CVE.report
CVE.report is the most up-to-date database of common vulnerabilities and exposures. Information is pulled in from several sources and processed in to a mobile friendly, easy to use page. Use the site to quickly check for vulnerabilities in products such as operating systems, applications, hardware, networks, databases, browsers, e-mail clients and more.
CVEs provide a unique and common naming scheme for publicly known cyber security vulnerabilities in order to quickly identify and share these vulnerabilities. You can use the search below to look for vulnerabilities based on product, vendor, or common tags
The form you will see after following this link allows you to fill out the various variables in the CVSS scoring system and receive the corresponding score. The description of each of the variables is also included for additional information.
cve.report now provides a free read-only JSON API for CVE details. Each record combines the CVE Program JSON record, NVD enrichment, KEV, and EPSS when available.
Recent CVEs
| CVE | Description | Updated |
|---|---|---|
| CVE-2026-113098 json | Memory corruption in CacheStorage in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially read memor... | |
| CVE-2026-113075 json | Use after free in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside... | |
| CVE-2026-113073 json | Use after free in Browser in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside ... | |
| CVE-2026-113072 json | Memory corruption in CSS in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary c... | |
| CVE-2026-113060 json | Improper input validation in Bluetooth in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execu... | |
| CVE-2026-113059 json | Memory corruption in Sensor in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrar... | |
| CVE-2026-113058 json | Use after free in WebUI in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside th... | |
| CVE-2026-112935 json | filelock is a platform-independent file lock for Python. From 3.22.0 until 4.2.1, SoftFileLock can break a stale marker after... | |
| CVE-2026-112934 json | filelock is a platform-independent file lock for Python. From 4.0.0 until 4.2.1, SoftReadWriteLock refreshes holder records b... | |
| CVE-2026-98149 json | In the Linux kernel, the following vulnerability has been resolved: bpf: Fix percpu map update indexing with sparse CPU IDs ... | |
| CVE-2026-114438 json | A flaw was found in the Update User Locale required action of the Keycloak identity and access management solution. When this... | |
| CVE-2026-114376 json | A weakness has been identified in leomoon-studios wiki-go up to 1.9.1. Affected by this vulnerability is the function SaveHan... | |
| CVE-2026-114375 json | A security flaw has been discovered in leomoon-studios wiki-go up to 1.9.1. Affected is the function RenameFileHandler of the... | |
| CVE-2026-114374 json | A vulnerability was identified in leomoon-studios wiki-go up to 1.9.1. This impacts an unknown function of the file internal/... | |
| CVE-2026-114362 json | A flaw has been found in HarnessRouter up to 0.31.12. This impacts an unknown function of the file gateway/app.py of the comp... | |
| CVE-2026-114136 json | Django REST framework is a toolkit for building Web APIs. From 3.6.4 until 3.18.2, JSONParser.parse in rest_framework/parsers... | |
| CVE-2026-85518 json | A flaw was found in OpenSCAP. When decomposing a Source DataStream (SDS) file, the application does not properly validate rel... | |
| CVE-2026-114135 json | Jupyter Server is the backend for Jupyter web applications. From 2.0.0 until 2.6.0, enabling GatewayClient.url replaced the n... | |
| CVE-2026-112408 json | Missing verification of source of a communication channel in the default_bucket() function in Amazon SageMaker Python SDK V3 ... | |
| CVE-2026-112381 json | Apache Traffic Server can crash with a null pointer dereference when a client POST request is torn down via half-close while ... | |
| CVE-2026-111817 json | Apache Traffic Server can stall a chunked transfer that it passes through with its trailers removed (proxy.config.http.drop_c... | |
| CVE-2026-111815 json | Apache Traffic Server can resume a TLS session across SNI virtual hosts without re-verifying a client certificate required by... | |
| CVE-2026-111814 json | Apache Traffic Server's default outbound session-sharing policy can reuse a pooled TLS session authenticated with one client ... | |
| CVE-2026-111812 json | Apache Traffic Server's origin_server_auth plugin lets a client force signing of attacker-chosen AWS request headers under th... | |
| CVE-2026-111811 json | Apache Traffic Server's experimental tsmemcache plugin allows unauthenticated network read, write, and deletion of the shared... | |
| CVE-2026-111810 json | Apache Traffic Server 9.2.15, 10.1.4 and 10.2.0 write one unthrottled diagnostic log line for every internal @ header they st... | |
| CVE-2026-114493 json | LocalAI v4.6.0 through v4.11.0 contains a server-side request forgery vulnerability in core/gallery/gallery.go that validates... | |
| CVE-2026-111809 json | Apache Traffic Server allows request smuggling via HEAD requests that carry Content-Length or Transfer-Encoding. This issu... | |
| CVE-2026-111808 json | Apache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool via a malformed padded HTTP/2 DATA frame. Th... | |
