CVE.report
CVE.report is the most up-to-date database of common vulnerabilities and exposures. Information is pulled in from several sources and processed in to a mobile friendly, easy to use page. Use the site to quickly check for vulnerabilities in products such as operating systems, applications, hardware, networks, databases, browsers, e-mail clients and more.
CVEs provide a unique and common naming scheme for publicly known cyber security vulnerabilities in order to quickly identify and share these vulnerabilities. You can use the search below to look for vulnerabilities based on product, vendor, or common tags
The form you will see after following this link allows you to fill out the various variables in the CVSS scoring system and receive the corresponding score. The description of each of the variables is also included for additional information.
cve.report now provides a free read-only JSON API for CVE details. Each record combines the CVE Program JSON record, NVD enrichment, KEV, and EPSS when available.
Recent CVEs
| CVE | Description | Updated |
|---|---|---|
| CVE-2026-111560 json | Improper neutralization of shell metacharacters in the timezone configuration field in certain Barracuda appliance products u... | |
| CVE-2026-105617 json | PostgreSQL Anonymizer doesn't invalidate plans prepared after a rule was added or a role changed. Users using such plans can ... | |
| CVE-2026-105615 json | PostgreSQL's optimized statistics on a table are visible as long as you have SELECT privilege on said table. A masked role ca... | |
| CVE-2026-105614 json | PostgreSQL Anonymizer's `anon.image_blur()` function doesn't check the declared dimension of the provided image, allowing an ... | |
| CVE-2026-127056 json | PapaParse before 5.7.1 contains an inefficient algorithmic complexity vulnerability that allows remote unauthenticated attack... | |
| CVE-2026-127050 json | Backup Migration before 2.1.8 for WordPress contains a path traversal vulnerability in its PclZip restore fallback that allow... | |
| CVE-2026-126994 json | A vulnerability has been found in braindecode up to 1.8.1. Affected is the function resolve_type_kwargs of the file braindeco... | |
| CVE-2026-126993 json | A security flaw has been discovered in SiteServer SSCMS up to 7.2.2. Impacted is an unknown function of the file /api/v1/capt... | |
| CVE-2026-125870 json | BookStack before 26.09.3 contains a missing authorization vulnerability in ImageController::checkImagePermission() that allow... | |
| CVE-2026-125285 json | Authentication bypass using an alternate path or channel vulnerability in TIBCO TIBCO Platform’s Self-Hosted Control Plane.... | |
| CVE-2026-123139 json | Improper verification of the source of a communication channel vulnerability in Opera Neon on macOS and Windows allows a mali... | |
| CVE-2026-111552 json | Use of single-factor authentication vulnerability in Hyper Teknoloji Ltd. Şti. Hyper E-Commerce Infrastructure, Hyper Teknol... | |
| CVE-2026-75869 json | Zohocorp ManageEngine DDI Central versions below 6301 is affected by an authorization bypass and PowerShell command inje... | |
| CVE-2026-75868 json | Zohocorp ManageEngine DDI Central versions below 6301 is affected by an authorization bypass vulnerability that allowed ... | |
| CVE-2026-75867 json | Zohocorp ManageEngine DDI Central versions below 6301 is affected by an authorization bypass vulnerability that allowed ... | |
| CVE-2026-75864 json | Zohocorp ManageEngine DDI Central versions below 6301 is affected by an improper authorization vulnerability that allowe... | |
| CVE-2026-19422 json | Zohocorp ManageEngine DDI Central versions below 6301 is affected by an authentication bypass vulnerability in Windows D... | |
| CVE-2026-126256 json | A out-of-bounds read vulnerability in Fortinet FortiOS 8.0.0 through 8.0.1, FortiOS 7.6.0 through 7.6.7, FortiOS 7.4.0 throug... | |
| CVE-2026-123580 json | Hickory DNS hickory-net 0.26.0-beta.1 before 0.26.2 and hickory-proto through 0.26.0-alpha.1 perform insufficient checks on N... | |
