CVE.report
CVE.report is the most up-to-date database of common vulnerabilities and exposures. Information is pulled in from several sources and processed in to a mobile friendly, easy to use page. Use the site to quickly check for vulnerabilities in products such as operating systems, applications, hardware, networks, databases, browsers, e-mail clients and more.
CVEs provide a unique and common naming scheme for publicly known cyber security vulnerabilities in order to quickly identify and share these vulnerabilities. You can use the search below to look for vulnerabilities based on product, vendor, or common tags
The form you will see after following this link allows you to fill out the various variables in the CVSS scoring system and receive the corresponding score. The description of each of the variables is also included for additional information.
cve.report now provides a free read-only JSON API for CVE details. Each record combines the CVE Program JSON record, NVD enrichment, KEV, and EPSS when available.
Recent CVEs
| CVE | Description | Updated |
|---|---|---|
| CVE-2026-91285 json | Vulnerability in the JD Edwards EnterpriseOne Orchestrator product of Oracle JD Edwards (component: E1 IOT Orchestrator Secur... | |
| CVE-2026-91277 json | Vulnerability in the JD Edwards EnterpriseOne Orchestrator product of Oracle JD Edwards (component: E1 IOT Orchestrator Secur... | |
| CVE-2026-91276 json | Vulnerability in the JD Edwards EnterpriseOne Orchestrator product of Oracle JD Edwards (component: E1 IOT Orchestrator Secur... | |
| CVE-2026-120656 json | OpenKruise kruise-manager exposes an unauthenticated ppof endpoint when enabled, opening it on 0.0.0.0:8090, which can enable... | |
| CVE-2026-120497 json | Stored cross-site scripting (XSS) in the HTML report generator in the aidlc-traceability CLI in AWS AI-DLC Workflows before 2... | |
| CVE-2026-120067 json | For updatable cursors, which are enabled by default, psqlODBC adds hidden ctid and, for tables with OIDs, oid columns to the ... | |
| CVE-2026-120066 json | On Unix-like systems, when logging is enabled, psqlODBC creates its log files in /tmp by default, named from the program name... | |
| CVE-2026-120065 json | For an updatable cursor over a table without OIDs that has an auto-increment int4 column, psqlODBC uses that column to identi... | |
| CVE-2026-120064 json | Several psqlODBC entry points use an application-supplied column number or row index as an array index without validating it.... | |
| CVE-2026-120063 json | When psqlODBC quotes a schema or table name into a 128-byte stack buffer, its length check lets it write up to two bytes past... | |
| CVE-2026-81938 json | Grafana Mimir's Alertmanager rejects tenant-supplied receiver configurations that reference local files, but the check did no... | |
| CVE-2026-120062 json | SQLSpecialColumns in psqlODBC splices the table and schema names it receives into its catalog query without escaping them, wh... | |
| CVE-2026-120061 json | The psqlODBC parser for ODBC escape sequences in application SQL text writes the argument offsets of a {fn} escape into a fix... | |
| CVE-2026-120060 json | psqlODBC trusts counts and lengths in server data in three places. SQLBulkOperations uses a server-supplied row count in a si... | |
| CVE-2026-120059 json | For an updatable cursor over a table without OIDs that has an auto-increment int4 column, psqlODBC places that column's name,... | |
| CVE-2026-120058 json | psqlODBC sizes its row cache from the column count of a cursor's first result, but recomputes the column count from each late... | |
| CVE-2026-120057 json | psqlODBC copies the reply to a large-object read (loread) into the application's buffer using the length sent by the server, ... | |
| CVE-2026-119736 json | Attendo (formerly Petpooja Payroll) Admin Android application version 3.0.13 and earlier contains a hard-coded credentials vu... | |
| CVE-2026-119735 json | Munshi (by Petpooja) before 2026-07-13 contained a stored cross-site scripting vulnerability that allows authenticated users ... | |
