CVE.report
CVE.report is the most up-to-date database of common vulnerabilities and exposures. Information is pulled in from several sources and processed in to a mobile friendly, easy to use page. Use the site to quickly check for vulnerabilities in products such as operating systems, applications, hardware, networks, databases, browsers, e-mail clients and more.
CVEs provide a unique and common naming scheme for publicly known cyber security vulnerabilities in order to quickly identify and share these vulnerabilities. You can use the search below to look for vulnerabilities based on product, vendor, or common tags
The form you will see after following this link allows you to fill out the various variables in the CVSS scoring system and receive the corresponding score. The description of each of the variables is also included for additional information.
cve.report now provides a free read-only JSON API for CVE details. Each record combines the CVE Program JSON record, NVD enrichment, KEV, and EPSS when available.
Recent CVEs
| CVE | Description | Updated |
|---|---|---|
| CVE-2026-62126 json | Allocation of Resources Without Limits or Throttling vulnerability in miniOrange SAML SP Single Sign On miniorange-saml-20-si... | |
| CVE-2026-62007 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unlimited Elements Unli... | |
| CVE-2026-57775 json | Authentication Bypass Using an Alternate Path or Channel vulnerability in RelyWP Simple Cloudflare Turnstile simple-cloudflar... | |
| CVE-2026-57666 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aguila Technologies WP ... | |
| CVE-2026-119477 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jacob N. Breetvelt WP P... | |
| CVE-2026-119366 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AdvancedCoding wpDiscuz... | |
| CVE-2026-110944 json | Resource exhaustion vulnerability in the HTTP request handling of the QHttpServer component of Qt HTTP Server. | |
| CVE-2026-57639 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Roland Murg WP Booking ... | |
| CVE-2026-56065 json | Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in Doofinder Doofinder for WooC... | |
| CVE-2026-54861 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aguila Technologies WP ... | |
| CVE-2026-121818 json | Herowatch Mini developed by About Time Technologies has a system signing vulnerability. Authenticated local attackers can exp... | |
| CVE-2026-121817 json | Herowatch Go Server developed by About Time Technologies has a Insecure Direct Object Reference vulnerability. Authenticated ... | |
| CVE-2026-121816 json | Herowatch Mini developed by About Time Technologies has a Missing Authentication vulnerability. Unauthenticated remote attack... | |
| CVE-2026-62000 json | Missing Authorization vulnerability in WC Lovers WCFM Marketplace wc-multivendor-marketplace allows Exploiting Incorrectly Co... | |
| CVE-2026-54851 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Awesomemotive Contact F... | |
| CVE-2024-33605 json | Improper processing of some parameters of installed_emanual_list.html and installed_emanual_down.html leads to a path travers... | |
| CVE-2026-87044 json | The Mbed TLS crypto shim driver in drivers/crypto/crypto_mbedtls_shim.c drives PSA multipart cipher and AEAD operations. In m... | |
| CVE-2026-118983 json | The VikWidgetsLoader WordPress plugin before 1.12.3 does not sanitise or escape several block attributes before outputting t... | |
| CVE-2026-118783 json | The All-in-One Video Gallery WordPress plugin before 5.0.0 does not validate and escape some of its shortcode attributes bef... | |
| CVE-2026-118637 json | The Simple Download Monitor WordPress plugin before 4.1.3 does not properly check the visibility of the content referenced by... | |
| CVE-2026-118523 json | The EventPrime WordPress plugin before 4.3.6.1 does not keep the built-in Pending Review post status non-public, allowing un... | |
| CVE-2026-118422 json | The Stape Conversion Tracking WordPress plugin before 2.3.11 does not validate the sub-path appended to its same-origin proxy... | |
| CVE-2026-118407 json | The Premium Packages WordPress plugin before 7.3.1 does not verify that a user claiming a guest order is the original buyer,... | |
| CVE-2026-118404 json | The Premium Packages WordPress plugin before 7.3.1 does not verify ownership or session binding when loading a previously sa... | |
| CVE-2026-87043 json | The entropy-device random number generator in subsys/random/random_entropy_device.c returned early with -ENODEV from rand_get... | |
| CVE-2026-87041 json | The RTIO submission-queue verifier rtio_vrfy_sqe() in subsys/rtio/rtio_syscalls.c (subsys/rtio/rtio_handlers.c before v4.3.0)... | |
| CVE-2026-87040 json | The nRF link-layer receive paths of the open-source Bluetooth LE Controller did not validate the on-air LENGTH field of a rec... | |
| CVE-2026-87039 json | The user-mode syscall verifier z_vrfy_i2s_configure() in drivers/i2s/i2s_handlers.c copies the caller's struct i2s_config in ... | |
