CVE.report
CVE.report is the most up-to-date database of common vulnerabilities and exposures. Information is pulled in from several sources and processed in to a mobile friendly, easy to use page. Use the site to quickly check for vulnerabilities in products such as operating systems, applications, hardware, networks, databases, browsers, e-mail clients and more.
CVEs provide a unique and common naming scheme for publicly known cyber security vulnerabilities in order to quickly identify and share these vulnerabilities. You can use the search below to look for vulnerabilities based on product, vendor, or common tags
The form you will see after following this link allows you to fill out the various variables in the CVSS scoring system and receive the corresponding score. The description of each of the variables is also included for additional information.
cve.report now provides a free read-only JSON API for CVE details. Each record combines the CVE Program JSON record, NVD enrichment, KEV, and EPSS when available.
Recent CVEs
| CVE | Description | Updated |
|---|---|---|
| CVE-2026-112777 json | Craft CMS 4.x before 4.18.8 and 5.x before 5.11.0 contains a blocklist bypass in the Twig create() function because its class... | |
| CVE-2026-112776 json | Craft CMS from 5.0.0 before 5.11.0 contains an authorization bypass vulnerability that allows site-scoped GraphQL tokens to m... | |
| CVE-2026-112775 json | Craft CMS from 5.0.0 before 5.11.0 contains an authentication bypass vulnerability that allows attackers to reuse verificatio... | |
| CVE-2026-112774 json | Craft CMS from 5.8.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated administrators to... | |
| CVE-2026-112773 json | Craft CMS from 5.0.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated Control Panel use... | |
| CVE-2026-112772 json | Craft CMS from 5.0.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated Control Panel use... | |
| CVE-2026-112771 json | Craft CMS 4.0.0 before 4.18.8 and 5.0.0 before 5.11.0 contains a Twig sandbox allowlist bypass because the column, contains, ... | |
| CVE-2026-112770 json | Craft CMS 4.x before 4.18.8 and 5.x before 5.11.0 contains a remote code execution vulnerability in the Twig group filter, wh... | |
| CVE-2026-112260 json | A flaw was found in GIMP. Opening a crafted XCF with a malformed text-layer parasite can cause a heap out-of-bounds read, dis... | |
| CVE-2026-112259 json | A flaw was found in GIMP. Importing a crafted SBZ palette without a color-model attribute can cause a NULL pointer dereferenc... | |
| CVE-2026-112214 json | A flaw was found in the GStreamer ASF demuxer in gst-plugins-ugly. When parsing a Simple Index object, an attacker-controlled... | |
| CVE-2026-112210 json | A flaw was found in the rhc-canonical-facts.service systemd unit shipped with rhc. The service runs as root and operates on a... | |
| CVE-2026-112161 json | MobaXterm Personal Edition (Portable) 26.4 GA extracts the CygUtils64.plugin file without first verifying its integrity. A lo... | |
| CVE-2026-103314 json | A flaw was found in Red Hat Advanced Cluster Security for Kubernetes (RHACS). The Central SAML authentication ACS endpoint do... | |
| CVE-2026-94294 json | The App Builder WordPress plugin before 5.7.1 does not require authentication or authorisation before writing attacker-suppli... | |
| CVE-2026-13695 json | SQL injection (SQLi) vulnerability—specifically a UNION-based vulnerability—in the Integratec application that affects th... | |
| CVE-2025-13591 json | The authentication endpoint of WSO2 Identity Server fails to provide a consistent system response when a username does not ex... | |
| CVE-2025-13173 json | Tokens associated with user sessions are not revoked when the corresponding user session is terminated, unless another SSO re... | |
| CVE-2025-10149 json | The SCIM endpoint does not sufficiently validate authorization for federated users when performing operations against the loc... | |
| CVE-2025-7203 json | The Management Console and product files expose sensitive data, including remote log server credentials, truststore passwords... | |
