CVE.report
CVE.report is the most up-to-date database of common vulnerabilities and exposures. Information is pulled in from several sources and processed in to a mobile friendly, easy to use page. Use the site to quickly check for vulnerabilities in products such as operating systems, applications, hardware, networks, databases, browsers, e-mail clients and more.
CVEs provide a unique and common naming scheme for publicly known cyber security vulnerabilities in order to quickly identify and share these vulnerabilities. You can use the search below to look for vulnerabilities based on product, vendor, or common tags
The form you will see after following this link allows you to fill out the various variables in the CVSS scoring system and receive the corresponding score. The description of each of the variables is also included for additional information.
cve.report now provides a free read-only JSON API for CVE details. Each record combines the CVE Program JSON record, NVD enrichment, KEV, and EPSS when available.
Recent CVEs
| CVE | Description | Updated |
|---|---|---|
| CVE-2026-118527 json | Use of predictable filenames in Ivanti Connect Secure before versions 25.1.1.3 and 22.8R2.6 allows a remote authenticated att... | |
| CVE-2026-105725 json | Use after free in Windows Security App allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-96199 json | Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-69446 json | Incorrect authorization in Microsoft Edge (Chromium-based) allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-109265 json | ImageMagick 7.1.1-7 before 7.1.2-32 contains a heap buffer over-read vulnerability that allows attackers to read beyond alloc... | |
| CVE-2026-87361 json | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). The supporte... | |
| CVE-2026-121631 json | Lightdash 0.2609.0 before 3.137.0 contains an authorization bypass vulnerability in the RenameService that allows authenticat... | |
| CVE-2026-121604 json | wlroots before 0.20.2 contains an out-of-bounds read vulnerability in read_surface_class() in xwayland/xwm.c that allows loca... | |
| CVE-2026-121603 json | Solanum before commit 2ea1382 contains a buffer overflow vulnerability in ms_kill() that allows malicious linked servers to c... | |
| CVE-2026-121602 json | Solanum before commit 2ce64de contains a heap-based buffer overflow vulnerability that allows a malicious linked server to co... | |
| CVE-2026-121588 json | TeXlyre from 0.11.0 before 0.13.5 contains a stored cross-site scripting vulnerability that allows attackers to execute scrip... | |
| CVE-2026-121587 json | Coolify before 4.1.1 contains an information disclosure vulnerability that allows unauthenticated attackers to enumerate appl... | |
| CVE-2026-121262 json | A vulnerability was found in phpMyAdmin SQL-Parser 6.0.0/6.0.1. The affected element is the function parse of the file src/St... | |
| CVE-2026-121261 json | A vulnerability has been found in phpMyAdmin ShapeFile up to 4.0.1. Impacted is the function ShapeRecord::loadFromFile of the... | |
| CVE-2026-121259 json | A flaw was found in the GStreamer JPEG 2000 decimator in gst-plugins-bad. Crafted JPEG 2000 media can cause integer overflows... | |
| CVE-2026-97072 json | Missing Authorization vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control Security ... | |
| CVE-2026-39777 json | Missing Authorization vulnerability in WC Lovers WCFM Membership wc-multivendor-membership allows Exploiting Incorrectly Conf... | |
| CVE-2026-39743 json | Missing Authorization vulnerability in WC Lovers WCFM Membership wc-multivendor-membership allows Exploiting Incorrectly Conf... | |
| CVE-2026-38601 json | A hardcoded session secret key in codeskyblue gohttpserver through v1.3.0 allows attackers to impersonate any user, bypass Op... | |
| CVE-2026-38600 json | A Zip Slip vulnerability in the /upload endpoint of codeskyblue gohttpserver through v1.3.0 allows attackers to write arbitra... | |
