CVE.report
CVE.report is the most up-to-date database of common vulnerabilities and exposures. Information is pulled in from several sources and processed in to a mobile friendly, easy to use page. Use the site to quickly check for vulnerabilities in products such as operating systems, applications, hardware, networks, databases, browsers, e-mail clients and more.
CVEs provide a unique and common naming scheme for publicly known cyber security vulnerabilities in order to quickly identify and share these vulnerabilities. You can use the search below to look for vulnerabilities based on product, vendor, or common tags
The form you will see after following this link allows you to fill out the various variables in the CVSS scoring system and receive the corresponding score. The description of each of the variables is also included for additional information.
cve.report now provides a free read-only JSON API for CVE details. Each record combines the CVE Program JSON record, NVD enrichment, KEV, and EPSS when available.
Recent CVEs
| CVE | Description | Updated |
|---|---|---|
| CVE-2026-82894 json | Improper Authorization in ContentWorker in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticate... | |
| CVE-2026-81828 json | Server-Side Request Forgery in SurveyWrapper in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an authenticated b... | |
| CVE-2026-81816 json | XML External Entity (XXE) Injection in ContentWorker in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote a... | |
| CVE-2026-123032 json | A security flaw has been discovered in OpenBMB Internet of Agents up to 9d78e88e47160eb42ee1ee8538c05e1c2c47877a. This affect... | |
| CVE-2026-119744 json | Cendio ThinLinc contains an improper authentication vulnerability in its browser-based web client (tlwebaccess) that allows a... | |
| CVE-2026-115738 json | SQL injection vulnerability in DLP on-prem extensions version 11.13.1 and earlier allows a remote authenticated attacker to i... | |
| CVE-2026-81815 json | SQL Injection in the entity engine's generic performFind service in Apache OFBiz 24.09 before 24.09.08 on MySQL/MariaDB-backe... | |
| CVE-2026-81808 json | Missing Authorization in ProductSearchEvents in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authentic... | |
| CVE-2026-81744 json | Incorrect Authorization in ContentPermissionServices in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote a... | |
| CVE-2026-81734 json | Missing Authorization in ProductEvents in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated a... | |
| CVE-2026-76152 json | Path traversal and missing authorization check in the imageCrop and imageRotate services in Apache OFBiz through 24.09.07 on ... | |
| CVE-2026-76150 json | Path traversal and missing authorization check in the replaceImageToExistImage service in Apache OFBiz through 24.09.07 on al... | |
| CVE-2026-74841 json | In multitenant deployments, ContextFilter and LoginWorker built a per-tenant delegator name from a request-supplied userTenan... | |
| CVE-2026-73580 json | Missing authorization check in the getHRChild service in Apache OFBiz through 24.09.07 on all platforms allows a remote unaut... | |
| CVE-2026-73578 json | Missing authorization enforcement in RequestHandler.renderView in Apache OFBiz 24.09 before 24.09.08 on all platforms allows ... | |
| CVE-2026-73577 json | Incorrect authorization in RequestHandler in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthentica... | |
| CVE-2026-71901 json | Improper Control of Resource Identifiers ('Resource Injection') vulnerability in Apache OFBiz. An authenticate user with a... | |
| CVE-2026-68524 json | An unauthenticated attacker can exploit temporary-file handling, access an open file descriptor, and inject a "file:" URI to ... | |
| CVE-2026-66903 json | Authenticated Path Traversal in Catalog Image Management allows writing image files outside the intended directory in Apache... | |
| CVE-2026-106716 json | ReelShort for Android version 3.8.55 loads an attacker-controlled activityUrl supplied through its cmsvictor://open deep link... | |
| CVE-2026-106715 json | NewsBreak for Android version 26.21.0 treats data:text/html; URLs as trusted in its WebView JavaScript bridge origin check. A... | |
| CVE-2026-106714 json | Chewy for Android version 26.23.0 does not adequately validate the host of a product-details deep link before loading it in a... | |
| CVE-2026-106713 json | An issue in FreeReels for Android version 2.3.11 allows a remote attacker to obtain sensitive information via the com.dramawa... | |
| CVE-2026-54384 json | VitaFit cloud API before 2026-10-30 contained an authentication bypass vulnerability that allows remote attackers to obtain a... | |
| CVE-2026-54383 json | VitaFit cloud API before 2026-10-30 contained an excessive data exposure vulnerability that allows any authenticated user to ... | |
| CVE-2026-54382 json | VitaFit cloud API before 2026-10-30 contained an improper access control vulnerability in its Cognito-issued AWS role that al... | |
| CVE-2026-54381 json | VitaFit cloud API before 2026-10-30 contained a misconfigured cloud storage bucket vulnerability that allows unauthenticated ... | |
