CVE.report
CVE.report is the most up-to-date database of common vulnerabilities and exposures. Information is pulled in from several sources and processed in to a mobile friendly, easy to use page. Use the site to quickly check for vulnerabilities in products such as operating systems, applications, hardware, networks, databases, browsers, e-mail clients and more.
CVEs provide a unique and common naming scheme for publicly known cyber security vulnerabilities in order to quickly identify and share these vulnerabilities. You can use the search below to look for vulnerabilities based on product, vendor, or common tags
The form you will see after following this link allows you to fill out the various variables in the CVSS scoring system and receive the corresponding score. The description of each of the variables is also included for additional information.
cve.report now provides a free read-only JSON API for CVE details. Each record combines the CVE Program JSON record, NVD enrichment, KEV, and EPSS when available.
Recent CVEs
| CVE | Description | Updated |
|---|---|---|
| CVE-2026-123976 json | EDFbrowser before 2.16 contains an out-of-bounds write vulnerability in check_edf_file() that allows attackers to overflow th... | |
| CVE-2026-123973 json | SharePoint Products CopyMove before 2026-11-06 allows traversal. An authenticated SharePoint user with the necessary permissi... | |
| CVE-2026-123876 json | A flaw was found in the default seccomp profile used by Podman via containers-common. Deny rules for AF_VSOCK and NETLINK_AUD... | |
| CVE-2026-123824 json | The Symfony Config component XmlUtils::parse() enables DTD validation before rejecting documents that carry a doctype, allo... | |
| CVE-2026-123783 json | Skyvern through 1.0.56 contains a sandbox bypass vulnerability that allows authenticated users to execute code by reconstruct... | |
| CVE-2026-123748 json | A security flaw has been discovered in chenyme grok2api up to 3.1.6. Affected by this vulnerability is the function proxyVoic... | |
| CVE-2026-123675 json | A flaw has been found in OpenBMB Internet of Agents up to 9d78e88e47160eb42ee1ee8538c05e1c2c47877a. This affects the function... | |
| CVE-2026-122193 json | OS command injection in the example SSM document provisioning script in Trusted Remote Execution (REX) before 2026-07-28 migh... | |
| CVE-2026-121881 json | SQL injection vulnerability in the get_last_seen code-server session-state RPC in Posit Software, PBC Posit Workbench before ... | |
| CVE-2026-121880 json | Authorization bypass through user-controlled key in the localhost port-proxy (/p/<token>/) in Posit Software, PBC RStudio Ser... | |
| CVE-2026-119758 json | ERPNext OCR app for Frappe/ERPNext through 1.1.1 contains a missing authorization and path traversal vulnerability that allow... | |
| CVE-2026-118670 json | OHIF Viewers is a zero-footprint DICOM viewer with shared extension packages. From 3.5.0-beta.0 until 3.12.15, 3.13.7, and 3.... | |
| CVE-2026-106144 json | Prototype Pollution in the Scheduler component (@progress/kendo-angular-scheduler and @progress/kendo-angular-common) in Prog... | |
| CVE-2026-106142 json | Cross-Site Scripting (XSS) in the Editor component (@progress/kendo-react-editor) in Progress Software KendoReact versions 2.... | |
| CVE-2026-106136 json | Cross-Site Scripting (XSS) in the Chat component (@progress/kendo-react-conversational-ui) in Progress Software KendoReact ve... | |
| CVE-2026-106135 json | Cross-Site Scripting (XSS) in the Chat component (@progress/kendo-angular-conversational-ui) in Progress Software Kendo UI fo... | |
| CVE-2026-106134 json | Cross-Site Scripting (XSS) in the Menu component (@progress/kendo-react-layout) in Progress Software KendoReact versions 1.3.... | |
| CVE-2026-106127 json | Prototype Pollution in the setter utility (@progress/kendo-react-common) in Progress Software KendoReact versions 3.5.0 throu... | |
| CVE-2026-104657 json | Missing integrity verification in the Progress Software Fiddler Download and Setup Skill on Linux, macOS, and Windows which a... | |