| CVE-2025-7043 json | The ForgeRock client fails to correctly validate refresh tokens. This allows a refresh token to be treated as a valid access ... | |
| CVE-2025-6623 json | The carbon console accepts user-supplied XML input without sufficiently encoding potentially executable content, allowing for... | |
| CVE-2024-4412 json | The software accepts user-supplied data without sufficient validation, allowing for the injection of malicious Expression Lan... | |
| CVE-2026-110034 json | The Salon Booking System WordPress plugin before 10.31.11 does not enforce a minimum of zero when subtracting a fixed-amount ... | |
| CVE-2026-106010 json | The BDM Digital Payment Gateway WordPress plugin through 1.3.12 does not verify the credentials on its public payment-status ... | |
| CVE-2026-103311 json | The Coinbase Commerce Payment Gateway for WooCommerce WordPress plugin through 1.4.1 does not verify the authenticity of inco... | |
| CVE-2026-94272 json | The Snap Finance WordPress plugin before 3.12.0 does not verify that a request to change a WooCommerce order's status comes f... | |
| CVE-2026-94231 json | The TrueBooker WordPress plugin before 1.3.0 does not have authorisation checks in place in some of its functionality, allowi... | |
| CVE-2026-94230 json | The TrueBooker WordPress plugin before 1.3.0 does not have authorisation checks in some of its AJAX actions, and does not val... | |
| CVE-2026-94229 json | The TrueBooker WordPress plugin before 1.3.0 does not verify that the requester owns a booking before rendering its confirmat... | |
| CVE-2026-94228 json | The TrueBooker WordPress plugin before 1.3.0 does not perform any capability check on one of its setup handlers, and the toke... | |
| CVE-2026-91831 json | The Subscribe to Comments WordPress plugin before 2.3.3 does not sanitise newline characters from a notification sender-name ... | |
| CVE-2026-86791 json | The iPOSpays Payment Gateway for WooCommerce WordPress plugin before 1.4.7 does not verify that a payment was actually comple... | |
| CVE-2026-74922 json | The Document Gallery WordPress plugin through 5.1.1 does not verify the signature on one of its unauthenticated webhook endpo... | |
| CVE-2026-74921 json | The Document Gallery WordPress plugin through 5.1.1 does not sanitise or escape several gallery shortcode attributes before e... | |
| CVE-2026-16460 json | A flaw was found in bootc and ostree. Already-staged deployments are finalized without revalidating the deployment's containe... | |
| CVE-2026-112005 json | WhoDB 0.104.0 before 0.135.0 contains a path traversal vulnerability that allows remote attackers to read and write arbitrary... | |
| CVE-2026-112004 json | Teable before 2026-10-12T12-45-53Z.3331 contains an authorization bypass vulnerability that allows authenticated users to ren... | |
| CVE-2026-112000 json | Vanus 0.8.0 through 0.9.0 contains a missing authorization vulnerability in the gateway that allows any authenticated user to... | |
| CVE-2026-108121 json | Brian Mariani from DigitalCanion SA has discovered a vulnerability in the domain creation functionality of koozali's SME ... | |
| CVE-2026-108120 json | Brian Mariani from DigitalCanion SA has discovered a path traversal vulnerability in the View Logs functionality of koozali... | |
| CVE-2026-106933 json | The Blaze Demo Importer WordPress plugin before 1.0.17 does not sanitize uploaded SVG files and registers the SVG MIME type f... | |
| CVE-2026-106028 json | The ActiveTrail for WooCommerce WordPress plugin through 1.2.6 does not perform any authorization check before creating WooCo... | |
| CVE-2026-106014 json | The Gateway for Vantiv on WC WordPress plugin through 1.0.1 does not verify the authenticity of the payment notification rece... | |
| CVE-2026-94273 json | The Snap Finance WordPress plugin through 3.11.0 does not verify that the payment provider's response actually confirms a com... | |
| CVE-2026-91047 json | The ElementsReady Addons for Elementor WordPress plugin through 6.7.2 does not properly restrict access to protected WooComme... | |