| CVE-2026-38595 json | An issue in im3x Scriptables through v2-dev branch allows attackers to inject arbitrary OS commands via uploading a file with... | |
| CVE-2026-28336 json | SolarWinds Dameware was found to be affected by a command injection vulnerability that could lead to the compromise of the re... | |
| CVE-2026-28335 json | SolarWinds Dameware was found to be affected by a buffer overflow vulnerability that can result in remote code execution. Aut... | |
| CVE-2026-28327 json | SolarWinds Dameware was found to be affected by a DLL hijacking vulnerability. The hijack occurs during installations only an... | |
| CVE-2026-120846 json | Missing Authorization vulnerability in Uncanny Owl Uncanny Automator uncanny-automator allows Exploiting Incorrectly Configur... | |
| CVE-2026-120843 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Barn2 Plugins Posts Tab... | |
| CVE-2026-119675 json | MongoDB Database Tools mongorestore inconsistently handles the system.buckets. prefix when validating collection names in an ... | |
| CVE-2026-119674 json | MongoDB Database Tools mongorestore incorrectly URL-decodes an original collection name read from metadata when the correspon... | |
| CVE-2026-119673 json | MongoDB Database Tools mongofiles does not resolve existing parent-directory symlinks when validating output paths for get_re... | |
| CVE-2026-119672 json | MongoDB Database Tools mongofiles uses a database-stored GridFS filename as the output destination for get_id when --local is... | |
| CVE-2026-119521 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cozmoslabs Paid Member ... | |
| CVE-2026-119509 json | Missing Authorization vulnerability in eranfl ClickCease Click Fraud Protection clickcease-click-fraud-protection allows Expl... | |
| CVE-2026-119495 json | Missing Authorization vulnerability in WebberZone Better Search better-search allows Exploiting Incorrectly Configured Access... | |
| CVE-2026-119487 json | Missing Authorization vulnerability in weDevs Dokan dokan-lite allows Exploiting Incorrectly Configured Access Control Securi... | |
| CVE-2026-119485 json | Missing Authorization vulnerability in weDevs Dokan dokan-lite allows Exploiting Incorrectly Configured Access Control Securi... | |
| CVE-2026-116859 json | Missing Authorization vulnerability in WPMU DEV Forminator forminator allows Exploiting Incorrectly Configured Access Control... | |
| CVE-2026-116858 json | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in WPMU DEV Forminator forminator... | |
| CVE-2026-115716 json | Allocation of Resources Without Limits or Throttling (CWE-770) in APM Server can lead to denial of service via Oversized Seri... | |
| CVE-2026-115715 json | Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to denial of service via a specially... | |
| CVE-2026-115714 json | Improper Certificate Validation (CWE-295) in the operating system certificate bundle shipped in the Docker images of APM Serv... | |
| CVE-2026-115710 json | Use of Cache Containing Sensitive Information (CWE-524) in Elasticsearch can lead to information disclosure and incorrect sea... | |
| CVE-2026-115298 json | Incorrect Authorization (CWE-863) in Elasticsearch can lead to information disclosure via Accessing Functionality Not Properl... | |
| CVE-2026-115297 json | NULL Pointer Dereference (CWE-476) in the AMQP protocol parser in Packetbeat can lead to denial of service via specially craf... | |
| CVE-2026-115295 json | Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to information disclosure via Accessing Functio... | |
| CVE-2026-115294 json | Improper Limitation of a Pathname to a Restricted Directory (CWE-22) in the Kibana Fleet feature can lead to unauthorized res... | |
| CVE-2026-115293 json | Insertion of Sensitive Information Into Sent Data (CWE-201) in Kibana Observability onboarding can lead to disclosure of the ... | |
| CVE-2026-115292 json | Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana Machine Learning can lead to information disclosure via ... | |
