CVE.report
CVE.report is the most up-to-date database of common vulnerabilities and exposures. Information is pulled in from several sources and processed in to a mobile friendly, easy to use page. Use the site to quickly check for vulnerabilities in products such as operating systems, applications, hardware, networks, databases, browsers, e-mail clients and more.
CVEs provide a unique and common naming scheme for publicly known cyber security vulnerabilities in order to quickly identify and share these vulnerabilities. You can use the search below to look for vulnerabilities based on product, vendor, or common tags
The form you will see after following this link allows you to fill out the various variables in the CVSS scoring system and receive the corresponding score. The description of each of the variables is also included for additional information.
cve.report now provides a free read-only JSON API for CVE details. Each record combines the CVE Program JSON record, NVD enrichment, KEV, and EPSS when available.
Recent CVEs
| CVE | Description | Updated |
|---|---|---|
| CVE-2026-126627 json | Creation of Temporary File With Insecure Permissions vulnerability in Apache XML Graphics FOP. This issue affects Apache X... | |
| CVE-2026-125784 json | Cross-Site Request Forgery (CSRF) vulnerability in Magnigenie RestroPress restropress allows Cross Site Request Forgery.This ... | |
| CVE-2026-125781 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NOUS Ouvert Utile et Si... | |
| CVE-2026-125777 json | Insertion of Sensitive Information Into Sent Data vulnerability in Cozmoslabs Profile Builder profile-builder allows Retrieve... | |
| CVE-2026-125761 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YITH YITH WooCommerce A... | |
| CVE-2026-125680 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bold Themes Bold Page B... | |
| CVE-2026-125455 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bold Themes Bold Page B... | |
| CVE-2026-125451 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins B Blocks b-blo... | |
| CVE-2026-125444 json | Missing Authorization vulnerability in King Addons King Addons for Elementor king-addons allows Exploiting Incorrectly Config... | |
| CVE-2026-125439 json | Missing Authorization vulnerability in Kit Kit (formerly ConvertKit) convertkit allows Exploiting Incorrectly Configured Acce... | |
| CVE-2026-125438 json | Missing Authorization vulnerability in Webful Creations RepairBuddy computer-repair-shop allows Exploiting Incorrectly Config... | |
| CVE-2026-125437 json | Missing Authorization vulnerability in NSquared Simply Schedule Appointments simply-schedule-appointments allows Exploiting I... | |
| CVE-2026-125434 json | Missing Authorization vulnerability in Webful Creations RepairBuddy computer-repair-shop allows Exploiting Incorrectly Config... | |
| CVE-2026-124753 json | Missing Authorization vulnerability in Ahmad WP Job Portal wp-job-portal allows Exploiting Incorrectly Configured Access Cont... | |
| CVE-2026-124752 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Element Pack E... | |
| CVE-2026-124743 json | A flaw was found in BusyBox. When processing filesystem metadata, the volume identification component does not properly valid... | |
| CVE-2026-124742 json | A flaw was found in BusyBox. The volume identification component fails to properly validate cluster parameters when analyzing... | |
| CVE-2026-124740 json | A flaw was found in BusyBox's udhcpc6 DHCPv6 client. A malicious server on the local network can trigger a use-after-free con... | |
| CVE-2026-124738 json | A flaw was found in BusyBox. When the HTTP daemon (httpd) has pre-compressed file support enabled, authentication checks are ... | |
| CVE-2026-124421 json | Missing Authorization vulnerability in BdThemes ZoloBlocks zoloblocks allows Exploiting Incorrectly Configured Access Control... | |
| CVE-2026-124413 json | Missing Authorization vulnerability in WP User Manager WP User Manager wp-user-manager allows Exploiting Incorrectly Configur... | |
| CVE-2026-124408 json | Missing Authorization vulnerability in Arraytics WPCafe wp-cafe allows Exploiting Incorrectly Configured Access Control Secur... | |
| CVE-2026-124271 json | Missing Authorization vulnerability in DEV Institute Restrict User Access – Membership Plugin with Force restrict-user-acce... | |
| CVE-2026-124255 json | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Franky Events Made Easy events... | |
| CVE-2026-123705 json | The Security For WooCommerce WordPress plugin through 1.0.16 does not restrict access to one of its REST API routes, allowing... | |
| CVE-2026-123704 json | The Security For WooCommerce WordPress plugin through 1.0.16 does not restrict access to one of its REST API routes, allowing... | |
| CVE-2026-123703 json | The Security For WooCommerce WordPress plugin through 1.0.16 does not check that the requester is authorised before ending a ... | |
| CVE-2026-123702 json | The Security For WooCommerce WordPress plugin through 1.0.16 does not check that the requester is authorised before regenerat... | |
| CVE-2026-123668 json | The GetPaid WordPress plugin from 2.8.63 to 2.8.64 does not ensure item quantities on its payment forms are whole numbers, al... | |
| CVE-2026-123659 json | The ProfilePress WordPress plugin before 4.17.6 does not restrict the role and user meta filters its member directories accep... | |