| CVE-2026-123576 json | Hickory DNS 0.24.0 through 0.26.1 contains a memory exhaustion vulnerability that allows remote attackers to consume server r... | |
| CVE-2026-123568 json | Sveltejs devalue before 5.6.3 contains a prototype pollution vulnerability that allows attackers to alter object prototypes b... | |
| CVE-2026-123564 json | Sveltejs devalue from 1.0.0 before 5.9.3 contains a memory exhaustion flaw in uneval, whose generated code for sparse arrays ... | |
| CVE-2026-123560 json | Zebra before 7.0.0 contains an incomplete cleanup vulnerability that allows unauthenticated peers to stall initial sync by se... | |
| CVE-2026-123556 json | ZcashFoundation Zebra from 4.5.0 before 7.0.0 contains a protection mechanism failure that bans honest peers by scoring mempo... | |
| CVE-2026-123552 json | OpenAM before 16.1.4 contains a server-side request forgery vulnerability in certificate CRL checking that fetches CRLs from ... | |
| CVE-2026-123548 json | OpenIdentityPlatform OpenAM before 16.1.4 contains an open redirect because WS-Federation logout, SAML v2.0 logout and name-i... | |
| CVE-2026-123544 json | OpenAM before 16.1.4 and its client SDK fail to sufficiently validate responses on the internal server-to-server SOAP channel... | |
| CVE-2026-119079 json | decode_sequence_of() in lib/krb5/asn.1/asn1_encode.c in MIT Kerberos 5 (aka krb5) 1.11 and later grows the decoded element ar... | |
| CVE-2026-112323 json | The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) 1.5.2 and later allows remote attackers to ... | |
| CVE-2026-112322 json | clean_client() in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) restarts its scan from the head of the client list a... | |
| CVE-2026-112321 json | The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) does not free decoded arguments on certain ... | |
| CVE-2026-112320 json | The GSS-RPC transport layer in MIT Kerberos 5 (aka krb5) 1.4 and later does not release the previous authentication context w... | |
| CVE-2026-112319 json | The GSS-RPC layer in MIT Kerberos 5 (aka krb5) does not enforce size limits on XDR-decoded data, which allows remote authenti... | |
| CVE-2026-112318 json | The policy RPC stubs in kadmin/server/server_stubs.c in MIT Kerberos 5 (aka krb5) 1.5.3 and later do not reject a NULL policy... | |
| CVE-2026-112317 json | krb5_ktkdb_get_entry() in lib/kdb/keytab.c in MIT Kerberos 5 (aka krb5) 1.2.8 and later does not free decrypted key material ... | |
| CVE-2026-112316 json | xdr_krb5_tl_data() in lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) does not free partially decoded data on failure, ... | |
| CVE-2026-112315 json | The RPCSEC_GSS authentication routines in lib/rpc/authgss_prot.c in MIT Kerberos 5 (aka krb5) 1.4 and later do not free parti... | |
| CVE-2026-112314 json | clnttcp_call() in lib/rpc/clnt_tcp.c in MIT Kerberos 5 (aka krb5) does not free the RPC reply verifier between retries, which... | |
| CVE-2026-110951 json | Weak Password Recovery Mechanism for Forgotten Password vulnerability in Hyper Teknoloji Ltd. Şti. Hyper E-Commerce Infrastr... | |
| CVE-2026-91151 json | A flaw was found in Cockpit. A local authenticated user with control over a target account's home directory can exploit a pri... | |
| CVE-2026-91150 json | A flaw was found in Cockpit. This vulnerability allows a remote attacker, without prior authentication, to send specially cra... | |
| CVE-2026-123540 json | OpenAM before 16.1.4 contains an incomplete output encoding vulnerability that allows a SAML 1.x identity provider to alter a... | |
| CVE-2026-123536 json | OpenAM before 16.1.4 contains a server-side request forgery vulnerability that allows administrators, including delegated rea... | |
| CVE-2026-123532 json | gix-fs in gitoxide before 0.24.1 contains a credential disclosure vulnerability that allows remote attackers to capture NTLM ... | |
| CVE-2026-123524 json | Vikunja from 0.23.0 before 2.7.1 contains an information disclosure vulnerability that allows project collaborators with writ... | |
| CVE-2026-123520 json | Vikunja from 0.18.0 before 2.7.1 contains a privilege escalation vulnerability that allows team owners to gain admin or owner... | |