| CVE-2026-111805 json | Apache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool via a truncated HTTP/2 Content-Length value. ... | |
| CVE-2026-53986 json | Girafit camera app (Android and iOS) version 1.9.1 and earlier, and Girafit camera devices, contain a hardcoded credentials v... | |
| CVE-2025-60497 json | A segmentation violation in the GetESD function (/isomedia/track.c) of GPAC Project/MP4Box before 2.5 allows attackers to cau... | |
| CVE-2025-60492 json | A stack overflow in the gf_bifs_dec_node function (/bifs/field_decode.c) of GPAC Project/MP4Box before 2.5 allows attackers t... | |
| CVE-2026-114401 json | Trudesk through 1.2.11 contains a regular expression injection vulnerability that allows unauthenticated attackers to enumera... | |
| CVE-2026-114386 json | Pydantic AI Harness before 0.59.0 fails to enforce UsageLimits.tool_calls_limit on nested tool calls dispatched from run_code... | |
| CVE-2026-113470 json | Cryptographic issue in the Security Block-lists, Allow-lists, and other State component. This vulnerability was fixed in Fire... | |
| CVE-2026-113147 json | Improper input validation in WebShare in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execut... | |
| CVE-2026-113146 json | Memory corruption in PerformanceAPIs in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute... | |
| CVE-2026-113142 json | Memory corruption in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially read memory ... | |
| CVE-2026-113141 json | Use after free in Transactions Platform in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrar... | |
| CVE-2026-113139 json | Memory corruption in Autofill in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially read memory in... | |
| CVE-2026-113118 json | Memory corruption in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code i... | |
| CVE-2026-113010 json | Out of bounds read in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to read memory inside the ... | |
| CVE-2026-113009 json | Use after free in WindowControlsOverlay in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrar... | |
| CVE-2026-95168 json | An issue in nvbn thefuck v.3.32 allows a local attacker to execute arbitrary code via the get_rules_import_paths in thefuck/c... | |
| CVE-2026-112259 json | A flaw was found in GIMP. Importing a crafted SBZ palette without a color-model attribute can cause a NULL pointer dereferenc... | |
| CVE-2026-98150 json | In the Linux kernel, the following vulnerability has been resolved: bpf: Fix BPF_F_CPU validation for sparse CPU IDs BPF_F_... | |
| CVE-2026-96512 json | A flaw was found in sudo. When sudoers rules use NOTBEFORE or NOTAFTER time-based access restrictions with timestamps that om... | |
| CVE-2026-94416 json | An authorization bypass was found in the Ansible Automation Platform (AAP) gateway. The gateway API allows an authenticated a... | |
| CVE-2026-93017 json | The `insights-operator-gather` ClusterRole grants the operator's service account read access to secrets in the core API group... | |
| CVE-2026-86332 json | A flaw was found in odh-dashboard in Red Hat OpenShift AI. The backend-for-frontend route GET /api/nim-serving/:nimResource r... | |
| CVE-2026-75888 json | A flaw was found in the OpenShift console. An authenticated console user can exploit a Server-Side Request Forgery (SSRF) vul... | |
| CVE-2026-102214 json | Use after free in Windows Hyper-V allows an authorized attacker to execute code locally. | |
| CVE-2026-98153 json | In the Linux kernel, the following vulnerability has been resolved: nvme: fix racy access to FDP placement id array nvme_qu... | |
| CVE-2026-113074 json | Use after free in Media in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary ... | |
| CVE-2026-113071 json | Use after free in Notifications in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute ar... | |
| CVE-2026-102217 json | Improper resolution of path equivalence in WebDAV allows an authorized attacker to elevate privileges over a network. | |
| CVE-2026-102216 json | Access of resource using incompatible type ('type confusion') in Windows StateRepository API allows an authorized attacker to... | |
| CVE-2026-102215 json | Heap-based buffer overflow in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevat... | |
| CVE-2026-114361 json | A vulnerability was detected in HarnessRouter up to 0.31.10. This affects an unknown function of the file gateway/app.py of t... | |
| CVE-2026-114268 json | A flaw has been found in Tenda BE3L Pro 16.03.60.62. Affected by this vulnerability is the function formWifiBasicSet of the f... | |
| CVE-2026-114267 json | A vulnerability was detected in SourceCodester Food Order Management System 1.0. Affected is an unknown function of the compo... | |
| CVE-2026-79976 json | The MCTP-over-I2C+GPIO target binding in subsys/pmci/mctp/mctp_i2c_gpio_target.c emulates a small pseudo-register file, where... | |
| CVE-2026-78119 json | The Nuvoton NPCX eSPI driver parses Target-Attached-Flash (TAF) requests in espi_taf_parse() (drivers/espi/espi_npcx.c), taki... | |
| CVE-2026-78118 json | The kernel helper z_waitq_head() (kernel/include/wait_q.h) reads the head of a thread wait queue, but on SMP systems it was c... | |
