CVE.report
CVE.report is the most up-to-date database of common vulnerabilities and exposures. Information is pulled in from several sources and processed in to a mobile friendly, easy to use page. Use the site to quickly check for vulnerabilities in products such as operating systems, applications, hardware, networks, databases, browsers, e-mail clients and more.
CVEs provide a unique and common naming scheme for publicly known cyber security vulnerabilities in order to quickly identify and share these vulnerabilities. You can use the search below to look for vulnerabilities based on product, vendor, or common tags
The form you will see after following this link allows you to fill out the various variables in the CVSS scoring system and receive the corresponding score. The description of each of the variables is also included for additional information.
cve.report now provides a free read-only JSON API for CVE details. Each record combines the CVE Program JSON record, NVD enrichment, KEV, and EPSS when available.
Recent CVEs
| CVE | Description | Updated |
|---|---|---|
| CVE-2026-108963 json | databasement before 1.8.2 allows remote code execution because it runs certain commands (e.g., mariadb-dump) with a database ... | |
| CVE-2025-69941 json | SourceCodester Tailor Management System 1.0 is vulnerable to SQL Injection in addmeasurement.php?id=1. | |
| CVE-2025-69934 json | CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /delete_members.php?id=1. | |
| CVE-2025-69230 json | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. In versions 3.13.2 and below, reading multipl... | |
| CVE-2025-69229 json | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. In versions 3.13.2 and below, handling of chu... | |
| CVE-2025-69228 json | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below allow a request to ... | |
| CVE-2025-69227 json | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below allow for an infini... | |
| CVE-2025-69226 json | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below enable an attacker ... | |
| CVE-2025-69225 json | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below contain parser logi... | |
| CVE-2025-67858 json | A Improper Neutralization of Argument Delimiters vulnerability in Foomuuri can lead to integrity loss of the firewall configu... | |
| CVE-2025-67603 json | A Improper Authorization vulnerability in Foomuuri llows arbitrary users to influence the firewall configuration.This issue ... | |
| CVE-2025-66003 json | An External Control of File Name or Path vulnerability in smb4k allowsl ocal users to perform a local root exploit via smb4k ... | |
| CVE-2025-66002 json | An Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability allows local users ton p... | |
| CVE-2025-13826 json | Zervit's portable HTTP/web server is vulnerable to remote DoS attacks when a configuration reset request is made. The vulnera... | |
| CVE-2025-69224 json | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below of the Python HTTP ... | |
| CVE-2025-69223 json | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below allow a zip bomb to... | |
| CVE-2025-61689 json | HTTP.jl is an HTTP client and server functionality for the Julia programming language. Prior to version 1.10.19, HTTP.jl did ... | |
| CVE-2025-60201 json | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in agui... | |
| CVE-2025-58186 json | Despite HTTP headers having a default limit of 1MB, the number of cookies that can be parsed does not have a limit. By sendin... | |
| CVE-2025-46363 json | Dell Secure Connect Gateway (SCG) 5.0 Application and Appliance version(s) 5.26.00.00 - 5.30.00.00, contain a Relative Path T... | |
| CVE-2025-15095 json | A security vulnerability has been detected in postmanlabs httpbin up to 0.6.1. This affects an unknown function of the file h... | |
| CVE-2025-11937 json | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Fo... | |
| CVE-2025-11278 json | A security vulnerability has been detected in AllStarLink Supermon up to 6.2. This vulnerability affects unknown code of the ... | |
| CVE-2025-11277 json | A weakness has been identified in Open Asset Import Library Assimp 6.0.2. This affects the function Q3DImporter::InternReadFi... | |
| CVE-2025-11275 json | A vulnerability was identified in Open Asset Import Library Assimp 6.0.2. Affected by this vulnerability is the function ODDL... | |
| CVE-2025-11274 json | A vulnerability was determined in Open Asset Import Library Assimp 6.0.2. Affected is the function Q3DImporter::InternReadFil... | |
| CVE-2025-11176 json | The Quick Featured Images plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and i... | |
