CVE.report
CVE.report is the most up-to-date database of common vulnerabilities and exposures. Information is pulled in from several sources and processed in to a mobile friendly, easy to use page. Use the site to quickly check for vulnerabilities in products such as operating systems, applications, hardware, networks, databases, browsers, e-mail clients and more.
CVEs provide a unique and common naming scheme for publicly known cyber security vulnerabilities in order to quickly identify and share these vulnerabilities. You can use the search below to look for vulnerabilities based on product, vendor, or common tags
The form you will see after following this link allows you to fill out the various variables in the CVSS scoring system and receive the corresponding score. The description of each of the variables is also included for additional information.
cve.report now provides a free read-only JSON API for CVE details. Each record combines the CVE Program JSON record, NVD enrichment, KEV, and EPSS when available.
Recent CVEs
| CVE | Description | Updated |
|---|---|---|
| CVE-2026-116123 json | A weakness has been identified in NocoDB up to 2026.07.0. The affected element is the function validatePassword of the file /... | |
| CVE-2026-116122 json | A security flaw has been discovered in NocoDB up to 2026.07.0. Impacted is the function AuthService.validateUser of the compo... | |
| CVE-2026-116121 json | A vulnerability was identified in NocoDB up to 2026.08.0. This issue affects some unknown processing of the file users.servic... | |
| CVE-2026-116120 json | A vulnerability was determined in NocoDB up to 2026.07.0. This vulnerability affects the function UserRefreshToken.deleteAllU... | |
| CVE-2026-116119 json | A vulnerability was found in NocoDB up to 2026.08.0. This affects an unknown part of the file packages/nocodb/src/services/us... | |
| CVE-2026-116118 json | A vulnerability has been found in Z.ai Zcode up to 3.14.3/3.15.1. Affected by this issue is some unknown functionality of the... | |
| CVE-2026-116117 json | A flaw has been found in halo-dev halo up to 2.27.0-beta.1. Affected by this vulnerability is the function run.halo.app.theme... | |
| CVE-2026-113345 json | Electronic delivery item Inspection Support System provided by Japan's Ministry of Land, Infrastructure, Transport and Touris... | |
| CVE-2026-111497 json | A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all p... | |
| CVE-2026-116116 json | A vulnerability was detected in Yoosee GM8135S Camera 21.00.01.36. Affected is an unknown function of the component Secure Bo... | |
| CVE-2026-116115 json | A security vulnerability has been detected in Yoosee GM8135S Camera 21.00.01.36. This impacts an unknown function of the file... | |
| CVE-2026-116114 json | A weakness has been identified in Yoosee GM8135S Camera 21.00.01.36. This affects an unknown function of the file /npc/npc of... | |
| CVE-2026-116113 json | A security flaw has been discovered in GouGuOA up to 6.1.2. The impacted element is the function chunkUpload of the file app/... | |
| CVE-2026-55655 json | A flaw was found in OpenSSH. A local unprivileged attacker on a Linux client host can hijack client-side X11 forwarding conne... | |
| CVE-2026-55653 json | A flaw was found in OpenSSH. A malicious SSH server can exploit a double free vulnerability in the Diffie-Hellman Group Excha... | |
| CVE-2026-116112 json | A vulnerability was identified in HashenUdara edoc-doctor-appointment-system up to cc258425b915d1af9e298777ccd26d160493e68d. ... | |
| CVE-2026-116111 json | A vulnerability was determined in 2K Games Civilization V 1.0.3.144. Impacted is the function loadstring of the component Lua... | |
| CVE-2026-116110 json | A vulnerability was found in GiantappMan LiveWallPaper 2.6.8.0 on Windows. This issue affects some unknown processing of the ... | |
| CVE-2026-116109 json | A vulnerability has been found in continuedev Continue 2.0.0. This vulnerability affects the function MCPManagerSingleton.set... | |
| CVE-2026-96280 json | The OCI delta stream parser read sizes as guint64 but passed them to GLib I/O and allocation functions expecting gsize (32 bi... | |
| CVE-2026-96275 json | A malicious or compromised Flatpak repository can write attacker-controlled content to arbitrary locations on the host filesy... | |
| CVE-2026-116108 json | A flaw has been found in openbq-org OpenBB up to 4.7.2/5.0.0. This affects an unknown part of the file openbb_platform/core/o... | |
| CVE-2026-116107 json | A vulnerability was detected in Datafeedr Product Sets Plugin up to 1.3.24 on WordPress. Affected by this issue is the functi... | |
| CVE-2026-116106 json | A security vulnerability has been detected in HeyCyan App 1.0.103 on Android. Affected by this vulnerability is an unknown fu... | |
| CVE-2026-116105 json | A weakness has been identified in HeyCyan App 1.0.103 on Android. Affected is an unknown function of the file AndroidManifest... | |
| CVE-2026-115825 json | HTTP::Server::PSGI versions before 1.0056 for Perl allow a single request to crash the server by declaring a large Content-Le... | |