| CVE-2026-78117 json | The Infineon PSOC 6 BLESS HCI driver in drivers/bluetooth/hci/hci_infineon_psoc6_bless.c stored the outgoing HCI packet descr... | |
| CVE-2026-78116 json | The Broadcom AFBR-S50 time-of-flight sensor driver double-completes an RTIO submission when sensor data evaluation fails. In ... | |
| CVE-2026-19947 json | The device multiplexer pseudo-driver in drivers/misc/devmux/devmux.c exposes two system calls, devmux_select_get() and devmux... | |
| CVE-2026-19676 json | The user-mode verifier for the peci_transfer() system call, z_vrfy_peci_transfer() in drivers/peci/peci_handlers.c, checked o... | |
| CVE-2026-18748 json | The Bluetooth Classic A2DP host stores a codec Information Element (IE) in struct bt_a2dp_codec_ie, a one-byte len field plus... | |
| CVE-2026-114266 json | A security vulnerability has been detected in ProjectWorlds Advanced Library Management System 1.0. This impacts the function... | |
| CVE-2026-113870 json | MongoDB Compass improperly escapes certain BSON values when converting a stored view’s aggregation pipeline into editable s... | |
| CVE-2026-113461 json | Local privilege escalation in Checkmk 2.5.0p14 allows a local user with write access to the Oracle client library directory o... | |
| CVE-2026-111816 json | Apache Traffic Server forwarded a malformed 302 response that should have been rejected as a parse error, because the Transfe... | |
| CVE-2026-111813 json | Apache Traffic Server's experimental magick plugin lets an unauthenticated client control ImageMagick convert arguments in it... | |
| CVE-2026-111804 json | Apache Traffic Server's experimental wasm plugin has a use-after-free in its transaction-close handler and forwards unvalidat... | |
| CVE-2026-111401 json | Cross-Site Request Forgery (CSRF) vulnerability in Tailored Media Tailored Tools tailored-tools allows Cross Site Request For... | |
| CVE-2026-110803 json | VaadinService.requestEnd() in Vaadin Framework 8 locks the session and then reads the v-uiId request parameter outside the bl... | |
| CVE-2026-107588 json | Vaadin Charts renders charts with the Highcharts library and pins an exact version of it, 9.2.2 in Vaadin 22 to 24 and 12.2.0... | |
| CVE-2026-105945 json | The Pulsar Packages Management Service can be configured to store packages on the local filesystem of the broker by using the... | |
| CVE-2026-105944 json | Apache Pulsar Manager is a web console for administering Apache Pulsar clusters. It has its own user accounts and login, and ... | |
| CVE-2026-105942 json | When a configured proxy role sends a request to the broker on behalf of another user (the original principal), the broker is ... | |
| CVE-2026-105938 json | Apache Pulsar namespaces can restrict which roles may use a subscription, either with the Prefix subscription authentication ... | |
| CVE-2026-105937 json | Apache Pulsar shadow topics (PIP-180) are topics that read the stored messages of a source topic from that topic's managed le... | |
| CVE-2026-105936 json | The Pulsar Functions worker REST API provides two endpoints that return the catalog of Pulsar IO connectors installed on the ... | |
| CVE-2026-105935 json | The Pulsar Functions Worker provides a REST API endpoint for triggering a function, which publishes a caller-supplied value t... | |
| CVE-2026-105934 json | The Apache Pulsar broker admin REST API provides a truncate operation for persistent topics (DELETE /admin/v2/persistent/{ten... | |
| CVE-2026-105933 json | Apache Pulsar allows an administrator to require end-to-end message encryption for all topics in a namespace by setting the e... | |
| CVE-2026-105932 json | The Apache Pulsar broker admin REST API provides endpoints to read, set and remove the topic-level entry filter policy of a t... | |
| CVE-2026-105931 json | The Apache Pulsar broker exposes a transaction administration REST API under /admin/v3/transactions. When authentication and ... | |
| CVE-2026-59562 json | Missing authentication for critical function vulnerability in Apache IoTDB. This issue affects Apache IoTDB: from 2.0.0 be... | |
| CVE-2026-59229 json | The Legacy Pipe receiver protocol (handshake / sendPipeData) uses a hardcoded SUPER_USER (root) identity when executing data ... | |
| CVE-2026-58663 json | An authentication bypass vulnerability exists in Apache IoTDB's Thrift RPC service This issue affects Apache IoTDB: from 2... | |
| CVE-2025-55702 json | When a client sends a POST with Expect: 100-continue and the origin answers before reading the body, Apache Traffic Server pa... | |
| CVE-2025-31699 json | Apache Traffic Server can return an origin connection to the shared pool while the origin is still waiting on a request body ... | |
| CVE-2026-113331 json | Memory corruption in Controls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitr... | |
| CVE-2026-113055 json | Type confusion in FullScreen in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbit... | |
| CVE-2026-113053 json | Use after free in Cookies in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrar... | |
| CVE-2026-113045 json | Out of bounds read in Offline in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially ... | |
| CVE-2026-113043 json | Use after free in iOSWeb in Google Chrome on on iOS prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary cod... |