CVE.report
CVE.report is the most up-to-date database of common vulnerabilities and exposures. Information is pulled in from several sources and processed in to a mobile friendly, easy to use page. Use the site to quickly check for vulnerabilities in products such as operating systems, applications, hardware, networks, databases, browsers, e-mail clients and more.
CVEs provide a unique and common naming scheme for publicly known cyber security vulnerabilities in order to quickly identify and share these vulnerabilities. You can use the search below to look for vulnerabilities based on product, vendor, or common tags
The form you will see after following this link allows you to fill out the various variables in the CVSS scoring system and receive the corresponding score. The description of each of the variables is also included for additional information.
cve.report now provides a free read-only JSON API for CVE details. Each record combines the CVE Program JSON record, NVD enrichment, KEV, and EPSS when available.
Recent CVEs
| CVE | Description | Updated |
|---|---|---|
| CVE-2026-90436 json | ** UNSUPPORTED WHEN ASSIGNED ** Deserialization of an inbound SOAP fault in Apache Axis 1.x allows unauthenticated remote cla... | |
| CVE-2026-80303 json | An integer underflow vulnerability in the Avast Windows Filtering Platform (WFP) stream parser on Windows allows denial of se... | |
| CVE-2026-80302 json | Insufficient isolation in the Avast sandbox file virtualization layer on Windows allows a local, low-privileged attacker exec... | |
| CVE-2026-80301 json | Improper isolation in the Avast sandbox on Windows allows a local, low-privileged attacker executing inside the sandbox to ac... | |
| CVE-2026-66987 json | HCL AION is affected by a vulnerability where the account lockout mechanism did not sufficiently restrict repeated failed log... | |
| CVE-2026-66986 json | HCL AION is affected by a vulnerability where user sessions did not expire after a sufficient period of inactivity. An unatt... | |
| CVE-2026-66984 json | HCL AION is affected by a vulnerability where certain application responses revealed internal server file system paths. This ... | |
| CVE-2026-66982 json | HCL AION is affected by a vulnerability where browser autocomplete was enabled on sensitive login form fields, allowing the b... | |
| CVE-2026-66981 json | HCL AION is affected by a vulnerability where the application trusted the value of the HTTP Host header supplied in requests ... | |
| CVE-2026-59105 json | Jumis (formerly Tildes Jumis) creates and uses a Microsoft SQL Server login named ##Tilde_JumisAdmin## whose password is deri... | |
| CVE-2026-58141 json | Dify before 1.15.0 contains a server-side request forgery vulnerability that allows any authenticated console user to bypass ... | |
| CVE-2026-35113 json | HCL AION is affected by a vulnerability where the Cross-Origin-Opener-Policy (COOP) header was missing or insecure, allowing ... | |
| CVE-2026-35112 json | HCL AION is affected by a vulnerability where the Cross-Origin-Embedder-Policy (COEP) header was missing or insecure, so embe... | |
| CVE-2026-5345 json | HCL AION is affected by a missing encryption vulnerability in a second WebSocket connection defined in the GenAI web interfac... | |
| CVE-2026-97367 json | A flaw was found in the Keycloak Account REST API where it incorrectly handles session identification. A malicious client own... | |
| CVE-2026-92895 json | The Live2DWebCanvas plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.2.1 v... | |
| CVE-2026-92080 json | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in TÜBİTAK BİLGEM Software Te... | |
| CVE-2026-89101 json | The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerab... | |
| CVE-2026-35115 json | HCL AION is affected by a vulnerability where the HTTP Strict-Transport-Security (HSTS) header was missing or insecurely conf... | |
| CVE-2026-35114 json | HCL AION is affected by a vulnerability where the X-Content-Type-Options header was missing or insecure, allowing browsers to... | |