| CVE-2026-91046 json | The ElementsReady Addons for Elementor WordPress plugin through 6.7.2 does not perform authorization checks that halt executi... | |
| CVE-2026-89286 json | The FormFlow for GoHighLevel (GHL) WordPress plugin through 1.0.0 does not restrict access to a log file it writes inside th... | |
| CVE-2026-16487 json | A flaw was found in bootc when operating with the default containers signature policy. Automatic or manual upgrades of a muta... | |
| CVE-2024-4457 json | The Management Console fails to properly validate input related to the configuration of JDBC user stores. This weakness allow... | |
| CVE-2026-111999 json | Vanus 0.8.0 through 0.9.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to pub... | |
| CVE-2026-111041 json | The AI Engine WordPress plugin before 3.7.9 does not verify that the user performing certain AI media management actions own... | |
| CVE-2026-110981 json | The WP Photo Album Plus WordPress plugin before 9.2.11.002 does not properly escape a category navigation value before reflec... | |
| CVE-2026-110976 json | The AI Engine WordPress plugin before 3.7.9 does not check that the item passed to one of its media actions belongs to the r... | |
| CVE-2026-110070 json | The Modern Events Calendar Lite WordPress plugin before 7.36.4 does not verify that a user is authorized to edit the target p... | |
| CVE-2026-110069 json | The Modern Events Calendar Lite WordPress plugin before 7.37.0 does not perform capability, nonce, or ownership checks before... | |
| CVE-2026-110035 json | The Salon Booking System WordPress plugin before 10.31.11 does not restrict one of its REST API endpoints to salon staff, al... | |
| CVE-2026-110033 json | The Salon Booking System WordPress plugin before 10.31.11 does not validate a user-supplied image URL before fetching it ser... | |
| CVE-2026-110032 json | The Salon Booking System WordPress plugin before 10.31.11 does not restrict which user account its salon staff roles may edi... | |
| CVE-2026-110031 json | The Salon Booking System WordPress plugin before 10.31.11 does not prevent users holding its custom salon staff role from as... | |
| CVE-2026-110026 json | The Tasty Recipes Lite WordPress plugin before 1.2.11 does not correctly check user capabilities when creating, renaming and... | |
| CVE-2026-96534 json | The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro WordPress plugin before 7.37.0 does... | |
| CVE-2026-87844 json | The PickPlugins Product Designer for WooCommerce WordPress plugin through 1.0.40 does not perform any capability check and it... | |
| CVE-2026-111934 json | Coder before 2.34.7 contains an IP spoofing vulnerability in the ExtractRealIPAddress middleware that trusts the leftmost, cl... | |
| CVE-2026-111933 json | Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contains a user enumeration vulner... | |
| CVE-2026-111932 json | Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contains a stored HTML injection v... | |
| CVE-2026-111931 json | Coder from 2.0.0 before 2.34.8 contains an open redirect vulnerability in handleAPIKeySmuggling that allows attackers to redi... | |
| CVE-2026-111930 json | Coder from 2.26.0 before 2.34.8 contains an incorrect authorization flaw in the GET /api/v2/workspaces/{id}/acl endpoint, whi... | |
| CVE-2026-111929 json | Coder from 2.30.0 before 2.34.8 contains an authorization bypass vulnerability in the provisioner daemon DownloadFile gRPC ha... | |
| CVE-2026-111928 json | Coder from 2.0.0 before 2.34.8 contains an incorrect authorization vulnerability in the acl_allow rule of coderd/rbac/policy.... | |
| CVE-2026-111927 json | Coder before 2.29.20, 2.33.0 before 2.33.12, 2.34.0 before 2.34.8, and 2.35.0 before 2.35.4 contains an improper hostname val... | |
| CVE-2026-111926 json | Coder from 2.10.0 before 2.34.8 has an unauthenticated agent debug HTTP server on 127.0.0.1:2113 whose /debug/manifest handle... | |
| CVE-2026-111920 json | Vikunja 2.6.0 contains a broken access control flaw in getProjectAccessForUser (pkg/models/project_access.go), which resolves... | |
