CVE.report
CVE.report is the most up-to-date database of common vulnerabilities and exposures. Information is pulled in from several sources and processed in to a mobile friendly, easy to use page. Use the site to quickly check for vulnerabilities in products such as operating systems, applications, hardware, networks, databases, browsers, e-mail clients and more.
CVEs provide a unique and common naming scheme for publicly known cyber security vulnerabilities in order to quickly identify and share these vulnerabilities. You can use the search below to look for vulnerabilities based on product, vendor, or common tags
The form you will see after following this link allows you to fill out the various variables in the CVSS scoring system and receive the corresponding score. The description of each of the variables is also included for additional information.
cve.report now provides a free read-only JSON API for CVE details. Each record combines the CVE Program JSON record, NVD enrichment, KEV, and EPSS when available.
Recent CVEs
| CVE | Description | Updated |
|---|---|---|
| CVE-2026-116046 json | A flaw has been found in eventcatalog sdk up to 2.29.0. This vulnerability affects the function getCustomDoc/writeCustomDoc/r... | |
| CVE-2026-116045 json | A vulnerability was detected in 1999AZZAR designer-mcp up to 2.1.0. This affects the function get_reference of the file skill... | |
| CVE-2026-114406 json | The system certificate authority (CA) store in Red Hat products, distributed via ca-certificates RPM packages, included multi... | |
| CVE-2026-116044 json | A security vulnerability has been detected in prasathmani TinyFileManager up to 2.6. Affected by this issue is some unknown f... | |
| CVE-2026-115251 json | The Duplicator WordPress plugin before 5.0.0 does not restrict its one-click upgrade routine to users allowed to install Dup... | |
| CVE-2026-115214 json | The Datawiza Proxy Auth Plugin WordPress plugin before 1.1.1 does not verify that the user-identity and role HTTP request he... | |
| CVE-2026-115183 json | The Qi Addons For Elementor WordPress plugin before 1.11.2 does not properly sanitise a widget's heading text after decoding ... | |
| CVE-2026-114743 json | The InstaWP Connect WordPress plugin before 0.1.4.2 does not perform a capability check on its InstaWP Connect WordPress pl... | |
| CVE-2026-114742 json | The WPVR WordPress plugin before 9.0.3 does not perform object-level ownership checks when updating virtual tours, allowing ... | |
| CVE-2026-114741 json | The WPVR WordPress plugin before 9.0.3 does not perform object-level authorization checks when reading and updating virtual ... | |
| CVE-2026-114740 json | The WPVR WordPress plugin before 9.1.3 does not correctly check user capabilities when creating a tour through its setup wiz... | |
| CVE-2026-111981 json | The GiveWP WordPress plugin before 4.19.0.1 does not perform a capability check when handling donor address changes, allowin... | |
| CVE-2026-111980 json | The GiveWP WordPress plugin before 4.19.0.1 does not correctly determine which page a page-capability request applies to, al... | |
| CVE-2026-111979 json | The GiveWP WordPress plugin before 4.19.0.1 does not properly sanitise and escape one of its donation form template settings... | |
| CVE-2026-111978 json | The GiveWP WordPress plugin before 4.19.0.1 does not properly validate a user-supplied filename before reading it from disk,... | |
| CVE-2026-111976 json | The GiveWP WordPress plugin before 4.19.0.1 does not perform any status or capability check when rendering a donation form o... | |
| CVE-2026-110285 json | The WP Stripe Checkout WordPress plugin before 1.2.2.62 does not verify the Stripe webhook signature when no signing secret i... | |
