CVE.report
CVE.report is the most up-to-date database of common vulnerabilities and exposures. Information is pulled in from several sources and processed in to a mobile friendly, easy to use page. Use the site to quickly check for vulnerabilities in products such as operating systems, applications, hardware, networks, databases, browsers, e-mail clients and more.
CVEs provide a unique and common naming scheme for publicly known cyber security vulnerabilities in order to quickly identify and share these vulnerabilities. You can use the search below to look for vulnerabilities based on product, vendor, or common tags
The form you will see after following this link allows you to fill out the various variables in the CVSS scoring system and receive the corresponding score. The description of each of the variables is also included for additional information.
cve.report now provides a free read-only JSON API for CVE details. Each record combines the CVE Program JSON record, NVD enrichment, KEV, and EPSS when available.
Recent CVEs
| CVE | Description | Updated |
|---|---|---|
| CVE-2026-116157 json | ImageMagick before 7.1.2-33 contains a memory leak vulnerability in PerlMagick that fails to free values returned when readin... | |
| CVE-2026-116153 json | ImageMagick before 7.1.2-33 contains a heap buffer overflow vulnerability on 32-bit systems that allows attackers to overwrit... | |
| CVE-2026-116142 json | ImageMagick before 7.1.2-33 contains a heap buffer over-read vulnerability that allows attackers to read beyond allocated mem... | |
| CVE-2026-116141 json | ImageMagick before 7.1.2-33 contains a policy bypass vulnerability in the UHDR decoder that allows attackers to evade image w... | |
| CVE-2026-109274 json | ImageMagick before 7.1.2-32 contains a time-of-check time-of-use symlink race vulnerability that allows attackers to bypass t... | |
| CVE-2026-109272 json | ImageMagick 7.1.1-31 before 7.1.2-32 contains a NULL pointer dereference in the PostScript decoder that is triggered when a p... | |
| CVE-2026-109271 json | ImageMagick 7.1.2-30 before 7.1.2-32 contains a use after free vulnerability in the WBINFO decoder that occurs when a memory ... | |
| CVE-2026-109270 json | ImageMagick before 7.1.2-32 contains a memory leak vulnerability in the -process option that allows attackers to cause unrele... | |
| CVE-2026-12944 json | IBM Langflow OSS 1.0.0 through 1.10.0 can allow attackers to execute arbitrary Python code with root privileges (UID=0) on th... | |
| CVE-2026-12767 json | IBM Langflow OSS 1.0.0 through 1.11.5 is vulnerable to server-side request forgery (SSRF). This may allow an unauthenticated ... | |
| CVE-2026-17628 json | IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote authenticated attacker to change the password of an account due to... | |
| CVE-2026-12766 json | IBM Langflow OSS 1.0.0 through 1.11.2 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated at... | |
| CVE-2026-12765 json | IBM Langflow OSS 1.0.0 through 1.10.2 is vulnerable to server-side request forgery (SSRF). This may allow an unauthenticated ... | |
| CVE-2026-12763 json | IBM Langflow OSS 1.0.0 through 1.11.5 could allow an authenticated attacker to access another user's MCP server context due t... | |
| CVE-2026-63499 json | zt-zip is a Java library that provides convenience methods for ZIP archive manipulation. Prior to 1.18.1, ZipUtil.unpack(...)... | |
| CVE-2026-121628 json | Bagisto before 2.3.16 and 2.4.x before 2.4.1 contains a race condition vulnerability in manageCartRule() that allows attacker... | |
| CVE-2026-121627 json | buku 5.0 through 5.1.1 contains a stored cross-site scripting vulnerability in the bukuserver bookmark list that allows attac... | |
| CVE-2026-121626 json | GNU Gatekeeper (gnugk) before 5.16 contains an out-of-bounds read vulnerability in H46024Socket::ReceivedProbePacket() that a... | |
| CVE-2026-121625 json | GNU Gatekeeper (gnugk) before 5.16 contains an out-of-bounds read vulnerability in ParseRTCP() in ProxyChannel.cxx that allow... | |
| CVE-2026-121624 json | Nanosystems Supremo for Windows and macOS before 5.0.2.3874 contains an improper certificate validation vulnerability that al... | |
| CVE-2026-121263 json | A vulnerability was determined in phpMyAdmin MoTranslator up to 6.0.1. The impacted element is the function Loader::getTransl... | |
| CVE-2026-116845 json | NetBox from 2.9.0 before 4.7.4 contains a broken access control vulnerability in BulkComponentCreateView that allows authenti... | |
| CVE-2026-97072 json | Missing Authorization vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control Security ... | |
| CVE-2026-63494 json | Rejected reason: This CVE is a duplicate of another CVE. | |
| CVE-2026-63492 json | Rejected reason: This CVE is a duplicate of another CVE. | |
| CVE-2026-63436 json | zt-zip is a Java library that provides convenience methods for ZIP archive manipulation. Prior to 1.18.0, the Zips.get(zip).u... | |
| CVE-2026-63418 json | Monitoring Plugins is a suite of plugins for monitoring applications. From 3.0.0-rc1 until 3.0.1, check_icmp stores the numbe... | |
