of the variables is also included for additional information.
cve.report now provides a free read-only JSON API for CVE details. Each record combines the CVE Program JSON record, NVD enrichment, KEV, and EPSS when available.
Recent CVEs
| CVE | Description | Updated |
|---|---|---|
| CVE-2026-114460 json | A flaw was found in mod_qos. An off-by-one pointer calculation error occurs when merging request body parameters with an exis... | |
| CVE-2026-114459 json | A flaw was found in mod_qos. When inspecting HTTP response bodies, improper boundary checking can cause the module to read me... | |
| CVE-2026-114458 json | A flaw was found in mod_qos. An unauthenticated remote attacker can cause a Denial of Service (DoS) by maintaining numerous c... | |
| CVE-2026-114457 json | A flaw was found in mod_qos. An unauthenticated remote attacker could cause a Denial of Service (DoS) by sending a specially ... | |
| CVE-2026-114184 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPVibes Elementor Addon... | |
| CVE-2026-114182 json | Missing Authorization vulnerability in IdeaBox Creations PowerPack Addons for Elementor powerpack-lite-for-elementor allows E... | |
| CVE-2026-114180 json | Missing Authorization vulnerability in Wpmet Metform metform allows Exploiting Incorrectly Configured Access Control Security... | |
| CVE-2026-114177 json | Cross-Site Request Forgery (CSRF) vulnerability in Xpro Xpro Elementor Addons xpro-elementor-addons allows Cross Site Request... | |
| CVE-2026-114175 json | Missing Authorization vulnerability in DigitalME eRoom eroom-zoom-meetings-webinar allows Exploiting Incorrectly Configured A... | |
| CVE-2026-112867 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in H5P H5P h5p allows Stor... | |
| CVE-2026-112843 json | Missing Authorization vulnerability in WP Chill Strong Testimonials strong-testimonials allows Exploiting Incorrectly Configu... | |
| CVE-2026-112826 json | Missing Authorization vulnerability in eLightUp Falcon – WordPress Optimizations & Tweaks falcon allows Exploiting Incorrec... | |
| CVE-2026-111847 json | Missing Authorization vulnerability in Kings Plugins MarketKing marketking-multivendor-marketplace-for-woocommerce allows Exp... | |
| CVE-2026-105270 json | Allocation of Resources Without Limits or Throttling vulnerability in esaml_binding in dropbox esaml allows an unauthenticate... | |
| CVE-2026-103634 json | Out-of-bounds read and write in the Count-Min sketch deserialization of Apache DataSketches C++ (repo: datasketches-cpp). co... | |
| CVE-2025-66533 json | Improper Control of Generation of Code ('Code Injection') vulnerability in Liquid Web / StellarWP GiveWP give allows Code Inj... | |
| CVE-2026-114570 json | WordPress Core is vulnerable to Stored Cross-Site Scripting via Quick Edit in all versions up to, and including, 7.0.2 due to... | |
| CVE-2026-111972 json | The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.5.8 does not verify that a user is authorised to act... | |
| CVE-2026-111971 json | The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.5.8 does not sanitise and escape collection and gall... | |
| CVE-2026-111958 json | The Royal MCP WordPress plugin before 1.5.7 does not limit a preview-link token to the single preview it was issued for, so ... | |
| CVE-2026-110011 json | The MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.12.3 does not perform a capability check in its export... | |
| CVE-2026-110010 json | The MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.12.3 does not perform any capability or authentication... | |
| CVE-2026-109987 json | The PixelYourSite WordPress plugin before 11.4.3, PixelYourSite Pro WordPress plugin before 12.6.8 do not sanitise and escap... | |
| CVE-2026-109931 json | The Infility Global WordPress plugin before 2.16.25 does not perform any authorisation or nonce check on an AJAX action avail... | |
| CVE-2026-109927 json | The HIPAA Forms WordPress plugin before 3.3.2 does not perform a capability check when handling a request that rebuilds its o... | |
| CVE-2026-103234 json | The WP Ultimate Review WordPress plugin before 2.4.5 does not neutralise shortcodes in all of the review fields submitted thr... | |
| CVE-2026-100142 json | The FluentCart A New Era of eCommerce WordPress plugin before 2.2.0 does not verify that a stored customer address selected ... | |
| CVE-2026-97328 json | The WebP Express WordPress plugin before 0.25.16 does not escape values that its bundled HTML parser re-emits into element at... | |
| CVE-2026-96512 json | A flaw was found in sudo. When sudoers rules use NOTBEFORE or NOTAFTER time-based access restrictions with timestamps that om... | |
| CVE-2026-88849 json | The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.55 does not verify that a user targeted through its student... | |
| CVE-2026-86332 json | A flaw was found in odh-dashboard in Red Hat OpenShift AI. The backend-for-frontend route GET /api/nim-serving/:nimResource r... | |
| CVE-2026-78392 json | The Link Library WordPress plugin before 7.9.6 does not sanitise and escape a link field before outputting it inside an attri... | |