| CVE-2026-119734 json | Munshi (by Petpooja) before 2026-06-17 contained a broken object level authorization vulnerability that allows authenticated ... | |
| CVE-2026-119733 json | Munshi (by Petpooja) before 2026-07-07 contained a missing authorization vulnerability in its company deletion workflow at DE... | |
| CVE-2026-119732 json | Munshi (by Petpooja) before 2026-07-28 contained a broken object level authorization vulnerability that allows authenticated ... | |
| CVE-2026-119731 json | Munshi (by Petpooja) before 2026-06-30 contained a payment bypass vulnerability in its subscription payment webhook at POST /... | |
| CVE-2026-117127 json | Directory Traversal vulnerability in Gleez GleezCMS v.1.2.0 allows a remote attacker to obtain sensitive information via the ... | |
| CVE-2026-117069 json | An integer truncation vulnerability in the NAS decoder of OpenAirInterface (OAI) CN5G AMF v2.2.1 allows an unauthenticated re... | |
| CVE-2026-105606 json | Joomla Extension - joomlaboat.com - Unauthenticated arbitrary file upload in Custom Tables < 3.7.8 - An unauthenticated attac... | |
| CVE-2026-105605 json | Joomla Extension - dj-extensions.com - IDOR vulnerability allowing cross-account ad access in DJ-Classifieds < 3.11.3 - A “... | |
| CVE-2026-105604 json | Joomla Extension - dj-extensions.com - Unauthenticated SQL injection in DJ-Classifieds < 3.11.3 - The Joomla extension DJ-Cla... | |
| CVE-2026-105603 json | Joomla Extension - dj-extensions.com - Authenticated arbitrary file upload in DJ-Classifieds < 3.11.3 - The Joomla extension ... | |
| CVE-2026-120627 json | The Private Internet Access Extension for Firefox contains an unguarded onAuthRequired authentication handler, leading to lea... | |
| CVE-2026-120596 json | A remotely exploitable denial-of-service vulnerability exists in the TCP options parser of the Nut/Net TCP/IP stack included ... | |
| CVE-2026-120416 json | A security vulnerability has been detected in AndyFactory newspaper4k up to 0.9.6. This affects the function Article.parse of... | |
| CVE-2026-119085 json | Improper neutralization of special elements used in a template engine in the publishing component of Amazon Virtual Engineeri... | |
| CVE-2026-117068 json | An integer underflow vulnerability in the NAS decoder of OpenAirInterface (OAI) CN5G AMF v2.2.1 allows an unauthenticated rem... | |
| CVE-2026-117067 json | An out-of-bounds memory access vulnerability in the N2 SCTP interface of OpenAirInterface (OAI) CN5G AMF v2.2.1 allows an una... | |
| CVE-2026-106808 json | OpenAirInterface Core Network v2.2.1 has a stack-based buffer overflow vulnerability in the OAI CN5G UDM Nudm_UEAU Generate A... | |
| CVE-2026-106806 json | A memory exhaustion issue exists in Open5GS v2.8.0 in the HTTP/2 SBI server. Repeated header names cause previously allocated... | |
| CVE-2026-65059 json | Furl versions through 3.15 for Perl allow memory exhaustion via unbounded decompression of HTTP responses. Furl inflates a r... | |
| CVE-2026-119301 json | Improper neutralization of quoting syntax in SQL identifier construction in the Apache Iceberg write component in AWS SDK for... | |
| CVE-2026-106807 json | A denial-of-service vulnerability exists in open5GS v2.8.0 in the PFCP transaction handling path. When the PFCP transaction o... | |
| CVE-2026-106805 json | A resource exhaustion issue exists in Free5GC v4.2.3 during PFCP Session Establishment failure handling. When the SMF does no... | |
| CVE-2026-106804 json | A stack-based buffer overflow exists in Kamailio v6.1.3 and v6.1.4 in the ims_qos_npn module. The w_rx_aar_register() functio... | |
| CVE-2026-106803 json | A stack-based buffer overflow exists in Kamailio v6.1.3 and v6.1.4 in the ims_registrar_pcscf module. When processing a craft... | |
| CVE-2026-105769 json | kaniko before 1.25.20 can send a Microsoft Entra ID (Azure AD) access token for Azure Resource Manager to an attacker-control... | |
| CVE-2026-77881 json | Control Web Panel (CWP) before webpanel_version 1.30 contains a blind SQL injection vulnerability in an unauthenticated loopb... | |
| CVE-2026-120501 json | An Otter Wiki 2.20.1 before 2.26.2 contains a file disclosure vulnerability in the DataTable embedding that allows attackers ... | |