| CVE-2026-104656 json | Improper neutralization of input in the sessions grid in Progress Telerik Fiddler Everywhere 8.3.0 and earlier allows an atta... | |
| CVE-2026-103985 json | FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.231, the profile form exposes the only_assigned_tickets... | |
| CVE-2026-103984 json | FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.231, when limit_user_customer_visibility is enabled, th... | |
| CVE-2026-102650 json | Nuxt Content is the file-based CMS for Nuxt applications, powered by Markdown and Vue components. From 3.0.0 until 3.15.2, th... | |
| CVE-2026-102359 json | Kroki creates diagrams from textual descriptions. Prior to 0.31.2, the TikZ backend's tikz/tikz2svg guard used when KROKI_SAF... | |
| CVE-2026-102356 json | Kroki creates diagrams from textual descriptions. From 0.26.0 until 0.31.2, the optional Mermaid companion's mermaid/src/work... | |
| CVE-2026-89017 json | Skyline DataMiner BrokerGateway contains an embedded API key vulnerability that allows unauthenticated attackers to retrieve ... | |
| CVE-2026-85742 json | FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.230, a pre-authenticated attacker can place HTML in a f... | |
| CVE-2026-75598 json | The Gradle Shadow plugin creates fat or uber JARs and supports file transformation and package relocation. Prior to version 9... | |
| CVE-2026-62855 json | FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.225, the administrator-only App Logs viewer accepts Lar... | |
| CVE-2026-62344 json | Wanderer is a self-hosted trail database for saving and sharing adventures. Prior to 0.19.3, the unauthenticated GET /activit... | |
| CVE-2026-53980 json | Charmbracelet wish before 2.0.5 contains a path traversal vulnerability in the git middleware (charm.land/wish/v2) that allow... | |
| CVE-2026-123621 json | Usermin through 2.570 contains a path traversal vulnerability in mailbox/detachall.cgi that allows remote unauthenticated att... | |
| CVE-2026-123617 json | Openwhyd before 1.65.1 contains a NoSQL injection vulnerability that allows unauthenticated attackers to manipulate user look... | |
| CVE-2026-123489 json | Craft CMS 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2 contains a blind SQL injection vulnerability because the sandbox-expose... | |
| CVE-2026-123487 json | Parse Server before 8.6.115 and 9.0.0 before 9.10.7-alpha.1 validates user email address format with a regular expression who... | |
| CVE-2026-123485 json | Ground Station from 0.6.0 before 0.8.20 does not restrict the get-orbital-sources Socket.IO handler (also exposed as get-tle-... | |
| CVE-2026-123269 json | A vulnerability was detected in libyal libvmdk. Affected by this vulnerability is the function libvmdk_descriptor_file_read_h... | |
| CVE-2026-123037 json | A flaw was found in the ansible-core user module. When generate_ssh_key is enabled, User.ssh_key_gen() guards the key files a... | |
| CVE-2026-121794 json | The Travelly – Tour & Travel Booking Manager for WooCommerce plugin for WordPress is vulnerable to authorization bypass in ... | |
| CVE-2026-120844 json | Incorrect Privilege Assignment vulnerability in miniOrange OAuth Single Sign On – SSO (OAuth Client) miniorange-login-with-... | |
| CVE-2026-119170 json | There was a regression in how FIPS algorithms were enforced for the hashlib module. Only users that are using OpenSSL in FIPS... | |
| CVE-2026-115831 json | The VOD Infomaniak plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.5.15. T... | |
| CVE-2026-114630 json | The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to arbitrary file deletion due to ... | |
| CVE-2026-113618 json | The ZSIRep client library (ZSIREP.CLIENT.DLL) is vulnerable to improper server certificate validation. It registers a proces... | |
| CVE-2026-112340 json | Wazuh dashboard plugins from 4.9.0 before 4.14.9 contain an authorization bypass vulnerability that allows authenticated dash... | |
| CVE-2026-112338 json | Wazuh from 4.3.0 before 4.14.9 contains a server-side request forgery vulnerability in the GitHub module (wm_github.c) that t... | |
