CVE.report
CVE.report is the most up-to-date database of common vulnerabilities and exposures. Information is pulled in from several sources and processed in to a mobile friendly, easy to use page. Use the site to quickly check for vulnerabilities in products such as operating systems, applications, hardware, networks, databases, browsers, e-mail clients and more.
CVEs provide a unique and common naming scheme for publicly known cyber security vulnerabilities in order to quickly identify and share these vulnerabilities. You can use the search below to look for vulnerabilities based on product, vendor, or common tags
The form you will see after following this link allows you to fill out the various variables in the CVSS scoring system and receive the corresponding score. The description of each of the variables is also included for additional information.
cve.report now provides a free read-only JSON API for CVE details. Each record combines the CVE Program JSON record, NVD enrichment, KEV, and EPSS when available.
Recent CVEs
| CVE | Description | Updated |
|---|---|---|
| CVE-2026-129352 json | A vulnerability was detected in TRENDnet TEW-657BRM 1.00.1. This issue affects some unknown processing of the file /usr/sbin/... | |
| CVE-2026-129351 json | A security vulnerability has been detected in TRENDnet TEW-657BRM 1.00.1. This vulnerability affects the function sprintf of ... | |
| CVE-2015-10149 json | Dancer versions before 1.3400 for Perl pass unvalidated session ids from the session cookie to the session engine. read_sess... | |
| CVE-2026-128240 json | GPAC through 26.07.0 contains a use-after-free vulnerability in gf_sg_proto_del() in src/scenegraph/vrml_proto.c because gf_s... | |
| CVE-2026-124031 json | GPAC through 26.07.0 contains a type confusion vulnerability in drawable_get_aspect_2d_mpeg4() and TraverseShape() that casts... | |
| CVE-2026-124030 json | GPAC through 26.07.0 contains a type confusion vulnerability in gf_sg_command_apply() in src/scenegraph/commands.c that fails... | |
| CVE-2011-10042 json | HTTP::Session versions before 0.43 for Perl allow memcached command injection via unfiltered session ids in HTTP::Session::St... | |
| CVE-2026-129456 json | In FRRouting, bgpd accepts a Tunnel Encapsulation attribute (type 23) whose outer TLV length does not match the length of the... | |
| CVE-2026-54831 json | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AyeCode Ltd GeoDirector... | |
| CVE-2026-129447 json | Kroki before 0.36.0 contains a reflected cross-site scripting vulnerability in the /dbml/svg endpoint that allows unauthentic... | |
| CVE-2026-129267 json | A vulnerability was found in sergix44 XBackBone up to 3.8.2. Impacted is the function MediaController::getRawById of the file... | |
| CVE-2026-129264 json | A security vulnerability has been detected in sox_ng up to 14.8.1. Affected by this issue is the function read_samples_voc of... | |
| CVE-2026-129262 json | A weakness has been identified in Wuxi Wubang Security Software Wubang Five-in-One Safety Production Management Information S... | |
| CVE-2026-129261 json | A vulnerability was found in Kingston FURY CTRL RGB Control Software up to 2.0.66.0. The impacted element is an unknown funct... | |
| CVE-2026-129260 json | A security vulnerability has been detected in Mereithhh VanBlog up to 0.54.0. This vulnerability affects the function fs.read... | |
| CVE-2026-127115 json | The BuddyForms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'buddyforms_form_content' parameter ... | |
| CVE-2026-120687 json | The Lightbox & Modal Popup WordPress Plugin – FooBox plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scri... | |
| CVE-2026-116753 json | The Multi Step for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'multipart field ... | |
| CVE-2026-110531 json | The FV Player 8 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fv_player_videos' parameter in all... | |
| CVE-2026-129259 json | A weakness has been identified in Mereithhh VanBlog up to 0.54.0. This affects an unknown part of the file packages/server/sr... | |
