CVE.report
CVE.report is the most up-to-date database of common vulnerabilities and exposures. Information is pulled in from several sources and processed in to a mobile friendly, easy to use page. Use the site to quickly check for vulnerabilities in products such as operating systems, applications, hardware, networks, databases, browsers, e-mail clients and more.
CVEs provide a unique and common naming scheme for publicly known cyber security vulnerabilities in order to quickly identify and share these vulnerabilities. You can use the search below to look for vulnerabilities based on product, vendor, or common tags
The form you will see after following this link allows you to fill out the various variables in the CVSS scoring system and receive the corresponding score. The description of each of the variables is also included for additional information.
cve.report now provides a free read-only JSON API for CVE details. Each record combines the CVE Program JSON record, NVD enrichment, KEV, and EPSS when available.
Recent CVEs
| CVE | Description | Updated |
|---|---|---|
| CVE-2026-102004 json | Wind River VxWorks 7 prior to 26.09, specific system call arguments can result in memory corruption within the memory managem... | |
| CVE-2026-101891 json | An improper access control vulnerability in an internal API service on WatchGuard Access Points allows an unauthenticated att... | |
| CVE-2026-101089 json | Nezha before 2.2.7 contains an information disclosure vulnerability in the GET /api/v1/profile endpoint that returns the bcry... | |
| CVE-2026-101088 json | Nezha is a server and website monitoring tool. In versions >= 2.2.11 and < 2.3.1, the service sentinel worker (service/single... | |
| CVE-2026-101087 json | Nezha versions 2.0.10 through 2.3.2 use a restricted HTTP client to validate user-configurable notification and DDNS webhook ... | |
| CVE-2026-101085 json | Nezha before 2.3.8 fails to validate alert rule type and duration bounds, allowing authenticated non-administrator users to c... | |
| CVE-2026-101084 json | obot versions before v0.21.1 fail to enforce Access Control Rules on the /mcp-connect endpoint, allowing any authenticated us... | |
| CVE-2026-97686 json | Wind River VxWorks 7 prior to 26.09, specific system call arguments can result in the IPNET subsystem failing to properly rel... | |
| CVE-2026-87969 json | An OS command injection vulnerability in the WatchGuard AP diagnostic CLI allows an authenticated administrator to execute ar... | |
| CVE-2026-87741 json | The ConvertPlus plugin for WordPress is vulnerable to Deserialization of Untrusted Data in all versions up to, and including,... | |
| CVE-2026-86102 json | An OS command injection vulnerability in the WatchGuard AP internal API service allows an attacker with network access to the... | |
| CVE-2026-101065 json | Obot is an open-source AI agent/MCP platform. In all versions up to and including commit d7e6970, the Docker quickstart comma... | |
| CVE-2026-101062 json | Obot before v0.23.0 (affected versions <= v0.22.1) running with OBOT_SERVER_ENABLE_AUTHENTICATION=true exposes OAuth dynamic ... | |
| CVE-2026-101050 json | Heym before 0.0.53 fails to verify the X-Telegram-Bot-Api-Secret-Token header on Telegram webhook endpoints when credential_i... | |
| CVE-2026-101033 json | KitchenOwl through 0.7.10 fails to verify that category IDs belong to the caller's household in expense and item operations. ... | |
| CVE-2026-100872 json | Sylius versions before 2.1.16 and 2.2.9 fail to validate payment amounts during cart recalculation, allowing unauthenticated ... | |
| CVE-2026-100871 json | Sylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 fail to include firewall identification in JWT tokens iss... | |
| CVE-2026-100870 json | Sylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 build administrator password-reset links using the reques... | |
| CVE-2026-100869 json | Sylius versions before 2.1.16 and 2.2.9 fail to restrict payment request actions in the Shop API endpoint, allowing customers... | |
| CVE-2026-100867 json | spaceship-prompt through 4.22.5 fails to sanitize control characters from project manifest version fields before rendering th... | |
