CVE.report
CVE.report is the most up-to-date database of common vulnerabilities and exposures. Information is pulled in from several sources and processed in to a mobile friendly, easy to use page. Use the site to quickly check for vulnerabilities in products such as operating systems, applications, hardware, networks, databases, browsers, e-mail clients and more.
CVEs provide a unique and common naming scheme for publicly known cyber security vulnerabilities in order to quickly identify and share these vulnerabilities. You can use the search below to look for vulnerabilities based on product, vendor, or common tags
The form you will see after following this link allows you to fill out the various variables in the CVSS scoring system and receive the corresponding score. The description of each of the variables is also included for additional information.
cve.report now provides a free read-only JSON API for CVE details. Each record combines the CVE Program JSON record, NVD enrichment, KEV, and EPSS when available.
Recent CVEs
| CVE | Description | Updated |
|---|---|---|
| CVE-2026-96778 json | Pillow is a Python imaging library. From 9.4.0 until 13.0.0, ImagingJpegEncode() in src/libImaging/JpegEncode.c can call jpeg... | |
| CVE-2026-96644 json | Pillow is a Python imaging library. Prior to 13.0.0 on Windows, src/PIL/WmfImagePlugin.py passes unchecked 32-bit WMF or EMF ... | |
| CVE-2026-96643 json | Pillow is a Python imaging library. From 11.0.0 until 13.0.0, Exif.load() in src/PIL/Image.py repeatedly slices the remaining... | |
| CVE-2026-96642 json | Pillow is a Python imaging library. Prior to 13.0.0, the TarIO initializer in src/PIL/TarIO.py accepts a negative octal membe... | |
| CVE-2026-96641 json | Pillow is a Python imaging library. Prior to 13.0.0, PILfont text-width accumulation in src/_imaging.c checks positive glyph ... | |
| CVE-2026-114406 json | The system certificate authority (CA) store in Red Hat products, distributed via ca-certificates RPM packages, included multi... | |
| CVE-2026-114380 json | A vulnerability was found in itsourcecode Online Cake Ordering System 1.0. Impacted is an unknown function of the file /inser... | |
| CVE-2026-114379 json | A flaw has been found in EKKOLearnAI ekko-studio up to 1.0.6. This vulnerability affects the function saveGeneratedImages of ... | |
| CVE-2026-114378 json | A vulnerability was detected in itsourcecode Online Cake Ordering System 1.0. This affects an unknown part of the file /delet... | |
| CVE-2026-114377 json | A security vulnerability has been detected in leomoon-studios wiki-go up to 1.9.1. Affected by this issue is the function Del... | |
| CVE-2026-114145 json | GitPython is a python library used to interact with Git repositories. Prior to 3.2.1, create_submodule() in git/objects/submo... | |
| CVE-2026-114144 json | toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse() passes unbounded hexadecimal, octal, bin... | |
| CVE-2026-114143 json | toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse() repeatedly slices and rejoins every path... | |
| CVE-2026-114142 json | toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse() can write attacker-controlled properties... | |
| CVE-2026-114141 json | toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, the toml.parse() compiler's addTableArray() function ... | |
| CVE-2026-114140 json | The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. From 5.4.0 un... | |
| CVE-2026-96640 json | Pillow is a Python imaging library. From 5.1.0 until 13.0.0, PdfParser.linearize_page_tree() in src/PIL/PdfParser.py treats a... | |
| CVE-2026-96639 json | Pillow is a Python imaging library. From 11.0.0 until 13.0.0, multi-frame loaders can retain an ImagingCore allocation create... | |
| CVE-2026-96638 json | Pillow is a Python imaging library. From 9.1.0 until 13.0.0, BmpRleDecoder.decode() in src/PIL/BmpImagePlugin.py permits craf... | |
| CVE-2026-96637 json | Pillow is a Python imaging library. Prior to 13.0.0, SpiderImageFile.seek() in src/PIL/SpiderImagePlugin.py reparses a later ... | |
| CVE-2026-96636 json | Pillow is a Python imaging library. Prior to 13.0.0, MpoImageFile.seek() and DcxImageFile.seek() reparse later MPO or DCX fra... | |
| CVE-2026-82987 json | There exists a screen capture endpoint in vCast media streaming service in ViewSonic ViewBoard unknown allows a remote, unaut... | |
| CVE-2026-29001 json | TastyIgniter through 4.4.5 contain a PHP object injection vulnerability that allows authenticated administrators to achieve a... | |
| CVE-2026-114396 json | Trudesk through 1.2.11 contains a server-side JavaScript injection vulnerability that allows authenticated users to inject co... | |
| CVE-2026-114391 json | ZenTao PMS before 22.3 contains an authorization bypass vulnerability in commonModel::isOpenMethod() that lets logged-in user... | |
| CVE-2026-114370 json | A flaw was found in the PathResourceManager component of the Undertow web server. This component is responsible for serving s... | |
| CVE-2026-114139 json | Sentry-Javascript is an official Sentry SDKs for JavaScript. From 9.36.0 until 9.47.2, 10.75.2, and 11.0.0-rc.1, the webpack ... | |
| CVE-2026-114138 json | Django REST framework is a toolkit for building Web APIs. Prior to 3.18.2, DefaultContentNegotiation.get_accept_list in rest_... | |
