CVE.report
CVE.report is the most up-to-date database of common vulnerabilities and exposures. Information is pulled in from several sources and processed in to a mobile friendly, easy to use page. Use the site to quickly check for vulnerabilities in products such as operating systems, applications, hardware, networks, databases, browsers, e-mail clients and more.
CVEs provide a unique and common naming scheme for publicly known cyber security vulnerabilities in order to quickly identify and share these vulnerabilities. You can use the search below to look for vulnerabilities based on product, vendor, or common tags
The form you will see after following this link allows you to fill out the various variables in the CVSS scoring system and receive the corresponding score. The description of each of the variables is also included for additional information.
cve.report now provides a free read-only JSON API for CVE details. Each record combines the CVE Program JSON record, NVD enrichment, KEV, and EPSS when available.
Recent CVEs
| CVE | Description | Updated |
|---|---|---|
| CVE-2026-129525 json | Several endpoints that work on both issues and pull requests did not check which of the two the addressed item is. A user who... | |
| CVE-2026-129341 json | The web endpoint that removes an attachment skipped the permission check when the request came from the user who had uploaded... | |
| CVE-2026-129337 json | Git over HTTP lowers the required permission for pushes to read access, so that the AGit flow works, and relies on the reposi... | |
| CVE-2026-128365 json | Removing a team's review request looked up a review by the negated team ID, which for the team with ID 2 is the ID of the bui... | |
| CVE-2026-128359 json | When Gitea acts as an OAuth2 or OpenID Connect provider, the token endpoint did not check the state of the user. After an adm... | |
| CVE-2026-127958 json | A pull request review created through the API as a draft (`event` set to `PENDING` or left empty) was added to the pull reque... | |
| CVE-2026-126338 json | Replying to a code review comment accepted a review ID that belongs to a different pull request, through the web form, the AP... | |
| CVE-2026-125617 json | `GET /api/v1/users/{username}/orgs/{org}/permissions` only checked that the organization is visible to the caller and then re... | |
| CVE-2026-123642 json | The AGit flow (pushing to `refs/for/...`) did not check the pusher's access to pull requests again when it created the pull r... | |
| CVE-2026-123638 json | The "Protected file patterns" setting of a branch protection rule was checked against file names as git prints them, and git ... | |
| CVE-2026-123065 json | When a release was edited, the files of the attachments to remove were deleted by the identifiers submitted in the form rathe... | |
| CVE-2026-123009 json | When a file is edited in a fork through the web editor, Gitea can first copy a branch from the base repository into the fork.... | |
| CVE-2026-123002 json | Gitea accepted an unlimited number of wrong TOTP passcodes during sign-in, in the password reset flow and for Basic authentic... | |
| CVE-2026-120991 json | When a container blob upload was rejected, for example because it exceeded a package size quota, the cleanup removed the blob... | |
| CVE-2026-120729 json | The popup shown when hovering an issue reference loaded its data from the path of the hovered link and inserted part of the r... | |
| CVE-2026-120725 json | With `REQUIRE_SIGNIN_VIEW = true`, the Git LFS endpoints still answered unauthenticated requests for repositories that are no... | |
| CVE-2026-118535 json | A repository registered by its owner as a source of scoped workflows kept that registration when it was transferred to anothe... | |
| CVE-2026-118389 json | The RubyGems package registry accepted gems whose platform, dependency names or dependency version requirements contain newli... | |
| CVE-2026-71531 json | PrestaShop before 8.2.9 and 9.2.1 contains an authorization flaw in the Webservice API that allows an attacker holding a key ... | |
| CVE-2026-71519 json | PrestaShop before 8.2.9 and 9.2.1 contains a broken access control vulnerability that allows an authenticated Webservice API ... | |
| CVE-2026-125423 json | A repository created with auto-init accepted pushes before its initialization had finished, and the initial commit was built ... | |
| CVE-2026-123006 json | The repository search used by the dashboard (`GET /repo/search`) returned the internal commit status object of each repositor... | |
| CVE-2026-129091 json | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mika... | |
| CVE-2026-125830 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Belingo belingoGeo beli... | |
| CVE-2026-125826 json | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Blubrry Podcasting PowerPress... | |
| CVE-2026-125823 json | Allocation of Resources Without Limits or Throttling vulnerability in Jegstudio Gutenverse gutenverse allows HTTP DoS.This is... | |