| CVE-2026-54380 json | VitaFit cloud API before 2026-10-30 contained a stored cross-site scripting vulnerability that allows authenticated attackers... | |
| CVE-2026-54378 json | VitaFit cloud API before 2026-10-30 contained a broken access control vulnerability that allows any authenticated user to obt... | |
| CVE-2026-54377 json | VitaFit cloud API before 2026-10-30 contained an insecure direct object reference vulnerability that allows authenticated att... | |
| CVE-2026-54376 json | VitaFit Android application (com.vt.vitafit) before 2.8.1.0 contains an insecure custom URI scheme vulnerability that allows ... | |
| CVE-2026-54375 json | VitaFit Android application (com.vt.vitafit) before 2.8.1.0 contains an insecure session management vulnerability that allows... | |
| CVE-2026-54374 json | VitaFit Android application (com.vt.vitafit) before 2.8.1.0 contains a hardcoded credentials vulnerability that allows attack... | |
| CVE-2026-54373 json | VitaFit Android application (com.vt.vitafit) before 2.8.1.0 contains a cleartext traffic vulnerability that allows network-ba... | |
| CVE-2026-48175 json | Processing a malformed RRC message leads to an out-of-bounds read, resulting in a denial-of-service condition. | |
| CVE-2026-121621 json | A command injection vulnerability was found in Argo CD Image Updater, where a proxy URL configured on an SSH Git repository i... | |
| CVE-2026-117959 json | Site isolation issue in the DOM: Service Workers component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, T... | |
| CVE-2026-117958 json | Site isolation issue in the Networking: HTTP component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thund... | |
| CVE-2026-117957 json | Cryptographic issue in the WebRTC: Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thun... | |
| CVE-2026-117953 json | Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird... | |
| CVE-2026-117952 json | Uninitialized memory in the Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ES... | |
| CVE-2026-117951 json | Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ES... | |
| CVE-2026-117950 json | Incorrect boundary conditions in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115... | |
| CVE-2026-117949 json | Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ES... | |
| CVE-2026-117948 json | Use-after-free in the SVG component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thun... | |
| CVE-2026-117947 json | Use-after-free in the XML component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thu... | |
| CVE-2026-64860 json | ESP-Protocols is a collection of protocol components for ESP-IDF. Prior to mDNS version 1.11.2, the `mdns` component follows ... | |
| CVE-2026-54372 json | VitaFit Android application (com.vt.vitafit) before 2.8.1.0 contains an insecure TLS/SSL certificate validation vulnerability... | |
| CVE-2026-117946 json | Incorrect boundary conditions in the JavaScript Engine component. This vulnerability was fixed in Firefox 159, Firefox ESR 11... | |
| CVE-2026-117945 json | Incorrect boundary conditions in the XML component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbi... | |
| CVE-2026-117944 json | Use-after-free in the Layout component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, T... | |
| CVE-2026-117943 json | Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ES... | |
| CVE-2026-117942 json | Incorrect boundary conditions in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 159, Firefox E... | |
| CVE-2026-117941 json | Use-after-free in the DOM: CSS Object Model component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firef... | |
| CVE-2026-117935 json | Use-after-free in the DOM: Bindings (WebIDL) component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Fire... | |
| CVE-2026-117934 json | Use-after-free in the Layout component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, T... | |
| CVE-2026-93748 json | http-cache-semantics through 4.2.0 fails to properly validate security-zeroed cache entries when processing client max-stale ... | |
| CVE-2026-93687 json | braces through 3.0.3 contains a stack overflow vulnerability in the recursive AST walkers that lack depth guards. Attackers c... | |
| CVE-2026-78002 json | A flaw was found in rsyslog. An unauthenticated remote attacker can trigger a heap buffer overflow in the RainerScript `repla... | |
| CVE-2026-39726 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Lumise Lumise Product D... | |
| CVE-2025-11395 json | A flaw was found in Podman. If an attacker can pass a crafted tar archive to the `podman load` command, they can create files... | |
| CVE-2026-19654 json | A unauthenticated remote peer may lead rsyslogd to crash due to a flaw in the optional imptcp module. A crafted input sequenc... | |
| CVE-2025-14946 json | A flaw was found in libnbd. A malicious actor could exploit this by convincing libnbd to open a specially crafted Uniform Res... | |
| CVE-2025-14905 json | A flaw was found in the 389-ds-base server. A heap buffer overflow vulnerability exists in the `schema_attr_enum_callback` fu... | |
| CVE-2025-14831 json | A flaw was found in GnuTLS. This vulnerability allows a denial of service (DoS) by excessive CPU (Central Processing Unit) an... | |