| CVE-2026-94417 json | When an application enables both OCSP and CRL revocation checking on one WOLFSSL_CTX or certificate manager, wolfSSL skips th... | |
| CVE-2026-93304 json | A (D)TLS 1.2 client can accept a ChangeCipherSpec message before it has sent its ClientKeyExchange. No master secret has been... | |
| CVE-2026-93302 json | MatchTrustedPeer ignores the public key used, leading to forged CA clones passing verification. Affected builds are any that ... | |
| CVE-2026-89136 json | When using RPK (Raw Public Key), the client side of a TLS 1.2, 1.3 and DTLS 1.2 connection could accept an unsolicited server... | |
| CVE-2026-89135 json | A failed X509_verify_cert call permanently plants an unverified attacker CA in the shared CertManager, bypassing certificate ... | |
| CVE-2026-89134 json | A certificate with no dNSName SAN but another SAN type present (e.g. registeredID or iPAddress) bypassed the Subject CN dNSNa... | |
| CVE-2026-100865 json | Heym before 0.0.53 evaluates workflow condition expressions using Python's eval() with insufficient sandboxing in the workflo... | |
| CVE-2026-100864 json | heym before 0.0.91 contains a sandbox escape vulnerability in the expression engine's DotList map/filter and fallback resolve... | |
| CVE-2026-100863 json | Heym versions 0.0.90 and earlier contain two server-side request forgery (SSRF) egress gaps, both remediated in app/services/... | |
| CVE-2026-100862 json | heym, a workflow automation platform, stores and returns multiple capability secrets in plaintext in versions prior to 0.0.91... | |
| CVE-2026-100861 json | heym before 0.0.105 fails to apply egress guards to integration services that use credential-supplied base URLs, allowing aut... | |
| CVE-2026-100860 json | heym before 0.0.105 does not act on the result of the credential authorization lookup in the Redis workflow node (backend/app... | |
| CVE-2026-100859 json | Heym before 0.0.106 contains a credential exfiltration vulnerability in the POST /api/credentials/test endpoint that allows c... | |
| CVE-2026-100858 json | heym before 0.0.109 contains a server-side request forgery vulnerability in the Slack, Discord, and Crawler workflow nodes. T... | |
| CVE-2026-94419 json | Without NO_SESSION_CACHE_REF, wolfSSL_get_session() does not return a session object but a ClientSession reference of the for... | |
| CVE-2026-94418 json | Under WOLFSSL_SMALL_CERT_VERIFY, ProcessPeerCertParse() runs the certificate signature check separately from the parse to kee... | |
| CVE-2026-89133 json | wolfSSL versions 5.9.2 and earlier contain a flaw in the X.509 certificate validation logic where it fails to properly enforc... | |
| CVE-2026-89102 json | In wolfSSL versions 5.7.2 through 5.9.2 there is a client-side implementation flaw in RFC 6961, multiple OCSP response stapli... | |
| CVE-2026-15442 json | In all builds that make use of (D)TLS, including default builds, there is a series of conditional states during the TLS shutd... | |
| CVE-2026-100855 json | AzuraCast before 0.23.6 contains a missing permission check vulnerability in the GET /api/station/{station_id}/file/{id}/play... | |
| CVE-2026-100854 json | AzuraCast before 0.23.6 lacks RequireInternalConnection middleware on the Liquidsoap API endpoint and incorrectly derives the... | |
| CVE-2026-100851 json | AzuraCast before 0.23.8 contains a broken access control vulnerability in the GET /api/station/{id}/vue/profile endpoint that... | |
| CVE-2026-100850 json | AzuraCast before 0.23.8 contains a server-side request forgery and local file read vulnerability in the AutoDJ remote playlis... | |
| CVE-2026-100847 json | AzuraCast before 0.23.8 contains a DQL injection vulnerability in the sortOrder API parameter of AbstractSearchableListAction... | |
| CVE-2026-100846 json | MONAI before 1.5.2 contains a deserialization of untrusted data vulnerability in the algo_from_pickle function in monai/auto3... | |
| CVE-2026-100843 json | MONAI versions before 1.6.0 contain a remote code execution vulnerability in the algo_from_pickle() function due to unsafe pi... | |
