CVE.report
CVE.report is the most up-to-date database of common vulnerabilities and exposures. Information is pulled in from several sources and processed in to a mobile friendly, easy to use page. Use the site to quickly check for vulnerabilities in products such as operating systems, applications, hardware, networks, databases, browsers, e-mail clients and more.
CVEs provide a unique and common naming scheme for publicly known cyber security vulnerabilities in order to quickly identify and share these vulnerabilities. You can use the search below to look for vulnerabilities based on product, vendor, or common tags
The form you will see after following this link allows you to fill out the various variables in the CVSS scoring system and receive the corresponding score. The description of each of the variables is also included for additional information.
cve.report now provides a free read-only JSON API for CVE details. Each record combines the CVE Program JSON record, NVD enrichment, KEV, and EPSS when available.
Recent CVEs
| CVE | Description | Updated |
|---|---|---|
| CVE-2026-108334 json | A flaw was found in the internal WebAssembly (WASM) shim used by the Kuadrant operator. When generating the CEL predicate tha... | |
| CVE-2026-110889 json | Generation of Error Message Containing Sensitive Information vulnerability in Gantry Gantry 5 Framework gantry5 allows Retrie... | |
| CVE-2026-110936 json | A vulnerability has been identified in Siemens Software Center (All versions < V4.0.9.8). The affected application loads dyna... | |
| CVE-2026-94177 json | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ruben Garcia GamiPress ... | |
| CVE-2026-93485 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic WordPress wo... | |
| CVE-2026-111110 json | The Payment forms, Buy now buttons, and Invoicing System | GetPaid plugin for WordPress is vulnerable to Stored Cross-Site Sc... | |
| CVE-2026-110253 json | The weForms – Easy Drag & Drop Contact Form Builder For WordPress plugin for WordPress is vulnerable to limited media file ... | |
| CVE-2026-109983 json | The YMC Filter plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'post_title' parameter in ... | |
| CVE-2026-100316 json | The European VAT Compliance Assistant for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via C... | |
| CVE-2026-110384 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Heateor Support Fancy C... | |
| CVE-2026-10813 json | A flaw has been found in LMCache up to 0.5.4. This affects the function hex_hash_to_int16 of the file lmcache/integration/vll... | |
| CVE-2026-110527 json | The WP User Manager WordPress plugin before 2.9.20 does not roll back the WordPress account it creates during payment-gated ... | |
| CVE-2026-106470 json | The WP Data Access WordPress plugin before 5.5.88 does not have authorisation and CSRF checks in one of its actions, allowin... | |
| CVE-2026-104246 json | The Contact Form 7 Signature Addon WordPress plugin through 4.2.2 does not sanitize a signature field value before building a... | |
| CVE-2026-104122 json | The Ukr-To-Lat WordPress plugin through 1.3.5 does not sanitize and escape a term name before using it in a SQL query, allowi... | |
| CVE-2026-103376 json | The PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net, NMI) WordPress ... | |
| CVE-2026-97314 json | The ThirstyAffiliates WordPress plugin before 3.12.1 does not check the status or type of the object requested by its link r... | |
| CVE-2026-92433 json | The Patreon WordPress plugin before 1.10.0 does not verify a nonce when connecting the site to a Patreon account, allowing at... | |
| CVE-2026-92432 json | The Patreon WordPress plugin before 1.10.0 does not validate a user-supplied redirect destination before redirecting, allowin... | |
| CVE-2026-92431 json | The Patreon WordPress plugin before 1.10.0 does not perform an authorization check on some of its functionality, allowing una... | |
| CVE-2026-91074 json | The BSK PDF Manager WordPress plugin through 3.8.1 does not properly sanitise and escape a parameter before using it in a SQL... | |
| CVE-2026-81344 json | The ACF Frontend Admin by DynamiApps WordPress plugin through 3.29.13 does not restrict which PHP classes may be instantiated... | |
| CVE-2026-81343 json | The ACF Frontend Admin by DynamiApps WordPress plugin through 3.29.13 does not perform a capability check on one of its form-... | |
| CVE-2026-111726 json | The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'visible' Shortcode Attribute in al... | |
| CVE-2026-110268 json | The Post Export Import with Media plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and includ... | |
| CVE-2026-96660 json | The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User... | |
| CVE-2026-92978 json | The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User... | |
| CVE-2026-92798 json | The User Registration & Membership plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and... | |
| CVE-2026-92715 json | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference... | |
| CVE-2026-109989 json | The Themify Popup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'popup_width_unit' parameter in a... | |
| CVE-2026-109985 json | The xSpeed Cache: AI-Powered Performance Hub with MCP, Caching & CDN plugin for WordPress is vulnerable to Stored Cross-Site ... | |
| CVE-2026-109369 json | The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to authorization bypass in all versions up to, ... | |
| CVE-2026-109368 json | The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in all versio... | |
| CVE-2026-108452 json | Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office SharePoint allows an autho... | |
| CVE-2026-108451 json | Numeric truncation error in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-108450 json | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-108449 json | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-108448 json | Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-108123 json | The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to authorization bypass in all versions up to, ... | |
| CVE-2026-107752 json | The Welcart e-Commerce plugin for WordPress is vulnerable to generic SQL Injection via the 'wp_usces_order_old (JSON fields s... | |
| CVE-2026-107744 json | The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to authorizatio... | |