| CVE-2026-115290 json | Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Serialized Data with Nested Payloads (CAP... | |
| CVE-2026-115289 json | Use of Multiple Resources with Duplicate Identifier (CWE-694) in APM Server can lead to information disclosure via a speciall... | |
| CVE-2026-114187 json | Missing Authorization vulnerability in WPVibes AnyWhere Elementor anywhere-elementor allows Exploiting Incorrectly Configured... | |
| CVE-2026-114185 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPVibes AnyWhere Elemen... | |
| CVE-2026-114183 json | Insertion of Sensitive Information Into Sent Data vulnerability in WPVibes AnyWhere Elementor anywhere-elementor allows Retri... | |
| CVE-2026-109594 json | Post-authentication Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability has be... | |
| CVE-2026-121560 json | LogChimp 0.9.0-alpha.1 before 0.9.3 contains an authorization bypass vulnerability that allows authenticated post authors to ... | |
| CVE-2026-121556 json | FastBee through 2.1.0 contains an insecure direct object reference vulnerability in ProductController that allows authenticat... | |
| CVE-2026-121552 json | Dromara domain-admin before 1.6.79 contains a missing authorization vulnerability in the POST /api/getGroupUserList handler t... | |
| CVE-2026-121548 json | Jarun nnn through 5.3 contains an OS command injection vulnerability in plugins/togglex that allows attackers to execute comm... | |
| CVE-2026-121544 json | Koodo Reader through 2.4.6 contains a path traversal vulnerability in the self-hosted HTTP server's OPDS handlers that allows... | |
| CVE-2026-121453 json | SQLBot through 1.10.3 contains a path traversal vulnerability in the importToDb endpoint that allows authenticated workspace ... | |
| CVE-2026-121449 json | Dockhand from 1.0.47 before 1.0.54 exposes plaintext stack secrets because deployStack() attaches resolved secret values to i... | |
| CVE-2026-121445 json | darylldoyle svg-sanitizer from 1.0.0 before 1.1.0 contains a regular expression denial of service vulnerability in the image-... | |
| CVE-2026-121441 json | Wasmtime before 36.0.19, 37.0.0 before 48.0.7, and 49.0.0 before 49.0.4 contains a request smuggling vulnerability in wasi-ht... | |
| CVE-2026-121437 json | Mistune from 3.3.0 before 3.3.4 contains a denial of service vulnerability that allows remote attackers to exhaust CPU throug... | |
| CVE-2026-121433 json | AzuraCast before 0.24.0 contains a stored CSV formula injection vulnerability that allows station users with Media permission... | |
| CVE-2026-121429 json | AzuraCast through 0.23.8 contains a command injection vulnerability that allows station users with Profile permission to exec... | |
| CVE-2026-121425 json | Nodemailer from 3.0.0 before 10.1.4 contains a parsing flaw in addressparser that ends an RFC 5322 group at a semicolon insid... | |
| CVE-2026-121421 json | SurrealDB 3.1.0 before 3.3.0 contains a server-side request forgery vulnerability in network-capability matching because port... | |
| CVE-2026-121417 json | SurrealDB before 3.3.0 contains a use-after-free vulnerability in surrealdb-core KV backends that pass borrowed transaction s... | |
| CVE-2026-121401 json | FreeRDP before 3.32.2 contains a denial of service vulnerability where rdg_process_packet dispatches a PKT_TYPE_EXTENDED_AUTH... | |
| CVE-2026-121397 json | FreeRDP before 3.32.2 contains a heap buffer over-read vulnerability in save_png_to_buffer() that allows malicious RDP server... | |
| CVE-2026-121393 json | FreeRDP from 3.0.0 before 3.32.2 contains a denial of service vulnerability that allows malicious RDP servers to abort client... | |
| CVE-2026-121260 json | A flaw has been found in Ziroom ZHOME A0101 1.0.1.0 Build 202004151405. This issue affects the function loadstring of the fil... | |
| CVE-2026-119741 json | rsync through 3.5.1 contains a denial of service vulnerability in the delta-transfer sender's hash_search() in match.c that a... | |