| CVE-2026-44267 json | Elo is a purely functional expression language for no-code tools. Prior to 1.0.1, plain Elo strings supplied to defaultFormat... | |
| CVE-2026-44266 json | Elo is a purely functional expression language for no-code tools. Prior to 1.0.1, the Ruby backend in src/compilers/ruby.ts e... | |
| CVE-2026-44265 json | Elo is a purely functional expression language for no-code tools. Prior to 1.0.1, Elo's programmatic AST API accepts arbitrar... | |
| CVE-2026-28336 json | SolarWinds Dameware was found to be affected by a command injection vulnerability that could lead to the compromise of the re... | |
| CVE-2026-28335 json | SolarWinds Dameware was found to be affected by a buffer overflow vulnerability that can result in remote code execution. Aut... | |
| CVE-2026-28327 json | SolarWinds Dameware was found to be affected by a DLL hijacking vulnerability. The hijack occurs during installations only an... | |
| CVE-2026-121603 json | Solanum before commit 2ea1382 contains a buffer overflow vulnerability in ms_kill() that allows malicious linked servers to c... | |
| CVE-2026-119675 json | MongoDB Database Tools mongorestore inconsistently handles the system.buckets. prefix when validating collection names in an ... | |
| CVE-2026-119674 json | MongoDB Database Tools mongorestore incorrectly URL-decodes an original collection name read from metadata when the correspon... | |
| CVE-2026-119673 json | MongoDB Database Tools mongofiles does not resolve existing parent-directory symlinks when validating output paths for get_re... | |
| CVE-2026-119672 json | MongoDB Database Tools mongofiles uses a database-stored GridFS filename as the output destination for get_id when --local is... | |
| CVE-2026-119495 json | Missing Authorization vulnerability in WebberZone Better Search better-search allows Exploiting Incorrectly Configured Access... | |
| CVE-2026-119487 json | Missing Authorization vulnerability in weDevs Dokan dokan-lite allows Exploiting Incorrectly Configured Access Control Securi... | |
| CVE-2026-115716 json | Allocation of Resources Without Limits or Throttling (CWE-770) in APM Server can lead to denial of service via Oversized Seri... | |
| CVE-2026-115715 json | Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to denial of service via a specially... | |
| CVE-2026-115714 json | Improper Certificate Validation (CWE-295) in the operating system certificate bundle shipped in the Docker images of APM Serv... | |
| CVE-2026-115710 json | Use of Cache Containing Sensitive Information (CWE-524) in Elasticsearch can lead to information disclosure and incorrect sea... | |
| CVE-2026-115298 json | Incorrect Authorization (CWE-863) in Elasticsearch can lead to information disclosure via Accessing Functionality Not Properl... | |
| CVE-2026-115297 json | NULL Pointer Dereference (CWE-476) in the AMQP protocol parser in Packetbeat can lead to denial of service via specially craf... | |
| CVE-2026-115295 json | Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to information disclosure via Accessing Functio... | |
| CVE-2026-115294 json | Improper Limitation of a Pathname to a Restricted Directory (CWE-22) in the Kibana Fleet feature can lead to unauthorized res... | |
| CVE-2026-121578 json | Tactical RMM contains a stored XSS vulnerability caused by improperly validated input or encode output for various fields, en... | |
| CVE-2026-121564 json | Incomplete Comparison with Missing Factors (CWE-1023) in merge_chats() (whatstk/utils/chat_merge.py), reached from BaseChat.m... | |
| CVE-2026-121413 json | Parse Server before 8.6.112 and 9.0.0 before 9.10.6-alpha.4 contains an authorization bypass in the session upgrade endpoint,... | |
| CVE-2026-121409 json | FreeRDP before 3.32.2 contains a denial of service vulnerability that allows malicious servers or unauthenticated peers to ab... | |
| CVE-2026-121405 json | FreeRDP before 3.32.2 fails to cap the OutputBufferLength in serial device-control IRP requests, allowing malicious servers t... | |
| CVE-2026-120758 json | HDF5 through 2.2.0 contains a NULL pointer dereference vulnerability in H5HL_unprotect() in src/H5HL.c. H5HL_protect() pins a... | |
| CVE-2026-120757 json | HDF5 through 2.2.0 contains a heap buffer over-read vulnerability in H5L__extern_traverse() in src/H5Lexternal.c, the default... | |
| CVE-2026-120756 json | HDF5 through 2.2.0 contains a heap buffer over-read vulnerability in H5O__chunk_deserialize() in src/H5Ocache.c. When decodin... | |
| CVE-2026-120754 json | HDF5 through 2.2.0 contains an uninitialized memory read vulnerability in H5Z__filter_scaleoffset() in src/H5Zscaleoffset.c. ... | |
| CVE-2026-119215 json | Authorization Bypass Through User-Controlled Key vulnerability in team-alembic ash_authentication allows a user with an accou... | |
| CVE-2026-118505 json | Improper Restriction of Excessive Authentication Attempts vulnerability in team-alembic ash_authentication allows an unauthen... | |
| CVE-2026-115293 json | Insertion of Sensitive Information Into Sent Data (CWE-201) in Kibana Observability onboarding can lead to disclosure of the ... | |
