CVE.report
CVE.report is the most up-to-date database of common vulnerabilities and exposures. Information is pulled in from several sources and processed in to a mobile friendly, easy to use page. Use the site to quickly check for vulnerabilities in products such as operating systems, applications, hardware, networks, databases, browsers, e-mail clients and more.
CVEs provide a unique and common naming scheme for publicly known cyber security vulnerabilities in order to quickly identify and share these vulnerabilities. You can use the search below to look for vulnerabilities based on product, vendor, or common tags
The form you will see after following this link allows you to fill out the various variables in the CVSS scoring system and receive the corresponding score. The description of each of the variables is also included for additional information.
cve.report now provides a free read-only JSON API for CVE details. Each record combines the CVE Program JSON record, NVD enrichment, KEV, and EPSS when available.
Recent CVEs
| CVE | Description | Updated |
|---|---|---|
| CVE-2026-127211 json | MultiVendorX plugin for WordPress before 5.0.22 contains a broken access control vulnerability in the /wp-json/multivendorx/v... | |
| CVE-2026-127209 json | Xiaomi Mi Browser Android Application (com.mi.globalbrowser) before 14.66.0-gn contains a path traversal vulnerability in the... | |
| CVE-2026-126823 json | A local user with an ordinary account on the same host can place a file in a shared temporary location that the JDBC driver's... | |
| CVE-2026-126354 json | Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.2.5 un... | |
| CVE-2026-126353 json | Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.3.0 un... | |
| CVE-2026-126352 json | Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.3.0 un... | |
| CVE-2026-126351 json | Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. Prior to 2.9.... | |
| CVE-2026-126350 json | Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.3.0 un... | |
| CVE-2026-126349 json | Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.0.0 un... | |
| CVE-2026-126348 json | Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.0.0 un... | |
| CVE-2026-126347 json | Tornado is a Python web framework and asynchronous networking library. In versions through 6.6.0, applications using tornad... | |
| CVE-2026-126346 json | basic-ftp is an FTP client for Node.js. Prior to 6.2.3, FTPContext.send() throws when a command contains carriage return, lin... | |
| CVE-2026-126345 json | basic-ftp is an FTP client for Node.js. Prior to 6.2.4, the MLSD directory-listing parser in src/parseListMLSD.ts uses untrus... | |
| CVE-2026-126344 json | @hono/node-server allows running the Hono application on Node.js. From 2.0.0 until 2.1.6, the WebSocket upgrade path resolves... | |
| CVE-2026-91141 json | A vulnerability in the default configuration of vsomeip allows a remote, unauthenticated attacker to trigger massive memory a... | |
| CVE-2026-126793 json | An untrusted search path issue in Aurora PostgreSQL dialect detection in the AWS Advanced Go Wrapper from release 2026-04-06 ... | |
| CVE-2026-126343 json | @hono/node-server allows running the Hono application on Node.js. From 2.0.0 until 2.1.6, the WebSocket upgrade handler waits... | |
| CVE-2026-126210 json | @hono/node-server allows running the Hono application on Node.js. Prior to 1.19.18 and from 2.0.0 until 2.1.6, the server pas... | |
| CVE-2026-120471 json | Joomla Extension - acymailing.com - Site modules rendered outside their access level in AcyMailing 1.0.0 - 11.1.1 - An unauth... | |
| CVE-2026-120470 json | Joomla / WordPress Extension - acymailing.com - Online version of an email readable without the visibility check in AcyMailin... | |
| CVE-2026-120469 json | Joomla / WordPress Extension - acymailing.com - Open redirect on the subscription and unsubscription endpoints in AcyMailing ... | |
| CVE-2026-120468 json | Joomla Extension - acymailing.com - Unauthenticated disclosure of mailing list metadata in AcyMailing 1.0.0 - 11.1.1 - An una... | |
