CVE.report
CVE.report is the most up-to-date database of common vulnerabilities and exposures. Information is pulled in from several sources and processed in to a mobile friendly, easy to use page. Use the site to quickly check for vulnerabilities in products such as operating systems, applications, hardware, networks, databases, browsers, e-mail clients and more.
CVEs provide a unique and common naming scheme for publicly known cyber security vulnerabilities in order to quickly identify and share these vulnerabilities. You can use the search below to look for vulnerabilities based on product, vendor, or common tags
The form you will see after following this link allows you to fill out the various variables in the CVSS scoring system and receive the corresponding score. The description of each of the variables is also included for additional information.
cve.report now provides a free read-only JSON API for CVE details. Each record combines the CVE Program JSON record, NVD enrichment, KEV, and EPSS when available.
Recent CVEs
| CVE | Description | Updated |
|---|---|---|
| CVE-2026-129180 json | A flaw has been found in projectworlds Visitor Management System 1.0. This vulnerability affects the function mysqli_query of... | |
| CVE-2026-129173 json | A security flaw has been discovered in Stirling-Tools Stirling-PDF up to 3.3.0. Affected is the function WorkflowParticipantC... | |
| CVE-2026-128347 json | ExcelJS through 4.4.0 contains an arbitrary file read vulnerability in the streaming WorkbookWriter that allows attackers to ... | |
| CVE-2026-128343 json | exceljs through 4.4.0 contains a denial of service vulnerability that allows attackers to block the event loop by supplying u... | |
| CVE-2026-128339 json | ExcelJS through 4.4.0 contains a memory exhaustion vulnerability in Worksheet._parseMergeCells that allows attackers to crash... | |
| CVE-2026-128242 json | actix-http before 3.20.1 and actix-web before 4.18.2 contain an unbounded decompression vulnerability in encoding::Decoder th... | |
| CVE-2026-128239 json | GPAC through 26.07.0 contains a NULL pointer dereference vulnerability in the MPEG-4 Form spatial-constraint handlers in src/... | |
| CVE-2026-128238 json | Scapy before 2.8.0 contains an uncontrolled recursion vulnerability in the BER/ASN.1 decoder in scapy/asn1/ber.py that allows... | |
| CVE-2026-128134 json | NLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials supporting research and de... | |
| CVE-2026-124726 json | Relative Path Traversal, with Unintended Proxy vulnerability in Apache APISIX. A caller of the MCP endpoint can invoke end... | |
| CVE-2026-124723 json | Interpretation Conflict, leading to Incorrect Authorization vulnerability in Apache APISIX. With match_uri_encoded_slash e... | |
| CVE-2026-124719 json | Authentication bypass by spoofing vulnerability in Apache APISIX. When a Route's configured headers carry a caller identit... | |
| CVE-2026-124716 json | Incorrect Authorization vulnerability in Apache APISIX. An authenticated user who holds any one of a route's required perm... | |
| CVE-2026-124680 json | Interpretation Conflict, resulting in (Incorrect Authorization) vulnerability in Apache APISIX. An unauthenticated client ... | |
| CVE-2026-124679 json | Authentication bypass by spoofing vulnerability in Apache APISIX. On routes using jwe-decrypt with strict: false and a for... | |
| CVE-2026-124666 json | Authentication bypass by spoofing vulnerability in Apache APISIX. On a route where multi-auth falls back from wolf-rbac to... | |
| CVE-2026-71531 json | PrestaShop before 8.2.9 and 9.2.1 contains an authorization flaw in the Webservice API that allows an attacker holding a key ... | |
| CVE-2026-71519 json | PrestaShop before 8.2.9 and 9.2.1 contains a broken access control vulnerability that allows an authenticated Webservice API ... | |
| CVE-2026-127284 json | A security flaw has been discovered in SourceCodester Food Ordering System 1.0. This affects an unknown part of the file admi... | |