| CVE-2026-87038 json | The user-mode verification handler for the i3c_transfer() system call, z_vrfy_i3c_transfer() in drivers/i3c/i3c_handlers.c, v... | |
| CVE-2026-85036 json | The Bluetooth Classic AVDTP layer defers releasing a session's stream endpoints: bt_avdtp_l2cap_disconnected() in subsys/blue... | |
| CVE-2026-77779 json | ManageEngine Key Manager Plus versions before 7151 were vulnerable to an Improper Access Control vulnerability that allowed a... | |
| CVE-2026-77690 json | ZohoCorp ManageEngine Key Manager Plus versions before 7151 were vulnerable to a Command Injection vulnerability that allowed... | |
| CVE-2026-16511 json | Two RTIO syscall verifiers, in subsys/rtio/rtio_syscalls.c (subsys/rtio/rtio_handlers.c before v4.3.0), did not validate user... | |
| CVE-2026-11753 json | A vulnerability has been identified in armeria-saml versions prior to 1.41.1, where attacker-controlled RelayState is reflect... | |
| CVE-2026-11749 json | A vulnerability has been identified in armeria-saml prior to 1.41.1, where bearer assertions are not enforced for one-time us... | |
| CVE-2026-118403 json | The Premium Packages WordPress plugin before 7.3.1 does not verify that the requester owns a guest order before returning it... | |
| CVE-2026-115426 json | The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.138 does not properly validate a backup storage direc... | |
| CVE-2026-115262 json | The Duplicator WordPress plugin before 5.1.0, duplicator-pro WordPress plugin before 5.1.0 does not restrict its database ch... | |
| CVE-2026-115257 json | The WP Roster WordPress plugin before 2.36 does not perform any capability or nonce checks before writing its stored roster d... | |
| CVE-2026-115250 json | The Text Typing WordPress plugin before 2.2.2 does not properly sanitize and escape a block attribute before storing it and ... | |
| CVE-2026-115243 json | The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137 does not validate the extension of the file it ac... | |
| CVE-2026-115242 json | The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137 does not sanitize the staging destination folder ... | |
| CVE-2026-115241 json | The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137 does not verify that a submitted snapshot identif... | |
| CVE-2026-114431 json | The Enable Media Replace WordPress plugin before 4.2.3 does not pass a replaced media file through the WordPress upload pipel... | |
| CVE-2026-112244 json | The Duplicator WordPress plugin before 5.1.0, duplicator-pro WordPress plugin before 5.1.0 does not prevent direct access to... | |
| CVE-2026-112243 json | The Duplicator WordPress plugin before 5.1.0, duplicator-pro WordPress plugin before 5.1.0 does not sanitise and escape a pa... | |
| CVE-2026-111962 json | The WP Remote Users Sync WordPress plugin before 2.2.0 does not adequately restrict access to the user export files it writes... | |
| CVE-2026-111740 json | The Post Duplicator WordPress plugin before 3.0.17 does not check whether the requesting user may view each post before retur... | |
| CVE-2026-110964 json | The Essential Real Estate WordPress plugin before 5.3.5 does not verify that a media attachment belongs to the requesting use... | |
| CVE-2026-110692 json | The PowerPack Addons for Elementor: Widgets, Form Styler and Templates WordPress plugin before 3.1.3 does not validate a user... | |
| CVE-2026-108068 json | The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not perform proper authorization checks on one of its... | |
| CVE-2026-108067 json | The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not properly verify record ownership before modifying... | |
| CVE-2026-108041 json | The SEOPress WordPress plugin before 10.4 does not sanitise and escape some of its analytics tracking settings before output... | |
| CVE-2026-106649 json | The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.29 does not prevent users with author-lev... | |
| CVE-2026-106000 json | The Booking Package WordPress plugin before 1.7.34 does not require payment to be completed before saving a booking on calend... | |
| CVE-2026-105413 json | The Form Maker by 10Web WordPress plugin before 1.15.51 does not consistently escape user-submitted field values before rend... | |
| CVE-2026-105191 json | The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce WordPress plugin before 1.17.11 does not perform a capabil... | |
| CVE-2026-115455 json | A flaw was found in GCC libstdc++. When an application extracts data into a bitset from a wide-character stream, internal sta... | |
| CVE-2026-114406 json | The system certificate authority (CA) store in Red Hat products, distributed via ca-certificates RPM packages, included multi... | |
| CVE-2026-104719 json | The CookieYes WordPress plugin before 3.5.8 does not correctly restrict who can write its cookie-category script fields, and... | |
| CVE-2026-101166 json | The Mollie Payments for WooCommerce WordPress plugin before 8.2.0 does not verify a product's publication status before creat... | |