| CVE-2026-18949 json | A flaw was found in odh-dashboard. This vulnerability allows an attacker, who has compromised the dashboard's Service Account... | |
| CVE-2026-15574 json | A flaw was found in the vllm-orchestrator-gateway component. The system's production binary logs all incoming authorization h... | |
| CVE-2026-15143 json | A flaw was found in the file_type content detector of guardrails-detectors. This vulnerability allows a remote attacker to su... | |
| CVE-2026-114223 json | NT OneAPP developed by NewType Infortech has an Exposure of Sensitive Information vulnerability. Unauthenticated local attack... | |
| CVE-2026-114222 json | NT OneAPP developed by NewType Infortech has an Authentication Bypass vulnerability. Unauthenticated local attackers can bypa... | |
| CVE-2026-114221 json | NT OneAPP developed by NewType Infortech has a Credential Disclosure vulnerability. Unauthenticated remote attackers can trig... | |
| CVE-2026-114220 json | NT OneAPP developed by NewType Infortech has an Improper Certificate Validation vulnerability. Unauthenticated network-adjace... | |
| CVE-2026-114219 json | NT OneAPP developed by NewType Infortech has a Hard-coded Credentials vulnerability. Unauthenticated remote attackers can obt... | |
| CVE-2026-114406 json | The system certificate authority (CA) store in Red Hat products, distributed via ca-certificates RPM packages, included multi... | |
| CVE-2026-112309 json | @rvf/set-get before 7.0.4 contains a prototype pollution vulnerability in setPath that allows unauthenticated attackers to ov... | |
| CVE-2026-112304 json | docTR through 1.1.0 contains an unsafe deserialization vulnerability in load_pretrained_params() that loads checkpoints with ... | |
| CVE-2026-112157 json | A weakness has been identified in MemTensor memmy-agent up to 1.0.9/1.1.1/1.2.2. The impacted element is the function require... | |
| CVE-2026-111056 json | FOSSBilling is an open source billing and client-management platform. From 0.1.0 until 0.8.7, the unauthenticated POST /api/g... | |
| CVE-2026-114732 json | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an improper authentication vulnerability in multi-host ... | |
| CVE-2026-114731 json | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an uncontrolled resource consumption vulnerability in t... | |
| CVE-2026-114730 json | Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a server-side request forgery filter bypass. The... | |
| CVE-2026-114729 json | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass. rcube_washtml inspect... | |
| CVE-2026-113406 json | BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary S... | |
| CVE-2026-110354 json | HAProxy 3 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (persistent worker-thread CPU ex... | |
| CVE-2026-110353 json | HAProxy 3.2 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (worker-thread CPU exhaustion)... | |
| CVE-2026-113405 json | BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary S... | |
| CVE-2026-112329 json | The Sensei LMS WordPress plugin before 4.26.4 contains a broken access control vulnerability in the legacy save_new_message h... | |
| CVE-2026-112293 json | BoxyHQ Enterprise SaaS Starter Kit through 1.6.0 contains a missing authorization vulnerability that allows non-owner team me... | |
| CVE-2026-112288 json | Krayin CRM 2.2.5 before 2.2.7 contains a server-side request forgery filter bypass that allows users with webhook permissions... | |
| CVE-2026-112283 json | VideoLAN libbluray through 1.5.1 contains an uncontrolled memory allocation vulnerability in _parse_extent_start_points() in ... | |
| CVE-2026-112278 json | rdesktop through 1.9.0 contains a heap out-of-bounds read vulnerability in process_raw_bmpcache() in orders.c that allows mal... | |
| CVE-2026-112273 json | libtins through 4.6 contains a heap out-of-bounds read vulnerability in DNS::compose_name in src/dns.cpp that allows remote a... | |
| CVE-2026-112268 json | sglang-router (sgl-model-gateway) through 0.3.2 contains an authorization bypass vulnerability that allows holders of the dat... | |
| CVE-2026-112263 json | Television (tv) 0.15.0 through 0.15.9 contains an OS command injection vulnerability that allows attackers to run shell comma... | |
| CVE-2026-112150 json | A security flaw has been discovered in vraj404 Criminal-Management-System up to 2808d057e7ddc5295519a487365b0cacfd0ba8c4. Aff... | |
| CVE-2026-112145 json | A security vulnerability has been detected in speaches-ai speaches up to 0.9.0-rc.3. This vulnerability affects the function ... | |
| CVE-2026-111936 json | Sigma File Manager through 2.2.0 contains a server-side request forgery vulnerability because validate_remote_url() in securi... | |
| CVE-2026-107081 json | SQL injection via identifier injection in the tableName and tableFields POST parameters of admin AJAX endpoints (admin/AJAX_l... | |
| CVE-2025-55654 json | A use-after-free in the gf_filter_pid_get_packet function (filter_core/filter_pid.c) of GPAC MP4Box v2.4 allows attackers to ... | |