| CVE-2026-127279 json | A vulnerability was detected in AIP-PUB ACPs-community up to 2.2.0. This impacts an unknown function of the file discovery-se... | |
| CVE-2026-127275 json | A vulnerability was determined in Linksys EA8100 1.0.3.216940. This issue affects the function SetRemoteSetting/SetUnsecuredW... | |
| CVE-2026-127088 json | 2FAuth before 9.0.1 contains a weak password recovery vulnerability that allows unauthenticated attackers to poison reset lin... | |
| CVE-2026-127080 json | OpsTree BuildPiper before 2.7.0 contains an improper authorization vulnerability that allows authenticated deploy users to de... | |
| CVE-2026-127076 json | OpsTree BuildPiper before 2.7.0 contains a broken access control vulnerability that allows authenticated users to list and bu... | |
| CVE-2026-126955 json | Glance from 0.8.0 before 0.8.8 contains an observable response discrepancy in handlePageRequest and handlePageContentRequest ... | |
| CVE-2026-126395 json | vLLM from 0.14.0rc1 before 0.31.0 contains an information disclosure vulnerability in sanitize_message() whose lowercase-only... | |
| CVE-2026-126366 json | MessagePack for Ruby is an implementation of the MessagePack binary serialization format. Prior to 1.8.7, the Java-platform m... | |
| CVE-2026-126358 json | Hono is a Web application framework that provides support for any JavaScript runtime. From 4.1.4 until 4.13.16, RegExpRouter ... | |
| CVE-2026-126298 json | NLTK before 3.10.4 contains a denial of service vulnerability in Tree.chomsky_normal_form that allows remote attackers to exh... | |
| CVE-2026-126294 json | Grav Login plugin before 3.11.0 contains an authentication bypass vulnerability that allows attackers with an account passwor... | |
| CVE-2026-126286 json | NocoDB before 2026.08.0 contains a reflected cross-site scripting vulnerability in PageLeavingWarning.vue that allows unauthe... | |
| CVE-2026-126278 json | NocoDB before 2026.08.1 contains a race condition vulnerability in users.service.ts that allows holders of a valid reset toke... | |
| CVE-2026-126270 json | NocoDB before 2026.09.1 contains a missing authentication vulnerability in the aggregated meta info route of utils.controller... | |
| CVE-2026-126266 json | SiYuan from 3.6.0 before 3.8.9 contains an information disclosure vulnerability that allows unauthenticated publish visitors ... | |
| CVE-2026-125055 json | The Chatterbug Forms – Fast, Flexible WordPress Form Builder plugin for WordPress is vulnerable to Arbitrary File Upload in... | |
| CVE-2026-121518 json | The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, ... | |
| CVE-2026-119077 json | The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to PHP Object Injection in all ver... | |
| CVE-2024-58405 json | Zipline through 3.7.9 contains an improper authorization vulnerability in the /api/auth/register endpoint, which enforces inv... | |
| CVE-2026-127029 json | A flaw was found in freeradius's Extensible Authentication Protocol Method for Subscriber Identity Module (EAP-SIM) module. W... | |
| CVE-2026-126210 json | @hono/node-server allows running the Hono application on Node.js. Prior to 1.19.18 and from 2.0.0 until 2.1.6, the server pas... | |
| CVE-2026-126206 json | Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. In ... | |
| CVE-2026-126190 json | Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 4.0, Soup Sieve repeatedly walks the... | |
| CVE-2026-124014 json | XWEB EVO 4.3.0 through 5.8.8 contains an unauthenticated arbitrary file write vulnerability that allows remote attackers to m... | |
| CVE-2026-124010 json | XWEB EVO before 5.6.2 contains a command injection vulnerability that allows unauthenticated remote attackers to execute arbi... | |
| CVE-2026-124006 json | XWEB EVO through 5.8.8 contains a predictable credential generation vulnerability that allows attackers to derive the Linux r... | |
| CVE-2026-124002 json | XWEB EVO versions 5.2.3 through before 5.7.0 contains a pre-authentication OS command injection vulnerability that allows una... | |