| CVE-2026-111914 json | Admidio from 5.0.11 before 5.0.16 contains a broken access control vulnerability in modules/inventory/inventory_data.php that... | |
| CVE-2026-109937 json | The Otter Blocks WordPress plugin before 3.2.3 does not validate that a user-supplied return URL belongs to the site before ... | |
| CVE-2025-71435 json | Coder before 2.23.0 contains a session expiration bypass vulnerability that allows authenticated users to retain access after... | |
| CVE-2024-58398 json | Coder 2.3.1 before 2.14.4, 2.15.x before 2.15.3, and 2.16.0 before 2.16.1 contains an open redirect vulnerability in the logi... | |
| CVE-2026-110527 json | The WP User Manager WordPress plugin before 2.9.20 does not roll back the WordPress account it creates during payment-gated ... | |
| CVE-2026-106470 json | The WP Data Access WordPress plugin before 5.5.88 does not have authorisation and CSRF checks in one of its actions, allowin... | |
| CVE-2026-104246 json | The Contact Form 7 Signature Addon WordPress plugin through 4.2.2 does not sanitize a signature field value before building a... | |
| CVE-2026-104122 json | The Ukr-To-Lat WordPress plugin through 1.3.5 does not sanitize and escape a term name before using it in a SQL query, allowi... | |
| CVE-2026-103376 json | The PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net, NMI) WordPress ... | |
| CVE-2026-97314 json | The ThirstyAffiliates WordPress plugin before 3.12.1 does not check the status or type of the object requested by its link r... | |
| CVE-2026-92433 json | The Patreon WordPress plugin before 1.10.0 does not verify a nonce when connecting the site to a Patreon account, allowing at... | |
| CVE-2026-92432 json | The Patreon WordPress plugin before 1.10.0 does not validate a user-supplied redirect destination before redirecting, allowin... | |
| CVE-2026-92431 json | The Patreon WordPress plugin before 1.10.0 does not perform an authorization check on some of its functionality, allowing una... | |
| CVE-2026-91074 json | The BSK PDF Manager WordPress plugin through 3.8.1 does not properly sanitise and escape a parameter before using it in a SQL... | |
| CVE-2026-89096 json | A flaw was found in nfs-utils. An unauthenticated remote attacker can trigger a Denial of Service (DoS) by sending repeated s... | |
| CVE-2026-81344 json | The ACF Frontend Admin by DynamiApps WordPress plugin through 3.29.13 does not restrict which PHP classes may be instantiated... | |
| CVE-2026-81343 json | The ACF Frontend Admin by DynamiApps WordPress plugin through 3.29.13 does not perform a capability check on one of its form-... | |
| CVE-2026-111802 json | A flaw was found in Nautilus. When a removable drive or disk image is unmounted or ejected, Nautilus prompts the user to empt... | |
| CVE-2026-103839 json | Substance3D - Stager is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the... | |
| CVE-2026-103838 json | Substance3D - Stager is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the... | |
| CVE-2026-103837 json | Substance3D - Stager is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the... | |
| CVE-2026-103836 json | Substance3D - Stager is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the... | |
| CVE-2026-101308 json | When an audio channel's buffer needs to be resized, the sound(4) driver checks that the buffer is not memory-mapped and then ... | |
| CVE-2026-89088 json | A flaw was found in parted. A heap-based buffer overflow exists in libparted's file system resizing logic when handling FAT16... | |
| CVE-2026-89085 json | A flaw was found in parted. A heap-based buffer overflow can occur when processing a specially crafted FAT32 filesystem due t... | |
| CVE-2026-62439 json | A flaw was found in GIMP. An integer overflow occurs in the file-pvr plug-in when calculating memory buffer sizes for image d... | |
| CVE-2026-62438 json | A flaw was found in GIMP. An attacker can cause a Denial of Service (DoS) or potentially disclose sensitive memory contents b... |