CVE.report
CVE.report is the most up-to-date database of common vulnerabilities and exposures. Information is pulled in from several sources and processed in to a mobile friendly, easy to use page. Use the site to quickly check for vulnerabilities in products such as operating systems, applications, hardware, networks, databases, browsers, e-mail clients and more.
CVEs provide a unique and common naming scheme for publicly known cyber security vulnerabilities in order to quickly identify and share these vulnerabilities. You can use the search below to look for vulnerabilities based on product, vendor, or common tags
The form you will see after following this link allows you to fill out the various variables in the CVSS scoring system and receive the corresponding score. The description of each of the variables is also included for additional information.
cve.report now provides a free read-only JSON API for CVE details. Each record combines the CVE Program JSON record, NVD enrichment, KEV, and EPSS when available.
Recent CVEs
| CVE | Description | Updated |
|---|---|---|
| CVE-2026-115455 json | A flaw was found in GCC libstdc++. When an application extracts data into a bitset from a wide-character stream, internal sta... | |
| CVE-2026-114691 json | A flaw was found in the libstdc++ component of GCC. An attacker who can provide an excessively large element count to a boole... | |
| CVE-2026-114690 json | A flaw was found in GCC. An out-of-bounds memory access vulnerability exists in the libstdc++ parallel search implementation ... | |
| CVE-2026-113496 json | A flaw was found in cockpit-machines. When saving Virtual Network Computing (VNC) console settings, the configured password i... | |
| CVE-2026-113495 json | A flaw was found in cockpit-machines. Red Hat Subscription Management (RHSM) authentication tokens are passed as command-line... | |
| CVE-2026-109971 json | A flaw was found in the clevis PKCS#11 pin. The clevis-decrypt-pkcs11 script passes the PKCS#11 token PIN as a command-line a... | |
| CVE-2026-109970 json | A flaw was found in the clevis PKCS#11 pin. The clevis-luks-pkcs11-askpin script writes the PKCS#11 token PIN in plaintext to... | |
| CVE-2026-109969 json | A flaw was found in the clevis PKCS#11 pin. The clevis-pkcs11-afunix-socket-unlock daemon creates AF_UNIX sockets without exp... | |
| CVE-2026-109968 json | A flaw was found in the clevis PKCS#11 pin. The clevis-pkcs11-afunix-socket-unlock daemon logs LUKS disk encryption passphras... | |
| CVE-2026-107176 json | A flaw was found in the cluster-samples-operator. The RBAC Role coreos-pull-secret-reader in namespace openshift-config grant... | |
| CVE-2026-102010 json | A flaw was found in GCC. When an application calls the erase_if function on a binary heap priority queue in libstdc++, the li... | |
| CVE-2026-93010 json | A flaw was found in dnsmasq. When DHCP leasequery is enabled without listing allowed source addresses, the server does not ch... | |
| CVE-2026-93009 json | A flaw was found in dnsmasq. The DHCPv6 client hostname parser can read one byte past the end of a crafted FQDN option becaus... | |
| CVE-2026-93007 json | A flaw was found in dnsmasq. The TCP DNS service uses a small fixed pool of child processes and does not set a receive timeou... | |
| CVE-2026-85231 json | A flaw was found in libtirpc. An authenticated remote attacker could exploit this vulnerability by sending oversized wrapped ... | |
| CVE-2026-82104 json | In Teltonika Networks RUTOS devices running versions from 7.22 through 7.24.2 and TSWOS devices running versions 1.9 through ... | |
| CVE-2026-79705 json | A flaw was found in the buildah/copier Go package. When used outside of Buildah by a non-root caller, a crafted tar archive c... | |
| CVE-2026-19730 json | The 'podman quadlet install --replace' command opens the existing destination file with O_CREATE|O_WRONLY but omits O_TRUNC. ... | |
| CVE-2026-15588 json | A denial-of-service and resource exhaustion vulnerability exists within the `GDBus` component of GLib. The `gdbusauth` authen... | |
| CVE-2026-58015 json | A flaw was found in GLib. The D-Bus client-side implementation of the DBUS_COOKIE_SHA1 SASL authentication mechanism does not... | |
| CVE-2026-58014 json | A flaw was found in GLib. An off-by-one error can occur in the g_key_file_get_locale_string_list function in the gkeyfile.c f... | |
| CVE-2026-55655 json | A flaw was found in OpenSSH. A local unprivileged attacker on a Linux client host can hijack client-side X11 forwarding conne... | |
| CVE-2026-55653 json | A flaw was found in OpenSSH. A malicious SSH server can exploit a double free vulnerability in the Diffie-Hellman Group Excha... | |
| CVE-2026-42013 json | A flaw was found in gnutls. When validating certificates, an oversized Subject Alternative Name (SAN) could cause the validat... | |
| CVE-2026-42011 json | A flaw was found in gnutls. This vulnerability occurs because permitted name constraints were incorrectly ignored when previo... | |
| CVE-2026-14324 json | RAOP module accepts unbounded Content-Length values and does not check the pw_array_add() return. | |
| CVE-2026-5260 json | A flaw was found in libgnutls. A remote attacker, by sending an extremely short premaster secret during an RSA key exchange t... | |