| CVE-2026-95651 json | Zoho Corporation ManageEngine DDI Central versions 6500 and below are vulnerable to an unauthenticated GSS-TSIG keytab update... | |
| CVE-2026-47259 json | BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.4, 1.5.1, and 1.6.0... | |
| CVE-2026-45265 json | BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.4 and 1.5.1, there ... | |
| CVE-2026-12708 json | Summary Cloudflare tokio-quiche was found to contain an uncontrolled resource consumption vulnerability in its HTTP/3 DATAG... | |
| CVE-2025-41725 json | Affected devices running firmware versions prior to 4.1.0 may crash and become unavailable when receiving specific malformed ... | |
| CVE-2024-58406 json | Huatian Dynamic OA8000 collaborative office system contains an unauthenticated path traversal vulnerability in /OAapp/jsp/tra... | |
| CVE-2025-71463 json | Scapy before 2.7.0 contains an insecure deserialization vulnerability in the load_session function that allows attackers to e... | |
| CVE-2025-71462 json | Zipline before 3.7.12 contains a cross-site scripting vulnerability in the login page that allows attackers to execute JavaSc... | |
| CVE-2025-71461 json | Zipline before 4.0.2 contains a predictable filename vulnerability that allows attackers to infer other users' upload filenam... | |
| CVE-2025-71460 json | Zipline before 4.2.1 contains a missing authorization vulnerability in the /api/user/files/transaction endpoint that allows a... | |
| CVE-2025-71459 json | Zipline through 4.3.2 contains a path traversal vulnerability that allows authenticated uploaders to write files outside the ... | |
| CVE-2025-59848 json | HCL Leap is vulnerable to Stored XSS through malicious application titles in the Manage page dialogs, allowing an attacker to... | |
| CVE-2025-59847 json | HCL Domino Leap is vulnerable to Stored XSS through malicious application titles in Manage page dialogs, allowing an attacker... | |
| CVE-2025-54507 json | Improper validation of consistency within input in AMD SEV (Secure Encrypted Virtualization) firmware could allow an attacker... | |
| CVE-2025-54501 json | Improper access control on an internal debug interface could allow a high privileged attacker to bypass memory access control... | |
| CVE-2025-48504 json | Operation on a resource after expiration or release in the Secure Encrypted Virtualization (SEV) firmware could allow a malic... | |
| CVE-2025-29941 json | Incorrect usage of seeds in pseudo-random number generator in the Secure Encrypted Virtualization (SEV) firmware could allow ... | |
| CVE-2025-15714 json | The Live Composer WordPress plugin before 2.1.24 does not sanitise and escape some of its Button module settings before outp... | |
| CVE-2025-15713 json | The Live Composer WordPress plugin before 2.1.24 does not sanitise and escape some of its page-builder module settings befor... | |
| CVE-2025-15712 json | The Live Composer WordPress plugin before 2.1.24 does not sanitise and escape some of its staff member settings before outpu... | |
| CVE-2025-15711 json | The Live Composer WordPress plugin before 2.1.24 does not sanitise and escape some of its module settings before outputting ... | |
| CVE-2025-10935 json | libilbm ILBM File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote at... | |
| CVE-2025-10698 json | Incorrect default permissions and Product released in Non-Release configuration vulnerability in OpenText Identity Console on... | |
| CVE-2025-0043 json | Incorrect directory permissions within AMD Vivado™ Lab Solutions could allow a local user-privileged attacker to escalate t... | |
| CVE-2025-62621 json | Expected behavior violation in AMD Secure Encrypted Virtualization (SEV) firmware could allow a malicious hypervisor to bypas... | |
| CVE-2025-62620 json | Improper validation of unsafe equivalence in input could allow an attacker with high privileges to reclaim the ring buffer qu... | |
| CVE-2025-61625 json | An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiAnalyzer 7.6... | |
| CVE-2025-54508 json | Improper validation of Reverse Map Table (RMP) entries in the Secure Encrypted Virtualization (SEV) firmware could allow a pr... | |