| CVE-2026-129258 json | A vulnerability was identified in Tenda AC18 15.03.05.05_multi/15.03.05.19 Build 6318. Affected by this vulnerability is an u... | |
| CVE-2026-120221 json | In FRRouting, bgpd frees the same memory twice when dynamic BGP neighbors disconnect, if the peer-group used by a "bgp listen... | |
| CVE-2026-120033 json | In FRRouting, bgpd does not correctly close a BGP session when the Send Hold Timer (RFC 9687) expires, i.e. when a neighbor h... | |
| CVE-2026-62031 json | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in StylemixThemes uListing... | |
| CVE-2026-59514 json | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BuddyBoss Buddyboss Pla... | |
| CVE-2026-39732 json | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in INTINITUM FORM Translit... | |
| CVE-2026-129433 json | Dokploy before 0.31.1 contains an OS command injection vulnerability in getComposeContainerCommand() that allows authenticate... | |
| CVE-2026-129432 json | Ettercap through 0.8.5.1 contains a heap out-of-bounds read vulnerability in dissector_mountd() in src/dissectors/ec_mountd.c... | |
| CVE-2026-129431 json | Ettercap through 0.8.5.1 contains a heap out-of-bounds read vulnerability in dissector_socks() in src/dissectors/ec_socks.c t... | |
| CVE-2026-129430 json | Axeloz Filesharing before 2.14.3 contains a stored cross-site scripting vulnerability that allows authenticated users to inje... | |
| CVE-2026-129429 json | Frappe india-payroll before 16.0.4 contains a missing authorization vulnerability in the get_employee_details, compute_tax_co... | |
| CVE-2026-129428 json | Pulse from 5.0.17 before 6.8.0 contains a missing authorization vulnerability in the /api/ai/approvals endpoints that allows ... | |
| CVE-2026-129255 json | A vulnerability was identified in CoolerMaster MASTERPLUS+ 1.9.6. This affects the function sub_11504 in the library WinRing0... | |
| CVE-2026-129254 json | A flaw has been found in Opixido OCMS up to b7c15660aba83d96677c1a9abaa69c082a24f21c. This impacts an unknown function of the... | |
| CVE-2026-120522 json | The Cloud Storage Manager for Fluent Forms – Google Drive, Dropbox, OneDrive, S3 Uploads plugin for WordPress is vulnerable... | |
| CVE-2026-19907 json | The Shipo plugin for WordPress is vulnerable to Authentication Bypass in versions 1.6 through 1.8.0. This is due to the `auth... | |
| CVE-2026-18053 json | The MemberDash plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.8.7. This i... | |
| CVE-2026-126658 json | ByteStash 1.5.10 before 1.6.2 contains an insufficient session expiration vulnerability that allows holders of API keys to ke... | |
| CVE-2025-71465 json | @kolkov/angular-editor before 3.0.3 contains a cross-site scripting vulnerability in refreshView() that writes HTML from ngMo... | |
| CVE-2025-71464 json | @kolkov/angular-editor before 3.0.4 contains a cross-site scripting vulnerability in toggleEditorMode() that assigns source v... | |
| CVE-2026-129427 json | Stored XSS via avatar upload chained with an authentication bypass in /Attachments leads to ATO in Cervantes version v1.3-bet... | |
| CVE-2026-129251 json | A vulnerability was detected in hrshadhin CloudSchool up to 3.0.1. This affects an unknown function of the file app/Http/Cont... | |
| CVE-2026-129250 json | A security vulnerability has been detected in Edimax BR6478ACV2 1.23. The impacted element is the function formPPTPSetup of t... | |
| CVE-2026-129115 json | JSON::XS versions from 3.0 before 4.05 for Perl read freed stack memory when a FREEZE result's serialisation grows the Perl s... | |
| CVE-2026-129114 json | JSON::XS versions from 3.04 before 4.05 for Perl write one byte past a heap buffer when appending a one-byte chunk in incr_pa... | |
| CVE-2026-129113 json | JSON::XS versions from 4.0_00 before 4.05 for Perl corrupt the incremental buffer length by chopping past its end in incr_ski... | |
| CVE-2026-124541 json | JSON::XS versions before 4.05 for Perl leak the decoded part of a rejected long string in decode_str. A string is decoded th... | |