| CVE-2026-114137 json | Django REST framework is a toolkit for building Web APIs. From 3.12.0 until 3.18.2, TokenProxy.delete() in rest_framework/aut... | |
| CVE-2026-114117 json | Vyper 0.3.8 through 0.5.0b1 contains an optimizer miscompilation in which (msg.value | K) or (len(msg.data) | K), where K is ... | |
| CVE-2026-113811 json | Algorithm::UrataniTakeda versions from 0.1.5 before 0.1.7 for Perl allow memory exhaustion via a never-cleared failure shift ... | |
| CVE-2026-101687 json | Vulnerability in the Oracle E-Business Suite Integrated SOA Gateway product of Oracle E-Business Suite (component: SOA Provid... | |
| CVE-2026-101686 json | Vulnerability in the Oracle E-Business Suite Integrated SOA Gateway product of Oracle E-Business Suite (component: SOA Provid... | |
| CVE-2026-101685 json | Vulnerability in the Oracle E-Business Suite Integrated SOA Gateway product of Oracle E-Business Suite (component: SOA Provid... | |
| CVE-2026-101684 json | Vulnerability in the Oracle E-Business Suite Integrated SOA Gateway product of Oracle E-Business Suite (component: Internal O... | |
| CVE-2026-101683 json | Vulnerability in the Applications DBA product of Oracle E-Business Suite (component: AD Utilities). Supported versions that ... | |
| CVE-2026-101682 json | Vulnerability in the Applications DBA product of Oracle E-Business Suite (component: AD Utilities). Supported versions that ... | |
| CVE-2026-101681 json | Vulnerability in the Applications DBA product of Oracle E-Business Suite (component: AD Utilities). Supported versions that ... | |
| CVE-2026-101680 json | Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications (component: Platfo... | |
| CVE-2026-101679 json | Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client programs). Supported versions th... | |
| CVE-2026-101678 json | Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). The supported version that is affec... | |
| CVE-2026-101677 json | Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). The supported version that is affec... | |
| CVE-2026-101676 json | Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: Other Issues). Supported ve... | |
| CVE-2026-101675 json | Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Internal Operations). Suppor... | |
| CVE-2026-101674 json | Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Internal Operations). Suppor... | |
| CVE-2026-92822 json | A flaw was found in libmodulemd. When parsing module metadata, the xmd field is converted into nested GVariant values through... | |
| CVE-2026-112915 json | filelock is a platform-independent file lock for Python. From 3.20.4 until 4.2.1, ReadWriteLock can open a crafted SQLite loc... | |
| CVE-2026-112914 json | filelock is a platform-independent file lock for Python. From 4.1.0 until 4.2.1, SoftFileLock can restore a stale marker by n... | |
| CVE-2026-112912 json | filelock is a platform-independent file lock for Python. From 3.32.6 until 4.2.1, SoftFileLock can follow a swapped symbolic ... | |
| CVE-2026-112911 json | filelock is a platform-independent file lock for Python. From 3.30.0 until 4.2.1, StrictSoftFileLock versions from 3.30.0 and... | |
| CVE-2026-112258 json | A flaw was found in GIMP. The XCF loader can leave a dangling pointer in the linked-channels list when a linked channel is la... | |
| CVE-2026-111699 json | Niefy wx-api through 0.8.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to impersona... | |
| CVE-2026-111694 json | qKnow through 2.4.3 contains a missing authentication vulnerability that allows unauthenticated remote attackers to access /f... | |
| CVE-2026-111689 json | Exrick XBoot through 3.3.4 contains an authorization bypass vulnerability that allows authenticated users to read user record... | |
| CVE-2026-111684 json | Magistrala through 1.0.0 contains an authorization bypass vulnerability that allows authenticated workspace members to view, ... | |
| CVE-2026-111679 json | Ekko Studio through 0.7.36 contains a missing authorization vulnerability that allows any authenticated non-super_admin user ... | |
| CVE-2026-111674 json | Tbed through 20240319 contains a missing authorization vulnerability that allows any authenticated user to rename other users... | |
| CVE-2026-111669 json | ZR.Admin.NET through 3.8.2 contains an sql injection vulnerability that allows authenticated attackers to manipulate the ORDE... | |
| CVE-2026-111664 json | Safing Portmaster before 2.2.5 contains a missing authorization vulnerability that allows unprivileged local processes to for... | |
| CVE-2026-105311 json | The StreamsHub Console operator acts as a confused deputy: a Kubernetes tenant with permission to create a Console custom res... | |
| CVE-2026-101673 json | Vulnerability in the Oracle US Federal Human Resources product of Oracle E-Business Suite (component: Internal Operations). ... | |
| CVE-2026-101672 json | Vulnerability in the Oracle Call Center Technology product of Oracle E-Business Suite (component: Internal Operations). Supp... | |
| CVE-2026-101671 json | Vulnerability in the Oracle Email Center product of Oracle E-Business Suite (component: Message Component). Supported versio... | |
| CVE-2026-101670 json | Vulnerability in the Oracle Email Center product of Oracle E-Business Suite (component: Message Component). Supported versio... | |