| CVE-2025-54506 json | A time-of-check to time-of-use (TOCTOU) race condition in the AMD SEV Secure Encrypted Virtualization (SEV) firmware could al... | |
| CVE-2025-54504 json | Insufficient Granularity of Access Control in AMD Secure Encrypted Virtualization (SEV) firmware could allow an attacker with... | |
| CVE-2025-54503 json | Improper handling of overlap between protected memory ranges in the Secure Encrypted Virtualization (SEV) firmware could allo... | |
| CVE-2025-52537 json | Improper access control within the AMD Secure Encrypted Virtualization (SEV) firmware could allow an attacker with administra... | |
| CVE-2025-52535 json | Improper resource reuse in the AMD Secure Encrypted Virtualization (SEV) firmware could allow an attacker with hypervisor acc... | |
| CVE-2025-29940 json | Unverified ownership in Secure Encrypted Virtualization (SEV) firmware could allow a privileged attacker with access to a mal... | |
| CVE-2025-13353 json | In gokey versions <0.2.0, a flaw in the seed decryption logic resulted in passwords incorrectly being derived solely from t... | |
| CVE-2025-10248 json | XSS Vulnerability in OpenText Filr Appliance versions upto 25.1.2 could allow an authenticated user to upload a malicious fi... | |
| CVE-2025-0027 json | Improper access control in AMD Secure Encrypted Virtualization (SEV) firmware could allow a malicious hypervisor to bypass Re... | |
| CVE-2025-0008 json | Insufficient verification of data authenticity may allow a local attacker to bypass Secure Debug Unlock (SDU), potentially re... | |
| CVE-2026-9870 json | IBM Cyber Fraud 1.0.0 through 1.1.0 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attac... | |
| CVE-2026-9821 json | IBM Cyber Fraud 1.0.0 through 1.1.0 could allow an unauthorized user to inject data into log messages due to improper neutral... | |
| CVE-2026-129137 json | Incorrect default permissions in the agent configuration folder in Devolutions PowerShell Universal 2026.3.4 and earlier allo... | |
| CVE-2026-128886 json | A flaw was found in dbus when configured with the nonce-tcp transport. An unauthenticated attacker able to connect to an expo... | |
| CVE-2026-124021 json | Control Web Panel (CWP) before webpanel_version 1.30.6 contains an authorization bypass vulnerability in the validate() funct... | |
| CVE-2026-124020 json | Control Web Panel (CWP) before webpanel_version 1.30.6 contains a host header injection vulnerability that allows unauthentic... | |
| CVE-2026-123628 json | IBM webMethods Integration Server 10.15 and 11.1 could allow a remote attacker to obtain sensitive information due to an expo... | |
| CVE-2026-115788 json | IBM App Connect Operator and IBM App Connect Enterprise Certified Containers Operands is vulnerable to Log Forging on a reque... | |
| CVE-2026-115501 json | IBM i 7.3 7.4, 7.5, and 7.6 is vulnerable to a stack buffer overflow, caused by improper bounds checking in the QFileSvr.400... | |
| CVE-2026-114468 json | IBM App Connect Operator and App Connect Enterprise Certified Containers Operands could allow an attacker with the ability to... | |
| CVE-2026-110331 json | A flaw was found in abrt. The completeness check introduced to mitigate CVE-2026-54228 and CVE-2026-54229 only verifies that ... | |
| CVE-2026-110330 json | A flaw was found in abrt. abrt-server trusts a client-supplied PID when creating problem dumps over abrt.socket and, running ... | |
| CVE-2026-97683 json | IBM Cyber Fraud 1.0.0 through 1.1.0 could allow a local attacker to bypass security restrictions due to a missing or misconfi... | |
| CVE-2026-94407 json | IBM ContextForge MCP Gateway 1.0.0 through 1.0.11 is potentially vulnerable to denial of service due to uncontrolled regular ... | |
| CVE-2026-91869 json | IBM Security QRadar EDR 3.12 through 3.12.26 could allow a remote authenticated attacker to bypass security restrictions due ... | |
| CVE-2026-91868 json | IBM Security QRadar EDR 3.12 through 3.12.26 could allow a remote authenticated attacker to obtain sensitive information due ... |