| CVE-2025-11273 json | A vulnerability was found in LaChatterie Verger up to 1.2.10. This impacts the function redirectToAuthorization of the file /... | |
| CVE-2025-11272 json | A vulnerability has been found in SeriaWei ZKEACMS up to 4.3. This affects the function Delete of the file src/ZKEACMS.Redire... | |
| CVE-2025-11228 json | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized modification of da... | |
| CVE-2025-11227 json | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Information Exposure in all ver... | |
| CVE-2025-10746 json | The Integrate Dynamics 365 CRM plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including... | |
| CVE-2025-10383 json | The Contest Gallery – Upload, Vote & Sell with PayPal and Stripe plugin for WordPress is vulnerable to Stored Cross-Site Sc... | |
| CVE-2025-9952 json | The Trinity Audio – Text to Speech AI audio player to convert content into audio plugin for WordPress is vulnerable to Refl... | |
| CVE-2025-9886 json | The Trinity Audio – Text to Speech AI audio player to convert content into audio plugin for WordPress is vulnerable to Cros... | |
| CVE-2025-9485 json | The OAuth Single Sign On – SSO (OAuth Client) plugin for WordPress is vulnerable to Improper Verification of Cryptographic ... | |
| CVE-2025-9243 json | The Cost Calculator Builder plugin for WordPress is vulnerable to unauthorizedmodification of data due to a missing capabilit... | |
| CVE-2025-9030 json | The Majestic Before After Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'before_label' and ... | |
| CVE-2025-9029 json | The WDesignKit – Elementor & Gutenberg Starter Templates, Patterns, Cloud Workspace & Widget Builder plugin for WordPress i... | |
| CVE-2025-8726 json | The WP Photo Album Plus plugin for WordPress is vulnerable to Cross-Site Scripting in all versions up to, and including, 9.0.... | |
| CVE-2025-60159 json | Missing Authorization vulnerability in webmaniabr Nota Fiscal Eletrônica WooCommerce nota-fiscal-eletronica-woocommerce allo... | |
| CVE-2025-36274 json | IBM Aspera HTTP Gateway 2.0.0 through 2.3.1 stores sensitive information in clear text in easily obtainable files which can b... | |
| CVE-2025-9859 json | The Fintelligence Calculator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'fintelligenc... | |
| CVE-2025-9858 json | The Auto Bulb Finder for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'abf_ve... | |
| CVE-2025-9854 json | The A Simple Multilanguage Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'asmp-sw... | |
| CVE-2025-9630 json | The WP SinoType plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. T... | |
| CVE-2025-9198 json | The Wp cycle text announcement plugin for WordPress is vulnerable to SQL Injection via the 'cycle-text' shortcode in all vers... | |
| CVE-2025-9194 json | The Constructor theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on t... | |
| CVE-2025-9130 json | The Unify plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin for WordPress's unify_checkout sho... | |
| CVE-2025-9129 json | The Flexi plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin for WordPress's flexi-form-tag sho... | |
| CVE-2025-9080 json | The Generic Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widget fields in version ... | |
| CVE-2025-9077 json | The Ultra Addons Lite for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Animated Text'... | |
| CVE-2025-60158 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webmaniabr Nota Fiscal ... | |
| CVE-2025-60157 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in emarket-design WP Ticke... | |
| CVE-2025-60156 json | Cross-Site Request Forgery (CSRF) vulnerability in webandprint AR For WordPress ar-for-wordpress allows Upload a Web Shell to... | |
| CVE-2025-60155 json | Missing Authorization vulnerability in loopus WP Virtual Assistant VirtualAssistant allows Exploiting Incorrectly Configured ... | |
| CVE-2025-60154 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jennifer Moss MWW Discl... | |
| CVE-2025-60153 json | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in wpsh... | |
| CVE-2025-60152 json | Missing Authorization vulnerability in wpshuffle Subscribe To Unlock subscribe-to-unlock allows Exploiting Incorrectly Config... | |
| CVE-2025-60150 json | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in wpsh... | |
| CVE-2025-60149 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rocket Apps Notely note... | |
| CVE-2025-60148 json | Missing Authorization vulnerability in wpshuffle Subscribe to Download subscribe-to-download allows Exploiting Incorrectly Co... | |
| CVE-2025-60147 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HT Plugins HT Feed ht-i... | |
| CVE-2025-60146 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Amit Verma Map Categori... | |