| CVE-2026-125822 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nickboss WordPress File... | |
| CVE-2026-125818 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AdvancedCoding wpDiscuz... | |
| CVE-2026-125817 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeisle Feedzy feedzy... | |
| CVE-2026-125804 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Meow Apps AI Engine ai-... | |
| CVE-2026-125798 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Zaytech Smart Online Or... | |
| CVE-2026-125796 json | Missing Authorization vulnerability in Ahmad JS Help Desk js-support-ticket allows Exploiting Incorrectly Configured Access C... | |
| CVE-2026-125760 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bit Apps Bit Assist bit... | |
| CVE-2026-123962 json | In FreedomBox before 26.15, unprivileged user accounts can read/write files for which they lack permissions by setting the au... | |
| CVE-2026-73186 json | Deserialization of Untrusted Data vulnerability in ShortPixel Enable Media Replace enable-media-replace allows Object Injecti... | |
| CVE-2026-57739 json | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Datasolution AcyMailing... | |
| CVE-2026-129456 json | In FRRouting, bgpd frees the sub-TLV chain of a Tunnel Encapsulation attribute (type 23) while routes stored by bgpd still po... | |
| CVE-2026-129490 json | littlefs through 2.11.3, when built with LFS_MIGRATE, contains a type confusion vulnerability in lfs_dir_traverse() that trea... | |
| CVE-2026-129485 json | Kroki before 0.36.0 contains a server-side request forgery vulnerability in the BlockDiag family of engines that allows unaut... | |
| CVE-2026-129484 json | Kroki before 0.36.0 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject s... | |
| CVE-2025-71470 json | MicroQuickJS (mquickjs) before commit 99eed3f contains an out-of-bounds read vulnerability because JS_Call() raises exception... | |
| CVE-2025-71469 json | GPAC before 26.02.0 contains a type confusion vulnerability in ctxload_process() that passes non-object descriptors to ODS_Se... | |
| CVE-2025-71468 json | GPAC before 26.02.0 contains a NULL pointer dereference vulnerability in gf_dash_group_get_audio_channels() in src/media_tool... | |
| CVE-2025-71467 json | GPAC before 26.02.0 contains a NULL pointer dereference vulnerability in gf_node_get_field_by_name() in src/scenegraph/base_s... | |
| CVE-2025-71466 json | GPAC before 26.02.0 contains a NULL pointer dereference vulnerability in m2tsdmx_update_sdt() in src/filters/dmx_m2ts.c that ... | |
| CVE-2026-128893 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Marcin Wise Chat wise-c... | |
| CVE-2026-125799 json | Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in Looks Awesome Flow-Flow Soci... | |
| CVE-2026-125795 json | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Esta... | |
| CVE-2026-125793 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in flexmls Flexmls® IDX f... | |
| CVE-2026-125771 json | Incorrect Privilege Assignment vulnerability in AtlasAiDev MCP Server for WordPress ai-workflow-automation-ai-agent-hub allow... | |
| CVE-2026-125765 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ShortPixel ShortPixel A... | |
| CVE-2026-125733 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DevItems ShopLentor woo... | |
| CVE-2026-125447 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kaliforms Kali Forms ka... | |
| CVE-2026-129483 json | Cyrus SASL through 2.1.28 contains an authentication bypass vulnerability in the SRP server mechanism because srp_server_mech... | |
| CVE-2026-129482 json | OkHttp through 5.5.1 contains an improper certificate validation vulnerability in CertificatePinner that skips pin checks bec... | |
| CVE-2026-129480 json | Assimp through 6.0.6 contains a heap out-of-bounds read vulnerability in MD2Importer::InternReadFile that allows attackers to... | |
| CVE-2026-129479 json | Assimp through 6.0.6 contains an integer overflow vulnerability in OgreBinarySerializer::ReadSubMesh that allows attackers to... | |
| CVE-2026-129478 json | Assimp through 6.0.6 contains a heap out-of-bounds read vulnerability in glTFCommon::Util::ParseDataURI caused by storing the... | |
| CVE-2026-129477 json | Assimp through 6.0.6 contains a path traversal vulnerability in the glTF and glTF2 importers that allows attackers to read lo... | |
| CVE-2026-129453 json | A vulnerability was found in DrayTek Vigor2960 1.5.1.6. This issue affects the function check_file_exist of the file /cgi-bin... | |
| CVE-2026-125857 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sarah Giles Dynamic Use... | |
| CVE-2026-125832 json | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Passionate Programmer P... | |
| CVE-2026-125828 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP ... | |
| CVE-2026-125813 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ays Pro Survey Maker su... | |