| CVE-2026-100842 json | MONAI through 1.6.0 contains an eval injection vulnerability in _get_fake_spatial_shape() in monai/bundle/scripts.py. The fun... | |
| CVE-2026-100674 json | stoatchat before 0.15.5 fails to revalidate usernames after Unicode sanitization, allowing attackers to create usernames with... | |
| CVE-2026-100654 json | vLLM before 0.29.0 accepts user-controlled stop_token_ids on the OpenAI-compatible POST /v1/completions and POST /v1/chat/com... | |
| CVE-2026-100653 json | vLLM is an inference and serving engine for large language models. In versions from 0.22.1 through 0.28.0, the operator-suppl... | |
| CVE-2026-100650 json | vLLM through 0.29.0 fetches and fully materializes remote or inline media before enforcing its documented media controls (the... | |
| CVE-2026-100649 json | vLLM before 0.29.0 contains a resource-limit bypass vulnerability in PyNvVideoCodec decoder allocation where sampler subclass... | |
| CVE-2026-100630 json | AVideo contains a stored cross-site scripting vulnerability in the video trailer1 field rendered unsanitized within an inline... | |
| CVE-2026-100629 json | Capgo (capgo.app backend) before 12.127.5 contains an authorization flaw in the PATCH /private/role_bindings/:binding_id endp... | |
| CVE-2026-100628 json | capgo.app before 12.128.12 fails to enforce an organization's API key expiration policy when creating app-scoped API keys. In... | |
| CVE-2026-100627 json | Capgo (Cap-go/capgo.app) server backend Supabase functions contain an incorrect authorization flaw in the API-key bundle prom... | |
| CVE-2026-100626 json | capgo through 12.128.2 contains an insecure direct object reference vulnerability in the PUT /app/:appId endpoint that accept... | |
| CVE-2026-100625 json | Capgo (capgo.app) exposes a native build TUS upload proxy (supabase/functions/_backend/public/build/upload.ts) that authorize... | |
| CVE-2026-100624 json | Capgo.app before 12.264.5 does not enforce upload expiry or build lifecycle state in the /build/upload/:jobId TUS proxy endpo... | |
| CVE-2026-100623 json | Capgo (capgo.app) exposes the legacy membership table public.org_users directly through Supabase PostgREST. The table's row-l... | |
| CVE-2026-100622 json | capgo.app through 12.129.0 fails to verify deletion status when serving cached bundle artifacts from the public file read end... | |
| CVE-2026-100621 json | Capgo (capgo.app) contains an incomplete access-control/content-lock enforcement issue affecting all versions; no patch is av... | |
| CVE-2026-100620 json | Capgo CLI (npm package @capgo/cli) through 7.98.2 is affected by an over-permissioned service account in its Android onboardi... | |
| CVE-2026-100619 json | Capgo (capgo.app) blocks direct user inserts into the public.manifest table with a RESTRICTIVE row-level security policy, but... | |
| CVE-2026-100618 json | Capgo (capgo.app) is affected by an authorization flaw in the app icon update path. The PUT /app/:id endpoint accepts a user-... | |
| CVE-2026-100617 json | Cap-go capgo.app fails to validate that principals in channel_permission_overrides belong to the organization, allowing authe... | |
| CVE-2026-100616 json | capgo.app is an over-the-air update platform for Capacitor apps. In all versions prior to a fix, the row-level security UPDAT... | |
| CVE-2026-100615 json | Cap-go capgo.app before 12.267.1 fails to validate target API key privilege during rotation, allowing an apikey_manager to ro... | |
| CVE-2026-100614 json | Capgo before 12.244.1 contains a cross-tenant integrity vulnerability in the metadata-cleaning worker that trusts image objec... | |
| CVE-2026-100613 json | capgo.app is an over-the-air (OTA) update platform for Capacitor apps. In all versions up to and including the current releas... | |
| CVE-2026-100612 json | Capgo (capgo.app) through version 12.261.0 contains an incomplete access-control fix for the public.sso_providers table. Migr... | |
| CVE-2026-100611 json | Capgo (capgo.app backend, versions ≤ 12.261.0) improperly restricts which roles the apikey_manager organization role may bi... | |