| CVE-2026-120467 json | Joomla / WordPress Extension - acymailing.com - Subscriber identity not bound to the record acted upon in AcyMailing 1.0.0 - ... | |
| CVE-2026-120466 json | Joomla / WordPress Extension - acymailing.com - Missing authorization on subscription changes in AcyMailing 1.0.0 - 11.1.1 - ... | |
| CVE-2026-117551 json | Joomla Extension - jdownloads.com - RCE through file upload in jDownloads < 4.1.8 - Insufficient validation of frontend thum... | |
| CVE-2026-117544 json | Joomla Extension - jdownloads.com - IDOR allowing restricted file downloads in jDownloads < 4.1.8 - The `other_file_id` param... | |
| CVE-2026-117542 json | Joomla Extension - jdownloads.com - Authenticated path traversal in jDownloads < 4.1.8 - A manipulated `update_file` form par... | |
| CVE-2026-0460 json | Improper authentication in Bootgen could result in the use of a fixed salt value for RSA padding instead of a randomly genera... | |
| CVE-2026-0455 json | The Versal™ AI Edge Series Gen 2 Peripheral Protection Unit (XPPU) for the inter-processor interrupt (IPI) buffers does not... | |
| CVE-2025-54507 json | Improper validation of consistency within input in AMD SEV (Secure Encrypted Virtualization) firmware could allow an attacker... | |
| CVE-2025-0043 json | Incorrect directory permissions within AMD Vivado™ Lab Solutions could allow a local user-privileged attacker to escalate t... | |
| CVE-2024-36344 json | Insufficient parameter sanitization in AMD Secure Processor (ASP) TEE DrvSys could allow an attacker with local access to the... | |
| CVE-2024-21963 json | An out-of-bounds read vulnerability in the IOMMU could allow a malicious guest to corrupt hypervisor (HV) pages and potential... | |
| CVE-2026-120154 json | Improper protection in PostgreSQL INSERT ... ON CONFLICT allows an attacker having INSERT, UPDATE, and applicable SELECT priv... | |
| CVE-2026-120153 json | SQL injection in PostgreSQL extension-script substitutions allows an attacker with database-level CREATE privilege to execute... | |
| CVE-2026-120152 json | Use after free in PostgreSQL pg_show_all_settings() allows a database user to retrieve memory contents, via loading a module ... | |
| CVE-2026-120151 json | Type confusion in PostgreSQL plpgsql record-field assignment allows an object creator to execute arbitrary code as the operat... | |
| CVE-2026-120144 json | Type confusion from incomplete PostgreSQL type-cache invalidation allows an object creator to execute arbitrary code as the o... | |
| CVE-2026-120143 json | Use after free in PostgreSQL trigger functions allows an object creator to execute arbitrary code as the operating system use... | |
| CVE-2026-120142 json | Type confusion in PostgreSQL anonymous RECORD types allows an object creator to execute arbitrary code as the operating syste... | |
| CVE-2026-120141 json | Type confusion in PostgreSQL materialized set-returning functions allows a database user to execute arbitrary code as the ope... | |
| CVE-2026-120139 json | Integer wraparound in PostgreSQL in-memory tuple-size calculations allows a database user to execute arbitrary code as the op... | |
| CVE-2026-117550 json | Joomla Extension - jdownloads.com - Publishing of files without approval in jDownloads < 4.1.8 - Manipulated frontend submis... | |
| CVE-2026-117543 json | Joomla Extension - jdownloads.com - SSRF via external download URL field jDownloads < 4.1.8 - HTTP redirects when retrieving... | |
| CVE-2026-116336 json | Operation on a dropped index in PostgreSQL REINDEX CONCURRENTLY allows an object creator to execute arbitrary code as the ope... | |
| CVE-2026-18447 json | Type confusion in PostgreSQL SQL-language functions allows an object creator to execute arbitrary code as the operating syste... | |
| CVE-2026-16240 json | Use of externally-controlled format string in PostgreSQL pg_basebackup allows an attacker having already compromised a server... | |
| CVE-2026-16237 json | Improper protection in PostgreSQL INSERT ... ON CONFLICT on auto-updatable views allows an attacker having INSERT and UPDATE ... | |