| CVE-2026-101165 json | The Mollie Payments for WooCommerce WordPress plugin before 8.2.0 does not verify an order's payment state or the requested p... | |
| CVE-2026-96889 json | A flaw was found in librsvg. When processing an SVG document containing nested XML inclusions (Xincludes) with duplicate enti... | |
| CVE-2026-92615 json | A flaw was found in flightctl. The configureRepoHTTPSClient() function in the device-render worker builds a per-repository tl... | |
| CVE-2026-74860 json | A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this vulnerability by providing a s... | |
| CVE-2026-54099 json | A flaw was found in the Windows Machine Config Operator (WMCO) for Red Hat OpenShift Container Platform. The WICD CSR auto-ap... | |
| CVE-2026-42784 json | A flaw was found in sequoia-openpgp. The library incorrectly infers key flags for older certificates when a key flags subpack... | |
| CVE-2026-2625 json | A flaw was found in rust-rpm-sequoia. An attacker can exploit this vulnerability by providing a specially crafted Red Hat Pac... | |
| CVE-2025-13327 json | A flaw was found in uv. This vulnerability allows an attacker to execute malicious code during package resolution or installa... | |
| CVE-2025-11229 json | The system fails to properly enforce scope authorization when the `authorize_all_scopes` configuration is enabled. This allow... | |
| CVE-2026-121803 json | Rejected reason: This CVE ID is a duplicate of CVE-2026-80335 (VULN-002 dl_download_midst) and has been rejected. | |
| CVE-2026-121247 json | Buffer overflow in Dawn in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execut... | |
| CVE-2026-121246 json | Use after free in WebGL in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execut... | |
| CVE-2026-121233 json | Type confusion in CacheStorage in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code in... | |
| CVE-2026-121229 json | Memory corruption in ANGLE in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially exe... | |
| CVE-2026-121228 json | Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the s... | |
| CVE-2026-121203 json | Use after free in Geometry in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside... | |
| CVE-2026-121188 json | Use after free in PerformanceAPIs in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code... | |
| CVE-2026-121185 json | Use after free in PictureInPicture in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engine... | |
| CVE-2026-121181 json | Use after free in Editing in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside ... | |
| CVE-2026-121180 json | Buffer overflow in Media in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside t... | |
| CVE-2026-121179 json | Use after free in PDFium in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside t... | |
| CVE-2026-121178 json | Use after free in Aura in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer pro... | |
| CVE-2026-121166 json | Type confusion in PDFium in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside t... | |
| CVE-2026-121156 json | Buffer overflow in Dawn in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary co... | |
| CVE-2026-105296 json | Multiple Akeeba products lack the anti-CSRF check on some actions. If the user access a malicious page while logged into the ... | |
| CVE-2026-121148 json | Use after free in ANGLE in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside t... | |
| CVE-2026-121140 json | Out of bounds read in Internals in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the ren... | |
| CVE-2026-121131 json | Use after free in Mobile in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to e... | |
| CVE-2026-121126 json | Use after free in Core in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary cod... | |
| CVE-2026-121124 json | Improper adherence to coding standards in XML in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentiall... | |
| CVE-2026-121118 json | Use after free in SVG in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the ... | |
| CVE-2026-121112 json | Out of bounds read in Permissions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the r... | |
| CVE-2026-121100 json | Use after free in DOM in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the ... | |
| CVE-2026-121098 json | Improper state validation in GPU in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the re... | |
| CVE-2026-121089 json | Use after free in WebGPU in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary c... | |
| CVE-2026-121083 json | Use after free in Compositing in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code ins... | |
| CVE-2026-121082 json | Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the s... | |
| CVE-2026-121080 json | Use after free in Codecs in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to read memory inside the sandbox ... | |
| CVE-2026-121074 json | Memory corruption in GPU in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execu... |