| CVE-2026-101669 json | Vulnerability in the Oracle Public Sector Human Resources product of Oracle E-Business Suite (component: Regression Testing).... | |
| CVE-2026-101668 json | Vulnerability in the Oracle Customer Care product of Oracle E-Business Suite (component: Internal Operations). Supported ver... | |
| CVE-2026-101660 json | Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Admin UI). Supported version... | |
| CVE-2026-101640 json | Vulnerability in the Oracle Marketing product of Oracle E-Business Suite (component: Audience). Supported versions that are ... | |
| CVE-2026-101634 json | Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Internal Operations). Suppor... | |
| CVE-2026-101379 json | Vulnerability in Oracle REST Data Services (component: ADP). Supported versions that are affected are 24.2.0-26.1.0. Easily ... | |
| CVE-2026-111659 json | Waynboot-mall through 2.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to forge or... | |
| CVE-2026-111654 json | FastBee through 2.1.0 contains an insecure direct object reference vulnerability that allows authenticated low-privilege user... | |
| CVE-2026-111649 json | Rocboss paopao-ce through 0.6.0-alpha.3 contains an insecure direct object reference vulnerability in DownloadAttachment that... | |
| CVE-2026-111644 json | Misaka Danmu Server through 2.8.9 contains a missing authentication vulnerability that allows unauthenticated attackers to ac... | |
| CVE-2026-111639 json | bbs-go through 4.4.6 contains an authentication bypass vulnerability in the /api/login/google_one_tap endpoint that allows re... | |
| CVE-2026-111634 json | Helical Insight through 7.0.0 contains an sql injection vulnerability that allows authenticated viewers to inject SQL through... | |
| CVE-2026-111629 json | IoTSharp through 3.6.1 contains an insecure direct object reference vulnerability that allows any authenticated user to read ... | |
| CVE-2026-111624 json | Umbraco CMS before 17.7.1 and 18.2.1 contains a missing authorization vulnerability that allows unauthenticated clients to co... | |
| CVE-2026-111619 json | FilePress through 3.0.1 contains an sql injection vulnerability that allows authenticated low-privilege users to inject SQL i... | |
| CVE-2026-111614 json | DataCap through 2025.1.1 contains an insecure direct object reference vulnerability in BaseController.getInfoForPath that all... | |
| CVE-2026-87876 json | Two case-insensitive comparisons on request-derived usernames outside the main authorization path in CUPS's scheduler (printe... | |
| CVE-2026-87875 json | The cupsUTF32ToUTF8() function in CUPS's cups/transcode.c lacks a source-length bound and can read past the end of the source... | |
| CVE-2026-82327 json | A flaw was found in libsolv, a dependency-resolution library used by RPM-based package managers such as dnf and zypper to wor... | |
| CVE-2026-81666 json | An integer overflow was found in Corosync's handling of membership commit token messages. The length-validation check for the... | |
| CVE-2026-81665 json | A heap-based buffer overflow was found in Corosync's Totem Process Group (totempg) message reassembly. When processing fragme... | |
| CVE-2026-78002 json | A flaw was found in rsyslog. An unauthenticated remote attacker can trigger a heap buffer overflow in the RainerScript `repla... | |
| CVE-2026-68800 json | Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | |
| CVE-2026-68798 json | Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | |
| CVE-2026-66805 json | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network... | |
| CVE-2026-65673 json | Incorrect authorization in Microsoft Entra Connect Sync allows an authorized attacker to elevate privileges over a network. | |
| CVE-2026-50516 json | Incorrect authorization in Microsoft Azure Kubernetes Service allows an authorized attacker to elevate privileges over a netw... | |
| CVE-2026-19654 json | A unauthenticated remote peer may lead rsyslogd to crash due to a flaw in the optional imptcp module. A crafted input sequenc... | |
| CVE-2026-17113 json | A flaw was found in CRI-O's container-creation environment-variable handling (`mergeEnvs` in `server/utils.go`, consumed by `... | |
| CVE-2025-5222 json | A stack buffer overflow was found in Internationl components for unicode (ICU ). While running the genrb binary, the 'subtag'... | |
| CVE-2025-0690 json | The read command is used to read the keyboard input from the user, while reads it keeps the input length in a 32-bit integer ... | |
| CVE-2025-0677 json | A flaw was found in grub2. When performing a symlink lookup, the grub's UFS module checks the inode's data size to allocate t... | |
| CVE-2024-8176 json | A stack overflow vulnerability exists in the libexpat library due to the way it handles recursive entity expansion in XML doc... | |
| CVE-2025-26465 json | A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. A machine-in-the-middle attack can be perfo... | |
| CVE-2025-1118 json | A flaw was found in grub2. Grub's dump command is not blocked when grub is in lockdown mode, which allows the user to read an... | |
| CVE-2025-0750 json | A vulnerability was found in CRI-O. A path traversal issue in the log management functions (UnMountPodLogs and LinkContainerL... |