CVE.report
CVE.report is the most up-to-date database of common vulnerabilities and exposures. Information is pulled in from several sources and processed in to a mobile friendly, easy to use page. Use the site to quickly check for vulnerabilities in products such as operating systems, applications, hardware, networks, databases, browsers, e-mail clients and more.
CVEs provide a unique and common naming scheme for publicly known cyber security vulnerabilities in order to quickly identify and share these vulnerabilities. You can use the search below to look for vulnerabilities based on product, vendor, or common tags
The form you will see after following this link allows you to fill out the various variables in the CVSS scoring system and receive the corresponding score. The description of each of the variables is also included for additional information.
cve.report now provides a free read-only JSON API for CVE details. Each record combines the CVE Program JSON record, NVD enrichment, KEV, and EPSS when available.
Recent CVEs
| CVE | Description | Updated |
|---|---|---|
| CVE-2026-124916 json | PrestaShop contains an authenticated PHP code injection vulnerability in the back-office Performance debug-mode configuration... | |
| CVE-2026-123476 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fifu.app Featured Image... | |
| CVE-2026-123475 json | Missing Authorization vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows Exploit... | |
| CVE-2026-123460 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nickboss WordPress File... | |
| CVE-2026-122673 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wpmet ShopEngine shopen... | |
| CVE-2026-122666 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kitae Park Mang Board W... | |
| CVE-2026-122665 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kitae Park Mang Board W... | |
| CVE-2026-122661 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpWax Directorist direc... | |
| CVE-2026-121782 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in If-So Dynamic Content I... | |
| CVE-2026-121722 json | Missing Authorization vulnerability in WP E-Signature Formidable Forms Signature Online Contract Automation forms-signature-f... | |
| CVE-2026-121570 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill RSVP and Event... | |
| CVE-2026-120856 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rymera Web Co Invoice G... | |
| CVE-2026-120855 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in TemplateInvaders TI Woo... | |
| CVE-2026-120854 json | Allocation of Resources Without Limits or Throttling vulnerability in iubenda iubenda iubenda-cookie-law-solution allows HTTP... | |
| CVE-2026-120838 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Plugins360 Labs All-in-... | |
| CVE-2026-119524 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aguila Technologies WP ... | |
| CVE-2026-119515 json | Missing Authorization vulnerability in Mamunur Rashid Radius Booking — Booking Calendar for Appointments & Services rad... | |
| CVE-2026-118798 json | Multiple sensitive authentication data, including credentials, OAuth-related secrets, session information, and authentication... | |
| CVE-2026-118795 json | Administrative roles and module permissions are stored in mutable local database fields, allowing privilege escalation for at... | |
| CVE-2026-118492 json | In Eclipse Langium versions 3.0.0 and later, the langium-sprotty package does not HTML-escape diagnostic messages before rend... | |
| CVE-2026-95779 json | An exposure of the appliance’s confidential certificate information vulnerability exists in HPE Morpheus manager softw... | |
| CVE-2026-95778 json | A remote code execution vulnerability exists in HPE Morpheus Software. | |
| CVE-2026-94434 json | Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in TÜBİTAK BİLGEM... | |
| CVE-2025-10248 json | XSS Vulnerability in OpenText Filr Appliance versions upto 25.1.2 could allow an authenticated user to upload a malicious fi... | |
| CVE-2026-123484 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetFormBuild... | |
| CVE-2026-123465 json | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in myCred myCred mycred allows Retri... | |
| CVE-2026-123463 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Wham Checkout Files ... | |
| CVE-2026-121780 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Gijo Varghese Flying Im... | |
| CVE-2026-121764 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FolioVision FV Flowplay... | |
| CVE-2026-121763 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPMU DEV Hummingbird hu... | |
| CVE-2026-121760 json | Missing Authorization vulnerability in weDevs weDocs wedocs allows Exploiting Incorrectly Configured Access Control Security ... | |
| CVE-2026-121606 json | A vulnerability has been found in Qihoo 360 D621-2, D603-2, D600-2, D619, D606-6 and D706 up to 6.4.9. Affected by this issue... | |
