CVE.report
CVE.report is the most up-to-date database of common vulnerabilities and exposures. Information is pulled in from several sources and processed in to a mobile friendly, easy to use page. Use the site to quickly check for vulnerabilities in products such as operating systems, applications, hardware, networks, databases, browsers, e-mail clients and more.
CVEs provide a unique and common naming scheme for publicly known cyber security vulnerabilities in order to quickly identify and share these vulnerabilities. You can use the search below to look for vulnerabilities based on product, vendor, or common tags
The form you will see after following this link allows you to fill out the various variables in the CVSS scoring system and receive the corresponding score. The description of each of the variables is also included for additional information.
cve.report now provides a free read-only JSON API for CVE details. Each record combines the CVE Program JSON record, NVD enrichment, KEV, and EPSS when available.
Recent CVEs
| CVE | Description | Updated |
|---|---|---|
| CVE-2026-120858 json | Missing Authorization vulnerability in WP ManageNinja LLC FluentForm fluentform allows Exploiting Incorrectly Configured Acce... | |
| CVE-2026-114189 json | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPVibes AnyWhere Elemen... | |
| CVE-2026-114188 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPVibes AnyWhere Elemen... | |
| CVE-2026-114186 json | Missing Authorization vulnerability in WPVibes AnyWhere Elementor anywhere-elementor allows Exploiting Incorrectly Configured... | |
| CVE-2026-109900 json | Incorrect Privilege Assignment vulnerability in Melapress Melapress Role Editor melapress-role-editor allows Privilege Escala... | |
| CVE-2026-109899 json | Missing Authorization vulnerability in Melapress Melapress Role Editor melapress-role-editor allows Exploiting Incorrectly Co... | |
| CVE-2026-103320 json | IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.10 could allow an authenticated user with the Reader role to... | |
| CVE-2026-102618 json | IBM i 7.6, 7.5, 7.4, and 7.3 could allow an authenticated user to indirectly disable system auditing, which they otherwise do... | |
| CVE-2026-101117 json | IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.2.2 could allow a remote attacker to bypass security restrictions due to impr... | |
| CVE-2026-61987 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WC Lovers WCFM – Fron... | |
| CVE-2025-36075 json | IBM Safer Payments 6.4.0.00 through 6.4.2.11, 6.5.0.00 through 6.5.0.09, 6.6.0.00 through 6.6.0.07, 6.7.0.00 through 6.7.0.03... | |
| CVE-2025-1837 json | IBM watsonx Orchestrate Cartridge for Cloud Pak for Data 4.8.4 through 4.8.5, and 5.0.0 through 5.4.2 could allow an authenti... | |
| CVE-2025-0166 json | IBM watsonx Orchestrate Cartridge for Cloud Pak for Data 4.8.4 through 4.8.5, and 5.0.0 through 5.4.2 could disclose sensitiv... | |
| CVE-2026-123158 json | sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication ... | |
| CVE-2026-66034 json | libssh2 through 1.11.1, fixed in commit a13bb6c, contains a missing bounds check vulnerability that allows a malicious SSH se... | |
| CVE-2026-66033 json | libssh2 through 1.11.1, fixed in commit a2ed82d, contains a pre-authentication integer underflow vulnerability in the ssh2_ci... | |
| CVE-2026-66032 json | libssh2 through 1.11.1, fixed in commit 5e47761, contains a double-free vulnerability in the sftp_open() function in src/sftp... | |
| CVE-2026-65693 json | Microweber CMS through 2.0.20 contains a server-side template injection vulnerability that allows authenticated administrator... | |
| CVE-2024-41786 json | IBM Engineering Requirements Management DOORS Next 7.1, and 7.2 could allow a remote attacker to force the Web server to retu... | |
| CVE-2026-36983 json | D-Link DCS-932L v2.18.01 is vulnerable to Command Injection in the function sub_42EF14 of the file /bin/alphapd. The manipula... | |
| CVE-2026-31248 json | Docling's METS GBS backend is vulnerable to XML Entity Expansion (XXE) attacks thru 2.61.0. The backend extracts and validate... | |
