CVE.report
CVE.report is the most up-to-date database of common vulnerabilities and exposures. Information is pulled in from several sources and processed in to a mobile friendly, easy to use page. Use the site to quickly check for vulnerabilities in products such as operating systems, applications, hardware, networks, databases, browsers, e-mail clients and more.
CVEs provide a unique and common naming scheme for publicly known cyber security vulnerabilities in order to quickly identify and share these vulnerabilities. You can use the search below to look for vulnerabilities based on product, vendor, or common tags
The form you will see after following this link allows you to fill out the various variables in the CVSS scoring system and receive the corresponding score. The description of each of the variables is also included for additional information.
cve.report now provides a free read-only JSON API for CVE details. Each record combines the CVE Program JSON record, NVD enrichment, KEV, and EPSS when available.
Recent CVEs
| CVE | Description | Updated |
|---|---|---|
| CVE-2026-65069 json | Data::DisjointSet::Shared versions before 0.02 for Perl create a world-readable mmap backing file and open it without O_EXCL ... | |
| CVE-2026-65068 json | Data::SpatialHash::Shared versions before 0.02 for Perl create a world-readable mmap backing file and open it without O_EXCL ... | |
| CVE-2026-65067 json | Data::Intern::Shared versions before 0.02 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_... | |
| CVE-2026-65066 json | Data::RingBuffer::Shared versions before 0.04 for Perl create a world-readable mmap backing file and open it without O_EXCL o... | |
| CVE-2026-65065 json | Data::RoaringBitmap::Shared versions before 0.02 for Perl create a world-readable mmap backing file and open it without O_EXC... | |
| CVE-2026-65064 json | Data::HashMap::Shared versions before 0.14 for Perl create a world-readable mmap backing file and open it without O_EXCL or O... | |
| CVE-2026-65063 json | Data::RadixTree::Shared versions before 0.02 for Perl create a world-readable mmap backing file and open it without O_EXCL or... | |
| CVE-2026-65062 json | Data::SortedSet::Shared versions before 0.03 for Perl create a world-readable mmap backing file and open it without O_EXCL or... | |
| CVE-2026-65061 json | Data::ReqRep::Shared versions before 0.05 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_... | |
| CVE-2026-64880 json | Unsanitized user-supplied input in report filtering parameters is concatenated directly into SQL queries without proper escap... | |
| CVE-2026-64879 json | A filename supplied during file upload is not properly sanitized before being used in system command execution, allowing an a... | |
| CVE-2026-64878 json | Unvalidated input in asset filter parameters allows shell metacharacters to escape command argument handling, resulting in re... | |
| CVE-2026-64617 json | Data::PubSub::Shared versions before 0.07 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_... | |
| CVE-2026-64616 json | Data::NDArray::Shared versions before 0.02 for Perl create a world-readable mmap backing file and open it without O_EXCL or O... | |
| CVE-2026-64615 json | Data::Graph::Shared versions before 0.04 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_N... | |
| CVE-2026-64614 json | Data::Deque::Shared versions before 0.06 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_N... | |
| CVE-2026-64613 json | Data::Buffer::Shared versions before 0.05 for Perl create a world-readable mmap backing file and open it without O_NOFOLLOW. ... | |
| CVE-2026-59147 json | Data::DisjointSet::Shared versions before 0.02 for Perl allow out-of-bounds reads and writes via an unvalidated parent index ... | |
| CVE-2026-59146 json | Data::SpatialHash::Shared versions before 0.02 for Perl allow out-of-bounds reads and writes via unvalidated bucket, link and... | |
| CVE-2026-59145 json | Data::Intern::Shared versions before 0.02 for Perl allow an out-of-bounds read via unvalidated slot, reverse and arena indice... | |
| CVE-2026-59144 json | Data::RingBuffer::Shared versions before 0.04 for Perl allow a stack buffer overflow via an unvalidated elem_size in ring_rea... | |
| CVE-2026-59143 json | Data::RoaringBitmap::Shared versions before 0.02 for Perl allow an out-of-bounds read via an unvalidated container offset and... | |
| CVE-2026-64877 json | An authenticated non-admin user can exploit a SQL injection flaw in the ticketing REST API to access sensitive data stored in... | |
| CVE-2026-56852 json | A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes. | |
| CVE-2026-56146 json | Improper Access Control (CWE-284) in Kibana can lead to unauthorized modification of Entity Analytics Watchlist configuration... | |
| CVE-2026-56145 json | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-13... | |
| CVE-2026-56144 json | Incorrect Authorization (CWE-863) in Elasticsearch can allow an authenticated user with limited index privileges to exploit i... | |
| CVE-2026-55084 json | DHIS2 is a flexible information system for data capture, management, validation, analytics and visualization. A SQL injection... | |