| CVE-2026-107079 json | An issue in Systrome Validation & Certification 1.0 allows an attacker to cause a denial of service via the t URL parameter i... | |
| CVE-2026-72714 json | Rocq Prover does not restore the universe graph's copy of the universe checking flag when a module that locally disabled the ... | |
| CVE-2026-72844 json | The Lean 4 kernel does not verify that the structure named in a projection expression matches the type of the value being pro... | |
| CVE-2026-72711 json | The Lean 4 kernel does not check that the body of an opaque declaration is closed. environment::add_opaque omits the check_no... | |
| CVE-2026-72705 json | The guard checker in Rocq Prover does not follow recursive calls made through a fixpoint's own arguments. A fixpoint may pass... | |
| CVE-2026-72704 json | The guard checker in Rocq Prover does not recheck the recursive tree representation of an inductive type parameter after that... | |
| CVE-2026-72703 json | The guard checker in Rocq Prover treats a parameter of a nested mutual fixpoint as uniform without examining calls between th... | |
| CVE-2025-60477 json | A NULL pointer dereference in the gf_filter_pid_resolve_file_template_ex function (/filter_core/filter_pid.c) of GPAC Project... | |
| CVE-2020-37268 json | Print Assumptions does not report that a definition was produced while universe checking was disabled when that definition re... | |
| CVE-2026-116104 json | A security flaw has been discovered in Sony Neural Network Libraries up to 1.39.0. This impacts the function func_set_nnabla_... | |
| CVE-2026-116103 json | A vulnerability was identified in Sony Neural Network Libraries up to 1.39.0. This affects the function load_param_in_txt of ... | |
| CVE-2026-116102 json | A vulnerability was determined in QuantGeekDev docker-mcp 0.1.0/0.2.0. The impacted element is the function _build_windows_co... | |
| CVE-2026-116101 json | A vulnerability was found in itsourcecode Online Cake Ordering System 1.0. The affected element is an unknown function of the... | |
| CVE-2026-116100 json | A vulnerability has been found in gougucms up to 4.08.18. Impacted is the function Add of the file app/admin/controller/Level... | |
| CVE-2026-115557 json | Python has added a denylist for known compromised certificates to the "ssl" module to ensure user safety even without certifi... | |
| CVE-2026-114583 json | tarfile.tar_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to re... | |
| CVE-2026-12345 json | The cleanup of tempfile.TemporaryDirectory is vulnerable to a race condition. An attacker who can modify the tree during clea... | |
| CVE-2024-3220 json | There is a defect in the CPython standard library module “mimetypes” where on Windows the default list of known file loca... | |
| CVE-2026-116099 json | A flaw has been found in Fusion Creators Studio SCP Containment Breach Multiplayer up to 1.295. This issue affects the functi... | |
| CVE-2026-116098 json | A vulnerability was detected in SteelRaven7 Ravenfield 25407073. This vulnerability affects the function cacheCoverPoints of ... | |
| CVE-2026-116097 json | A security vulnerability has been detected in CloudClassroom-PHP-Project. This affects an unknown part of the file addnewstud... | |
| CVE-2026-55740 json | Nur-Alam39 bus-ticket (no released versions; latest commit 459cabdbeb99c00225b26e46e3c2c30ae1de7bad) contains an unauthentica... | |
| CVE-2026-55205 json | Hermes WebUI before 0.51.468 contains a resource exhaustion vulnerability in the unauthenticated POST /api/onboarding/oauth/s... | |
| CVE-2026-54806 json | Unauthenticated PHP Object Injection in WP Activity Log <= 5.6.3.1 versions. | |
| CVE-2026-54312 json | n8n is an open source workflow automation platform. Prior to 2.24.0, an authenticated user with permission to create or modif... | |
| CVE-2026-54221 json | UBB.threads is vulnerable to Reflected XSS. The application improperly handles user input in certain requests, enabling atta... | |
| CVE-2026-53875 json | picklescan before 1.0.3 contains a scanning bypass vulnerability in the scan_pytorch function that allows attackers to embed ... | |
| CVE-2026-49268 json | A remote attacker can inject LDAP special characters into the Distinguished Name (DN) construction in DefaultLdapRealm class.... | |
| CVE-2026-22674 json | Hashgraph Guardian through 3.6.0, fixed in commit ba8c566, contains a stored cross-site scripting vulnerability that allows a... | |
| CVE-2026-7300 json | Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in RTI Connext Professional (Web Integra... | |
| CVE-2026-54805 json | Subscriber Privilege Escalation in Falang multilanguage <= 1.4.2 versions. | |
| CVE-2026-54804 json | Subscriber Broken Authentication in Melhor Envio <= 2.16.3 versions. | |
| CVE-2026-54196 json | Incorrect Privilege Assignment vulnerability in Jetmonsters JetFormBuilder allows Privilege Escalation. This issue affects J... | |
| CVE-2026-54188 json | Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.10 versions. | |