| CVE-2026-121600 json | A flaw has been found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected by this vulnerability is the function setMacFilterR... | |
| CVE-2026-119514 json | Incorrect Privilege Assignment vulnerability in Webful Creations RepairBuddy computer-repair-shop allows Privilege Escalation... | |
| CVE-2026-119505 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Welcart Welcart e-Comme... | |
| CVE-2026-119504 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DynamiApps Frontend Adm... | |
| CVE-2026-119503 json | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Welcart Welcart e-Commerce usc... | |
| CVE-2026-119497 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpWax Directorist direc... | |
| CVE-2026-119483 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 10Web Form Maker by 10W... | |
| CVE-2026-115701 json | Allocation of Resources Without Limits or Throttling vulnerability in ninenines cowboy allows an unauthenticated remote attac... | |
| CVE-2026-113431 json | Allocation of Resources Without Limits or Throttling vulnerability in ninenines cowlib allows an unauthenticated remote peer ... | |
| CVE-2026-111453 json | Apache Airflow's API endpoint for deleting an asset's queued events checked Dag edit permission against the `dag_id` query pa... | |
| CVE-2026-111403 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Inventory WP Invento... | |
| CVE-2026-66675 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in StylemixThemes Motors m... | |
| CVE-2026-54863 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mamunur Rashid Review S... | |
| CVE-2026-121735 json | blueprintUE self-hosted edition before 4.3.4 contains an insufficient session expiration vulnerability that allows attackers ... | |
| CVE-2026-121731 json | RosarioSIS before 12.9 contains a sql injection vulnerability that allows authenticated non-student users, including parents,... | |
| CVE-2026-121727 json | Kore before 4.3.0 contains an integer underflow vulnerability in HTTP request body handling that allows unauthenticated attac... | |
| CVE-2026-121627 json | buku 5.0 through 5.1.1 contains a stored cross-site scripting vulnerability in the bukuserver bookmark list that allows attac... | |
| CVE-2026-121589 json | A weakness has been identified in spatie url-signer up to 2.1.3. Affected is the function AbstractUrlSigner::validate of the ... | |
| CVE-2026-121524 json | A flaw has been found in sumiie24 School-Management-System up to d946d649c7c95e101fc5679ecd91999533bb10d7. Affected by this i... | |
| CVE-2026-121502 json | A vulnerability was identified in mathurvishal CloudClassroom-PHP-Project. The impacted element is an unknown function of the... | |
| CVE-2026-111752 json | Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other lang... | |
| CVE-2026-88066 json | Claude Desktop is Anthropic's desktop application for interacting with Claude. Prior to 1.8089.0, Claude Desktop on Windows i... | |
| CVE-2026-82976 json | A flaw was found in the image-customization-controller used in OpenShift's bare metal provisioning stack. The controller regi... | |
| CVE-2026-76894 json | CKAN MCP Server is a tool for querying CKAN open data portals. Prior to 0.4.112, the DataStore table UI in src/resources/data... | |
| CVE-2026-63502 json | Yeti bridges the gap between CTI and DFIR practitioners by providing a Forensics Intelligence platform and pipeline. Prior to... | |
| CVE-2026-63489 json | Yeti bridges the gap between CTI and DFIR practitioners by providing a Forensics Intelligence platform and pipeline. In versi... | |
| CVE-2026-63469 json | fastapi-code-generator creates FastAPI applications from OpenAPI files. Prior to 0.8.1, the generator inserts an additional r... | |
| CVE-2026-63436 json | zt-zip is a Java library that provides convenience methods for ZIP archive manipulation. Prior to 1.18.0, the Zips.get(zip).u... | |
| CVE-2026-63417 json | Logging Redactor is a Python library designed to redact sensitive data in logs based on regex patterns and / or dictionary ke... | |
| CVE-2026-45146 json | Chamilo LMS is an open-source learning management system. Prior to 1.11.40 and 2.0.1, an authenticated administrator can call... | |
| CVE-2026-44265 json | Elo is a purely functional expression language for no-code tools. Prior to 1.0.1, Elo's programmatic AST API accepts arbitrar... | |
| CVE-2025-71452 json | Vembu BDRSuite before 7.6.0 contains an unauthenticated cross-site scripting vulnerability in templates/progress/clientside/r... | |
| CVE-2026-121631 json | Lightdash 0.2609.0 before 3.137.0 contains an authorization bypass vulnerability in the RenameService that allows authenticat... | |
| CVE-2026-121588 json | TeXlyre from 0.11.0 before 0.13.5 contains a stored cross-site scripting vulnerability that allows attackers to execute scrip... | |
| CVE-2026-121562 json | CTFd 3.1.0 before 3.8.7 contains an information disclosure vulnerability in the /api/v1/teams list endpoint that exposes non-... | |
