CVE.report
CVE.report is the most up-to-date database of common vulnerabilities and exposures. Information is pulled in from several sources and processed in to a mobile friendly, easy to use page. Use the site to quickly check for vulnerabilities in products such as operating systems, applications, hardware, networks, databases, browsers, e-mail clients and more.
CVEs provide a unique and common naming scheme for publicly known cyber security vulnerabilities in order to quickly identify and share these vulnerabilities. You can use the search below to look for vulnerabilities based on product, vendor, or common tags
The form you will see after following this link allows you to fill out the various variables in the CVSS scoring system and receive the corresponding score. The description of each of the variables is also included for additional information.
cve.report now provides a free read-only JSON API for CVE details. Each record combines the CVE Program JSON record, NVD enrichment, KEV, and EPSS when available.
Recent CVEs
| CVE | Description | Updated |
|---|---|---|
| CVE-2026-126085 json | Active Storage makes it simple to upload and reference files in cloud services and attach those files to Active Record object... | |
| CVE-2026-126081 json | Action Pack is a framework for handling and responding to web requests. Prior to 8.1.4.1 and 8.0.5.2, ActionController::Param... | |
| CVE-2026-126077 json | Action Pack is a framework for handling and responding to web requests. Prior to 8.1.4.1 and 8.0.5.2, When ActionDispatch::Co... | |
| CVE-2026-126072 json | Action Pack is a framework for handling and responding to web requests. Prior to 8.1.4.1 and 8.0.5.2, ActionController::Live:... | |
| CVE-2026-126069 json | Action View is a framework for handling view template lookup and rendering and provides view helpers for building HTML. Prior... | |
| CVE-2026-126065 json | OpenObserve is a cloud-native observability platform. Prior to 1.1.0, the shared authentication validator in src/api/common/s... | |
| CVE-2026-126061 json | Winter CMS is a content management system built on the Laravel PHP framework. From 1.2.13 until 1.2.14, the Backend\Controlle... | |
| CVE-2026-125338 json | Winter CMS is a content management system built on the Laravel PHP framework. Prior to 1.2.14, BrandSetting::renderCss() and ... | |
| CVE-2026-125334 json | Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.3, a forge.... | |
| CVE-2026-125330 json | HarnessRouter is a self-hosted unified API for agent harnesses. From version 0.4.2 until 0.31.7, routes that accept a session... | |
| CVE-2026-125322 json | pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible clients... | |
| CVE-2026-122101 json | CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature byp... | |
| CVE-2026-118484 json | CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature byp... | |
| CVE-2026-104060 json | Worklenz before 3.3.0 contains an SQL injection vulnerability in the reporting members endpoints that allows authenticated at... | |
| CVE-2026-79914 json | NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Versions 2.1... | |
| CVE-2026-63653 json | Group-Office is an enterprise customer relationship management and groupware tool. Prior to version 26.0.37, go/modules/commu... | |
| CVE-2026-61547 json | rabbitmq-c is a C-language AMQP client library for RabbitMQ. Prior to version 0.17.0, a heap buffer overflow exists in rabbit... | |
| CVE-2026-126048 json | Gwenhywfar 4.99.8beta before 5.14.2 contains a stack-based buffer overflow in GWEN_TLV_Buffer_To_DB() in src/parser/tlv.c whe... | |
| CVE-2026-125758 json | Aptabase before commit 61d4c01 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge... | |
| CVE-2026-125754 json | Dolibarr 20.0.0 through 23.0.4 and 24.x before 24.0.2 contains an insecure direct object reference vulnerability in api_expen... | |
| CVE-2026-125750 json | Firekylin through 2.18.1 contains an improper authorization vulnerability that allows editor-role users to read administrator... | |