| CVE-2026-50759 json | An issue in exo-explore exo 1.0.69 allows a remote attacker to escalate privileges via the GET /state and DELETE /instance/{i... | |
| CVE-2026-50758 json | Cross Site Scripting vulnerability in DayuanJiang next-ai-draw-io 0.4.13 allows a remote attacker to execute arbitrary code v... | |
| CVE-2026-50757 json | Directory Traversal vulnerability in DayuanJiang next-ai-draw-io 0.4.13 allowsa remote attacker to execute arbitrary code via... | |
| CVE-2026-50756 json | An issue in DayuanJiang next-ai-draw-io 0.4.13 allows a remote attacker to obtain sensitive information via the x-ai-provider... | |
| CVE-2026-50755 json | An issue in DayuanJiang next-ai-draw-io 0.4.13 allows a remote attacker to obtain sensitive information via the X-Forwarded-F... | |
| CVE-2026-49092 json | Unintended Proxy or Intermediary ('Confused Deputy') (CWE-441) in Kibana can lead to unauthorized information exposure via Ac... | |
| CVE-2026-47671 json | Nhost is an open source Firebase alternative with GraphQL. In versions of Nhost CLI prior to 1.46.0, the hidden `nhost config... | |
| CVE-2026-47667 json | CImg Library is a C++ library for image processing. Prior to version 4.0.0 in `_load_analyze()`, the header_size field is rea... | |
| CVE-2026-46600 json | Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer. | |
| CVE-2026-46403 json | Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.17, KVM exposes `ExecuteReadOnlyWithTypedA... | |
| CVE-2026-42397 json | Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Alloca... | |
| CVE-2026-30632 json | Directory traversal vulnerability in knowns-dev/knowns 0.11.4 via crafted folder name value to the create_doc tool. | |
| CVE-2026-15957 json | Smithy-RS is a Rust code generation and runtime framework that generates HTTP clients and servers from Smithy interface defin... | |
| CVE-2026-12547 json | SoupAuthManager caches proxy authentication credentials without scoping them to the proxy authority (host:port). When the pro... | |
| CVE-2026-61901 json | The Joomla extension Hikashop is vulnerable to an open redirect. | |
| CVE-2026-56173 json | Use after free in Windows WebView allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-56171 json | Exposure of private personal information to an unauthorized actor in Windows RDP allows an unauthorized attacker to disclose ... | |
| CVE-2026-35149 json | HCL DFXServer is affected by an Authentication Bypass vulnerability via server response manipulation. An unauthorized user wi... | |
| CVE-2026-35148 json | HCL DFXServer is affected by a Missing Access Control vulnerability. This vulnerability states that certain endpoints are acc... | |
| CVE-2026-35147 json | HCL DFXServer is affected by a Broken Authentication vulnerability via direct API access. The application fails to verify the... | |
| CVE-2026-35146 json | HCL DFXServer is affected by an Unencrypted Communication vulnerability. The application permits users to establish connectio... | |
| CVE-2026-16412 json | Memory safety bugs present in Firefox ESR 140.12 and Firefox 152. Some of these bugs showed evidence of memory corruption and... | |
| CVE-2026-16411 json | Memory safety bugs present in Firefox 152. Some of these bugs showed evidence of memory corruption and we presume that with e... | |
| CVE-2026-16408 json | Integer overflow in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 153. | |
| CVE-2026-16406 json | Mitigation bypass in the Networking component. This vulnerability was fixed in Firefox 153. | |
| CVE-2026-16405 json | Information disclosure in the Networking: WebSockets component. This vulnerability was fixed in Firefox 153 and Firefox ESR 1... | |
| CVE-2026-16397 json | Clickjacking issue in the WebExtensions component in Firefox for Android. This vulnerability was fixed in Firefox 153. | |
| CVE-2026-16395 json | Integer overflow in the Audio/Video component. This vulnerability was fixed in Firefox 153. | |
| CVE-2026-16394 json | Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 153. | |
| CVE-2026-16359 json | Incorrect boundary conditions in the Audio/Video: GMP component. This vulnerability was fixed in Firefox 153, Firefox ESR 115... | |
| CVE-2026-58411 json | ChurchCRM is an open-source church management system. Prior to version 7.4.0, Cross-Site Scripting (XSS) vulnerabilities were... | |
| CVE-2026-56168 json | Null pointer dereference in Windows SMB Server allows an authorized attacker to deny service over a network. | |
| CVE-2026-56159 json | Heap-based buffer overflow in Windows DHCP Server allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-54128 json | Use after free in Windows DHCP Client allows an unauthorized attacker to execute code locally. | |
| CVE-2026-54126 json | Out-of-bounds read in Windows RDP allows an unauthorized attacker to disclose information over a network. | |
| CVE-2026-44697 json | Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.17, a remote, unauthenticated denial-of-se... | |
| CVE-2026-1995 json | In versions before 7.0.0.64, IDrive’s id_service.exe process runs with elevated privileges and regularly reads from several... | |