| CVE-2026-118952 json | A flaw was found in the Kroxylicious ACL authorizer. Its prefix-matching logic may apply a rule to a principal of a different... | |
| CVE-2026-118593 json | A flaw was found in Red Hat Enterprise Linux 9 kernel builds. An incomplete backport of the CVE-2026-46099 fix in RHEL 9.6 th... | |
| CVE-2026-116622 json | The Food Store – Online Food Delivery & Pickup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 's... | |
| CVE-2026-114406 json | The system certificate authority (CA) store in Red Hat products, distributed via ca-certificates RPM packages, included multi... | |
| CVE-2026-110732 json | The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Missing Authorization i... | |
| CVE-2026-103039 json | The Gravity Forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.1.2 via ... | |
| CVE-2026-97645 json | The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via List Field in all versions up to, and... | |
| CVE-2026-93011 json | A flaw was found in dnsmasq. After a reduction of internal domain-name buffer sizes, the DNSSEC validator can write a few byt... | |
| CVE-2026-92824 json | A flaw was found in libmodulemd. In the module stream v2 rpm-map emission path, an inner loop incorrectly uses the count of d... | |
| CVE-2026-92823 json | A flaw was found in libmodulemd. In builds with rpmio support enabled, compressed modulemd YAML is decompressed through a cus... | |
| CVE-2026-92822 json | A flaw was found in libmodulemd. When parsing module metadata, the xmd field is converted into nested GVariant values through... | |
| CVE-2026-90437 json | The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Post Excerpt / Post Custom Field / Ri... | |
| CVE-2026-89435 json | The Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More plugin for WordPress is vulner... | |
| CVE-2026-76781 json | A flaw was found in libxml2. A local user or an attacker providing a specially crafted XML catalog can trigger a NULL pointer... | |
| CVE-2026-42012 json | A flaw was found in gnutls. A remote attacker could exploit this vulnerability by presenting a specially crafted certificate ... | |
| CVE-2026-14330 json | Multiple unbounded alloca() calls in the PulseAudio protocol server. | |
| CVE-2026-119087 json | The Content Egg – Affiliate Product Importer & Price Comparison plugin for WordPress is vulnerable to authorization bypass ... | |
| CVE-2026-119059 json | The Content Egg plugin for WordPress is vulnerable to unauthorized modification of data due to a missing per-post capability ... | |
| CVE-2026-118698 json | The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to generic SQL Inject... | |
| CVE-2026-118634 json | The Events Made Easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'width' parameter in all versi... | |
| CVE-2026-118500 json | The Cool FormKit Lite – Advanced Form Builder for Elementor plugin for WordPress is vulnerable to Stored DOM-Based Cross-Si... | |
| CVE-2026-118194 json | The Page and Post Restriction plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and includin... | |
| CVE-2026-118165 json | The Firelight Lightbox WordPress plugin before 2.3.23 does not escape the URL of links it opens in its Classic lightbox befor... | |
| CVE-2026-118101 json | The BuddyForms WordPress plugin before 2.10.1 does not verify that a user editing an existing entry is the author of the targ... | |
| CVE-2026-118100 json | The BuddyForms WordPress plugin before 2.10.3 does not check that the requester is allowed to manage a form before exporting ... | |
| CVE-2026-118072 json | The Fraud Prevention For WooCommerce and EDD WordPress plugin before 2.3.6 does not check that a user is allowed to manage or... | |
| CVE-2026-118071 json | The Joinchat WordPress plugin before 6.4.2 does not escape the message of its button block before outputting it in an HTML a... | |
| CVE-2026-117572 json | The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 8.8 does not sanitize and escape a parameter before usi... | |
| CVE-2026-117571 json | The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 8.8 does not sanitize and escape tracking data derived ... | |
| CVE-2026-115277 json | The User Frontend WordPress plugin before 4.3.14 does not sanitise and escape some user-supplied values before reflecting th... | |
| CVE-2026-114444 json | The Security Plugin, Firewall & Malware Scanner with Auto Removal WordPress plugin before 2.191 does not restrict its File Sy... | |
| CVE-2026-114443 json | The Security Plugin, Firewall & Malware Scanner with Auto Removal WordPress plugin before 2.191 does not verify the account p... | |
| CVE-2026-114422 json | The Enable Media Replace WordPress plugin before 4.2.3 does not restrict the classes allowed when deserializing stored metada... | |
| CVE-2026-95619 json | A flaw was found in libstdc++. An integer overflow can occur when processing large inputs to the aligned operator new in the ... | |
| CVE-2026-71226 json | Memory Corruption via Uncanceled AIO Requests on Error: libkcapi's one-shot AIO path can return an error before all submitted... | |
| CVE-2026-12080 json | A flaw was found in the QEMU Guest Agent (qga). A local unprivileged user can exploit a vulnerability in the guest-ssh-add-au... | |
| CVE-2026-104368 json | The Export and Import Users and Customers plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, a... | |