| CVE-2026-124540 json | JSON::XS versions before 4.05 for Perl allow stack exhaustion via nested tagged values under allow_tags in decode_tag. With ... | |
| CVE-2026-124539 json | JSON::XS versions before 4.05 for Perl leak the decoded key of an object rejected for a missing colon in decode_hv. Unless i... | |
| CVE-2026-124536 json | JSON::XS versions before 4.05 for Perl allow memory exhaustion by buffering incremental input past max_size after a NUL byte ... | |
| CVE-2026-129248 json | A weakness has been identified in Akaunting up to 3.3.0. The affected element is the function calculation_to_quantity of the ... | |
| CVE-2026-129247 json | A security flaw has been discovered in yangzongzhuan RuoYi up to 4.8.3. Impacted is the function VelocityUtils.getFileName of... | |
| CVE-2026-18742 json | The Flatsome theme for WordPress is vulnerable to Stored Cross-Site Scripting via 'data-text-sec', 'data-title', and 'title' ... | |
| CVE-2026-129181 json | A vulnerability has been found in projectworlds Visitor Management System 1.0. This issue affects the function mysqli_query o... | |
| CVE-2026-84761 json | Server-Side Request Forgery (SSRF) vulnerability in Hai Zheng / Lite Speed Cache LiteSpeed Cache litespeed-cache allows Serve... | |
| CVE-2026-129319 json | create-ecdh is a browserifiable implementation of Node.js crypto.createECDH. In versions 4.0.4 and below, the JavaScript impl... | |
| CVE-2026-126697 json | The Quick Page/Post Redirect Plugin WordPress plugin before 5.2.4 was distributed with a hidden update mechanism that fetched... | |
| CVE-2026-126640 json | The WP Ultimate CSV Importer WordPress plugin before 9.3 does not escape values from imported files before using them in SQL... | |
| CVE-2026-126639 json | The WP Ultimate CSV Importer WordPress plugin before 9.2, WP Ultimate CSV Importer Pro WordPress plugin before 9.0.7 do not ... | |
| CVE-2026-124649 json | The Lightbox with PhotoSwipe WordPress plugin before 5.19.0 does not properly sanitise link titles and other caption sources ... | |
| CVE-2026-123122 json | The Checkout Files Upload for WooCommerce WordPress plugin before 2.4.1 does not verify that a file uploaded at checkout is r... | |
| CVE-2026-123046 json | The SEOJuice WordPress plugin before 2.12.0 does not correctly restrict a REST API authentication filter, disabling WordPress... | |
| CVE-2026-119258 json | The Swipe WordPress plugin through 1.4 does not properly authenticate a login request before issuing a WordPress session cook... | |
| CVE-2026-118183 json | The Duplicate Post WordPress plugin before 1.5.8 does not check whether a user may publish posts when duplicating one, allowi... | |
| CVE-2026-118182 json | The Duplicate Post WordPress plugin before 1.5.8 does not check that a user duplicating a post is allowed to edit it, which, ... | |
| CVE-2026-118181 json | The Duplicate Post WordPress plugin before 1.5.8 does not perform a capability check when saving its global settings, relying... | |
| CVE-2026-117490 json | The Flatsome WordPress theme before 3.20.13 does not enforce the acting user's publish and post-type restrictions on an AJAX ... | |
| CVE-2026-117487 json | The Flatsome WordPress theme before 3.20.13 does not perform a capability or nonce check on an AJAX action available to unaut... | |
| CVE-2026-125709 json | A flaw was found in libstdc++. When a byte-by-byte write operation fails during file stream processing, the library may still... | |
| CVE-2026-116528 json | The Chargely Free Subscriptions For Woocommernce WordPress plugin through 1.0 does not perform any authorization check on a R... | |
| CVE-2026-111034 json | The Countdown, Coming Soon, Maintenance WordPress plugin through 3.0.8 does not check that the user is allowed to browse con... | |
| CVE-2026-111033 json | The Countdown, Coming Soon, Maintenance WordPress plugin through 3.0.8 does not perform authorization or nonce checks when s... | |
| CVE-2026-105984 json | The Email Marketing 4Dem WordPress plugin through 2.0.5 does not perform authorization or capability checks on several of its... | |
| CVE-2026-105983 json | The Email Marketing 4Dem WordPress plugin through 2.0.5 does not perform authorization or capability checks on several of its... | |