| CVE-2026-125703 json | A flaw was found in the GStreamer gst-plugins-bad MXF plugin. Insufficient bounds checks when parsing crafted VANC data can c... | |
| CVE-2026-125124 json | compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. In version 0.... | |
| CVE-2026-124747 json | A flaw was found in BusyBox. When resuming a download over File Transfer Protocol (FTP), the wget utility fails to verify tha... | |
| CVE-2026-112137 json | A vulnerability has been identified in Mendix Studio Pro 11 (All versions >= V11.15.0 < V11.16.0), Mendix Studio Pro 11.12 (A... | |
| CVE-2026-82509 json | V programming language standard library net.http through version 0.5.2 prior to commit 4077484 contains a TLS certificate val... | |
| CVE-2026-60044 json | The backups created by the application use a weak static password allowing an unauthenticated remote attacker to access their... | |
| CVE-2026-60039 json | A high privileged remote attacker can perform a code injection in the backends backup restore function leading to code execut... | |
| CVE-2026-125405 json | Ettercap through 0.8.4.1 contains an out-of-bounds read vulnerability in Parse_NTLM_Auth() in src/dissectors/ec_http.c due to... | |
| CVE-2026-125401 json | Ettercap through 0.8.4.1 contains a heap buffer overflow vulnerability in gg_get_version() in src/dissectors/ec_gg.c that wri... | |
| CVE-2026-125397 json | NocoBase plugin-ai 2.1.0 through 2.2.41 contains an authorization bypass vulnerability in getAccessibleAIEmployee() that lets... | |
| CVE-2026-125393 json | MailEnable Enterprise Premium before 10.62 contains a heap overflow vulnerability in the IMAP X-FB-FETCH command that allows ... | |
| CVE-2026-125389 json | Intermesh Group-Office before 6.8.181, 25.0.116, and 26.0.58 contains a stored cross-site scripting vulnerability in the emai... | |
| CVE-2026-125385 json | INDOTALENT WHMS before 10.20261109 contains a path traversal vulnerability that allows authenticated users to read arbitrary ... | |
| CVE-2026-125381 json | DataRoom through 3.0.0 contains an sql injection vulnerability in MyBatisService.generateSql that allows sharer-role users to... | |
| CVE-2026-125377 json | Pig before 4.1.2 contains a missing authorization vulnerability in SysClientController that allows authenticated users withou... | |
| CVE-2026-125373 json | IETF Datatracker before 12.83.0 contains an authorization bypass vulnerability that allows NomCom role holders to access othe... | |
| CVE-2026-125369 json | Bitpoll through 0.11.0 contains an insecure direct object reference vulnerability that allows unauthenticated attackers to re... | |
| CVE-2026-125082 json | A security flaw has been discovered in sunkaifei FlyCMS up to e71738e0cfb7ffd48c2ce74242a2dbb43f84f25a. Affected by this vuln... | |
| CVE-2026-96769 json | The Extend B2B - Companies and Users Management for WooCommerce plugin for WordPress is vulnerable to Sensitive Information E... | |
| CVE-2026-125365 json | DollarDollar through 4.4 contains a missing authorization vulnerability in add_expense() that allows authenticated users to m... | |
| CVE-2026-125361 json | Tencent BrowserSkill through 0.4.2 contains a missing authentication vulnerability that allows local attackers to impersonate... | |
| CVE-2026-125357 json | Munin munin-httpd 2.99.1 through 2.999.18 contains a path traversal vulnerability in the static file handler of Munin::Master... | |
| CVE-2026-125118 json | Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.12, 7.8.13, 8.24.7,... | |
| CVE-2026-125114 json | Novu provides an API for sending notifications through multiple channels. Prior to 3.15.0, the conditions filter webhook in l... | |
| CVE-2026-125110 json | Rack is a modular Ruby web server interface. Prior to 2.2.25, 3.1.23, and 3.2.8, Rack::Static serves a path after Utils.clean... | |
| CVE-2026-125076 json | A vulnerability was found in SourceCodester Smart Attendance System with QR Code Scanner 1.0. Affected is an unknown function... | |
