CVE.report
CVE.report is the most up-to-date database of common vulnerabilities and exposures. Information is pulled in from several sources and processed in to a mobile friendly, easy to use page. Use the site to quickly check for vulnerabilities in products such as operating systems, applications, hardware, networks, databases, browsers, e-mail clients and more.
CVEs provide a unique and common naming scheme for publicly known cyber security vulnerabilities in order to quickly identify and share these vulnerabilities. You can use the search below to look for vulnerabilities based on product, vendor, or common tags
The form you will see after following this link allows you to fill out the various variables in the CVSS scoring system and receive the corresponding score. The description of each of the variables is also included for additional information.
cve.report now provides a free read-only JSON API for CVE details. Each record combines the CVE Program JSON record, NVD enrichment, KEV, and EPSS when available.
Recent CVEs
| CVE | Description | Updated |
|---|---|---|
| CVE-2026-113501 json | The LiteSpeed Cache WordPress plugin before 7.9.2 does not perform a capability check on its admin-notice dismissal handler, ... | |
| CVE-2026-113500 json | The LiteSpeed Cache WordPress plugin before 7.9.2 does not limit one of its HTML optimization routines to stylesheet content,... | |
| CVE-2026-113499 json | The LiteSpeed Cache WordPress plugin before 7.9.2 does not restrict one of its HTML rewriting routines to stylesheet content,... | |
| CVE-2026-113472 json | The Depicter — Popup & Slider Builder WordPress plugin before 4.8.2 does not properly validate uploaded files in its editor... | |
| CVE-2026-112230 json | The Popup Builder WordPress plugin before 4.4.6 does not perform authorization checks before trashing popup content in a mai... | |
| CVE-2026-112219 json | The Download Monitor WordPress plugin before 5.3.5 does not correctly restrict management of the list of filesystem locations... | |
| CVE-2026-111982 json | The User Profile Builder WordPress plugin before 4.0.5 does not verify that a user is authorized to edit the specific accoun... | |
| CVE-2026-111966 json | The User Profile Builder WordPress plugin before 4.0.5 does not sanitise and escape one of its shortcode attributes before o... | |
| CVE-2026-111738 json | The Speed Optimizer WordPress plugin before 7.8.5 does not verify network-level privilege before applying an option change t... | |
| CVE-2026-111737 json | The Speed Optimizer WordPress plugin before 7.8.5 does not sanitise or escape some of its settings before outputting them in... | |
| CVE-2026-110537 json | The Essential Addons for Elementor WordPress plugin before 6.8.7 does not verify that an administrator may manage the specif... | |
| CVE-2026-110510 json | The Essential Addons for Elementor WordPress plugin before 6.8.7 does not validate the HTML tag setting of some of its widge... | |
| CVE-2026-94268 json | The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin b... | |
| CVE-2026-94267 json | The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin b... | |
| CVE-2026-94264 json | The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin b... | |
| CVE-2026-94262 json | The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin b... | |
| CVE-2026-109936 json | The Otter Blocks WordPress plugin before 3.2.8 does not correctly bound a pattern it uses to rewrite its dynamic-content tok... | |
| CVE-2026-109935 json | The Otter Blocks WordPress plugin before 3.2.8 does not enforce its block visibility conditions when a published post is ren... | |
| CVE-2026-109934 json | The Otter Blocks WordPress plugin before 3.2.8 does not correctly determine whether a post is publicly readable before retur... | |
| CVE-2026-109933 json | The Otter Blocks WordPress plugin before 3.2.8 does not properly sanitize and escape user-supplied block styling values befo... | |
| CVE-2026-107858 json | Missing Origin Validation in WebSockets (CWE-1385) and Permissive Cross-domain Policy with Untrusted Domains (CWE-942) in the... | |
| CVE-2026-93017 json | The `insights-operator-gather` ClusterRole grants the operator's service account read access to secrets in the core API group... | |
| CVE-2026-85518 json | A flaw was found in OpenSCAP. When decomposing a Source DataStream (SDS) file, the application does not properly validate rel... | |
| CVE-2026-83589 json | A flaw was found in oauth-proxy. The application fails to properly validate the destination redirect parameter (`rd`) during ... | |