| CVE-2026-35111 json | HCL AION is affected by a vulnerability where the Cross-Origin-Resource-Policy (CORP) header was missing or insecure, allowin... | |
| CVE-2026-35110 json | HCL AION is affected by a vulnerability where encrypted (HTTPS) communication was not enforced for all requests. Data may be ... | |
| CVE-2026-35109 json | HCL AION is affected by a vulnerability where pages served over HTTPS could be cached by the browser or intermediate proxies.... | |
| CVE-2026-35107 json | HCL AION is affected by an open redirect vulnerability in the user menu of the GenAI web interface (UserMenu component). The ... | |
| CVE-2026-35106 json | HCL AION is affected by an open redirect vulnerability in the session-handling logic of the GenAI web interface (UserContext ... | |
| CVE-2026-35105 json | HCL AION is affected by an open redirect vulnerability in the session-handling logic of the GenAI web interface (UserContext ... | |
| CVE-2026-35104 json | HCL AION is affected by an open redirect vulnerability on the user registration page (Signup component). The redirect perform... | |
| CVE-2026-35103 json | HCL AION is affected by an open redirect vulnerability on the role assignment pending page (RoleAssignPending component). The... | |
| CVE-2026-35102 json | HCL AION is affected by an open redirect vulnerability in the navigation bar of the GenAI web interface (Navbar component). T... | |
| CVE-2026-77152 json | Improper Authorization vulnerability in Drupal Field Collection for Drupal 7 allows a user with the "edit field collections" ... | |
| CVE-2026-58963 json | In multiple locations, there is a possible denial of service due to improper input validation. This could lead to remote deni... | |
| CVE-2026-58953 json | In dec_vlc_read of oapv_vlc.c, there is a possible out-of-bounds read due to a heap buffer overflow. This could lead to remot... | |
| CVE-2026-58951 json | In multiple locations, there is a possible permission bypass due to a missing permission check. This could lead to local info... | |
| CVE-2026-58945 json | In multiple locations, there is a possible side channel information leak due to improperly used crypto. This could lead to pa... | |
| CVE-2026-58938 json | In parseChunk of MPEG4Extractor.cpp, there is a possible denial of service due to improper input validation. This could lead ... | |
| CVE-2026-58930 json | An unprivileged application can exploit a lack of package/signature validation in SystemUI's `RemoteQCController` when resolv... | |
| CVE-2026-58927 json | The vulnerability is a Use-After-Free (UAF) in the EVS AIDL HAL, arising from a data race on an unsynchronized `std::weak_ptr... | |
| CVE-2026-58925 json | The report details a heap Use-After-Free (UAF) vulnerability within the `android.hardware.automotive.evs-default` HAL service... | |
| CVE-2026-58924 json | The vulnerability is a heap out-of-bounds read in the EVS HAL's `getStreamList()` method. An attacker can craft a `CameraDesc... | |
| CVE-2026-58882 json | In decodeWapPdu of WapPushOverSms.java, there is a possible out of bounds read due to an integer overflow. This could lead to... | |
| CVE-2026-58870 json | In onPersistentGroupsChanged of WifiP2pServiceImpl.java, there is a possible permission bypass due to a missing permission ch... | |
| CVE-2026-55270 json | In dialInternal in multiple locations, there is a possible permission bypass due to a confused deputy. This could lead to loc... | |
| CVE-2026-28621 json | In getRingtone of RingtoneFactory.java, there is a possible unprivileged access risk due to a missing permission check. This ... | |
| CVE-2026-84391 json | A use of uninitialized variable vulnerability in Fortinet FortiAnalyzer 7.6.3 through 7.6.6 may allow attacker to denial of s... | |
| CVE-2026-84388 json | A improper restriction of rendered ui layers or frames vulnerability in Fortinet FortiPAM Chrome Extension 8.0 all versions m... | |
| CVE-2026-71407 json | A Stack-based Buffer Overflow vulnerability [CWE-121] vulnerability in Fortinet FortiOS 7.6.1 through 7.6.6 may allow an unau... | |