| CVE-2026-124996 json | A weakness has been identified in Turboderp-org ExLlamaV3 up to 1.6.3. The impacted element is the function routing_sel_norm_... | |
| CVE-2026-63644 json | bird-lg-go is a BIRD looking glass in Go. Prior to version 1.4.7, unsanitized input path enables arbitrary local file read, a... | |
| CVE-2026-63496 json | augment-vir is a collection of helper functions. Prior to version 31.73.5, the grep() function exported by @augment-vir/node ... | |
| CVE-2026-125269 json | FFmpeg through 9.0.2 contains a double free vulnerability in libavcodec/cbs_sei.c where cbs_sei_delete_message() leaves a sta... | |
| CVE-2026-125265 json | FFmpeg through 9.0.2 contains a use-after-free vulnerability in libavcodec/nvdec.c because ff_nvdec_start_frame() fails to re... | |
| CVE-2026-125261 json | FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in the SGI encoder's encode_frame() in libavcodec/sgienc.c,... | |
| CVE-2026-124834 json | A security vulnerability has been detected in iomad up to 4.5.15/5.0.11/5.1.8/5.2.4. Affected by this issue is the function s... | |
| CVE-2026-123817 json | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, the WebSocket reader retains... | |
| CVE-2026-123813 json | pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev102, pyLoad does not invalidate exis... | |
| CVE-2026-123808 json | Nuxt UI is an intuitive Vue UI library powered by Reka UI and Tailwind CSS. Prior to 4.8.1, the server-rendered form element ... | |
| CVE-2026-102643 json | AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of ... | |
| CVE-2026-102289 json | zizmor is a static analysis tool for CI/CD systems. In version 1.27.0, debug logging serializes the parsed application config... | |
| CVE-2026-12977 json | A flaw was found in the deployment-operation family of WildFly Core. Certain handlers, such as upload-deployment-url, lack pr... | |
| CVE-2026-125257 json | FFmpeg through 9.0.2 contains an off-by-one heap overflow vulnerability in get_exponent_dynamic() in libavcodec/nellymoserenc... | |
| CVE-2026-125253 json | FFmpeg through 9.0.2 contains an integer overflow in cbs_vp9_split_fragment() in libavcodec/cbs_vp9.c that wraps the superfra... | |
| CVE-2026-125249 json | FFmpeg 7.1 through 9.0.2 contains an integer overflow in ff_vk_decode_add_slice() in libavcodec/vulkan_decode.c that miscalcu... | |
| CVE-2026-125241 json | FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in libavcodec/flicvideo.c that allows attackers to write o... | |
| CVE-2026-125233 json | FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in dvbsub_encode() in libavcodec/dvbsubenc.c that undercou... | |
| CVE-2026-125229 json | FFmpeg through 9.0.2 contains an out-of-bounds memory access vulnerability in the encode_frame() function of libavcodec/huffy... | |
| CVE-2026-125217 json | FFmpeg through 9.0.2 contains an uninitialized memory use vulnerability in roq_dpcm_encode_frame() in libavcodec/roqaudioenc.... | |
| CVE-2026-125213 json | FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in the PSD decoder in libavcodec/psd.c that allows attacke... | |
| CVE-2026-125209 json | FFmpeg before 8.1.3 and 9.x before 9.0.2 contains a heap buffer overflow vulnerability in the DVD subtitle encoder that under... | |
| CVE-2026-125201 json | FFmpeg 7.0 before 8.1.3 and 9.x before 9.0.2 contains a heap out-of-bounds write vulnerability in vk_av1_decode_slice() in li... | |
| CVE-2026-125197 json | FFmpeg through 9.0.2 contains an integer underflow in decode_frame() in libavcodec/lcldec.c that allows attackers to trigger ... | |
| CVE-2026-125193 json | FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in bitpacked_decode_uyvy422() in libavcodec/bitpacked_dec.c... | |
| CVE-2026-125181 json | FFmpeg through 9.0.2 contains an out-of-bounds write vulnerability in flic_decode_frame_15_16BPP() in libavcodec/flicvideo.c ... | |
