CVE.report
CVE.report is the most up-to-date database of common vulnerabilities and exposures. Information is pulled in from several sources and processed in to a mobile friendly, easy to use page. Use the site to quickly check for vulnerabilities in products such as operating systems, applications, hardware, networks, databases, browsers, e-mail clients and more.
CVEs provide a unique and common naming scheme for publicly known cyber security vulnerabilities in order to quickly identify and share these vulnerabilities. You can use the search below to look for vulnerabilities based on product, vendor, or common tags
The form you will see after following this link allows you to fill out the various variables in the CVSS scoring system and receive the corresponding score. The description of each of the variables is also included for additional information.
cve.report now provides a free read-only JSON API for CVE details. Each record combines the CVE Program JSON record, NVD enrichment, KEV, and EPSS when available.
Recent CVEs
| CVE | Description | Updated |
|---|---|---|
| CVE-2026-114732 json | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an improper authentication vulnerability in multi-host ... | |
| CVE-2026-114731 json | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an uncontrolled resource consumption vulnerability in t... | |
| CVE-2026-114730 json | Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a server-side request forgery filter bypass. The... | |
| CVE-2026-114729 json | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass. rcube_washtml inspect... | |
| CVE-2026-113406 json | BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary S... | |
| CVE-2026-110354 json | HAProxy 3 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (persistent worker-thread CPU ex... | |
| CVE-2026-110353 json | HAProxy 3.2 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (worker-thread CPU exhaustion)... | |
| CVE-2026-113405 json | BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary S... | |
| CVE-2026-112329 json | The Sensei LMS WordPress plugin before 4.26.4 contains a broken access control vulnerability in the legacy save_new_message h... | |
| CVE-2026-112293 json | BoxyHQ Enterprise SaaS Starter Kit through 1.6.0 contains a missing authorization vulnerability that allows non-owner team me... | |
| CVE-2026-112288 json | Krayin CRM 2.2.5 before 2.2.7 contains a server-side request forgery filter bypass that allows users with webhook permissions... | |
| CVE-2026-112283 json | VideoLAN libbluray through 1.5.1 contains an uncontrolled memory allocation vulnerability in _parse_extent_start_points() in ... | |
| CVE-2026-112278 json | rdesktop through 1.9.0 contains a heap out-of-bounds read vulnerability in process_raw_bmpcache() in orders.c that allows mal... | |
| CVE-2026-112273 json | libtins through 4.6 contains a heap out-of-bounds read vulnerability in DNS::compose_name in src/dns.cpp that allows remote a... | |
| CVE-2026-112268 json | sglang-router (sgl-model-gateway) through 0.3.2 contains an authorization bypass vulnerability that allows holders of the dat... | |
| CVE-2026-112263 json | Television (tv) 0.15.0 through 0.15.9 contains an OS command injection vulnerability that allows attackers to run shell comma... | |
| CVE-2026-112150 json | A security flaw has been discovered in vraj404 Criminal-Management-System up to 2808d057e7ddc5295519a487365b0cacfd0ba8c4. Aff... | |
| CVE-2026-112145 json | A security vulnerability has been detected in speaches-ai speaches up to 0.9.0-rc.3. This vulnerability affects the function ... | |
| CVE-2026-111936 json | Sigma File Manager through 2.2.0 contains a server-side request forgery vulnerability because validate_remote_url() in securi... | |
| CVE-2026-107081 json | SQL injection via identifier injection in the tableName and tableFields POST parameters of admin AJAX endpoints (admin/AJAX_l... | |
| CVE-2025-55654 json | A use-after-free in the gf_filter_pid_get_packet function (filter_core/filter_pid.c) of GPAC MP4Box v2.4 allows attackers to ... | |
| CVE-2026-112141 json | A vulnerability was determined in satya-vinay Events-Management-System up to 437c77ceb69bf9fe2e3f4f46f7871b83f425383a. Affect... | |
| CVE-2026-112108 json | A vulnerability was determined in ztxz16 fastllm up to 0.1.8.2. This impacts the function GGUFBuffer::ReadString of the file ... | |
| CVE-2026-112104 json | A flaw has been found in eremef bandcamp-player up to 1.8.33-beta. The impacted element is an unknown function of the file da... | |
| CVE-2026-112100 json | A vulnerability was determined in DeepPavlov up to 1.7.0. This affects the function MultiTaskPipelinePreprocessor.__init__ of... | |
| CVE-2026-112095 json | A flaw has been found in SourceCodester Inventory System 1.0. This affects an unknown part of the file /api/products_handler.... | |