| CVE-2025-14512 json | A flaw was found in glib. This vulnerability allows a heap buffer overflow and denial-of-service (DoS) via an integer overflo... | |
| CVE-2025-14242 json | A flaw was found in vsftpd. This vulnerability allows a denial of service (DoS) via an integer overflow in the ls command par... | |
| CVE-2025-14104 json | A flaw was found in util-linux. This vulnerability allows a heap buffer overread when processing 256-byte usernames, specific... | |
| CVE-2025-14087 json | A flaw was found in GLib (Gnome Lib). This vulnerability allows a remote attacker to cause heap corruption, leading to a deni... | |
| CVE-2025-13601 json | A heap-based buffer overflow problem was found in glib through an incorrect calculation of buffer size in the g_escape_uri_st... | |
| CVE-2025-13193 json | A flaw was found in libvirt. External inactive snapshots for shut-down VMs are incorrectly created as world-readable, making ... | |
| CVE-2025-12801 json | A vulnerability was recently discovered in the rpc.mountd daemon in the nfs-utils package for Linux, that allows a NFSv3 clie... | |
| CVE-2025-11065 json | A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. Thi... | |
| CVE-2025-32990 json | A heap-buffer-overflow (off-by-one) flaw was found in the GnuTLS software in the template parsing logic within the certtool u... | |
| CVE-2025-32989 json | A heap-buffer-overread vulnerability was found in GnuTLS in how it handles the Certificate Transparency (CT) Signed Certifica... | |
| CVE-2025-32988 json | A flaw was found in GnuTLS. A double-free vulnerability exists in GnuTLS due to incorrect ownership handling in the export lo... | |
| CVE-2025-32914 json | A flaw was found in libsoup, where the soup_multipart_new_from_message() function is vulnerable to an out-of-bounds read. Thi... | |
| CVE-2025-32912 json | A flaw was found in libsoup, where SoupAuthDigest is vulnerable to a NULL pointer dereference. The HTTP server may cause the ... | |
| CVE-2025-32910 json | A flaw was found in libsoup, where soup_auth_digest_authenticate() is vulnerable to a NULL pointer dereference. This issue ma... | |
| CVE-2025-32909 json | A flaw was found in libsoup. SoupContentSniffer may be vulnerable to a NULL pointer dereference in the sniff_mp4 function. Th... | |
| CVE-2025-31177 json | gnuplot is affected by a heap buffer overflow at function utf8_copy_one. | |
| CVE-2025-12748 json | A flaw was discovered in libvirt in the XML file processing. More specifically, the parsing of user provided XML files was pe... | |
| CVE-2025-12464 json | A stack-based buffer overflow was found in the QEMU e1000 network device. The code for padding short frames was dropped from ... | |
| CVE-2025-12105 json | A flaw was found in the asynchronous message queue handling of the libsoup library, widely used by GNOME and WebKit-based app... | |
| CVE-2025-11568 json | A data corruption vulnerability has been identified in the luksmeta utility when used with the LUKS1 disk encryption format. ... | |
| CVE-2025-11234 json | A flaw was found in QEMU. If the QIOChannelWebsock object is freed while it is waiting to complete a handshake, a GSource is ... | |
| CVE-2025-10911 json | A use-after-free vulnerability was found in libxslt while parsing xsl nodes that may lead to the dereference of expired point... | |
| CVE-2025-3576 json | A vulnerability in the MIT Kerberos implementation allows GSSAPI-protected messages using RC4-HMAC-MD5 to be spoofed due to w... | |
| CVE-2025-32907 json | A flaw was found in libsoup. The implementation of HTTP range requests is vulnerable to a resource consumption attack. This f... | |
| CVE-2025-32053 json | A flaw was found in libsoup. A vulnerability in sniff_feed_or_html() and skip_insignificant_space() functions may lead to a h... | |
| CVE-2025-32052 json | A flaw was found in libsoup. A vulnerability in the sniff_unknown() function may lead to heap buffer over-read. | |
| CVE-2025-32051 json | A flaw was found in libsoup. The libsoup soup_uri_decode_data_uri() function may crash when processing malformed data URI. Th... | |
| CVE-2025-32050 json | A flaw was found in libsoup. The libsoup append_param_quoted() function may contain an overflow bug resulting in a buffer und... | |
| CVE-2025-32049 json | A flaw was found in libsoup. The SoupWebsocketConnection may accept a large WebSocket message, which may cause libsoup to all... | |
| CVE-2025-31181 json | A flaw was found in gnuplot. The X11_graphics() function may lead to a segmentation fault and cause a system crash. | |
| CVE-2025-31180 json | A flaw was found in gnuplot. The CANVAS_text() function may lead to a segmentation fault and cause a system crash. | |
| CVE-2025-31179 json | A flaw was found in gnuplot. The xstrftime() function may lead to a segmentation fault, causing a system crash. | |
| CVE-2025-31178 json | A flaw was found in gnuplot. The GetAnnotateString() function may lead to a segmentation fault and cause a system crash. | |
| CVE-2025-31176 json | A flaw was found in gnuplot. The plot3d_points() function may lead to a segmentation fault and cause a system crash. | |
| CVE-2025-3359 json | A flaw was found in GNUPlot. A segmentation fault via IO_str_init_static_internal may jeopardize the environment. |