| CVE-2026-125177 json | FFmpeg through 9.0.2 contains an information disclosure vulnerability in the MSCC/SRGC decoder in libavcodec/mscc.c that outp... | |
| CVE-2026-125100 json | FFmpeg through 9.0.2 contains an integer overflow vulnerability in the OpenEXR decoder's decode_frame() in libavcodec/exr.c t... | |
| CVE-2026-125096 json | FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in libavcodec/tiertexseqv.c that allows attack... | |
| CVE-2026-124001 json | NASA JPL ION-DTN 2.2.1b through 4.2.0 contains an integer overflow vulnerability in the Datagram Retransmission (DGR) converg... | |
| CVE-2026-123804 json | SuperTokens Core is an open source authentication server. From 7.0.0 until 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 1... | |
| CVE-2026-125063 json | A flaw was found in the rrule validation of schedules in automation controller. Several non-anchored regular expressions with... | |
| CVE-2026-124624 json | A weakness has been identified in PipraPay 3.0.0. Affected by this vulnerability is the function hash_hmac of the file pp-con... | |
| CVE-2026-124079 json | rConfig Core 8.0.0 before 8.2.19 and rConfig Pro before 8.4.1 contain a deserialization of untrusted data vulnerability that ... | |
| CVE-2026-123800 json | SuperTokens Core is an open source authentication server. From 6.0.0 until 6.0.24, 7.0.23, 8.0.7, 9.0.6, 9.1.6, 9.2.7, 9.3.5,... | |
| CVE-2026-123796 json | compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From 0.32.0 u... | |
| CVE-2026-123370 json | compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From 0.9.0 un... | |
| CVE-2026-123364 json | OctoPrint provides a web interface for controlling consumer 3D printers. From 2.0.0rc1 until 2.0.0rc7, an authenticated user ... | |
| CVE-2026-121629 json | A flaw was found in GStreamer's adaptive streaming demuxers (HLS, DASH, MSS). When processing a media playlist or manifest, U... | |
| CVE-2026-113702 json | A security flaw has been discovered in iomad up to 4.5.15/5.0.11/5.1.8/5.2.4. Affected by this vulnerability is the function ... | |
| CVE-2026-112323 json | The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) 1.5.2 and later allows remote attackers to ... | |
| CVE-2026-112317 json | krb5_ktkdb_get_entry() in lib/kdb/keytab.c in MIT Kerberos 5 (aka krb5) 1.2.8 and later does not free decrypted key material ... | |
| CVE-2026-60117 json | The Android implementation of the Flutter/Dart receive_sharing_intent package, versions 1.4.1 through 1.9.0, contains a path ... | |
| CVE-2026-129180 json | A flaw has been found in projectworlds Visitor Management System 1.0. This vulnerability affects the function mysqli_query of... | |
| CVE-2026-129173 json | A security flaw has been discovered in Stirling-Tools Stirling-PDF up to 3.3.0. Affected is the function WorkflowParticipantC... | |
| CVE-2026-128347 json | ExcelJS through 4.4.0 contains an arbitrary file read vulnerability in the streaming WorkbookWriter that allows attackers to ... | |
| CVE-2026-128343 json | exceljs through 4.4.0 contains a denial of service vulnerability that allows attackers to block the event loop by supplying u... | |
| CVE-2026-128339 json | ExcelJS through 4.4.0 contains a memory exhaustion vulnerability in Worksheet._parseMergeCells that allows attackers to crash... | |
| CVE-2026-128242 json | actix-http before 3.20.1 and actix-web before 4.18.2 contain an unbounded decompression vulnerability in encoding::Decoder th... | |
| CVE-2026-128239 json | GPAC through 26.07.0 contains a NULL pointer dereference vulnerability in the MPEG-4 Form spatial-constraint handlers in src/... | |
| CVE-2026-128238 json | Scapy before 2.8.0 contains an uncontrolled recursion vulnerability in the BER/ASN.1 decoder in scapy/asn1/ber.py that allows... | |
| CVE-2026-128134 json | NLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials supporting research and de... | |
| CVE-2026-124726 json | Relative Path Traversal, with Unintended Proxy vulnerability in Apache APISIX. A caller of the MCP endpoint can invoke end... |