| CVE-2025-60145 json | Cross-Site Request Forgery (CSRF) vulnerability in yonifre Lenix scss compiler lenix-scss-compiler allows Cross Site Request ... | |
| CVE-2025-60144 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in yonifre Lenix scss comp... | |
| CVE-2025-60142 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DaganLev Simple Meta Ta... | |
| CVE-2025-60141 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in thetechtribe The Tribal... | |
| CVE-2025-60140 json | Insertion of Sensitive Information Into Sent Data vulnerability in thetechtribe The Tribal the-tech-tribe allows Retrieve Emb... | |
| CVE-2025-60139 json | Cross-Site Request Forgery (CSRF) vulnerability in Joovii Sendle Shipping official-sendle-shipping-method allows Cross Site R... | |
| CVE-2025-60138 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sonalsinha21 SKT Blocks... | |
| CVE-2025-60137 json | Cross-Site Request Forgery (CSRF) vulnerability in Galaxy Weblinks Post Featured Video post-featured-video allows Cross Site ... | |
| CVE-2025-60136 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cartpauj User Notes use... | |
| CVE-2025-60133 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DJ-Extensions.com PE Ea... | |
| CVE-2025-60130 json | Missing Authorization vulnerability in wedos.com WEDOS Global wgpwpp allows Accessing Functionality Not Properly Constrained ... | |
| CVE-2025-60128 json | Missing Authorization vulnerability in WP Delicious Delisho dr-widgets-blocks allows Exploiting Incorrectly Configured Access... | |
| CVE-2025-60127 json | Missing Authorization vulnerability in ArtistScope CopySafe Web Protection wp-copysafe-web allows Exploiting Incorrectly Conf... | |
| CVE-2025-60126 json | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Plug... | |
| CVE-2025-60125 json | Insertion of Sensitive Information Into Sent Data vulnerability in themelooks FoodBook foodbook allows Retrieve Embedded Sens... | |
| CVE-2025-60124 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ryan Hellyer Simple Col... | |
| CVE-2025-60123 json | Missing Authorization vulnerability in HivePress HivePress Claim Listings hivepress-claim-listings allows Exploiting Incorrec... | |
| CVE-2025-60122 json | Missing Authorization vulnerability in HivePress HivePress Claim Listings hivepress-claim-listings allows Exploiting Incorrec... | |
| CVE-2025-60121 json | Missing Authorization vulnerability in Ex-Themes WooEvents woo-events allows Exploiting Incorrectly Configured Access Control... | |
| CVE-2025-60120 json | Missing Authorization vulnerability in WPDirectoryKit WP Directory Kit wpdirectorykit allows Exploiting Incorrectly Configure... | |
| CVE-2025-60118 json | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Potenzaglobalsolutions ... | |
| CVE-2025-60117 json | Cross-Site Request Forgery (CSRF) vulnerability in TangibleWP Vehica Core vehica-core allows Cross Site Request Forgery.This ... | |
| CVE-2025-60116 json | Missing Authorization vulnerability in ThemeGoods Grand Conference Theme Custom Post Type grandconference-custom-post allows ... | |
| CVE-2025-60115 json | Cross-Site Request Forgery (CSRF) vulnerability in instapagedev Instapage Plugin instapage allows Cross Site Request Forgery.... | |
| CVE-2025-60114 json | Improper Control of Generation of Code ('Code Injection') vulnerability in YayCommerce YayCurrency yaycurrency allows Code In... | |
| CVE-2025-60113 json | Cross-Site Request Forgery (CSRF) vulnerability in grooni Groovy Menu groovy-menu-free allows Cross Site Request Forgery.This... | |
| CVE-2025-60112 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Syed Balkhi aThemes Add... | |
| CVE-2025-60111 json | Cross-Site Request Forgery (CSRF) vulnerability in javothemes Javo Core javo-core allows Authentication Bypass.This issue aff... | |
| CVE-2025-60110 json | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup AllInOne -... | |
| CVE-2025-60109 json | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup LambertGro... | |
| CVE-2025-60108 json | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup LambertGro... | |
| CVE-2025-60107 json | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup LambertGro... | |
| CVE-2025-60106 json | Missing Authorization vulnerability in Roxnor EmailKit emailkit allows Exploiting Incorrectly Configured Access Control Secur... | |
| CVE-2025-60105 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in metaphorcreations Ditty... | |
| CVE-2025-60104 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jordy Meow Gallery Cust... | |
| CVE-2025-60103 json | Missing Authorization vulnerability in CridioStudio ListingPro listingpro-plugin allows Exploiting Incorrectly Configured Acc... |