| CVE-2026-112091 json | A flaw has been found in Dav-ee dairy-management-system 31ace9692d1e1e6d64339a42c463b361319c615c/f31a584c3330c013b61f8b0306d9... | |
| CVE-2026-112087 json | A weakness has been identified in itsourcecode Online Cake Ordering System 1.0. This issue affects some unknown processing of... | |
| CVE-2026-112081 json | A vulnerability was determined in hankcs HanLP up to 2.1.0-beta.64. This affects the function hanlp.load of the file plugins/... | |
| CVE-2026-112077 json | A vulnerability was detected in radareorg radare2 6.2.0/6.2.2. This issue affects the function r_core_cmd_str_pipe in the lib... | |
| CVE-2026-112073 json | A vulnerability was identified in Tencent ncnn up to 44b02dabdcf97499281a4692ebd65bad73dcf8b6. Affected by this vulnerability... | |
| CVE-2026-112042 json | A security flaw has been discovered in diem-project diem up to 116974edfb9a5b8bd69cb13586dc62bcdbb485ad. This issue affects t... | |
| CVE-2026-112038 json | A vulnerability has been found in diem-project diem up to 116974edfb9a5b8bd69cb13586dc62bcdbb485ad. Affected by this vulnerab... | |
| CVE-2026-112034 json | A weakness has been identified in aircheng-org iWebShop-5 up to 5.16. The impacted element is the function IController::redir... | |
| CVE-2026-111883 json | Locust through 2.46.7 contains a cross-site request forgery vulnerability that allows remote attackers to stop load tests or ... | |
| CVE-2026-112059 json | libLAS through 1.8.1 contains a heap out-of-bounds write vulnerability in the point record reader caused by truncating the sc... | |
| CVE-2026-112054 json | Schroedinger libschroedinger through 1.0.11 contains a divide by zero vulnerability that allows attackers to crash applicatio... | |
| CVE-2026-112049 json | Vita3K before build 4187 contains a path traversal (zip slip) vulnerability in install_archive_content() that allows attacker... | |
| CVE-2026-112030 json | A vulnerability was found in diem-project diem up to 5.1.3. This vulnerability affects unknown code of the file dmCorePlugin/... | |
| CVE-2026-112026 json | A security vulnerability has been detected in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c381... | |
| CVE-2026-112020 json | LodePNG through 20261006 contains a heap out-of-bounds read vulnerability in lodepng::getFilterTypesInterlaced() in lodepng_u... | |
| CVE-2026-112005 json | WhoDB 0.104.0 before 0.135.0 contains a path traversal vulnerability that allows remote attackers to read and write arbitrary... | |
| CVE-2026-112000 json | Vanus 0.8.0 through 0.9.0 contains a missing authorization vulnerability in the gateway that allows any authenticated user to... | |
| CVE-2026-111991 json | A security vulnerability has been detected in WongKinYiu yolov9 0.1. This vulnerability affects the function DetectMultiBacke... | |
| CVE-2026-111986 json | A vulnerability was determined in AUTOMATIC1111 stable-diffusion-webui up to 1.10.1. Affected is the function get_obj_from_st... | |
| CVE-2026-111932 json | Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contains a stored HTML injection v... | |
| CVE-2026-111877 json | A vulnerability was determined in dext34-morgan Books4Cash up to a8d3e357db75c07ac5ffbadcbaee2aeb4db3e571. This affects an un... | |
| CVE-2026-111873 json | A vulnerability was detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. This... | |
| CVE-2026-111869 json | A vulnerability was identified in makeplane plane up to 1.4.2. Impacted is an unknown function of the component API Endpoint.... | |
| CVE-2026-96398 json | Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0... | |
| CVE-2026-96392 json | Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal AI CKEditor allows Code Injecti... | |
| CVE-2026-96391 json | Missing Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. This issue affects Webform REST versions... | |
| CVE-2026-96390 json | Privilege Defined With Unsafe Actions vulnerability in Drupal Editoria11y Accessibility Checker allows Privilege Escalation. ... | |
| CVE-2026-96388 json | Cross-Site Request Forgery (CSRF) vulnerability in Drupal Tawk.to - Live chat application allows Cross Site Request Forgery. ... | |
| CVE-2026-96387 json | Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Stop administrator login allows Authenticati... | |
| CVE-2026-96386 json | Missing Authorization vulnerability in Drupal Smart Content allows Forceful Browsing. This issue affects Smart Content versio... | |
| CVE-2026-96385 json | Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal REST & JSON API Authentication for Drupal al... | |
| CVE-2026-96384 json | Incorrect Authorization vulnerability in Drupal Mermaid Diagram Field allows Forceful Browsing. This issue affects Mermaid Di... | |
| CVE-2026-96382 json | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Diba carousel sl... | |
| CVE-2026-96380 json | Missing Authorization vulnerability in Drupal CSS Usage Analyzer allows Forceful Browsing. This issue affects CSS Usage Analy... | |