| CVE-2026-94295 json | The Chikkili- Google Pay India for Woocommerce WordPress plugin through 1.0.6 does not verify that a payment notification act... | |
| CVE-2025-15705 json | The Contact Form by Supsystic WordPress plugin before 1.8.0 does not sanitise and escape a form name, allowing users with ac... | |
| CVE-2026-116007 json | A flaw has been found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.09. The impacted element is the function SmsCodeServic... | |
| CVE-2026-116006 json | A vulnerability was detected in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.09. The affected element is an unknown function... | |
| CVE-2026-114820 json | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (com... | |
| CVE-2026-116004 json | A security vulnerability has been detected in onyx-dot-app Onyx up to 5.0.0. Impacted is an unknown function of the file web/... | |
| CVE-2026-116000 json | A security flaw has been discovered in Zylon PrivateGPT 1.0.0/1.0.1. This vulnerability affects the function load_file_from_u... | |
| CVE-2026-115999 json | A vulnerability has been found in mansi-k Restaurant_IMS d7ad49f61ab7cc1ec6eb359ac2b5378bdbde0694. Affected is the function m... | |
| CVE-2026-115557 json | Python has added a denylist for known compromised certificates to the "ssl" module to ensure user safety even without certifi... | |
| CVE-2025-60493 json | A segmentation violation in the check_media_profile function (/mp4box/mp4box.c) of GPAC Project/MP4Box before 2.5 allows atta... | |
| CVE-2026-115997 json | A flaw has been found in pig-mesh pig up to 4.1.0. This impacts the function orderItem.getColumn of the file pig-common/pig-c... | |
| CVE-2026-115996 json | A vulnerability was detected in Unitree Robotics Unitree Go2 up to 1.1.13/1.1.14.1/1.1.15.1. This affects the function WebSoc... | |
| CVE-2026-115995 json | A security vulnerability has been detected in Unitree Robotics Unitree Go2 up to 1.1.11.4. The impacted element is the functi... | |
| CVE-2026-111326 json | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | |
| CVE-2026-89284 json | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | |
| CVE-2026-109111 json | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | |
| CVE-2026-61434 json | PraisonAI versions before 4.6.78 contain an allowlist bypass vulnerability in shell command execution that allows attackers t... | |
| CVE-2026-61432 json | PraisonAI (praisonaiagents) before 1.6.78 contains a path traversal vulnerability in the FastContext feature (praisonaiagents... | |
| CVE-2026-61431 json | PraisonAI before 4.6.78 contains a path traversal vulnerability in ContextGatherer that fails to validate include paths in .p... | |
| CVE-2026-60091 json | PraisonAI before 4.6.78 contains an unauthenticated server-side request forgery vulnerability in the Jobs API /api/v1/runs en... | |
| CVE-2026-60089 json | PraisonAI (pip package praisonaiagents) before 1.6.78 automatically loads defaults from a project-local .praisonai/config.tom... | |
| CVE-2026-60086 json | PraisonAI before 4.6.78 contains a prompt injection defense bypass vulnerability where the injection defense only blocks thre... | |
| CVE-2026-59796 json | In JetBrains TeamCity before 2026.1.2 pipeline modification was possible due to improper permission checks | |
| CVE-2026-59795 json | In JetBrains TeamCity before 2026.1.2 stored XSS via unauthenticated agent registration was possible | |
| CVE-2026-59794 json | In JetBrains TeamCity before 2026.1.2 stored XSS on the cloud profile page was possible via agent-reported data | |
| CVE-2026-59793 json | In JetBrains TeamCity before 2026.1.2 arbitrary file access was possible via the Perforce VCS integration | |
| CVE-2026-59792 json | In JetBrains IntelliJ IDEA before 2026.1.4, 2026.2 code execution via path traversal in project workspace ID handling was po... | |