| CVE-2026-120500 json | An Otter Wiki before 2.26.2 contains a stored cross-site scripting vulnerability in OtterwikiMdRenderer.block_code that allow... | |
| CVE-2026-109142 json | When a CA's parent lives on the same Krill server: instead of building and verifying a signed CMS message, it runs the RFC 64... | |
| CVE-2026-109141 json | The vulnerability gives a role that is restricted to a list of CAs (cas = [...]) its full permission set for every request th... | |
| CVE-2026-77880 json | Control Web Panel (CWP) before webpanel_version 1.16 contains an OS command injection vulnerability in the loopback API passw... | |
| CVE-2026-77879 json | Control Web Panel (CWP) before webpanel_version 1.16 contains a SQL injection vulnerability in the loopback API authenticatio... | |
| CVE-2026-77878 json | Control Web Panel (CWP) before webpanel_version 1.30 contains an OS command injection vulnerability in the loopback API datab... | |
| CVE-2026-77877 json | Control Web Panel (CWP) before webpanel_version 1.30 contains a missing authentication vulnerability that allows attackers ab... | |
| CVE-2026-77876 json | Control Web Panel (CWP) before webpanel_version 1.16 contains an OS command injection vulnerability in the protected_director... | |
| CVE-2026-16306 json | Remote Code Execution in the `IModular.exe` URI handler in INFINITT Healthcare Co., Ltd. INFINITT PACS allows a remote unauth... | |
| CVE-2026-120491 json | Wing FTP Server before 8.2.6 contains a stored cross-site scripting vulnerability that allows authenticated web-client users ... | |
| CVE-2026-120489 json | Outline before 1.12.0 contains an incorrect authorization vulnerability in authorizeDocumentPublish() that allows authenticat... | |
| CVE-2026-120458 json | Kvazaar through 2.3.2 contains an infinite loop vulnerability in read_header() in src/encmain.c that allows attackers to hang... | |
| CVE-2026-109140 json | The vulnerability is that Krill encrypts every login-session token with a nonce built from a counter that is reset to 0 on ev... | |
| CVE-2026-104080 json | Control Web Panel (CWP) before webpanel_version 1.30 contains an OS command injection vulnerability in the loopback API /vali... | |
| CVE-2026-73697 json | Control Web Panel (CWP) before webpanel_version 1.16 contains an arbitrary file write and OS command injection vulnerability ... | |
| CVE-2026-73696 json | Control Web Panel (CWP) before webpanel_version 1.12 contains an execution after redirect vulnerability in the user panel aut... | |
| CVE-2026-73695 json | Control Web Panel (CWP) before webpanel_version 1.16 contains a path traversal vulnerability in services/users/index.php that... | |
| CVE-2026-120457 json | libaec through 1.1.7 contains an out-of-bounds read vulnerability in m_se_decode() in src/decode.c that allows attackers to b... | |
| CVE-2026-120454 json | The Sleuth Kit through 4.15.0 contains a NULL pointer dereference vulnerability in decmpfs_decompress_lzvn_attr() that allows... | |
| CVE-2026-120453 json | The Sleuth Kit through 4.15.0 contains a heap out-of-bounds read vulnerability in hfs_load_extended_attrs() in tsk/fs/hfs.c t... | |
| CVE-2026-120452 json | libgphoto2 through 2.5.34 contains a heap out-of-bounds read and write vulnerability in jl2005bcd_decompress() that allows ma... | |
| CVE-2026-120451 json | libgphoto2 through 2.5.34 contains stack-based and heap-based buffer overflow vulnerabilities in jl2005c_init() that allow ma... | |
| CVE-2026-120449 json | Outline before 1.12.0 contains an improper access control vulnerability that allows unauthenticated users to read unpublished... | |
| CVE-2026-120448 json | DoraCMS through 3.1.0 contains a mass assignment vulnerability in the PUT /api/v1/user/api-keys/:id endpoint that allows auth... | |
| CVE-2026-120447 json | HotGo through 2.15.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to choose the SMS ... | |
| CVE-2026-120446 json | madong-admin-saas through 5.1.4 contains a missing authentication vulnerability in the platform tenant management API because... | |
