CVE.report
CVE.report is the most up-to-date database of common vulnerabilities and exposures. Information is pulled in from several sources and processed in to a mobile friendly, easy to use page. Use the site to quickly check for vulnerabilities in products such as operating systems, applications, hardware, networks, databases, browsers, e-mail clients and more.
CVEs provide a unique and common naming scheme for publicly known cyber security vulnerabilities in order to quickly identify and share these vulnerabilities. You can use the search below to look for vulnerabilities based on product, vendor, or common tags
The form you will see after following this link allows you to fill out the various variables in the CVSS scoring system and receive the corresponding score. The description of each of the variables is also included for additional information.
cve.report now provides a free read-only JSON API for CVE details. Each record combines the CVE Program JSON record, NVD enrichment, KEV, and EPSS when available.
Recent CVEs
| CVE | Description | Updated |
|---|---|---|
| CVE-2026-93634 json | A cross-account authorization vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user to insert forged... | |
| CVE-2026-93633 json | A CSS sanitization vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user with Briefcase access to pu... | |
| CVE-2026-93631 json | A cross-site request forgery vulnerability in the OAuth extension of Zimbra Collaboration Suite (ZCS) Network Edition allows ... | |
| CVE-2026-118668 json | langgraph-api implements the LangGraph API for rapid development and testing. From 0.1.2 until 0.15.0, JavaScript or TypeScri... | |
| CVE-2026-118667 json | LangGraph Python SDK is used to connect to running LangGraph API servers, manage assistants, threads and stream runs from Pyt... | |
| CVE-2026-118666 json | GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to version 1.1.36 of the GraphQL... | |
| CVE-2026-118665 json | GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to version 1.1.36 of the GraphQL... | |
| CVE-2026-118664 json | decode-uri-component provides a more robust alternative to decodeURIComponent. Prior to 0.5.1, decodeUriComponent in index.js... | |
| CVE-2026-118663 json | @hono/node-server allows running the Hono application on Node.js. From 1.19.10 until 2.1.3, serveStatic decodes a request pat... | |
| CVE-2026-118662 json | Vite is a frontend tooling framework for JavaScript. From 6.4.4 until 6.4.5, the Vite development server can evaluate server.... | |
| CVE-2026-118661 json | Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Prior to 20.14.6, Happy DOM's... | |
| CVE-2026-118660 json | Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Prior to 21.0.0, Happy DOM lo... | |
| CVE-2026-118659 json | Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Prior to 21.0.2, the Happy DO... | |
| CVE-2026-118658 json | Echo is a Go web framework. Prior to 4.15.2 and 5.1.1, Context.Scheme returns values from X-Forwarded-Proto, X-Forwarded-Prot... | |
| CVE-2026-118657 json | Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Context.Scheme unconditionally trusts forwarded scheme headers from an... | |
| CVE-2026-118656 json | Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, sanitizeURI checks only the first two bytes of a redirect target befor... | |
| CVE-2026-93638 json | A reflected cross-site scripting vulnerability in the login page of Zimbra Collaboration Suite (ZCS) allows an unauthenticate... | |
| CVE-2026-93636 json | An LDAP filter injection vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user to query otherwise un... | |
| CVE-2026-91282 json | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Portal SEC). Supported versions... | |
| CVE-2026-91281 json | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC). ... | |
| CVE-2026-91280 json | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). Supported ver... | |
| CVE-2026-91279 json | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). Supported ver... | |
| CVE-2026-91278 json | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Monitoring and Diagnostics SEC).... | |
| CVE-2026-91277 json | Vulnerability in the JD Edwards EnterpriseOne Orchestrator product of Oracle JD Edwards (component: E1 IOT Orchestrator Secur... | |
| CVE-2026-91276 json | Vulnerability in the JD Edwards EnterpriseOne Orchestrator product of Oracle JD Edwards (component: E1 IOT Orchestrator Secur... | |
| CVE-2026-91275 json | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Monitoring and Diagnostics SEC).... | |
| CVE-2026-91274 json | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Monitoring and Diagnostics SEC).... | |
| CVE-2026-91272 json | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Interoperability SEC). Supporte... | |
| CVE-2026-91271 json | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Monitoring and Diagnostics SEC).... | |
| CVE-2026-91270 json | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Monitoring and Diagnostics SEC).... | |
| CVE-2026-91269 json | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC). ... | |
| CVE-2026-91268 json | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). Supported ver... | |
| CVE-2026-91267 json | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Interoperability SEC). Supporte... | |
| CVE-2026-91266 json | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Monitoring and Diagnostics SEC).... | |
| CVE-2026-102479 json | In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x HTTP/1.x decoder uses a canonicaliza... | |
| CVE-2026-91264 json | Vulnerability in the PeopleSoft Enterprise SCM Manufacturing product of Oracle PeopleSoft (component: Security). The suppor... | |
| CVE-2026-91263 json | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Notification Configuration). ... | |
| CVE-2026-91262 json | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). The supporte... | |
| CVE-2026-91261 json | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). The supporte... | |
| CVE-2026-91260 json | Vulnerability in the iProcurement product of Oracle E-Business Suite (component: E-Content Manager Catalog). Supported versi... | |
| CVE-2026-91259 json | Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI). Supported versi... | |
| CVE-2026-91257 json | Vulnerability in the iSupport product of Oracle E-Business Suite (component: Service Requests). Supported versions that are ... | |
| CVE-2026-91256 json | Vulnerability in the Oracle Solaris product of Oracle Systems (component: Services). The supported version that is affected... | |
| CVE-2026-91253 json | Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel). The supported version that is affected i... | |
| CVE-2026-91252 json | Vulnerability in the Oracle Solaris product of Oracle Systems (component: Services). The supported version that is affected... | |