| CVE-2026-109593 json | An unauthenticated attacker with network access to the SonicWall GMS 9.5.2 and earlier versions may be able to read internal ... | |
| CVE-2026-103916 json | Docker Sandboxes sbx cp does not safely confine host-side paths to a shared workspace. A malicious sandbox can create or repl... | |
| CVE-2026-103077 json | Missing Authorization vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control Security ... | |
| CVE-2026-58867 json | In getMessenger of WifiP2pServiceImpl.java, there is a possible permission bypass due to a missing permission check. This cou... | |
| CVE-2026-55263 json | In multiple functions of AllowBindAppWidgetActivity.java, there is a possible misunderstanding of reject/consent actions due ... | |
| CVE-2026-119282 json | Nx is a monorepo solution for TypeScript and polyglot codebases. From 22.0.2 until 22.7.9 and 23.1.2 for @nx/maven, and from ... | |
| CVE-2026-119279 json | MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7,... | |
| CVE-2026-119210 json | MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7,... | |
| CVE-2026-119206 json | pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can take excessive time to retrieve page labe... | |
| CVE-2026-119202 json | @hapi/content provides HTTP Content-* header parsing. From 3.0.6 until 6.0.3, Content.disposition() uses an unanchored parame... | |
| CVE-2026-119198 json | Nuxt is an open-source web development framework for Vue.js. From 4.6.0 until 4.6.3, a client with TCP access to an exposed N... | |
| CVE-2026-119085 json | Improper neutralization of special elements used in a template engine in the publishing component of Amazon Virtual Engineeri... | |
| CVE-2026-118959 json | A flaw was found in the required action provider mechanism of Keycloak. The issue occurs when an authorization request includ... | |
| CVE-2026-117184 json | An issue in the GraphQL endpoint of traggo server v0.8.3 allows attackers to cause a Denial of Service (DoS) via a crafted PO... | |
| CVE-2026-117028 json | Skuul School Management System through version 2.6.5 is vulnerable to incorrect access control in the ResultChecker::checkRes... | |
| CVE-2026-104080 json | Control Web Panel (CWP) before webpanel_version 1.29 contains an OS command injection vulnerability in the loopback API /vali... | |
| CVE-2026-77881 json | Control Web Panel (CWP) before webpanel_version 1.29 contains a blind SQL injection vulnerability in an unauthenticated loopb... | |
| CVE-2026-77880 json | Control Web Panel (CWP) before webpanel_version 1.16 contains an OS command injection vulnerability in the loopback API passw... | |
| CVE-2026-77879 json | Control Web Panel (CWP) before webpanel_version 1.16 contains a SQL injection vulnerability in the loopback API authenticatio... | |
| CVE-2026-77878 json | Control Web Panel (CWP) before webpanel_version 1.29 contains an OS command injection vulnerability in the loopback API datab... | |
| CVE-2026-77877 json | Control Web Panel (CWP) before webpanel_version 1.29 contains a missing authentication vulnerability that allows attackers ab... | |
| CVE-2026-77876 json | Control Web Panel (CWP) before webpanel_version 1.16 contains an OS command injection vulnerability in the protected_director... | |
| CVE-2026-73696 json | Control Web Panel (CWP) before webpanel_version 1.12 contains an execution after redirect vulnerability in the user panel aut... | |
| CVE-2026-61719 json | WeGIA is a web manager for charitable institutions. Prior to 3.8.7, a stored cross-site scripting vulnerability in `saude/his... | |
| CVE-2026-61654 json | Lightdash is an open source business intelligence platform. In affected versions through 0.3213.0, the dbt Cloud webhook `POS... | |
| CVE-2026-55261 json | In nfa_t4tnfcee_store_rx_buf of nfa_nfcee_act.cc, there is a possible way to achieve code execution due to a missing permissi... | |
| CVE-2026-49934 json | In multiple functions of MmiUtils.java, there is a possible risk of USSD/MMI code execution due to improper input validation.... |