| CVE-2026-28581 json | In fixInitiatingUserIfNecessary of CallIntentProcessor.java, there is a possible way to make an emergency call due to a logic... | |
| CVE-2026-28578 json | In multiple functions of DevicePolicyManagerService.java, there is a possible desync from persistence due to improper input v... | |
| CVE-2026-26084 json | A improper access control vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, Forti... | |
| CVE-2026-0100 json | In Load of LoadedArsc.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local es... | |
| CVE-2026-0098 json | In getCallingPackageName of Shared.java, there is a possible way to bypass activity start restrictions due to a confused depu... | |
| CVE-2026-0096 json | In getAppLabel of ForgetDeviceDialogFragment.java, there is a possible trick the user into forgetting a device due to mislead... | |
| CVE-2026-0094 json | In getApplicationLabel of KeyChainActivity.java, there is a possible way to trick the user into approving access to certifica... | |
| CVE-2026-0091 json | In multiple locations, there is a possible way to execute code in the launcher process due to an over-privileged shell user. ... | |
| CVE-2026-45963 json | In the Linux kernel, the following vulnerability has been resolved: ASoC: nau8821: Cancel delayed work on component remove ... | |
| CVE-2026-0088 json | In getCallingAppLabel of CertInstaller.java, there is a possible way to hide a sensitive security dialogue due to misleading ... | |
| CVE-2026-0086 json | In onCreate of DisableSupervisionActivity.kt, there is a possible way to delete supervision data due to a missing null check.... | |
| CVE-2026-0080 json | In multiple functions of ubsan_throwing_runtime.cpp, there is a possible way to cause a crash due to an integer overflow. Thi... | |
| CVE-2026-0078 json | In setGlobalProxy of DevicePolicyManagerService.java, there is a possible desync in persistence due to improper input validat... | |
| CVE-2026-0076 json | In validateNode of ResourceTypes.cpp, there is a possible out of bounds read due to an incorrect bounds check. This could lea... | |
| CVE-2026-0074 json | In getPreferredSize of LauncherProcessImageListener.kt, there is a possible denial of service due to resource exhaustion. Th... | |
| CVE-2026-0070 json | In multiple functions of DevicePolicyManagerService.java, there is a possible way to hide a system critical package due to im... | |
| CVE-2026-0061 json | In multiple functions of WindowState.java, there is a possible way to trick a user into accepting a permission due to a tapja... | |
| CVE-2026-0059 json | In multiple functions of sdp_discovery.cc, there is a possible way to achieve code execution due to a heap buffer overflow. T... | |
| CVE-2026-0055 json | In createSessionInternal of PackageInstallerService.java, there is a possible to update a Device Policy Controller (DPC) into... | |
| CVE-2026-0051 json | In multiple functions of ubsan_throwing_runtime.cpp, there is a possible way to cause a system crash due to improper input va... | |
| CVE-2026-45892 json | In the Linux kernel, the following vulnerability has been resolved: ext4: drop extent cache after doing PARTIAL_VALID1 zeroo... | |
| CVE-2026-43478 json | In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: rt1011: Use component to get the dapm cont... | |
| CVE-2026-43443 json | In the Linux kernel, the following vulnerability has been resolved: ASoC: amd: acp-mach-common: Add missing error check for ... | |
| CVE-2026-43344 json | In the Linux kernel, the following vulnerability has been resolved: perf/x86/intel/uncore: Fix die ID init and look up bugs ... | |
| CVE-2026-43311 json | In the Linux kernel, the following vulnerability has been resolved: soc/tegra: pmc: Fix unsafe generic_handle_irq() call Cu... | |
| CVE-2026-43308 json | In the Linux kernel, the following vulnerability has been resolved: btrfs: don't BUG() on unexpected delayed ref type in run... | |
| CVE-2026-43305 json | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix mismatched unlock for DMUB HW lock ... | |