| CVE-2026-31247 json | Docling's JATS XML backend is vulnerable to XML Entity Expansion (XXE) attacks thru 2.61.0. The backend uses etree.parse() to... | |
| CVE-2026-31221 json | PyTorch-Lightning versions 2.6.0 and earlier contain an insecure deserialization vulnerability (CWE-502) in the checkpoint lo... | |
| CVE-2026-42481 json | Open CASCADE Technology (OCCT) V8_0_0_rc5 contains multiple vulnerabilities in its IGES and STEP file parsers that can be tri... | |
| CVE-2026-42469 json | Buffer overflow vulnerability in Open Vehicle Monitoring System 3 (OVMS3) 3.3.005. In canformat_canswitch.cpp the parser does... | |
| CVE-2026-42468 json | Buffer overflow vulnerability in Open Vehicle Monitoring System 3 (OVMS3) 3.3.005. In canformat_pcap.cpp , the parser's phdr.... | |
| CVE-2026-38361 json | Multiple unauthenticated denial-of-service (DoS) issues in fohrloop dash-uploader v0.1.0 through v0.7.0a2. The chunked-upload... | |
| CVE-2026-37540 json | OpenAMP v2025.10.0 ELF loader contains an integer overflow vulnerability in firmware image parsing. In elf_loader.c, it perfo... | |
| CVE-2026-37532 json | AGL agl-service-can-low-level thru 17.1.12 contains a heap buffer over-read in the isotp-c library. In isotp_continue_receive... | |
| CVE-2026-37531 json | AGL app-framework-main thru 17.1.12 contains a Zip Slip path traversal vulnerability (CWE-22) combined with a TOCTOU race con... | |
| CVE-2026-37526 json | AGL app-framework-binder (afb-daemon) through v19.90.0 allows any local process to execute privileged supervision commands (E... | |
| CVE-2026-37525 json | AGL app-framework-binder (afb-daemon) through v19.90.0 contains a privilege escalation vulnerability in the supervision Do co... | |
| CVE-2026-37461 json | An out-of-bounds read in the ParseIP6Extended function (/bgp/bgp.go) of gobgp v4.3.0 allows attackers to cause a Denial of Se... | |
| CVE-2026-31205 json | Cross Site Scripting vulnerability in Pluck CMS before v.4.7.21dev allows a remote attacker to escalate privileges via the ed... | |
| CVE-2026-26461 json | A Command Injection vulnerability in the web management interface in Aver PTC320UV2 0.1.0000.65 allows an unauthenticated att... | |
| CVE-2026-42480 json | A stack-based out-of-bounds read vulnerability in VrmlData_Scene::ReadLine in the VRML parser in Open CASCADE Technology (OCC... | |
| CVE-2026-42479 json | An out-of-bounds read vulnerability in VrmlData_IndexedLineSet::TShape in the VRML parser in Open CASCADE Technology (OCCT) V... | |
| CVE-2026-42477 json | A heap-based out-of-bounds read vulnerability in RWObj_Reader::read in the OBJ file parser in Open CASCADE Technology (OCCT) ... | |
| CVE-2026-36959 json | U-SPEED N300 router V1.0.0 does not implement rate limiting or account lockout protections on the /api/login endpoint. This a... | |
| CVE-2026-36958 json | A denial-of-service vulnerability exists in the U-SPEED N300 V1.0.0 wireless router. By sending a large number of concurrent ... | |
| CVE-2026-36957 json | Dbit N300 T1 Pro Easy Setup Wireless Wi-Fi Router V1.0.0 is vulnerable to Denial of Service via the boa web server URI handle... | |
| CVE-2026-124553 json | BabelDOC from 0.3.61 before 0.7.0 contains a resource exhaustion vulnerability that allows remote attackers to exhaust CPU an... | |
| CVE-2026-124552 json | Webmin through 2.670 contains a stored cross-site scripting vulnerability in the Shorewall and Shorewall6 modules' list.cgi, ... | |
| CVE-2026-124551 json | ClassroomIO through 1.0.0 contains an authorization bypass vulnerability that allows authenticated users of any organization ... | |
| CVE-2026-124494 json | SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability because the html.clean() sanitizer's _normalizeUR... | |
| CVE-2026-124493 json | SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability in the DocumentType constructor that injects head... | |
| CVE-2026-124492 json | SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability in ModalAnchorEditor's #createBookmarkList, which... | |