| CVE-2026-121558 json | AuditPilot before commit 4669c93 contains an authorization bypass vulnerability in _metadata_allowed in rag/agentic_rag.py th... | |
| CVE-2026-121447 json | svg-sanitizer before 1.1.0 contains a cross-site scripting vulnerability that allows attackers to bypass sanitization by plac... | |
| CVE-2026-121262 json | A vulnerability was found in phpMyAdmin SQL-Parser 6.0.0/6.0.1. The affected element is the function parse of the file src/St... | |
| CVE-2026-119485 json | Missing Authorization vulnerability in weDevs Dokan dokan-lite allows Exploiting Incorrectly Configured Access Control Securi... | |
| CVE-2026-116371 json | A weakness has been identified in Akuvox Akubela HyPanel PS51 51.130.40.26. The impacted element is an unknown function of th... | |
| CVE-2026-111503 json | Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an SQL C... | |
| CVE-2026-91149 json | A flaw was found in Cockpit. An unauthenticated remote attacker can exploit this vulnerability by initiating and sustaining n... | |
| CVE-2026-43966 json | Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') vulnerability in ninenines cowl... | |
| CVE-2026-38601 json | A hardcoded session secret key in codeskyblue gohttpserver through v1.3.0 allows attackers to impersonate any user, bypass Op... | |
| CVE-2026-111500 json | Dell OpenManage Enterprise, versions prior to 4.8.0, contains a Missing Authentication for Critical Function vulnerability. A... | |
| CVE-2026-111499 json | Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Incorrect Permission Assignment for Critical Resource vulner... | |
| CVE-2026-111498 json | OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Resource Locking vulnerability. A high privileged attack... | |
| CVE-2026-91917 json | Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Input Validation vulnerability. A low privileged at... | |
| CVE-2026-55292 json | In rw_ci_data_cback of rw_ci.cc, there is a possible memory safety issue due to integer underflow. This could lead to remote ... | |
| CVE-2026-55289 json | In multiple functions in multiple locations, there is a possible execution of sensitive USSD codes due to a confused deputy. ... | |
| CVE-2026-55288 json | In validEfCfis of SIMRecords.java, there is a possible way to cause a denial of service due to an uncaught exception. This co... | |
| CVE-2026-55287 json | In onCreate of GrantCredentialsPermissionActivity.java, there is a possible way to trick the user into granting account crede... | |
| CVE-2026-55283 json | In multiple locations, there is a possible memory safety issue due to a use-after-free. This could lead to remote escalation ... | |
| CVE-2026-55275 json | In multiple locations, there is a possible use-after-free due to a race condition. This could lead to remote escalation of pr... | |
| CVE-2026-55272 json | In loadDescription of DeviceAdminAdd.java, there is a possible denial of service due to improper input validation. This could... | |
| CVE-2026-55271 json | In forwardToPreferredActionPickHandler of ContactsPickerActivity.kt, there is a possible intent redirection due to a confused... | |
| CVE-2026-55264 json | In checkWhetherCallingAppHasAccess of DownloadProvider.java, there is a possible information leak due to a confused deputy. T... | |
| CVE-2026-116248 json | In pgAdmin 4 server mode only administrators are meant to share a server with all users; the server dialog shows the Shared s... | |
| CVE-2026-116238 json | In server mode pgAdmin 4 locks an internal account after MAX_LOGIN_ATTEMPTS failed logins (3 by default). The limit could be ... | |
| CVE-2026-55263 json | In multiple functions of AllowBindAppWidgetActivity.java, there is a possible misunderstanding of reject/consent actions due ... | |
| CVE-2026-55262 json | In setNotificationListenerAccessGrantedForUserInternal of NotificationManagerService.java, there is a possible policy desync... | |
| CVE-2026-55261 json | In nfa_t4tnfcee_store_rx_buf of nfa_nfcee_act.cc, there is a possible way to achieve code execution due to a missing permissi... | |
| CVE-2026-55257 json | In UsbDialogHelper of UsbDialogHelper.java, there is a possible UI confusion due to misleading or insufficient UI. This could... | |
| CVE-2026-49935 json | In getXmlFileNameForUser of LocaleManagerService.java, there is a possible permission bypass due to a confusable path travers... | |
| CVE-2026-70800 json | Vulnerability in the Oracle SDP Number Portability product of Oracle E-Business Suite (component: Internal Operations). Supp... | |
| CVE-2026-70799 json | Vulnerability in the Oracle SDP Number Portability product of Oracle E-Business Suite (component: Internal Operations). Supp... | |
| CVE-2026-116249 json | In server mode pgAdmin 4 resolves a server's password file, SSL certificate, key, CRL and SSH tunnel identity file relative t... | |
| CVE-2026-58882 json | In decodeWapPdu of WapPushOverSms.java, there is a possible out of bounds read due to an integer overflow. This could lead to... |