| CVE-2026-123473 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in weDevs Happy Addons for... | |
| CVE-2026-122671 json | Missing Authorization vulnerability in E2Pdf.com e2pdf e2pdf allows Exploiting Incorrectly Configured Access Control Security... | |
| CVE-2026-121773 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GeneratePress GenerateB... | |
| CVE-2026-121770 json | Cross-Site Request Forgery (CSRF) vulnerability in VillaTheme VISeek viseek-easy-custom-search allows Cross Site Request Forg... | |
| CVE-2026-121574 json | Missing Authorization vulnerability in WP Chill Passster content-protector allows Exploiting Incorrectly Configured Access Co... | |
| CVE-2026-121028 json | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in WP Chill Strong Testimonials s... | |
| CVE-2026-121014 json | Missing Authorization vulnerability in Ahmad WP Job Portal wp-job-portal allows Exploiting Incorrectly Configured Access Cont... | |
| CVE-2026-119615 json | The Reset Database plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 1.1.3. This i... | |
| CVE-2026-119302 json | The NotificationX WordPress plugin before 3.3.7 does not perform any capability, authentication or nonce check on its notific... | |
| CVE-2026-119171 json | The Advanced Product Fields (Product Addons) for WooCommerce WordPress plugin from 1.6.22 to 1.7.3 does not validate that a s... | |
| CVE-2026-119097 json | The Author Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name' parameter in all ve... | |
| CVE-2026-115600 json | Missing Authorization vulnerability in DEV Institute Restrict User Access – Membership Plugin with Force restrict-user-acce... | |
| CVE-2026-103883 json | The 6Storage Rentals plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeover in... | |
| CVE-2026-92408 json | The WPS Bookings for WooCommerce WordPress plugin before 3.13.1 does not validate a price value taken from user input before ... | |
| CVE-2026-88813 json | The YITH WooCommerce Gift Cards WordPress plugin through 4.39.0 does not reconcile the value of a gift card it issues against... | |
| CVE-2026-123701 json | The Security For WooCommerce WordPress plugin through 1.0.16 does not have proper authorization checks when resetting its set... | |
| CVE-2026-123700 json | The Security For WooCommerce WordPress plugin through 1.0.16 does not check that the requester is authorised before running s... | |
| CVE-2026-123699 json | The Security For WooCommerce WordPress plugin through 1.0.16 does not check that the requester is authorised before running b... | |
| CVE-2026-123698 json | The Security For WooCommerce WordPress plugin through 1.0.16 does not restrict access to one of its REST API routes, allowing... | |
| CVE-2026-123697 json | The Security For WooCommerce WordPress plugin through 1.0.16 does not restrict who can request a user's current two-factor co... | |
| CVE-2026-123696 json | The Security For WooCommerce WordPress plugin through 1.0.16 does not check that the requester is authorised before resetting... | |
| CVE-2026-123695 json | The Security For WooCommerce WordPress plugin through 1.0.16 does not restrict access to several of its REST API routes, allo... | |
| CVE-2026-123667 json | The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.6.2 does not sanitise and escape keyword names befor... | |
| CVE-2026-123666 json | The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.6.2 does not check that a user may delete the media ... | |
| CVE-2026-123661 json | The ProfilePress WordPress plugin before 4.17.4 does not check that a membership plan is still active when checkout is used ... | |
| CVE-2026-123657 json | The ProfilePress WordPress plugin before 4.17.6 does not reject negative membership plan identifiers before checking whether... | |
| CVE-2026-123134 json | The Smoove abandoned cart trigger for WooCommerce WordPress plugin before 4.3.6 does not sanitise and escape abandoned-cart d... | |
| CVE-2026-122087 json | The Event Tickets and Registration WordPress plugin before 5.30.3.1 does not restrict attendee data to events the requester i... | |
| CVE-2026-122061 json | The Event Tickets and Registration WordPress plugin before 5.30.3.1 does not correctly check whether an event displays a publ... | |
| CVE-2026-121998 json | The iChart WordPress plugin before 2.2.4 does not perform capability or ownership checks in several of its AJAX actions, rel... | |
| CVE-2026-121873 json | The Redirection for Contact Form 7 WordPress plugin before 3.2.16 does not verify ownership of the email address supplied thr... | |
| CVE-2026-121870 json | The Simpler Checkout WordPress plugin before 1.5.4 does not properly restrict who can create orders and checks its automatic ... | |
| CVE-2026-121863 json | The Knowledge Building WordPress plugin before 0.7.3 does not escape several user-supplied values before echoing them back in... | |
| CVE-2026-121862 json | The Knowledge Building WordPress plugin before 0.7.3 does not sanitise and escape comments submitted through its reply featur... | |
| CVE-2026-121497 json | The AskAny WordPress plugin before 2.2.0 does not validate the extension or content of files attached to chat messages, trus... | |
| CVE-2026-121472 json | The AutomatorWP WordPress plugin before 6.0.8 does not bind the requests that complete its Zoom and AWeber integration conne... | |