| CVE-2026-124491 json | SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability in the FileUpload plugin create() method that ass... | |
| CVE-2026-124490 json | OpenEMR before 8.3.0 contains a path traversal vulnerability in the RingCentral RCFaxClient disposeDocument() method of oe-mo... | |
| CVE-2026-124489 json | OpenEMR before 8.3.0 contains a broken access control vulnerability in portal/portal_payment.php that allows low-privilege au... | |
| CVE-2026-124488 json | OpenEMR before 8.3.0 contains an authorization bypass vulnerability that allows authenticated clinicians lacking high-sensiti... | |
| CVE-2026-124487 json | OpenEMR before 8.4.0 contains an improper authorization vulnerability in the non-patient POST /fhir/DocumentReference/$docref... | |
| CVE-2026-124486 json | OpenEMR before 8.3.0 contains a missing authorization vulnerability in the classic document controller that allows low-privil... | |
| CVE-2026-124485 json | OpenEMR before 8.3.0 contains an authorization bypass vulnerability in the patient portal onsitedocuments API that allows aut... | |
| CVE-2026-124484 json | OpenEMR before 8.4.0 contains a missing authorization vulnerability in portal onsite-document APIs that allows any authentica... | |
| CVE-2026-124483 json | OpenEMR before 8.4.0 contains an incorrect authorization vulnerability because the prescription REST API routes check the pat... | |
| CVE-2026-124482 json | OpenEMR before 8.4.0 contains an authorization bypass allowing low-privileged SMART standalone-launch users to bind arbitrary... | |
| CVE-2026-124481 json | OpenEMR before 8.4.0 contains an improper authorization vulnerability in Rainforest patient portal payments that trusts brows... | |
| CVE-2026-124480 json | OpenEMR before 8.4.0 contains an authorization bypass vulnerability that allows low-privileged authenticated users to read cr... | |
| CVE-2026-124479 json | OpenEMR before 8.4.0 contains an arbitrary local file read vulnerability in REST document download, where the controller pass... | |
| CVE-2026-124478 json | OpenEMR before 8.3.0 contains a missing authorization vulnerability in the addRecall action of /interface/main/messages/save.... | |
| CVE-2026-124477 json | OpenEMR before 8.3.0 contains a missing authorization vulnerability that allows low-privileged authenticated users to delete ... | |
| CVE-2026-124476 json | OpenEMR before 8.3.0 contains an insecure direct object reference in portal/lib/paylib.php, which writes the request-supplied... | |
| CVE-2026-124475 json | OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in portal/lib/persist.php that allows authent... | |
| CVE-2026-124474 json | MRBS (Meeting Room Booking System) before 1.12.3 contains a reflected cross-site scripting vulnerability that allows unauthen... | |
| CVE-2026-124473 json | OpenEMR before 8.3.0 contains a broken object-level authorization vulnerability in the SOAP note update API, which does not v... | |
| CVE-2026-124472 json | OpenEMR before 8.3.0 contains a missing authorization vulnerability in interface/billing/sl_eob_patient_note.php that allows ... | |
| CVE-2026-124471 json | OpenEMR before 8.3.0 contains a missing authorization vulnerability in interface/billing/sl_eob_invoice.php that allows any a... | |
| CVE-2026-124470 json | OpenEMR before 8.3.0 contains a broken object level authorization vulnerability in portal/report/portal_custom_report.php tha... | |
| CVE-2026-124469 json | OpenEMR before 8.3.0 contains an SQL injection vulnerability in the Fee Sheet drug-inventory lookup (DrugSalesService::sellDr... | |
| CVE-2026-124468 json | OpenEMR before 8.3.0 contains an SQL injection vulnerability in the Standard REST API patient insurance and employer search, ... | |
| CVE-2026-124467 json | OpenEMR before 8.4.0 contains a local file inclusion in the ESign router (library/ESign/Router.php), which passes the unsanit... | |
| CVE-2026-124466 json | OpenEMR before 8.4.0 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the s... | |