| CVE-2026-120445 json | madong-admin-saas through 5.1.4 contains an incorrect authorization vulnerability in AccessTokenMiddleware that allows authen... | |
| CVE-2026-120444 json | GoFound through 1.4.1 contains a path traversal vulnerability that allows unauthenticated attackers to delete arbitrary direc... | |
| CVE-2026-120443 json | GoFound through 1.4.1 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject sc... | |
| CVE-2026-120442 json | ape-volo-admin before 3.6.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge ad... | |
| CVE-2026-120441 json | OwnTone Server through 29.3 contains an sql injection vulnerability in mpd_sticker_find() in src/mpd.c that allows unauthenti... | |
| CVE-2026-120440 json | QuickJS-NG before 0.16.0 contains a memory leak vulnerability in js_atomics_store() in quickjs.c that fails to free the conve... | |
| CVE-2026-120439 json | QuickJS-NG before 0.16.0 contains an integer overflow in js_typed_array_sort() in quickjs.c that allows attackers to cause a ... | |
| CVE-2026-120438 json | QuickJS-NG before 0.16.0 contains an integer overflow in js_proxy_get_own_property_names() in quickjs.c that causes a heap bu... | |
| CVE-2026-120428 json | PandaWiki 3.65.0 through 3.87.5 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to... | |
| CVE-2026-120463 json | Warracker before 1.0.4 contains a missing authorization vulnerability in its Paperless-ngx integration that allows an authent... | |
| CVE-2026-120426 json | OpenCSG CSGHub through v2.6.0-ce contains an authorization bypass vulnerability in the unauthenticated file resolve route tha... | |
| CVE-2026-120425 json | Chatify before 1.6.4 contains an authorization bypass vulnerability in the Pusher channel authorization endpoint that allows ... | |
| CVE-2026-120318 json | Product Gallery Slider & Additional Variation Images for WooCommerce 2.3.23 before 2.3.26 contains a missing authorization vu... | |
| CVE-2026-103310 json | The PayHere Payment Gateway WordPress plugin from 2.4.0 through 2.4.5 does not verify the authenticity of payment notificatio... | |
| CVE-2026-92886 json | Missing Authorization vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute eta-register allows Privile... | |
| CVE-2026-74993 json | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Starnet Computer and Ne... | |
| CVE-2025-71450 json | inih before r63 contains a one-byte stack buffer under-read in ini_parse_stream() in ini.c that allows attackers to read abys... | |
| CVE-2026-120338 json | Prefab UI's Generative UI sandbox runs caller-supplied Python inside Pyodide, Python compiled to WebAssembly, in a Deno subpr... | |
| CVE-2026-120315 json | LobeHub Chat from 1.84.26 before 2.1.49 contains a path traversal vulnerability that allows authenticated users to write arbi... | |
| CVE-2026-120309 json | Nuxt from 4.6.0 before 4.6.2 contains a route parameter confusion vulnerability in getRouterParam and getRouterParams that le... | |
| CVE-2026-120308 json | A Beta9 tenant can attach a volume when deploying a function, endpoint, or task queue. The gateway builds the host path by jo... | |
| CVE-2026-120307 json | The Beta9 worker serves the sandbox file API from outside the container. getHostPathFromContainerPath turns the tenant's cont... | |
| CVE-2026-117680 json | Improper Check for Unusual or Exceptional Conditions vulnerability in the pattern and patternProperties keywords in lud jsv a... | |
| CVE-2026-74760 json | Google::Auth versions from 0.11 through 0.12 for Perl accept an authorization code from any local process because the gcloud-... | |
| CVE-2026-74759 json | Google::Auth versions 0.12 for Perl allow server side request forgery via unvalidated credential_source URLs in AWS external ... | |
| CVE-2026-120306 json | Beta9 turns each shell command in a tenant image definition into a Dockerfile RUN line and executes it with Buildah on the bu... | |
| CVE-2026-120251 json | imagecodecs 2026.3.6 through 2026.10.10 contains an infinite loop vulnerability in ccitt_fax4_decode_size() that allows attac... | |
| CVE-2026-120250 json | OpenAlgo 1.0.0.29 before 2.0.3.1 contains an improper certificate validation vulnerability in utils/email_utils.py and utils/... |