| CVE-2026-115292 json | Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana Machine Learning can lead to information disclosure via ... | |
| CVE-2026-115290 json | Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Serialized Data with Nested Payloads (CAP... | |
| CVE-2026-115289 json | Use of Multiple Resources with Duplicate Identifier (CWE-694) in APM Server can lead to information disclosure via a speciall... | |
| CVE-2026-114185 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPVibes AnyWhere Elemen... | |
| CVE-2026-111211 json | An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19. `django.contrib.gis.forms.widge... | |
| CVE-2026-103916 json | Docker Sandboxes sbx cp does not safely confine host-side paths to a shared workspace. A malicious sandbox can create or repl... | |
| CVE-2026-97350 json | Securepoint SSL VPN Client v2 on Windows contains vulnerabilities in the handling of OpenVPN configurations and proxy setting... | |
| CVE-2026-40652 json | An out-of-bounds read condition in the AMD Compressonator SDK could allow an attacker with local access to supply a specially... | |
| CVE-2026-118488 json | In Eclipse Vert.x versions [4.0.0, 4.5.35] or [5.0.0, 5.2.2], when a malicious server keeps sending bytes on an EOL-terminate... | |
| CVE-2026-116152 json | ImageMagick before 7.1.2-33 contains a memory leak vulnerability in the MAT decoder that fails to release allocated memory in... | |
| CVE-2026-113937 json | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2. An app may ... | |
| CVE-2026-112622 json | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 2... | |
| CVE-2026-112593 json | An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Sequoia 15.8.2, macOS ... | |
| CVE-2026-112481 json | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2, macOS Sequo... | |
| CVE-2026-110748 json | This issue affects Apache SIS from version 0.7 through 1.6 inclusive. When a data file contains links to other files, Apache ... | |
| CVE-2026-110265 json | A specially crafted malformed search query could return results from outside a user's organization. Log analysis of runZero's... | |
| CVE-2026-100493 json | An integer overflow in the DDS RGB888 loader of AMD Compressonator SDK could allow an attacker to supply a crafted DDS file t... | |
| CVE-2026-96203 json | Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges over a network. | |
| CVE-2026-91920 json | A flaw was found in the ChunkReader component of the Undertow web server, which is used to handle chunked transfer encoding i... | |
| CVE-2026-86970 json | An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS ... | |
| CVE-2026-86946 json | A use-after-free issue was addressed with improved memory management. This issue is fixed in macOS Golden Gate 27.2, macOS Se... | |
| CVE-2026-85898 json | Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attac... | |
| CVE-2026-84605 json | An authorization issue was addressed with improved state management. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS... | |
| CVE-2026-84594 json | A logic issue was addressed with improved state management. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27 and i... | |
| CVE-2026-83831 json | Double free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-65631 json | Inefficient Algorithmic Complexity in erlang-jose allows an unauthenticated remote attacker to cause a CPU-exhaustion denial ... | |
| CVE-2026-62765 json | Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attac... | |
| CVE-2025-13833 json | A vulnerability exists in SecureConnector for Windows when the “Additional Appliance Connections” setting is enabled and ... | |
| CVE-2026-116150 json | ImageMagick before 7.1.2-33 contains a memory leak vulnerability in the FPX encoder that allows attackers to exhaust memory b... | |
| CVE-2026-91504 json | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Portal Suite). Support... | |
| CVE-2025-71434 json | Weaver E-cology 8.0, 9.0, and 10.0 prior to 10.76 contains an unauthenticated SQL injection vulnerability in the /api/doc/out... | |
| CVE-2019-25779 json | WooThemes Diarise through 1.5.9 contains a file read vulnerability that allows unauthenticated attackers to read arbitrary fi... | |
| CVE-2026-109281 json | ImageMagick 7.1.0-21 before 7.1.2-32 contains a heap buffer over-read in its handling of the -fx option, where a certain -fx ... | |
| CVE-2026-109280 json | ImageMagick 7.1.0-20 before 7.1.2-32 contains a use after free vulnerability in the -fx option that occurs when a memory allo... | |
| CVE-2026-100236 json | A flaw was found in the DPDK GSO library. When software GSO copies packet headers into a new mbuf, it does not check that the... | |
| CVE-2026-91495 json | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported ver... | |
| CVE-2026-91262 json | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). The supporte... | |
| CVE-2026-91261 json | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). The supporte... | |
| CVE-2026-91210 json | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). The supporte... | |
| CVE-2026-87400 json | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). The supporte... |