| CVE-2026-112334 json | Wazuh from 1.0.0 before 4.14.9 contains an out-of-bounds write vulnerability in wazuh-execd that allows privileged manager-co... | |
| CVE-2026-109081 json | A flaw was found in Keycloak. The Dynamic Client Registration (DCR) endpoint does not properly validate authorization when pr... | |
| CVE-2026-107124 json | A flaw was found in the OIDC logout endpoint of the keycloak-services component, which handles user session termination in Re... | |
| CVE-2026-103479 json | The Pubjet | پابجت plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 5... | |
| CVE-2026-97848 json | A flaw was found in the token sanitization logic of Keycloak, an open source identity and access management solution. The iss... | |
| CVE-2026-97367 json | A flaw was found in the Keycloak Account REST API where it incorrectly handles session identification. A malicious client own... | |
| CVE-2026-96547 json | A flaw was found in the Dynamic Client Registration component of Keycloak, an open-source identity and access management solu... | |
| CVE-2026-96460 json | A flaw was found in the token exchange mechanism of Keycloak. When using Standard Token Exchange V2, the system issues new to... | |
| CVE-2026-96447 json | A flaw was found in the TokenManager component of Keycloak, an open-source identity and access management solution. The issue... | |
| CVE-2026-92856 json | A flaw was found in the SAML brokering component of Keycloak, an identity and access management solution. The issue occurs wh... | |
| CVE-2026-92693 json | FastNetMon is a high-performance DDoS detector and sensor. In version 1.2.9 and earlier, parse_raw_packet_to_simple_packet_fu... | |
| CVE-2026-88981 json | Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the fron... | |
| CVE-2026-77299 json | Regexp2 is a feature-rich RegExp engine for Go. Prior to version 2.3.0, when regexp2 compiles and matches a pattern containin... | |
| CVE-2026-73471 json | A flaw was found in GStreamer gst-plugins-good (avidemux). In the Nikon metadata tag parser, a pointer can be dereferenced wi... | |
| CVE-2026-19688 json | A flaw was found in the Admin REST API of Keycloak, an identity and access management solution. The Admin API fails to verify... | |
| CVE-2026-9797 json | A flaw was found in Keycloak's administrative services (org.keycloak.services.resources.admin). A highly privileged attacker,... | |
| CVE-2026-120740 json | A flaw was found in hivex. By supplying a specially crafted Windows registry hive file, an attacker can trigger an out-of-bou... | |
| CVE-2026-120627 json | The Private Internet Access Extension for Firefox contains an unguarded onAuthRequired authentication handler, leading to lea... | |
| CVE-2026-120091 json | Temporal Server compiles a Worker Controller Instance module, go.temporal.io/auto-scaled-workers, into its Worker Service, an... | |
| CVE-2026-119328 json | Immich is a high-performance self-hosted photo and video management solution. Prior to 3.3.0, the unauthenticated machine-lea... | |
| CVE-2026-116769 json | CVE-2026-116769 is an authentication bypass vulnerability in Secure Access servers starting with version 13.0 and prior to 14... | |
| CVE-2026-116767 json | CVE-2026-116767 is an improper input handling vulnerability in Secure Access servers prior to 14.61. Authenticated attackers ... | |
| CVE-2026-116766 json | CVE-2026-116766 is an improper input handling vulnerability in the Secure Access server versions between 13.0 and prior to 14... | |
| CVE-2026-116635 json | Improper limitation of a pathname to a restricted directory in the deployment status component of the AWS Serverless MCP Serv... | |
| CVE-2026-115403 json | In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, built with BSD raw socket and IPv6 support, the IPv6 raw send... | |
| CVE-2026-115215 json | In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, the NetX Secure DTLS server allocates a session from its fixe... | |
| CVE-2026-114232 json | A flaw was found in the UserManagedPermissionService of the Keycloak authorization server. The UMA Protection API, which mana... | |