| CVE-2026-112141 json | A vulnerability was determined in satya-vinay Events-Management-System up to 437c77ceb69bf9fe2e3f4f46f7871b83f425383a. Affect... | |
| CVE-2026-112108 json | A vulnerability was determined in ztxz16 fastllm up to 0.1.8.2. This impacts the function GGUFBuffer::ReadString of the file ... | |
| CVE-2026-112104 json | A flaw has been found in eremef bandcamp-player up to 1.8.33-beta. The impacted element is an unknown function of the file da... | |
| CVE-2026-112100 json | A vulnerability was determined in DeepPavlov up to 1.7.0. This affects the function MultiTaskPipelinePreprocessor.__init__ of... | |
| CVE-2026-112095 json | A flaw has been found in SourceCodester Inventory System 1.0. This affects an unknown part of the file /api/products_handler.... | |
| CVE-2026-112091 json | A flaw has been found in Dav-ee dairy-management-system 31ace9692d1e1e6d64339a42c463b361319c615c/f31a584c3330c013b61f8b0306d9... | |
| CVE-2026-112087 json | A weakness has been identified in itsourcecode Online Cake Ordering System 1.0. This issue affects some unknown processing of... | |
| CVE-2026-112081 json | A vulnerability was determined in hankcs HanLP up to 2.1.0-beta.64. This affects the function hanlp.load of the file plugins/... | |
| CVE-2026-112077 json | A vulnerability was detected in radareorg radare2 6.2.0/6.2.2. This issue affects the function r_core_cmd_str_pipe in the lib... | |
| CVE-2026-112073 json | A vulnerability was identified in Tencent ncnn up to 44b02dabdcf97499281a4692ebd65bad73dcf8b6. Affected by this vulnerability... | |
| CVE-2026-112042 json | A security flaw has been discovered in diem-project diem up to 116974edfb9a5b8bd69cb13586dc62bcdbb485ad. This issue affects t... | |
| CVE-2026-112038 json | A vulnerability has been found in diem-project diem up to 116974edfb9a5b8bd69cb13586dc62bcdbb485ad. Affected by this vulnerab... | |
| CVE-2026-112034 json | A weakness has been identified in aircheng-org iWebShop-5 up to 5.16. The impacted element is the function IController::redir... | |
| CVE-2026-111883 json | Locust through 2.46.7 contains a cross-site request forgery vulnerability that allows remote attackers to stop load tests or ... | |
| CVE-2026-112059 json | libLAS through 1.8.1 contains a heap out-of-bounds write vulnerability in the point record reader caused by truncating the sc... | |
| CVE-2026-112054 json | Schroedinger libschroedinger through 1.0.11 contains a divide by zero vulnerability that allows attackers to crash applicatio... | |
| CVE-2026-112049 json | Vita3K before build 4187 contains a path traversal (zip slip) vulnerability in install_archive_content() that allows attacker... | |
| CVE-2026-112030 json | A vulnerability was found in diem-project diem up to 5.1.3. This vulnerability affects unknown code of the file dmCorePlugin/... | |
| CVE-2026-112026 json | A security vulnerability has been detected in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c381... | |
| CVE-2026-112020 json | LodePNG through 20261006 contains a heap out-of-bounds read vulnerability in lodepng::getFilterTypesInterlaced() in lodepng_u... | |
| CVE-2026-112005 json | WhoDB 0.104.0 before 0.135.0 contains a path traversal vulnerability that allows remote attackers to read and write arbitrary... | |
| CVE-2026-112000 json | Vanus 0.8.0 through 0.9.0 contains a missing authorization vulnerability in the gateway that allows any authenticated user to... | |
| CVE-2026-111991 json | A security vulnerability has been detected in WongKinYiu yolov9 0.1. This vulnerability affects the function DetectMultiBacke... | |
| CVE-2026-111986 json | A vulnerability was determined in AUTOMATIC1111 stable-diffusion-webui up to 1.10.1. Affected is the function get_obj_from_st... | |
| CVE-2026-111932 json | Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contains a stored HTML injection v... | |
| CVE-2026-111877 json | A vulnerability was determined in dext34-morgan Books4Cash up to a8d3e357db75c07ac5ffbadcbaee2aeb4db3e571. This affects an un... | |
| CVE-2026-111873 json | A vulnerability was detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. This... | |
| CVE-2026-111869 json | A vulnerability was identified in makeplane plane up to 1.4.2. Impacted is an unknown function of the component API Endpoint.... | |
| CVE-2026-96398 json | Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0... | |
| CVE-2026-96392 json | Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal AI CKEditor allows Code Injecti... | |
| CVE-2026-96391 json | Missing Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. This issue affects Webform REST versions... | |
| CVE-2026-96390 json | Privilege Defined With Unsafe Actions vulnerability in Drupal Editoria11y Accessibility Checker allows Privilege Escalation. ... | |
| CVE-2026-96388 json | Cross-Site Request Forgery (CSRF) vulnerability in Drupal Tawk.to - Live chat application allows Cross Site Request Forgery. ... | |
| CVE-2026-96387 json | Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Stop administrator login allows Authenticati... |