| CVE-2026-14661 json | External control of file name in PostgreSQL dblink and CREATE/ALTER SUBSCRIPTION allows a user to achieve persistent denial o... | |
| CVE-2026-6467 json | Uncontrolled search path element in PostgreSQL CREATE EXTENSION allows an attacker with database-level CREATE privilege to ex... | |
| CVE-2026-6460 json | Type confusion in PostgreSQL allows an object creator to execute arbitrary code as the operating system user running the data... | |
| CVE-2026-116335 json | Type confusion in PostgreSQL operator commutator and negator links allows an object creator to execute arbitrary code as the ... | |
| CVE-2026-116333 json | Buffer over-read in PostgreSQL parallel B-tree scans allows an object creator to read attacker-chosen server-memory addresses... | |
| CVE-2026-116332 json | Use after free in PostgreSQL portal setup allows an object creator to execute arbitrary code as the operating system user run... | |
| CVE-2026-116331 json | Type confusion in PostgreSQL min/max aggregate optimization allows an object creator to execute arbitrary code as the operati... | |
| CVE-2026-116322 json | Improper locking in PostgreSQL startup processing allows an unauthenticated network client to trigger a server restart, via a... | |
| CVE-2026-116321 json | Improper null termination in PostgreSQL array element assignment allows a database user to disclose server memory, via changi... | |
| CVE-2026-116320 json | Use after free in PostgreSQL plperl allows an object creator to execute arbitrary code as the operating system user running t... | |
| CVE-2026-116319 json | Use after free in PostgreSQL plperl allows an object creator to execute arbitrary code as the operating system user running t... | |
| CVE-2026-116318 json | SQL injection in PostgreSQL pg_dump allows an object creator to execute arbitrary SQL as the user restoring the dump, via an ... | |
| CVE-2026-116317 json | Heap-based buffer overflow in PostgreSQL ts_rank_cd() may allow a database user to execute arbitrary code as the operating sy... | |
| CVE-2026-116316 json | Improper protection of alternate path in PostgreSQL security-restricted operations allows an object creator to execute arbitr... | |
| CVE-2026-116315 json | Heap-based buffer overflow in PostgreSQL tsvector_delete() allows a database user to execute arbitrary code as the operating ... | |
| CVE-2026-116314 json | Improper input validation in PostgreSQL pg_restore allows a non-plain archive provider to execute arbitrary code as the opera... | |
| CVE-2026-116313 json | Untrusted search path in PostgreSQL vacuumdb allows a database owner to execute arbitrary SQL as the database user running va... | |
| CVE-2026-116309 json | Type confusion in PostgreSQL plperl may allow an object creator to execute arbitrary code, via blessing a non-hash reference ... | |
| CVE-2026-116308 json | Buffer over-read in PostgreSQL dict_int allows a database user to disclose portions of server memory, via a zero-length token... | |
| CVE-2026-116307 json | Use after free in PostgreSQL plperl allows an object creator to execute arbitrary code as the operating system user running t... | |
| CVE-2026-116306 json | Type confusion in PostgreSQL composite-value field assignment allows an object creator to execute arbitrary code as the opera... | |
| CVE-2026-116304 json | Use after free in PostgreSQL coordination of anonymous RECORD type identifiers among parallel workers allows a database user ... | |
| CVE-2026-126641 json | A host key verification flaw was found in ansible-pylibssh and in the ansible.netcommon libssh connection plugin. When trust-... | |
| CVE-2026-116303 json | Missing authorization in PostgreSQL type conversion allows a database user to invoke a cast function despite lacking EXECUTE ... | |
| CVE-2026-68549 json | ClickMigrate is a database migration tool for ClickHouse with automatic SQL migration management and version tracking. Prior ... | |
| CVE-2026-68512 json | Paaster is a pastebin application. Prior to version 3.3.0, Paaster's account login has no rate limiting, lockout, or CAPTCHA ... | |