| CVE-2026-104736 json | The LearnPress plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.4.10 via deseri... | |
| CVE-2026-103899 json | The EU VAT Assistant for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'vat_number' p... | |
| CVE-2026-102917 json | IBM i 7.3, 7.4, 7.5, and 7.6 is vulnerable to an authenticated attacker elevating their privilege. A bad actor could exploit ... | |
| CVE-2026-81452 json | Dell Alienware Command Center (AWCC), versions prior to 6.14.54.0, contain a Least Privilege Violation vulnerability. A low p... | |
| CVE-2026-80092 json | Authentication bypass by assumed-immutable data in Microsoft Identity Web allows an authorized attacker to elevate privileges... | |
| CVE-2026-68571 json | Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Kylin. Special parameter in JDBC URL can le... | |
| CVE-2026-18551 json | Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to validate the combination... | |
| CVE-2026-108447 json | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-108446 json | Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-108445 json | Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-108444 json | Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-108443 json | Off-by-one error in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-108442 json | Use after free in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-108441 json | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-108440 json | Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-108439 json | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-108437 json | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-108432 json | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-108431 json | Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-108430 json | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-108429 json | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-108428 json | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-108427 json | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-108426 json | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-103946 json | An SQL injection vulnerability could allow an authenticated user to read or modify data stored by Nessus. | |
| CVE-2026-102764 json | The vulnerability exists within internal components of BeyondTrust’s Remote Support product. The components did not adequat... | |
| CVE-2026-101950 json | A Heap-based Buffer Overflow vulnerability in the SVR component of Juniper Networks Junos OS on SRX Series allows an unauthen... | |
| CVE-2026-88127 json | Use after free in Windows SMB Server allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-88115 json | Out-of-bounds read in Windows Server for NFS allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-88101 json | Weak authentication in Microsoft Input Method Editor (IME) allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-85936 json | Double free in Windows Shell allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-85851 json | Use after free in Windows SmartScreen allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-85338 json | Out-of-bounds read in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-83876 json | Use after free in Windows Shell allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-83873 json | Relative path traversal in Windows Shell allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-83639 json | Heap-based buffer overflow in Windows Sensor Data Service allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-83584 json | Use after free in Windows Smart Card allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-83579 json | Heap-based buffer overflow in Windows Smart Card allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-83510 json | Time-of-check time-of-use (toctou) race condition in Windows Setup Files Cleanup allows an authorized attacker to elevate pri... | |
| CVE-2026-83509 json | Untrusted search path in Windows Setup Files Cleanup allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-83505 json | Time-of-check time-of-use (toctou) race condition in Windows Setup Files Cleanup allows an authorized attacker to elevate pri... | |
| CVE-2026-83499 json | Insufficient granularity of access control in Windows Server Update Service allows an authorized attacker to elevate privileg... | |
| CVE-2026-73027 json | External control of system or configuration setting in Windows Setup Files Cleanup allows an authorized attacker to elevate p... | |
| CVE-2026-105009 json | Incorrect default permissions in Windows Server Update Service allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-102209 json | Heap-based buffer overflow in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-100215 json | Heap-based buffer overflow in Microsoft Graphics Component allows an unauthorized attacker to execute code locally. | |
| CVE-2026-70222 json | Relative path traversal in Windows Shell allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-70123 json | Numeric truncation error in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-70051 json | Access of resource using incompatible type ('type confusion') in Windows SmartScreen allows an authorized attacker to elevate... | |
| CVE-2026-111602 json | The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Sens... | |
| CVE-2026-111601 json | The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'token_id'... | |
| CVE-2026-110653 json | The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Auth... | |
| CVE-2026-109208 json | The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Stored Cross... | |
| CVE-2026-107763 json | The Fastcache by Host.it plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.7... | |
| CVE-2026-107762 json | The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Insecure Direct Objec... | |
| CVE-2026-104734 json | The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to PHP Object Injection ... | |
| CVE-2026-97381 json | Legacy Update is a tool for activating and installing updates on legacy Windows PCs. Legacy Update 1.12.0 through 1.13.1 cont... | |
| CVE-2026-95633 json | CAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that could result in... | |
| CVE-2026-93895 json | IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow an unauthenticated remote attacker to bypa... |