| CVE-2026-62228 json | OpenClaw before 2026.6.5 contain an authorization bypass vulnerability in node exec approvals that allows lower-trust callers... | |
| CVE-2026-62227 json | OpenClaw 2026.4.14 before 2026.5.26 contain a server-side request forgery vulnerability in browser snapshot routes that fail ... | |
| CVE-2026-62226 json | OpenClaw 2026.3.28 before 2026.5.19 contain an authorization bypass vulnerability in the browser act route that fails to prop... | |
| CVE-2026-62221 json | OpenClaw 2026.5.12 before 2026.5.26 contain an incorrect authorization vulnerability in the ClickClack allowFrom feature. Whe... | |
| CVE-2026-62220 json | OpenClaw 2026.2.25 before 2026.5.26 allow a lower-trust caller or configured input path to bypass non-browser rate limits on ... | |
| CVE-2026-62219 json | OpenClaw 2026.2.12 before 2026.5.26 contain an authorization bypass vulnerability in the hooks allowedAgentIds validation. A ... | |
| CVE-2026-62218 json | OpenClaw 2026.1.20 before 2026.5.27 contain an authorization bypass vulnerability in the device.pair.approve feature that all... | |
| CVE-2026-62217 json | OpenClaw 2026.5.14-beta.1 before 2026.5.27 contain an authorization flaw in the QQBot exec approvals feature. When the featur... | |
| CVE-2026-62216 json | OpenClaw 2026.4.20 before 2026.5.28 contain a policy bypass in the QQBot media upload feature. A lower-trust caller or config... | |
| CVE-2026-62209 json | OpenClaw versions 2026.5.10-beta.1 before 2026.6.5 contain an authorization bypass in the ClickClack agent-mode dispatch feat... | |
| CVE-2026-62205 json | OpenClaw versions 2026.4.12-beta.1 before 2026.6.6 contain a missing-authorization vulnerability in the MS Teams message acti... | |
| CVE-2026-62202 json | OpenClaw versions 2026.6.1 before 2026.6.9 contain a privilege escalation vulnerability in isolated cron jobs that allows low... | |
| CVE-2026-54125 json | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Runtime allows an auth... | |
| CVE-2026-54124 json | Integer overflow or wraparound in Windows Terminal allows an unauthorized attacker to execute code locally. | |
| CVE-2026-54121 json | Improper authorization in Active Directory Certificate Services (AD CS) allows an authorized attacker to elevate privileges o... | |
| CVE-2026-54115 json | Integer overflow or wraparound in Windows Active Directory allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-50692 json | Heap-based buffer overflow in Desktop Window Manager allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-50690 json | Use of uninitialized resource in Windows SMB allows an authorized attacker to disclose information locally. | |
| CVE-2026-50689 json | Use after free in Windows Clipboard Server allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-50686 json | Access of resource using incompatible type ('type confusion') in Windows OLE allows an unauthorized attacker to execute code ... | |
| CVE-2026-50685 json | Double free in Windows DHCP Server allows an authorized attacker to execute code over a network. | |
| CVE-2026-50684 json | Improper neutralization of input during web page generation ('cross-site scripting') in Active Directory Federation Services ... | |
| CVE-2026-50683 json | Heap-based buffer overflow in Windows DHCP Server allows an authorized attacker to elevate privileges over an adjacent networ... | |
| CVE-2026-50682 json | Out-of-bounds read in Windows Active Directory allows an authorized attacker to deny service over a network. | |
| CVE-2026-55082 json | DHIS2 is a flexible information system for data capture, management, validation, analytics and visualization. DHIS2 SQL View ... | |
| CVE-2026-58484 json | Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.12.2, `EnvironmentManager.listBackups()` read... | |
| CVE-2026-58482 json | Network-AI, a TypeScript/Node.js multi-agent orchestrator, has a shipped, exported, documented feature called `ApprovalInbox`... | |
| CVE-2026-58481 json | Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.12.2, `AgentRuntime` promises scoped file acc... | |
| CVE-2026-58414 json | Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.12.2, `EnvironmentManager.backup()` recursive... | |
| CVE-2026-58413 json | Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.12.2, `EnvironmentManager.restore(env, backup... | |
| CVE-2026-56582 json | HCL MyCloud was affected by the SSL/TLS LUCKY13 Vulnerability. An attacker may exploit this vulnerability to decrypt sensitiv... | |
| CVE-2026-56581 json | HCL MyCloud was affected with Cookie Attribute Path Not Set. It may increase the risk of unauthorized access to session data ... | |
| CVE-2026-56579 json | HCL MyCloud was affected with License Key Revealed in HTTP Response. It may enable attackers to misuse the exposed informatio... | |
| CVE-2026-56578 json | HCL MyCloud was affected by Server Version Disclosure. It may help attackers identify and exploit known vulnerabilities affec... | |
| CVE-2026-55639 json | xrdp is an open source RDP server. Versions 0.10.6 and prior contain a vulnerability concerning the parsing of Client Securit... |