| CVE-2026-123516 json | Vikunja before 2.7.1 contains a resource exhaustion vulnerability in the vikunja-file ZIP importer that allows authenticated ... | |
| CVE-2026-123512 json | Vikunja before 2.7.1 embeds live password-reset, email-confirmation and account-deletion tokens in the URL query string of em... | |
| CVE-2026-123508 json | Vikunja before 2.7.1 contains a supply chain vulnerability in its mage release targets that fetch the xgo module and Docker i... | |
| CVE-2026-123504 json | Vikunja from 0.22.0 before 2.7.1 contains an information disclosure vulnerability that allows read-only project members to vi... | |
| CVE-2026-123500 json | Vikunja before 2.7.1 contains an insecure file permissions vulnerability that allows local users to read dump archives create... | |
| CVE-2026-123496 json | Vikunja veans before 2.7.1 contains a symlink following vulnerability that allows attackers to make veans init write files ou... | |
| CVE-2026-19421 json | Zohocorp ManageEngine DDI Central versions below 6301 is affected by a PowerShell injection vulnerability due to insuffi... | |
| CVE-2026-2982 json | The WP Table Builder – Drag & Drop Table Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ... | |
| CVE-2026-127046 json | The MISP Modules website component contains an information disclosure vulnerability in the external tools management interfac... | |
| CVE-2026-127036 json | Improper neutralization of CRLF sequences ('CRLF injection') vulnerability in ibi WebFOCUS. This issue affects WebFOCUS: 9.1... | |
| CVE-2026-124817 json | The Clockinator Lite WordPress plugin before 1.1.0 does not check authorisation or ownership when updating leave requests, al... | |
| CVE-2026-124815 json | The Clockinator Lite WordPress plugin before 1.1.0 does not restrict access to several of its record deletion actions, and us... | |
| CVE-2026-124814 json | The Ultimate Addons for Elementor Forms WordPress plugin before 1.0.8 does not properly validate the extension of uploaded fi... | |
| CVE-2026-124705 json | In Progress® Telerik® UI for .NET MAUI prior to version 16.0.0, an untrusted URL redirection vulnerability in the RadRichTe... | |
| CVE-2026-124665 json | The Order Tracking WordPress plugin before 3.6.2 does not verify that a visitor owns the customer or sales representative ac... | |
| CVE-2026-124653 json | The Mine CloudVod WordPress plugin before 2.6.6 does not restrict who can request cloud storage upload credentials from sever... | |
| CVE-2026-124652 json | The Mine CloudVod WordPress plugin before 2.6.6 does not verify that an order belongs to the requesting user before returning... | |
| CVE-2026-124648 json | The TI WooCommerce Wishlist WordPress plugin before 2.13.0 does not verify that a visitor who is not logged in owns a registe... | |
| CVE-2026-124647 json | The TI WooCommerce Wishlist WordPress plugin before 2.0.7 does not sanitise and escape user input before using it in a SQL st... | |
| CVE-2026-124023 json | Out-of-bounds Read vulnerability in the Guththila XML parser wrapper of Apache Axis2/C. On some malformed XML input the Gutht... | |
| CVE-2026-123092 json | The WP Remote Users Sync WordPress plugin before 2.3.0 does not restrict which user metadata keys may be written through its ... | |
| CVE-2026-123044 json | The ContentPen WordPress plugin before 1.1.1 discloses its REST API key to unauthenticated users, who can then use it to crea... | |
| CVE-2026-122003 json | The Abilities Bridge WordPress plugin before 1.4.2 does not require a valid nonce before re-authenticating a REST API request... | |
| CVE-2026-121498 json | The AskAny WordPress plugin before 2.2.1 does not verify that a chat session belongs to the requester before returning or ch... | |
| CVE-2026-119040 json | The Defender Security WordPress plugin before 6.4.1 does not limit the number of failed two-factor authentication attempts i... | |
| CVE-2026-119039 json | The Defender Security WordPress plugin before 6.4.1 does not verify that the client IP address it derives for its firewall a... | |