| CVE-2026-68511 json | Paaster is a pastebin application. Prior to version 3.3.0, Paaster's "view once" (burn-after-reading) paste mode can be bypas... | |
| CVE-2026-68507 json | ideon is a self-hosted visual workspace. Prior to version 0.9.5, ideon's link-preview endpoint requires no authentication at ... | |
| CVE-2026-67548 json | taOS is a self-hosted AI agent OS. Prior to version 1.0.0-beta.25, tinyagentos (taOS) registers all system settings routes un... | |
| CVE-2026-67547 json | taOS is a self-hosted AI agent OS. Prior to version 1.0.0-beta.23, the POST /api/skill-exec/{skill_id}/call endpoint in taOS ... | |
| CVE-2026-67449 json | Portabase is a database backup and restore tool for PostgreSQL, MySQL, MsSQL, MariaDB, Firebird SQL, SQLite, MongoDB, Redis, ... | |
| CVE-2026-65982 json | nginx-http-flv-module is a media streaming server based on nginx-rtmp-module. Prior to version 1.2.14, if a server received a... | |
| CVE-2026-65973 json | Laradocs maintains version-controlled documentation inside a Laravel codebase. From version 0.4.0 to before version 1.0.0, La... | |
| CVE-2026-65971 json | Livewire PowerGrid creates data tables based on Laravel Livewire library. From version 6.0.0 to before version 6.10.4, the pu... | |
| CVE-2026-65968 json | ideon is a self-hosted visual workspace. Prior to version 0.9.4, validateUrlForSSRF() / safeFetch() in lib/oauth/ssrf-protect... | |
| CVE-2026-65965 json | ideon is a self-hosted visual workspace. Prior to version 0.9.4, several project mutation endpoints under /api/projects/[id]/... | |
| CVE-2026-65957 json | Helio is an MCP proxy that sits between AI agents and the tools they use. Prior to version 0.8.0, the dashboard sideband (def... | |
| CVE-2026-103980 json | ideon is a self-hosted visual workspace. Prior to version 0.9.6, the SSRF protection in safeFetch is bypassed by IPv6 transit... | |
| CVE-2026-65967 json | Fider is a feedback portal for feature requests and suggestions. Prior to version 0.34.0, a Server-Side Request Forgery (SSRF... | |
| CVE-2026-65843 json | sync-rpc runs asynchronous commands synchronously by putting them in a separate proces. Prior to version 1.3.7, if an attacke... | |
| CVE-2026-65840 json | Fider is a feedback portal for feature requests and suggestions. Prior to version 0.36.0, in multi-tenant mode (HOST_MODE=mul... | |
| CVE-2026-65833 json | iopress is a native HTTP server for Node.js with platform-specific async I/O. Prior to version 1.0.5, the chunked-transfer-en... | |
| CVE-2026-65820 json | aeon is a scikit-learn compatible Python library for learning from time series. Prior to version 1.5.0, a GitHub Actions work... | |
| CVE-2026-64858 json | vulnerability-operator scans SBOMs and Images for vulnerabilities. Prior to version 0.28.16, an unauthenticated information-d... | |
| CVE-2026-64855 json | soapbar is a SOAP library for Python — client, server, and WSDL handling. Prior to version 0.13.0, verify_envelope_bsp() de... | |
| CVE-2026-64682 json | AstroBlocks is a block-first CMS for Astro projects. Prior to version 3.4.0, admin session tokens can be forged due to a hard... | |
| CVE-2026-64678 json | NOsql Object (NO2 a.k.a Nitrite) database is an open source nosql embedded document store. Prior to version 4.4.1, when Nitri... | |
| CVE-2026-64668 json | pam_usb provides hardware authentication for Linux using removable media. From version 0.8.0 to before version 0.9.3, the den... | |
| CVE-2026-62971 json | The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewalls. P... | |
| CVE-2026-59191 json | TwigView plugin for CakePHP provides wrappers for common View operations and extensions that expose CakePHP functions and jas... | |
| CVE-2026-58505 json | geojson-vt is a JavaScript library for slicing GeoJSON data into vector tiles on the fly, primarily designed to enable render... | |
| CVE-2026-57500 json | REVA is an interoperability platform. Prior to versions 2.40.5 and 2.46.4, Reva exposes internal metadata folders in the spac... |