| CVE-2026-91251 json | Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Adapters). Supported versions that are... | |
| CVE-2026-91250 json | Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Adapters). Supported versions that are... | |
| CVE-2026-91249 json | Vulnerability in the Oracle Solaris product of Oracle Systems (component: Libraries). The supported version that is affecte... | |
| CVE-2026-91243 json | Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware (component: Fabric Layer). ... | |
| CVE-2026-91242 json | Vulnerability in the Oracle Solaris product of Oracle Systems (component: Plugins). The supported version that is affected ... | |
| CVE-2026-91241 json | Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Web Ad... | |
| CVE-2026-91240 json | Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). Supported vers... | |
| CVE-2026-91239 json | Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions that... | |
| CVE-2026-85934 json | Use after free in Windows AppX Deployment Service allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-77468 json | Lychee is a free, open-source photo-management tool. Prior to 7.7.0, GET /docs/api exposes the Scramble-generated OpenAPI doc... | |
| CVE-2026-61702 json | OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, copy_ba... | |
| CVE-2026-55103 json | Discourse ActivityPub adds ActivityPub support to Discourse. Prior to commit 1c8518b0f2abdf31cbea3e0b242f74d8994a9ba5, inboun... | |
| CVE-2026-100208 json | Integer overflow or wraparound in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-85933 json | Use after free in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-70341 json | Use after free in Microsoft Edge (Chromium-based) allows an authorized attacker to execute code over a network. | |
| CVE-2026-66798 json | Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-66324 json | External control of file name or path in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing ... | |
| CVE-2026-66323 json | Improper neutralization of parameter/argument delimiters in Microsoft Edge (Chromium-based) allows an unauthorized attacker t... | |
| CVE-2026-62904 json | Incorrect authorization in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a net... | |
| CVE-2026-62752 json | Heap-based buffer overflow in Windows Kerberos allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-58616 json | Concurrent execution using shared resource with improper synchronization ('race condition') in Copilot Chat (Microsoft Edge) ... | |
| CVE-2026-101732 json | Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer). Supported versions ... | |
| CVE-2026-101731 json | Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer). Supported versions ... | |
| CVE-2026-101487 json | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Portal). Supported versions ... | |
| CVE-2026-101486 json | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Fluid Core). Supported versi... | |
| CVE-2026-101450 json | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Integration Broker). Support... | |
| CVE-2026-101433 json | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Test Framework). Supported v... | |
| CVE-2026-101430 json | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Test Framework). Supported v... | |
| CVE-2026-101425 json | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: SQR). Supported versions tha... | |
| CVE-2026-101423 json | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Report Distribution). Suppor... | |
| CVE-2026-87706 json | Heap-based buffer overflow in Windows Storage Spaces Controller allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-87705 json | Improper verification of source of a communication channel in Windows Hyper-V allows an unauthorized attacker to bypass a sec... | |
| CVE-2026-87704 json | Use after free in Windows Installer allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-87702 json | Integer overflow or wraparound in Windows Resource Management (MRM) allows an authorized attacker to elevate privileges local... | |
| CVE-2026-87700 json | Use after free in Windows Installer allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-87693 json | Use after free in Windows Installer allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-87691 json | Use after free in Windows Management Services allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-85945 json | Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-85941 json | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Installer allows an au... | |
| CVE-2026-85939 json | Weak authentication in Windows Kernel allows an authorized attacker to bypass a security feature over a network. | |
| CVE-2026-85938 json | Improper access control in Windows Broadcast DVR User Service allows an authorized attacker to disclose information locally. | |
| CVE-2026-85936 json | Double free in Windows Shell allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-85935 json | Buffer over-read in Windows USB Driver allows an authorized attacker to disclose information locally. | |
| CVE-2026-78674 json | The BPMN System REST APIs do not sufficiently validate input parameters, allowing authenticated users to submit crafted reque... | |
| CVE-2026-76418 json | A vulnerability in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and ... | |
| CVE-2026-63190 json | FearlessCMS is a flat-file `content` management system centered on simplicity and open source. Prior to version 0.1.4, five d... | |
| CVE-2026-61542 json | Gearboy is a Game Boy, Game Boy Color, and Super Game Boy emulator and debugger with an embedded MCP server. Gearsystem, the ... | |
| CVE-2026-61529 json | Endatix is a self-hosted form and survey management platform with a headless API. Prior to 0.7.0, the anonymous `POST /forms/... | |
| CVE-2026-6647 json | In deployments of WSO2 Identity Server configured with a case-insensitive user store and a case-sensitive database for identi... | |
| CVE-2026-118655 json | Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, middleware.Static can decode an already decoded Request.URL.Path a sec... | |
| CVE-2026-118654 json | Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo's static file handlers can normalize dot segments after route mat... | |
| CVE-2026-118653 json | Echo is a Go web framework. From 4.0.0 until 5.1.0, Context.RealIP falls back to client-supplied X-Forwarded-For or X-Real-IP... | |
| CVE-2026-118652 json | Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Context.JSONP and Context.JSONPBlob concatenate an unvalidated callbac... | |
| CVE-2026-118651 json | Echo is a Go web framework. From 4.0.0 until 5.4.0, the Proxy middleware can preserve an attacker-supplied X-Real-IP header a... | |
| CVE-2026-118650 json | Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, a globally mounted middleware.Static instance can interpret an encoded... |