| CVE-2026-100604 json | ClawHub (openclaw/clawhub) contains an incorrect authorization vulnerability in the ClawHub application/backend: an organizat... | |
| CVE-2026-100601 json | ClawHub (openclaw/clawhub) application/backend contains a server-side request forgery vulnerability in the public profile pre... | |
| CVE-2026-100600 json | ClawHub (the openclaw/clawhub application/backend) does not bind anonymous HTTP API requests to a trusted caller identity, so... | |
| CVE-2026-100505 json | Ghidra versions 9.2 through 12.1.4 contain a heap out-of-bounds read vulnerability in StringManager::getCodepoint when decodi... | |
| CVE-2026-100503 json | Ghidra versions through 12.1.4 contain a heap use-after-free vulnerability in the decompiler's Funcdata::opInsertAfter functi... | |
| CVE-2026-97064 json | X-SpringBoot through 6.0 ships with a hardcoded static master login verification code 172839 enabled by default in the databa... | |
| CVE-2026-97063 json | X-SpringBoot through 6.0 returns login verification codes in HTTP responses from unauthenticated endpoints GET /sys/mobile/co... | |
| CVE-2026-100306 json | TDuck survey form through 6.0 fails to validate write passwords on submission endpoints, enforcing the check only on the fron... | |
| CVE-2026-100305 json | TDuck survey form through 6.0 fails to enforce form fill-in restrictions on the authenticated submission endpoint POST /user/... | |
| CVE-2026-100304 json | TDuck survey form 6.0 contains an information disclosure vulnerability in FormAuthUtils.hasPermission that fails open when a ... | |
| CVE-2026-100303 json | TDuck survey form through 6.0 lacks authorization checks on FormThemeController write endpoints for global form themes and ca... | |
| CVE-2026-100192 json | X-SpringBoot through 6.0 exposes appKey and appSecret credentials in the GET /application/manager/select endpoint without aut... | |
| CVE-2026-97060 json | X-SpringBoot through 6.0 lacks object-level authorization in user management endpoints, allowing sub-administrators to modify... | |
| CVE-2026-93366 json | Bludit CMS through 3.22.0 contains an authorization bypass vulnerability that allows authenticated users with the Author role... | |
| CVE-2026-93365 json | Bludit CMS through 3.22.0 contains a missing authorization vulnerability that allows authenticated users holding the Author o... | |
| CVE-2026-93364 json | Bludit CMS through 3.22.0 contains a mass assignment vulnerability that allows authenticated users with the Author role to mo... | |
| CVE-2026-6925 json | IBM Concert 1.0.0 through 3.0.0 could allow a remote attacker to traverse directories on the system. An attacker could send a... | |
| CVE-2026-6794 json | IBM Concert 1.0.0 through 3.0.0 has a double free vulnerability that exists due to incorrect memory management. A local attac... | |
| CVE-2026-6730 json | IBM Concert 1.0.0 through 3.0.0 is vulnerable to a buffer overflow, caused by improper bounds checking. A local user could ov... | |
| CVE-2026-6544 json | IBM Concert 1.0.0 through 3.0.0 allows recursive copying of directories without proper controls which can lead to unintention... | |
| CVE-2026-6721 json | IBM Concert 1.0.0 through 3.0.0 allows an unauthenticated remote attacker can supply specially crafted input that is incorpor... | |
| CVE-2026-101915 json | @grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.6 and 1.14.5... | |
| CVE-2026-101914 json | @grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.1 and 1.14.1... | |
| CVE-2026-101143 json | A vulnerability was found in Eleveo Quality Management 9.7.0. Affected by this issue is some unknown functionality of the fil... | |
| CVE-2026-101142 json | A vulnerability has been found in Eleveo Quality Management 9.7.0. Affected by this vulnerability is an unknown functionality... | |
| CVE-2026-96760 json | Authlib (v1.7.2 and below) contains a signature verification bypass vulnerability. The JsonWebSignature.deserialize_json() me... | |
| CVE-2026-93355 json | LiteLLM contains a weak authentication vulnerability that allows an attacker holding a valid JWT from the configured identity... | |
| CVE-2026-86950 json | An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.1 and iPadOS 26.7.1... |