| CVE-2026-43191 json | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Adjust PHY FSM transition to TX_EN-to-P... | |
| CVE-2026-43131 json | In the Linux kernel, the following vulnerability has been resolved: drm/amd/pm: Fix null pointer dereference issue If SMU i... | |
| CVE-2026-43095 json | In the Linux kernel, the following vulnerability has been resolved: ASoC: SDCA: Fix errors in IRQ cleanup IRQs are enabled ... | |
| CVE-2026-43053 json | In the Linux kernel, the following vulnerability has been resolved: xfs: close crash window in attr dabtree inactivation Wh... | |
| CVE-2026-43022 json | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -E... | |
| CVE-2026-43021 json | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: fix leaks when hci_cmd_sync_queue_o... | |
| CVE-2026-31777 json | In the Linux kernel, the following vulnerability has been resolved: ALSA: ctxfi: Check the error for index mapping The ctxf... | |
| CVE-2026-31776 json | In the Linux kernel, the following vulnerability has been resolved: ALSA: ctxfi: Fix missing SPDIFI1 index handling SPDIF1 ... | |
| CVE-2026-31775 json | In the Linux kernel, the following vulnerability has been resolved: ALSA: ctxfi: Don't enumerate SPDIF1 at DAIO initializati... | |
| CVE-2026-39810 json | A use of hard-coded cryptographic key vulnerability in Fortinet FortiClientEMS 7.4.3 through 7.4.5, FortiClientEMS 7.4.0 thro... | |
| CVE-2026-27316 json | A insufficiently protected credentials vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4 all versi... | |
| CVE-2026-0049 json | In onHeaderDecoded of LocalImageResolver.java, there is a possible persistent denial of service due to resource exhaustion. T... | |
| CVE-2026-123339 json | Improper trust of forwarded headers in RouterListener::onKernelFinishRequest() in Symfony HttpKernel versions prior to 5.4.... | |
| CVE-2026-123335 json | In JetBrains YouTrack before 2026.2.19562, 2026.1.14137, 2025.3.169041 missing authorization allowed attaching tags to any... | |
| CVE-2026-123334 json | In JetBrains YouTrack before 2026.2.19562 project admins of a related project could delete VCS integrations owned by another ... | |
| CVE-2026-123333 json | In JetBrains YouTrack before 2026.2.19562 sprint creation allowed moving issues from inaccessible projects between sprints | |
| CVE-2026-123332 json | In JetBrains YouTrack before 2026.2.19562 missing authorization allowed Project Admin to manage VCS hosting server configurat... | |
| CVE-2026-123331 json | In JetBrains YouTrack before 2026.2.19197 article editors could change visibility of restricted child articles | |
| CVE-2026-123330 json | In JetBrains YouTrack before 2026.2.19562 missing authorization allowed users with read-only access to change issue visibilit... | |
| CVE-2026-123329 json | In JetBrains YouTrack before 2026.2.19562 missing authorization in TeamCity integration allowed disclosure of other projects'... | |
| CVE-2026-123328 json | In JetBrains YouTrack before 2026.2.19656 app permission bypass allowed privilege escalation via project tab | |
| CVE-2026-123327 json | In JetBrains YouTrack before 2026.2.19562 missing authorization in the saved query endpoint allowed disclosure of issue descr... | |
| CVE-2026-120659 json | The Redirection for Contact Form 7 plugin for WordPress is vulnerable to authorization bypass in all versions up to, and incl... | |
| CVE-2026-120263 json | When `[oauth2_client].ACCOUNT_LINKING` is set to `auto` (not the default) and registration is enabled, the link-account sign-... | |
| CVE-2026-119533 json | Repository and organization project boards listed the pull requests that reference each issue on the board without checking w... | |
| CVE-2026-119499 json | Insertion of Sensitive Information Into Sent Data vulnerability in BAKKBONE Australia FloristPress bakkbone-florist-companion... | |
| CVE-2026-119441 json | `DELETE /api/v1/orgs/{org}/repos` deletes all repositories of an organization, but it did not enforce the public-only restric... |