| CVE-2026-112913 json | filelock is a platform-independent file lock for Python. From 3.20.4 until 4.2.1, ReadWriteLock and AsyncReadWriteLock on Win... | |
| CVE-2026-112208 json | A flaw was found in the Organization identity-first login flow of the Keycloak authentication server. Keycloak is an open-sou... | |
| CVE-2026-110932 json | A flaw was found in the theme resource endpoint of Keycloak, an open-source identity and access management solution. The issu... | |
| CVE-2026-105770 json | Octo STS (github.com/octo-sts/app) before 0.11.2 returns trust policy configuration to callers whose OIDC token does not sati... | |
| CVE-2026-102943 json | Dagu is a workflow engine with a built-in Web user interface. Prior to version 2.11.0, its MCP dagu_read operation with t... | |
| CVE-2026-99270 json | In the Linux kernel, the following vulnerability has been resolved: tcp: Fix potential UAF in reqsk_timer_handler(). When T... | |
| CVE-2026-99255 json | In the Linux kernel, the following vulnerability has been resolved: io_uring/io-wq: don't hide a link from cancellations A ... | |
| CVE-2026-99254 json | In the Linux kernel, the following vulnerability has been resolved: io_uring: don't flood a cancelling task with task_work ... | |
| CVE-2026-99253 json | In the Linux kernel, the following vulnerability has been resolved: io_uring/cancel: rearm local work wake up before sleep ... | |
| CVE-2026-99231 json | In the Linux kernel, the following vulnerability has been resolved: io_uring/waitid: own the request before clearing ->head ... | |
| CVE-2026-99230 json | In the Linux kernel, the following vulnerability has been resolved: io_uring/cmd: don't leave list poison in ->hash_node io... | |
| CVE-2026-99229 json | In the Linux kernel, the following vulnerability has been resolved: io_uring/wait: don't spin on a stuck overflow list As l... | |
| CVE-2026-99228 json | In the Linux kernel, the following vulnerability has been resolved: io_uring/io-wq: don't lose the signal that ends work Wh... | |
| CVE-2026-97718 json | CVE-2026-97718 Is a cross-site request forgery vulnerability in version 14.60 of the Secure Access server. Because of a byp... | |
| CVE-2026-88979 json | Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. From 2.17.0 until 2.18.0,... | |
| CVE-2026-71450 json | Authentication bypass using an alternate path or channel vulnerability in Johnson Controls EasyIO Neo EC and CW Edge Controll... | |
| CVE-2026-62301 json | MyTube is a self-hosted downloader and player for several video websites. Prior to version 1.10.3, backend video access does ... | |
| CVE-2026-61694 json | go-xrpl is a Go implementation of the XRP Ledger protocol. In versions through the June 18, 2026 revision identified by the a... | |
| CVE-2026-58273 json | Rucio is a scientific data management framework. From 1.16.1 until 35.9.0, 38.6.0, and 41.0.0rc1, the /credentials/signurl en... | |
| CVE-2026-118475 json | A flaw was found in Eye of GNOME. When parsing a specially crafted PNG image containing malformed color profile metadata, the... | |
| CVE-2026-115456 json | A flaw was found in gcc. An attacker could cause a Denial of Service (DoS) by passing a string that is not null-terminated to... | |
| CVE-2026-115449 json | A flaw was found in libslirp. When handling ICMP echo requests, the reply length is not updated to match the actual data rece... | |
| CVE-2026-114488 json | A flaw was found in Wildfly. A remote attacker can bypass authentication on IIOP EJB invocations as the CSIv2 security interc... | |
| CVE-2026-114370 json | A flaw was found in the PathResourceManager component of the Undertow web server. This component is responsible for serving s... | |
| CVE-2026-114236 json | storage/pkg/archive.ApplyLayer and ApplyUncompressedLayer may, when processing corrupt or malicious inputs, leak a file descr... | |
| CVE-2026-113935 json | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2. An app may ... | |
| CVE-2026-113875 json | On a SmileCDR HAPI FHIR server with REST-hook subscriptions enabled, if a user is granted subscription-creation permissions, ... |