| CVE-2026-5461 json | The Forminator Forms plugin for WordPress is vulnerable to Limited File Deletion in all versions up to, and including, 1.55.0... | |
| CVE-2026-109411 json | An access control bypass flaw was identified in Samba's vfs_ceph_rgw module in it's openat() function. An authenticated user ... | |
| CVE-2026-104795 json | The insights-runtime-extractor runs as a privileged DaemonSet (`hostPID: true`) that scans container processes for runtime fi... | |
| CVE-2026-103963 json | A flaw was found in glib-networking. When establishing connections using Transport Layer Security (TLS) version 1.3, the clie... | |
| CVE-2026-94640 json | A flaw was found in rpcbind. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service (DoS) ... | |
| CVE-2026-93017 json | The `insights-operator-gather` ClusterRole grants the operator's service account read access to secrets in the core API group... | |
| CVE-2026-92574 json | A vulnerability in CRI-O checkpoint restore allows a user who can create a pod from a malicious checkpointed container to byp... | |
| CVE-2026-92092 json | A flaw was found in openshift-ansible. The installer container's `run` script downloads and executes remote inventory and dyn... | |
| CVE-2026-83589 json | A flaw was found in oauth-proxy. The application fails to properly validate the destination redirect parameter (`rd`) during ... | |
| CVE-2026-75888 json | A flaw was found in the OpenShift console. An authenticated console user can exploit a Server-Side Request Forgery (SSRF) vul... | |
| CVE-2026-49329 json | A flaw was found in openshift/oauth-server. The OAuth login and error page endpoints pass the unauthenticated Accept-Language... | |
| CVE-2026-118584 json | Incorrect Authorization vulnerability in Drupal Field Permissions allows Forceful Browsing. This issue affects Field Permissi... | |
| CVE-2026-118583 json | Incorrect Authorization vulnerability in Drupal Field Permissions allows Forceful Browsing. This issue affects Field Permissi... | |
| CVE-2026-118582 json | Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal CAPTCHA allows Functionality Bypass. This is... | |
| CVE-2026-118576 json | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Stage File Proxy... | |
| CVE-2026-118575 json | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Signature pad wi... | |
| CVE-2026-118574 json | Incorrect Permission Assignment for Critical Resource vulnerability in Drupal S3 File System allows Exploiting Incorrectly Co... | |
| CVE-2026-118573 json | Missing Authorization vulnerability in Drupal OAuth2 Token Manager allows Forceful Browsing. This issue affects OAuth2 Token ... | |
| CVE-2026-118572 json | Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal OAuth Login - OAuth OIDC SSO allows Authenti... | |
| CVE-2026-118571 json | Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Media Alias Display allows Exploiting Incor... | |
| CVE-2026-118570 json | Cross-Site Request Forgery (CSRF) vulnerability in Drupal Fasttoggle allows Cross Site Request Forgery. This issue affects Fa... | |
| CVE-2026-118569 json | Incorrect Authorization vulnerability in Drupal Fasttoggle allows Forceful Browsing. This issue affects Fasttoggle versions: ... | |
| CVE-2026-118568 json | Insecure Storage of Sensitive Information vulnerability in Drupal Content Sync (content-sync.io) allows Retrieve Embedded Sen... | |
| CVE-2026-118567 json | Incorrect Authorization vulnerability in Drupal Bulk Update User Roles allows Forceful Browsing. This issue affects Bulk Upda... | |
| CVE-2026-118565 json | Vulnerability in Drupal GroupEx PRO ( Daxko ) integration. This issue affects GroupEx PRO ( Daxko ) integration versions: *... | |
| CVE-2026-118564 json | Vulnerability in Drupal PayUmoney for Drupal Commerce. This issue affects PayUmoney for Drupal Commerce versions: *.*. | |
| CVE-2026-118563 json | Vulnerability in Drupal CacheFlush. This issue affects CacheFlush versions: *.*. | |
| CVE-2026-96389 json | Missing Authorization vulnerability in Drupal Xray Audit allows Forceful Browsing. This issue affects Xray Audit versions: fr... | |
| CVE-2026-118562 json | Deserialization of Untrusted Data vulnerability in Drupal Single Content Sync allows Object Injection. This issue affects Sin... | |
| CVE-2026-118561 json | External Control of File Name or Path vulnerability in Drupal Single Content Sync allows Path Traversal. This issue affects S... | |
| CVE-2026-118560 json | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Commerce Stripe ... | |
| CVE-2026-118559 json | Improper Verification of Cryptographic Signature vulnerability in Drupal Commerce Stripe allows Signature Spoof. This issue a... | |
| CVE-2026-118558 json | Cross-Site Request Forgery (CSRF) vulnerability in Drupal Commerce Stripe allows Cross Site Request Forgery. This issue affec... | |
| CVE-2026-118557 json | Incorrect Authorization vulnerability in Drupal Commerce Shipping allows Forceful Browsing. This issue affects Commerce Shipp... | |
| CVE-2026-118556 json | Incorrect Authorization vulnerability in Drupal Commerce Shipping allows Forceful Browsing. This issue affects Commerce Shipp... | |
| CVE-2026-118555 json | Incorrect Authorization vulnerability in Drupal Commerce License allows Forceful Browsing. This issue affects Commerce Licens... |