| CVE-2026-59791 json | In JetBrains YouTrack before 2026.2.17012 cSS injection via Mermaid diagram rendering was possible | |
| CVE-2026-56813 json | Improper Neutralization of Parameter/Argument Delimiters vulnerability in elixir-plug plug allows an attacker to inject or ov... | |
| CVE-2026-54470 json | Dell Unisphere for PowerMax, version(s) 10.3.0.5 and prior contain(s) an Improper Restriction of XML External Entity Referenc... | |
| CVE-2026-54469 json | Dell Unisphere for PowerMax, version(s) 10.3.0.5 and prior, contain(s) a Deserialization of Untrusted Data vulnerability. A l... | |
| CVE-2026-58225 json | SQL Injection vulnerability in elixir-ecto postgrex allows an attacker who can influence a LISTEN channel name to inject SQL ... | |
| CVE-2026-56814 json | Plug.Parsers.MULTIPART, the multipart request-body parser used to handle file uploads and multipart forms, does not enforce i... | |
| CVE-2026-54468 json | Dell Unisphere for PowerMax, version(s) 10.3.0.5 and prior, contain(s) a path traversal vulnerability. A low privileged attac... | |
| CVE-2026-41880 json | R-SOFT DMS is vulnerable to OS Command Injection in the Optical Character Recognition (OCR) module. Multiple command executi... | |
| CVE-2026-41879 json | R-SOFT DMS stores superadmin credentials using a non-salted nested MD5 hash. This allows an attacker who obtain password has... | |
| CVE-2026-14461 json | mtr is vulnerable to Out-of-bound read vulnerability in ipinfo_lookup() function. An attacker who can influence the TXT respo... | |
| CVE-2026-115982 json | A vulnerability was detected in phpIPAM up to 1.8.3. Affected by this issue is the function create_rack_link of the file app/... | |
| CVE-2026-115981 json | A security vulnerability has been detected in phpIPAM up to 1.8.3. Affected by this vulnerability is an unknown functionality... | |
| CVE-2026-58655 json | The bundled Grav Flex Objects plugin (getgrav/grav-plugin-flex-objects) before 1.4.0 contains a stored server-side template i... | |
| CVE-2026-56764 json | Hono before 4.11.10 contains a timing attack vulnerability in the basicAuth and bearerAuth middlewares due to non-constant-ti... | |
| CVE-2026-59235 json | Missing Authorization (CWE-862) in BankAccountListController (app/Http/Controllers/Api/BankAccount/BankAccountListController.... | |
| CVE-2026-58077 json | Joomla Extension - weeblr.com - Unauthenticated stored XSS in 4Analytics < 5.0.2 - The Joomla extension 4Analytics is vulnera... | |
| CVE-2026-57831 json | Joomla Extension - digital-peak.com - Unauthenticated blind SQL injection in DP Calendar 8.18.0 - 10.11.2 - The Joomla extens... | |
| CVE-2026-57821 json | A SQL Injection vulnerability exists in Apache Fineract's Office Search API (GET /api/v1/offices) in versions up to and inclu... | |
| CVE-2026-56287 json | A boolean-based SQL Injection vulnerability exists in Apache Fineract's Client Search API (GET /api/v1/clients) in versions u... | |
| CVE-2026-42936 json | The installer of HYPER SBI 2 insecurely loads Dynamic Link Libraries. If there is a crafted DLL at the same directory when in... | |
| CVE-2026-35152 json | A SQL Injection vulnerability exists in Apache Fineract's Report Execution API (runreports endpoint) in versions up to and in... | |
| CVE-2026-15804 json | The HCM developed by MetaGuru has a SQL Injection vulnerability. Authenticated remote attackers can inject SQL commands via s... | |
| CVE-2026-15583 json | A confused-deputy flaw in Grafana MCP Server allows an unauthenticated remote attacker to exfiltrate the server's environment... | |
| CVE-2026-14251 json | A flaw was found in the OpenShift GitOps operator. The ClusterRole reconciler does not validate resource ownership when recon... | |
| CVE-2026-8920 json | Improper Restriction of Communication Channel to Intended Endpoints and External Control of File Name or Path in Aura Wallpap... | |