| CVE-2026-114369 json | Resource exhaustion vulnerability in the Qt Framework QWebSocket and QWebSocketServer classes of the Qt WebSockets module | |
| CVE-2026-76792 json | The User Verification by PickPlugins WordPress plugin before 2.0.49 does not rate limit the verification step of its one-time... | |
| CVE-2026-16135 json | The VibeBP plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.9.9.8.1. This i... | |
| CVE-2026-15309 json | The CourseCure Courses plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 1.5.1. Th... | |
| CVE-2026-13764 json | The Masterstudy - Education WordPress Theme theme for WordPress is vulnerable to Privilege Escalation in all versions up to, ... | |
| CVE-2026-124058 json | A weakness has been identified in TOTOLINK CA300-PoE 6.2c.884. Affected is the function setWiFiRepeaterConfig of the file /cg... | |
| CVE-2026-118531 json | The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11.1 does not prevent a l... | |
| CVE-2026-118494 json | Joomla Extension - jreviews.com - Secret configs cached in a web-accessible in JReviews 1.0.0-5.12.0, 6.0.0-6.6.9 - JReviews ... | |
| CVE-2026-118421 json | The WP Directory Kit WordPress plugin before 1.6.3 does not properly sanitise and escape a parameter used to order results on... | |
| CVE-2026-110959 json | The Descope WordPress plugin before 1.2.0 does not validate the authentication token it receives before creating a WordPress ... | |
| CVE-2026-110072 json | The Photo Gallery by 10Web WordPress plugin before 1.8.49 does not escape a shortcode attribute that sets a gallery watermar... | |
| CVE-2026-110041 json | The Crop Thumbnails WordPress plugin before 1.10.0 does not perform object-level authorization when reading and re-cropping m... | |
| CVE-2026-106027 json | The Oxygen MyData for WooCommerce WordPress plugin before 3.0.9 does not have proper authorisation, nor validate the authenti... | |
| CVE-2026-84838 json | A flaw was found in rpmuncompress. This command injection vulnerability allows a local attacker to execute arbitrary commands... | |
| CVE-2026-84837 json | A flaw was found in rpm. An attacker can exploit a command injection vulnerability by influencing the path or filename of a t... | |
| CVE-2026-84233 json | A flaw was found in rpm. A local attacker could supply a specially crafted `.gem` filename containing RPM macro syntax. When ... | |
| CVE-2026-78367 json | A vulnerability was found in RPM's rpmbuild tarball processing. When processing a crafted source archive, the getTarSpec() fu... | |
| CVE-2026-59599 json | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | |
| CVE-2026-13732 json | A flaw was found in GDB's STABS debug format parser. The read_member_functions() function in gdb/stabsread.c contains a linke... | |
| CVE-2025-66365 json | Incorrect handling of SIP packets leads to baseband crashes | |
| CVE-2022-4329 json | The Product list Widget for Woocommerce WordPress plugin before 3.4.0 does not sanitise and escape a parameter before outputt... | |
| CVE-2026-116606 json | An authentication bypass in Barracuda Email Security Gateway versions earlier than 9.4.0.030 allows an unauthenticated remote... | |
| CVE-2026-126644 json | A link-following flaw was found in the authorized_key module of the ansible.posix collection, residual to the fix for CVE-202... | |
| CVE-2026-126643 json | A cleartext storage flaw was found in the AAP Gateway Operator. When reconciling an AutomationController, the operator reads ... | |
| CVE-2026-126641 json | A host key verification flaw was found in ansible-pylibssh and in the ansible.netcommon libssh connection plugin. When trust-... | |
| CVE-2026-126229 json | A authorization bypass through user-controlled key vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer... | |
| CVE-2026-124704 json | In Telerik UI for WPF, versions prior to 2026.4.1110, a deserialization of untrusted data vulnerability exists that allows an... | |
| CVE-2026-124703 json | In Telerik UI for WPF, versions prior to 2026.4.1110, an improper control of code generation vulnerability exists that allows... |