| CVE-2026-119531 json | The Live Composer WordPress plugin before 2.1.24 does not escape several attributes of one of its page-builder shortcodes be... | |
| CVE-2026-119529 json | The Gravity Forms WordPress plugin before 3.2.2 does not properly restrict the file types that unauthenticated users can uplo... | |
| CVE-2026-119303 json | The NotificationX WordPress plugin before 3.3.7 does not perform any capability or nonce check on one of its REST routes, al... | |
| CVE-2026-119035 json | The Schema & Structured Data for WP & AMP WordPress plugin before 1.70 does not safely encode its structured data output when... | |
| CVE-2026-119034 json | The Schema & Structured Data for WP & AMP WordPress plugin before 1.70 does not verify that a post is publicly viewable befor... | |
| CVE-2026-119033 json | The Schema & Structured Data for WP & AMP WordPress plugin before 1.70 does not verify that a user may edit a post before let... | |
| CVE-2026-119032 json | The Schema & Structured Data for WP & AMP WordPress plugin before 1.70 does not check that the importing user may edit the po... | |
| CVE-2026-118439 json | The Limit Login Attempts Security WordPress plugin before 3.4.2 does not validate the destination of a server-side request b... | |
| CVE-2026-118420 json | The WP Directory Kit WordPress plugin before 1.6.3 does not sanitise and escape a parameter before using it in a SQL statemen... | |
| CVE-2026-118418 json | The WP Directory Kit WordPress plugin before 1.6.3 does not restrict which database models and columns its public directory-s... | |
| CVE-2026-118241 json | The Smush WordPress plugin before 4.3.6 does not verify that a user is authorised to act on the targeted media attachment, o... | |
| CVE-2026-118041 json | The Contest Gallery WordPress plugin before 34.0.3 does not sanitise the name of files uploaded through its e-commerce sale ... | |
| CVE-2026-117524 json | The Dynific Addons for Elementor (formerly Anywhere Elementor) WordPress plugin before 1.3.1 does not perform a status or cap... | |
| CVE-2026-117523 json | The Dynific Addons for Elementor (formerly Anywhere Elementor) WordPress plugin before 1.3.1 does not perform a capability or... | |
| CVE-2026-117522 json | The Dynific Addons for Elementor (formerly Anywhere Elementor) WordPress plugin before 1.3.1 does not escape the post title b... | |
| CVE-2026-117521 json | The Dynific Addons for Elementor (formerly Anywhere Elementor) WordPress plugin before 1.3.1 does not escape a user-controlle... | |
| CVE-2026-115735 json | The Somatic Framework WordPress plugin through 1.8.14 does not perform an authorization check or validate a user-supplied fil... | |
| CVE-2026-115734 json | The Pay with a tweet WordPress plugin through 1.0.5 does not validate a file path before deleting it, nor does it restrict ac... | |
| CVE-2026-115733 json | The Printaura-Woocommerce WordPress plugin through 4.0.2 does not properly restrict access to the WooCommerce REST API, causi... | |
| CVE-2026-111597 json | The Forminator Forms WordPress plugin before 1.58.4 does not verify that a Stripe Checkout payment has completed before retu... | |
| CVE-2026-111579 json | The Forminator Forms WordPress plugin before 1.58.4 does not enforce payment on the server side when a form's configured pay... | |
| CVE-2026-110949 json | The Download Manager WordPress plugin before 3.3.73, Download Manager WordPress plugin before 7.6.2 does not verify a package... | |
| CVE-2026-110948 json | The Download Manager WordPress plugin before 3.3.73, Download Manager WordPress plugin before 7.6.2 does not verify that a vi... | |
| CVE-2026-110016 json | The Data Tables Generator by Supsystic WordPress plugin before 1.15.8 does not perform any authorization or ownership check ... | |
| CVE-2026-109873 json | The User Registration & Membership WordPress plugin before 5.3.2 does not enforce its payment-before-login restriction when ... | |
| CVE-2026-109871 json | The User Registration & Membership WordPress plugin before 5.3.2 does not verify that a payment has actually been completed ... | |
| CVE-2026-109870 json | The User Registration & Membership WordPress plugin before 5.3.2 does not verify that a discount coupon applied to a paid me... | |
| CVE-2026-106468 json | The Code Snippets WordPress plugin before 4.1.0 does not verify network-level capabilities before honouring a network-scope p... | |
| CVE-2026-104718 json | The Elementor Website Builder WordPress plugin before 4.3.6 does not validate or escape an element identifier before renderi... | |
| CVE-2025-15714 json | The Live Composer WordPress plugin before 2.1.24 does not sanitise and escape some of its Button module settings before outp... | |
| CVE-2025-15713 json | The Live Composer WordPress plugin before 2.1.24 does not sanitise and escape some of its page-builder module settings befor... | |
| CVE-2025-15712 json | The Live Composer WordPress plugin before 2.1.24 does not sanitise and escape some of its staff member settings before outpu... | |
| CVE-2026-122474 json | Time-of-check time-of-use (toctou) race condition in Windows Security Account Manager allows an unauthorized attacker to bypa... | |
| CVE-2026-121661 json | Incomplete list of disallowed inputs in Visual Studio Code allows an unauthorized attacker to bypass a security feature local... |