| CVE-2026-96379 json | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal CookieCuttr allo... | |
| CVE-2026-96378 json | Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Commerce Decoupled Che... | |
| CVE-2026-96377 json | Allocation of Resources Without Limits or Throttling vulnerability in Drupal Combined image style allows Excessive Allocation... | |
| CVE-2026-96376 json | Improper Neutralization of Special Elements used in an OS Command ("OS Command Injection") vulnerability in Drupal Cloud allo... | |
| CVE-2026-96375 json | Improper Certificate Validation vulnerability in Drupal Cloud allows Adversary in the Middle (AiTM). This issue affects Cloud... | |
| CVE-2026-96374 json | Cross-Site Request Forgery (CSRF) vulnerability in Drupal Project Browser allows Cross Site Request Forgery. This issue affec... | |
| CVE-2026-96373 json | Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0... | |
| CVE-2026-96372 json | Insufficient Granularity of Access Control vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webfo... | |
| CVE-2026-96371 json | Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions:... | |
| CVE-2026-96370 json | Incorrect Authorization vulnerability in Drupal Webform allows Server Side Request Forgery. This issue affects Webform versio... | |
| CVE-2026-96369 json | Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Webform allows Exploiting Incorrectly Confi... | |
| CVE-2026-96368 json | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows S... | |
| CVE-2026-96367 json | Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions:... | |
| CVE-2026-96366 json | Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0... | |
| CVE-2026-96365 json | Allocation of Resources Without Limits or Throttling vulnerability in Drupal Webform allows Excessive Allocation. This issue ... | |
| CVE-2026-96364 json | Improper Control of Interaction Frequency vulnerability in Drupal Webform allows Functionality Misuse. This issue affects Web... | |
| CVE-2026-96363 json | Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions:... | |
| CVE-2026-96362 json | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows C... | |
| CVE-2026-96361 json | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows C... | |
| CVE-2026-96360 json | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows C... | |
| CVE-2026-96359 json | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows C... | |
| CVE-2026-96358 json | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows C... | |
| CVE-2026-96357 json | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows S... | |
| CVE-2026-96356 json | Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0... | |
| CVE-2026-96355 json | Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Webform allows Code Injection. ... | |
| CVE-2026-87955 json | Missing Authorization vulnerability in Drupal Ultimate Table Field allows Forceful Browsing. This issue affects Ultimate Tabl... | |
| CVE-2026-87954 json | Missing Authorization vulnerability in Drupal Taxonomy Term Glossary allows Forceful Browsing. This issue affects Taxonomy Te... | |
| CVE-2026-87953 json | Server-Side Request Forgery (SSRF) vulnerability in Drupal SAML SSO - Service Provider allows Server Side Request Forgery. T... | |
| CVE-2026-87952 json | Authentication Bypass by Capture-replay vulnerability in Drupal SAML SSO - Service Provider allows Remote Services with Stol... | |
| CVE-2026-87951 json | Insecure Storage of Sensitive Information vulnerability in Drupal SAML SSO - Service Provider allows Retrieve Embedded Sensi... | |
| CVE-2026-87950 json | Use of Hard-coded Credentials vulnerability in Drupal SAML SSO - Service Provider allows Retrieve Embedded Sensitive Data. T... | |
| CVE-2026-87949 json | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal SAML SSO - Servi... | |
| CVE-2026-87948 json | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal SAML SSO - Servi... | |
| CVE-2026-87947 json | Improper Verification of Cryptographic Signature vulnerability in Drupal SAML SSO - Service Provider allows Signature Spoof.... | |
| CVE-2026-87946 json | Observable Timing Discrepancy vulnerability in Drupal SAML SSO - Service Provider allows Brute Force. This issue affects SAM... | |
| CVE-2026-87945 json | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal SAML SSO - Service Provider allows Fake the Sour... | |
| CVE-2026-87944 json | Improper Certificate Validation vulnerability in Drupal SAML SSO - Service Provider allows Adversary in the Middle (AiTM). T... | |
| CVE-2026-87943 json | Missing Authorization vulnerability in Drupal SAML SSO - Service Provider allows Forceful Browsing. This issue affects SAML ... | |
| CVE-2026-87942 json | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal SafeDelete allow... | |
| CVE-2026-87941 json | Vulnerability in Drupal Patreon. This issue affects Patreon versions: 7.x. |