| CVE-2026-124465 json | Trendyol kafka-konsumer from 2.3.3 before 2.6.18 contains a denial of service vulnerability in batch_consumer.go that panics ... | |
| CVE-2026-124464 json | OpenEMR before 8.4.0 contains an authorization bypass vulnerability that allows patient-scoped SMART tokens to read other pat... | |
| CVE-2026-124463 json | OpenEMR before 8.3.0 contains a stored cross-site scripting vulnerability that allows authenticated users with CAMOS access t... | |
| CVE-2026-124462 json | OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in OnsiteDocumentController::Query() that all... | |
| CVE-2026-124461 json | OpenEMR before 8.3.0 contains a missing authorization vulnerability in library/ajax/upload.php that allows any authenticated ... | |
| CVE-2026-124460 json | OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in PortalPatientController::Read() that allow... | |
| CVE-2026-124459 json | OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in many encounter-form view and save endpoint... | |
| CVE-2026-124458 json | OpenEMR before 8.4.0 contains an authorization bypass vulnerability in the FHIR GET /fhir/Person/:uuid route that allows pati... | |
| CVE-2026-124457 json | OpenEMR before 8.3.0 contains a path traversal vulnerability in interface/billing/sl_eob_process.php that allows authenticate... | |
| CVE-2026-124456 json | OpenEMR before 8.3.0 contains missing authorization and insecure direct object reference vulnerabilities in the oe-module-pri... | |
| CVE-2026-124455 json | OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in OnsiteDocumentController::Query() that all... | |
| CVE-2026-124453 json | OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in portal/lib/persist.php that allows authent... | |
| CVE-2026-124452 json | OpenEMR before 8.3.0 contains a stored cross-site scripting vulnerability in interface/forms/eye_mag/report.php that allows a... | |
| CVE-2026-124451 json | OpenEMR before 8.4.0 contains an authorization bypass vulnerability in its SMART on FHIR implementation because checkUserHasA... | |
| CVE-2026-124450 json | OpenEMR before 8.3.0 contains a broken access control and path traversal vulnerability in the fax/sms module disposeDocument ... | |
| CVE-2026-124449 json | OpenEMR before 8.4.0 contains a missing authorization vulnerability in FHIR Media/:uuid and QuestionnaireResponse read routes... | |
| CVE-2026-124448 json | OpenEMR before 8.3.0 contains a stored cross-site scripting vulnerability in the CCDA/CCD preview stylesheets, where cda.xsl ... | |
| CVE-2026-124447 json | OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in OnsitePortalActivityController::Update() t... | |
| CVE-2026-124446 json | OpenEMR before 8.3.0 contains a path traversal vulnerability in the FaxSMS module's RCFaxClient and SignalWireClient disposeD... | |
| CVE-2026-124445 json | OpenEMR from 7.0.1 before 8.4.0 contains a flaw in src/Common/Auth/OneTimeAuth.php that ignores the enforce_onetime_use and m... | |
| CVE-2026-124444 json | OpenEMR before 8.4.0 contains a mass assignment vulnerability in the patient portal OnsiteDocument query API that lets reques... | |
| CVE-2026-124443 json | Frappe Framework before 15.121.1 and 16.x before 16.35.0 contains a broken access control vulnerability in File list and repo... | |
| CVE-2026-124442 json | AzuraCast before 0.24.0 contains a server-side request forgery vulnerability that allows users with station WebHooks permissi... | |
| CVE-2026-124441 json | Kyverno before 1.19.2 contains an authorization bypass vulnerability that allows namespaced tenants to generate any resource ... | |
| CVE-2026-124440 json | Kyverno from 1.19.1 before 1.19.2 contains an authorization bypass vulnerability in the apiCall namespace clamp that allows n... | |
| CVE-2026-124439 json | Scriban and Scriban.Signed before 7.5.3 contain uncontrolled recursion flaws in which postfix member, indexer, and call chain... | |
| CVE-2026-124438 json | Scriban before 7.5.2 contains an information disclosure and object manipulation vulnerability that allows template authors to... |