| CVE-2026-75888 json | A flaw was found in the OpenShift console. An authenticated console user can exploit a Server-Side Request Forgery (SSRF) vul... | |
| CVE-2026-75887 json | A flaw was found in the OpenShift console. An unauthenticated attacker can exploit a path traversal vulnerability by manipula... | |
| CVE-2026-75885 json | A flaw was found in the OpenShift console. Unauthenticated access to the `/api/devfile/` and `/api/devfile/samples/` endpoint... | |
| CVE-2026-49329 json | A flaw was found in openshift/oauth-server. The OAuth login and error page endpoints pass the unauthenticated Accept-Language... | |
| CVE-2026-115497 json | The Music Store – WordPress eCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and ... | |
| CVE-2026-109198 json | The Anti-Spam by CleanTalk – Spam Protection Without CAPTCHA plugin for WordPress is vulnerable to Stored Cross-Site Script... | |
| CVE-2026-108334 json | A flaw was found in the internal WebAssembly (WASM) shim used by the Kuadrant operator. When generating the CEL predicate tha... | |
| CVE-2026-90458 json | OpenStack Ironic before 39.0.1 allows DELETE and GET via vendor_passthru, e.g., to delete accounts from the BMC's Redfish ser... | |
| CVE-2026-89419 json | OpenStack Ironic before 39.0.1 sometimes allows a user to change the maintenance setting on a node via PATCH to /v1/nodes/{id... | |
| CVE-2026-86055 json | Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.3, Part-DB builds the ... | |
| CVE-2026-86020 json | Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.2, Part-DB contains a ... | |
| CVE-2026-86019 json | Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.2, Part-DB allows auth... | |
| CVE-2026-86018 json | Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.2, Part-DB allows auth... | |
| CVE-2026-59188 json | Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.3, Part-DB-server sani... | |
| CVE-2026-55835 json | Lookyloo is a web interface that allows users to capture a website page and then display a tree of domains that call each oth... | |
| CVE-2026-55600 json | Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.2, Part-DB renders BOM... | |
| CVE-2026-54631 json | Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.1, the file .env commi... | |
| CVE-2026-54630 json | Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.1, the part attachment... | |
| CVE-2026-115638 json | OpenStack Ironic through 39.0.1 allows a denial of service via a configdrive that results in a very large amount of uncompres... | |
| CVE-2026-115547 json | An input validation issue in the Okta Access Gateway (OAG) Admin Console allows the processing of specially formatted configu... | |
| CVE-2026-115546 json | Okta Access Gateway (OAG) does not validate the selected authentication source during sign-on. An authenticated user with an ... | |
| CVE-2026-115414 json | OS command injection in the Terraform hook in AWS SAM CLI before 1.166.2 might allow an actor who can influence the Terraform... | |
| CVE-2026-115253 json | An incorrect permission assignment vulnerability in the WatchGuard Agent's log directory allows a local, authenticated non-ad... | |
| CVE-2026-114625 json | VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged i... | |
| CVE-2026-96376 json | Improper Neutralization of Special Elements used in an OS Command ("OS Command Injection") vulnerability in Drupal Cloud allo... | |
| CVE-2026-96355 json | Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Webform allows Code Injection. ... | |
| CVE-2026-79851 json | No description provided | |
| CVE-2026-79850 json | No description provided | |
| CVE-2026-79849 json | No description provided | |
| CVE-2026-79848 json | No description provided | |
| CVE-2026-79847 json | No description provided | |
| CVE-2026-79846 json | No description provided | |
| CVE-2026-79844 json | No description provided | |
| CVE-2026-54615 json | Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.1, LogEntryExtraFormat... | |
| CVE-2026-15723 json | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1 before 19.3.6, 19.4 before 19.4.3, and 19.5 b... | |
| CVE-2026-12664 json | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 19.3.6, 19.4 before 19.4.3, and 19.5 b... | |
| CVE-2026-101500 json | Vulnerability in the Oracle Global Lifecycle Management OPatchAuto product of Oracle Global Lifecycle Management (component: ... | |
| CVE-2026-101482 json | Vulnerability in Oracle Secure Backup (component: Device Management and Support). Supported versions that are affected are 1... | |
| CVE-2026-101481 json | Vulnerability in Oracle Secure Backup (component: Device Management and Support). Supported versions that are affected are 1... | |