| CVE-2026-126173 json | The AutomatorWP Pro plugin for WordPress' webhook addon is vulnerable to authorization bypass in all versions up to, and incl... | |
| CVE-2026-124969 json | The Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization plugin for WordPress is vulnera... | |
| CVE-2026-109091 json | A buffer overflow in handling EDID Display-Range descriptors in X.Org xwayland before 24.1.15 and X Server before 21.1.26 co... | |
| CVE-2026-124705 json | In Progress® Telerik® UI for .NET MAUI prior to version 16.0.0, an untrusted URL redirection vulnerability in the RadRichTe... | |
| CVE-2026-124704 json | In Telerik UI for WPF, versions prior to 2026.4.1110, a deserialization of untrusted data vulnerability exists that allows an... | |
| CVE-2026-124703 json | In Telerik UI for WPF, versions prior to 2026.4.1110, an improper control of code generation vulnerability exists that allows... | |
| CVE-2026-124702 json | In Telerik UI for WPF, versions prior to 2026.4.1110, an untrusted URL redirection vulnerability exists that allows an attack... | |
| CVE-2026-124701 json | In Telerik UI for WinForms, versions prior to 2026.4.1111, a deserialization of untrusted data vulnerability exists that allo... | |
| CVE-2026-124700 json | In Telerik UI for WinForms, versions prior to 2026.4.1111, an untrusted URL redirection vulnerability exists that allows an a... | |
| CVE-2026-124699 json | In Telerik UI for WinForms, versions prior to 2026.4.1111, an improper control of code generation vulnerability exists that a... | |
| CVE-2026-123039 json | The Gaia OS DynamicCLI daemon runs as root and listens on a world-writable local socket (/tmp/dynamic_socket) without authent... | |
| CVE-2026-120150 json | Use after free in PostgreSQL expanded-record domain checks allows an object creator to execute arbitrary code as the operatin... | |
| CVE-2026-120149 json | Heap-based buffer overflow in PostgreSQL foreign batch inserts allows a foreign server to execute arbitrary code, via reporti... | |
| CVE-2026-120148 json | Type confusion in PostgreSQL extended statistics allows an object creator to execute arbitrary code as the operating system u... | |
| CVE-2026-120147 json | Use after free in the PostgreSQL dblink extension allows an object creator to execute arbitrary code as the operating system ... | |
| CVE-2026-120145 json | Missing authorization in PostgreSQL logical replication allows a compromised publisher to execute arbitrary code as the opera... | |
| CVE-2026-116330 json | Untrusted data inclusion in PostgreSQL pg_dump tar-format restore.sql allows a compromised origin server to execute arbitrary... | |
| CVE-2026-116329 json | Type confusion in PostgreSQL statistics import allows a table maintainer to execute arbitrary code as the operating system us... | |
| CVE-2026-116328 json | Integer wraparound in PostgreSQL generation memory contexts allows a database user to execute arbitrary code as the operating... | |
| CVE-2026-116326 json | Uncaught exceptions in PostgreSQL plperl allow an object creator to cause use of a stale sigjmp_buf, via a tied Perl object, ... | |
| CVE-2026-116323 json | Use after free in PostgreSQL pltcl allows an object creator to execute arbitrary code as the operating system user running th... | |
| CVE-2026-107522 json | Dell PowerStore contains an Improper Authorization vulnerability. An authenticated user could exploit this vulnerability, pot... | |
| CVE-2026-103813 json | Dell PowerStore contains an OS Command Injection vulnerability. An authenticated user with limited privileges could potential... | |
| CVE-2026-86356 json | Dell PowerStore contains an authorization-bypass vulnerability that could lead to elevation of privilege to administrator. | |
| CVE-2026-86355 json | Dell PowerStore contains an External Control of File Name or Path vulnerability. A remote authenticated attacker could exploi... | |
| CVE-2026-82177 json | Dell PowerStore contains an OS Command Injection vulnerability. A high-privileged attacker could exploit this vulnerability, ... |