| CVE-2026-125805 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AyeCode Ltd GeoDirector... | |
| CVE-2026-125791 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in iWorks Orphans sierotki... | |
| CVE-2026-125790 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikBooking Hot... | |
| CVE-2026-125789 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikBooking Hot... | |
| CVE-2026-125780 json | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Acowebs Woocommerce Custom Pr... | |
| CVE-2026-125775 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CRM Perks CRM Perks For... | |
| CVE-2026-125769 json | Incorrect Privilege Assignment vulnerability in Nasir Ahmed Advanced Form Integration advanced-form-integration allows Privil... | |
| CVE-2026-125764 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in E2Pdf.com e2pdf e2pdf a... | |
| CVE-2026-125449 json | Deserialization of Untrusted Data vulnerability in Mamunur Rashid Testimonial Slider testimonial-slider-and-showcase allows O... | |
| CVE-2026-125443 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Denishua WPJAM Basic wp... | |
| CVE-2026-124995 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Michal Jaworski Track, ... | |
| CVE-2026-124755 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Justin Kruit Advanced C... | |
| CVE-2026-124561 json | A vulnerability was determined in D-Link DIR-878 1.20B05. This impacts the function SetVLANSettings of the file prog.cgi of t... | |
| CVE-2026-124560 json | A vulnerability was found in D-Link DIR-878 1.20B05. This affects the function GetCAPTCHAsetting of the file bin/prog.cgi of ... | |
| CVE-2026-124270 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Basix NEX-Forms nex-for... | |
| CVE-2026-124259 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Franky Events Made Easy... | |
| CVE-2026-124254 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Exactly WWW LLC EWWW Im... | |
| CVE-2026-122662 json | Deserialization of Untrusted Data vulnerability in Barn2 Plugins Document Library Pro document-library-pro allows Object Inje... | |
| CVE-2026-129469 json | Course-tencent-cloud before 2.0.2 contains an insecure direct object reference vulnerability that allows unauthenticated atta... | |
| CVE-2026-129468 json | Netcccyun dnsmgr 2.18 before 2.22 contains a missing authorization vulnerability in POST /cloudflare/get_domain_default_line ... | |
| CVE-2026-129467 json | GeoPulse 1.5.0 through 2.3.0 contains an insecure direct object reference vulnerability in GET /api/v1/places/geocoding/{id} ... | |
| CVE-2026-129452 json | A vulnerability has been found in DrayTek Vigor2960 1.5.1.6. This vulnerability affects the function set_table of the file /c... | |
| CVE-2026-129451 json | A flaw has been found in DrayTek Vigor2960 up to 1.5.1.6. This affects the function app_guest_export of the file /cgi-bin/mai... | |
| CVE-2026-129450 json | A vulnerability was detected in DrayTek Vigor2960 1.5.1.6. Affected by this issue is the function sub_1E084 of the file /cgi-... | |
| CVE-2026-129449 json | A security vulnerability has been detected in DrayTek Vigor2960 up to 1.5.1.6. Affected by this vulnerability is the function... | |
| CVE-2026-129445 json | A security flaw has been discovered in D-Link DIR-850L FW1.20WWb03. This impacts an unknown function of the file /usr/sbin/co... | |
| CVE-2026-129349 json | When authentication caching is enabled on DefaultLdapRealm, after a user logs in successfully once, subsequent logins for tha... | |
| CVE-2026-82663 json | The Give - Peer-to-Peer plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.9.... | |
| CVE-2026-82568 json | The Give - Peer-to-Peer plugin for WordPress is vulnerable to time-based SQL Injection via the 'sort' parameter in all versio... | |
| CVE-2026-129444 json | A vulnerability was identified in D-Link DSL-6740C 20131126. This affects an unknown function of the file /etc/templates/ftpd... | |
| CVE-2026-129443 json | A vulnerability was determined in itsourcecode Airline Reservation System 1.0. The impacted element is an unknown function of... | |
| CVE-2026-124684 json | A use-after-free vulnerability exists in Samsung Escargot 5.0.2 in the buffer-access paths for ReloadableString and Compressi... | |
| CVE-2026-127048 json | The Custom Block Builder WordPress plugin before 3.0.0 does not properly deny unauthorised requests to its REST routes, as i... | |
| CVE-2026-124673 json | The Burst Statistics WordPress plugin before 3.7.5 does not check that a reported page view belongs to published content, no... | |
| CVE-2026-124671 json | The Burst Statistics WordPress plugin before 3.7.5 does not enforce a shared report's date range on the analytics it serves ... | |
| CVE-2026-123707 json | The WPGraphQL WordPress plugin before 2.27.1 does not restrict access to posts in custom non-public post statuses, allowing u... |