| CVE-2026-101431 json | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Test Framework). Supported v... | |
| CVE-2026-101420 json | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: SQR). Supported versions tha... | |
| CVE-2026-101416 json | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: PsAdmin). Supported versions... | |
| CVE-2026-91663 json | Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploit... | |
| CVE-2026-91658 json | Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploit... | |
| CVE-2026-91651 json | Vulnerability in Oracle Essbase (component: Essbase Web Platform). The supported version that is affected is 21.8.3.0.0. Di... | |
| CVE-2026-91647 json | Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Difficult to e... | |
| CVE-2026-91638 json | Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploit... | |
| CVE-2026-91637 json | Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploit... | |
| CVE-2026-91635 json | Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Difficult to e... | |
| CVE-2026-91478 json | Vulnerability in the PeopleSoft Enterprise SCM Strategic Sourcing product of Oracle PeopleSoft (component: Strategic Sourcing... | |
| CVE-2026-91403 json | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (com... | |
| CVE-2026-87351 json | Vulnerability in Oracle GoldenGate (component: Admin Server Executable). Supported versions that are affected are 19.1.0.0.0... | |
| CVE-2026-76298 json | In Splunk Enterprise versions below 10.4.4 and 10.2.8, a user who does not hold the "admin" or "power" Splunk roles could der... | |
| CVE-2026-76293 json | In Splunk Enterprise versions below 10.4.3, 10.2.8, 10.0.11, and 9.4.16, a user that holds a role with the edit_manager_xml c... | |
| CVE-2026-76291 json | In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user that holds a role with the schedule_search ca... | |
| CVE-2026-101411 json | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Business Interlink). Support... | |
| CVE-2026-101410 json | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Business Interlink). Support... | |
| CVE-2026-101390 json | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Business Interlink). Support... | |
| CVE-2026-91398 json | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (com... | |
| CVE-2026-91397 json | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (com... | |
| CVE-2026-113727 json | OpenChoreo is a developer platform for Kubernetes. From 1.0.0 until 1.0.6, 1.1.7, and 1.2.5, the PUT .../workflowruns/{runNam... | |
| CVE-2026-101404 json | Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Marketing). Supported versions that ar... | |
| CVE-2026-101403 json | Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Email Marketing). Supported versions t... | |
| CVE-2026-101402 json | Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Email Marketing). Supported versions t... | |
| CVE-2026-101401 json | Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Marketing). Supported versions that ar... | |
| CVE-2026-101400 json | Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Marketing). Supported versions that ar... | |
| CVE-2026-101398 json | Vulnerability in the Oracle Capacity product of Oracle E-Business Suite (component: Internal Operations). Supported versions... | |
| CVE-2026-101397 json | Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Marketing). Supported versions that ar... | |
| CVE-2026-91394 json | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK product of Oracle Java SE (component: Networking). Supported ver... | |
| CVE-2016-20100 json | Memphis Documents Library plugin for WordPress before 3.1.6 contains a path traversal vulnerability that allows unauthenticat... | |
| CVE-2014-125134 json | ChurcHope theme for WordPress before 2.2 contains a path traversal vulnerability that allows unauthenticated attackers to dow... | |
| CVE-2012-20004 json | K-news plugin for WordPress before 1.1.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated ... | |
| CVE-2026-115537 json | A weakness has been identified in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. This affects... | |
| CVE-2026-19678 json | A server-side request forgery (SSRF) vulnerability in the unauthenticated form service in version 11.0.14 in onPhase Forms al... | |
| CVE-2026-19677 json | An authentication bypass vulnerability in the public onPhase/ frevvo registration form version 11.0.14 allows an unauthentic... | |
| CVE-2026-115536 json | A security flaw has been discovered in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. The imp... |