| CVE-2026-49081 json | Unauthenticated Broken Access Control in User Registration Stripe <= 1.3.12 versions. | |
| CVE-2026-49080 json | Unauthenticated SQL Injection in wpDataTables <= 7.3.6 versions. | |
| CVE-2026-40783 json | Contributor Remote Code Execution (RCE) in Blocksy Companion Pro <= 2.1.37 versions. | |
| CVE-2026-40754 json | Unauthenticated PHP Object Injection in Roisin <= 1.4 versions. | |
| CVE-2026-40753 json | Unauthenticated PHP Object Injection in EasyMeals <= 1.5.1 versions. | |
| CVE-2026-40751 json | Unauthenticated PHP Object Injection in Ashtanga <= 1.2 versions. | |
| CVE-2026-40735 json | Unauthenticated PHP Object Injection in Reina <= 2.1 versions. | |
| CVE-2026-40731 json | Unauthenticated Local File Inclusion in ChapterOne <= 1.7 versions. | |
| CVE-2026-40724 json | CP Client Arbitrary File Download in Client Portal (Pro) <= 5.6.2 versions. | |
| CVE-2026-39567 json | Unauthenticated PHP Object Injection in Santé <= 1.5.1 versions. | |
| CVE-2026-53899 json | Firefox for iOS used partial domain matching when attaching cookies to PDF requests, allowing a malicious site on a suffix do... | |
| CVE-2026-49772 json | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Liquid Web / StellarWP ... | |
| CVE-2026-47329 json | Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches which fail to validate invalid sizes of the name field in AppAmor notifi... | |
| CVE-2026-45290 json | Cloudburst Network provides network components used within Cloudburst projects. A vulnerability in versions prior to `1.0.0.C... | |
| CVE-2026-42753 json | Missing Authorization vulnerability in WC Lovers WCFM Membership wc-multivendor-membership allows Exploiting Incorrectly Conf... | |
| CVE-2026-42739 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IniLerm Advanced IP Blo... | |
| CVE-2026-39558 json | Unauthenticated Local File Inclusion in Malmö <= 2.2 versions. | |
| CVE-2026-39557 json | Unauthenticated PHP Object Injection in NeoBeat <= 1.7 versions. | |
| CVE-2026-32998 json | This vulnerability in Veeam Service Provider Console allows for remote code execution. | |
| CVE-2026-28615 json | In Telecomm, there is a possible way to initiate an unauthorized phone call due to a permissions bypass. This could lead to l... | |
| CVE-2026-8637 json | A potential uncontrolled search path vulnerability was reported in the LanSchool Classic client application that could allow ... | |
| CVE-2026-8444 json | The WP Review Slider Pro plugin for WordPress is vulnerable to SQL Injection via the 'curselrevs[]' parameter of the wpfb_fin... | |
| CVE-2026-7528 json | IBM Langflow OSS 1.0.0 through 1.9.0 could allow a denial of service due to uncontrolled resource consumption. | |
| CVE-2026-49002 json | Access control failure means that an application does not effectively check user access permissions, so that unauthorized use... | |
| CVE-2026-46408 json | Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.3, the... | |
| CVE-2026-45038 json | Tabby (formerly Terminus) is a highly configurable terminal emulator. Prior to 1.0.233, since Tabby does not escape control c... | |
| CVE-2026-42728 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HT Plugins HT Contact F... | |
| CVE-2026-41971 json | Permission control vulnerability in the security control module. Impact: Successful exploitation of this vulnerability may a... | |
| CVE-2026-41969 json | Permission control vulnerability in the projection module. Impact: Successful exploitation of this vulnerability may affect ... | |
| CVE-2026-41964 json | Permission control vulnerability in the web. Impact: Successful exploitation of this vulnerability may affect availability. | |
| CVE-2026-41963 json | Stack overflow vulnerability in the media platform. Impact: Successful exploitation of this vulnerability may affect availab... | |
| CVE-2026-40838 json | An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getDeviceScalings functio... | |
| CVE-2026-40829 json | A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the view.html.php files Updat... | |
| CVE-2026-28761 json | Cross-site request forgery vulnerability exists in Musetheque V4 Information Disclosure for IPKNOWLEDGE V4L1 rev2203.0 and ea... | |
| CVE-2026-8581 json | Use after free in GPU in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a s... | |
| CVE-2026-8572 json | Insufficient policy enforcement in Network in Google Chrome on Android prior to 148.0.7778.168 allowed a remote attacker who ... | |
| CVE-2026-8570 json | Type Confusion in V8 in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to obtain potentially sensitive infor... | |
| CVE-2026-8566 json | Insufficient policy enforcement in Payments in Google Chrome on Android prior to 148.0.7778.168 allowed a remote attacker to ... | |
| CVE-2026-46446 json | SOGo before 5.12.7, when PostgreSQL or MariaDB is used, and cleartext passwords are stored, allows SQL injection. This is rel... | |
| CVE-2026-44511 json | Katalyst Koi is a framework for building Rails admin functionality. Prior to 4.20.0 and 5.6.0, admin session cookies were not... |