| CVE-2026-54684 json | jadx is a Dex to Java decompiler. From 1.5.2 to 1.5.5, a malicious .xapk file can cause jadx to write attacker-controlled arc... | |
| CVE-2026-49981 json | Twig is a template language for PHP. Prior to 3.27.0, the per-template filter, tag, and function allow-list verdict is comput... | |
| CVE-2026-48808 json | Twig is a template language for PHP. Prior to 3.27.0, the column filter passes the active sandbox state as a boolean but does... | |
| CVE-2026-48807 json | Twig is a template language for PHP. Prior to 3.27.0, the sandbox __toString() checks do not fully cover Traversable values p... | |
| CVE-2026-48806 json | Twig is a template language for PHP. Prior to 3.27.0, ArrayExpression does not guard dynamic mapping keys that are coerced to... | |
| CVE-2026-48805 json | Twig is a template language for PHP. Prior to 3.27.0, deprecated internal wrappers in src/Resources/core.php do not forward t... | |
| CVE-2026-15753 json | A vulnerability was determined in zhinianboke xianyu-auto-reply on Server. Affected by this vulnerability is an unknown funct... | |
| CVE-2026-15752 json | A vulnerability was found in zhinianboke xianyu-auto-reply up to dcb445ad97816ad65299a7580ee0c8c8f929da84. Affected is an unk... | |
| CVE-2026-15751 json | A security vulnerability has been detected in mastergo-design mastergo-magic-mcp up to 0.2.0. The affected element is the fun... | |
| CVE-2026-13385 json | An Improper Validation of Integrity Check Value and Improper Certificate Validation in certain ASUS router models allows a re... | |
| CVE-2026-11851 json | Improper Neutralization of Special Elements used in an SQL Command ("SQL Injection") in the web management interface of certa... | |
| CVE-2026-8919 json | Permissive Cross-domain Security Policy with Untrusted Domains in ASUS GameSDK allows a remote user to obtain a local user’... | |
| CVE-2026-47732 json | Twig is a template language for PHP. Prior to 3.26.0, several Twig language constructs trigger PHP string coercion on a Strin... | |
| CVE-2026-47730 json | Twig is a template language for PHP. From 3.0.0 until 3.26.0, Twig\Profiler\Dumper\HtmlDumper writes Profile::getTemplate() a... | |
| CVE-2026-46640 json | Twig is a template language for PHP. From 3.15.0 until 3.26.0, _self.(<string>) and import-alias dynamic attribute syntax can... | |
| CVE-2026-46639 json | Twig is a template language for PHP. From 3.24.0 until 3.26.0, object-destructuring assignment compiles CoreExtension::getAtt... | |
| CVE-2026-46638 json | Twig is a template language for PHP. Prior to 3.26.0, {% sandbox %}{% include %} can include a template that was previously l... | |
| CVE-2026-46635 json | Twig is a template language for PHP. Prior to 3.26.0, the column filter passes object arrays to PHP array_column(), which rea... | |
| CVE-2026-46634 json | Twig is a template language for PHP. From 3.9.0 until 3.26.0, template_from_string() compiles an inner template under a synth... | |
| CVE-2026-46633 json | Twig is a template language for PHP. Prior to 3.26.0, Compiler::string() does not escape single quotes when a template name f... | |
| CVE-2026-46629 json | Twig is a template language for PHP. Prior to 3.26.0, twig/intl-extra memoises IntlDateFormatter and NumberFormatter instance... | |
| CVE-2026-46628 json | Twig is a template language for PHP. Prior to 3.26.0, the deprecated spaceless filter is registered as safe for HTML, causing... | |
| CVE-2026-46627 json | Twig is a template language for PHP. Prior to 3.26.0, the Twig sandbox does not prevent a template from consuming CPU, memory... | |
| CVE-2026-45363 json | ruby-jwt is a Ruby implementation of the RFC 7519 OAuth JSON Web Token standard. Prior to 2.10.3 and 3.2.0, JWT.decode(token,... | |
| CVE-2026-42447 json | jadx is a Dex to Java decompiler. Prior to 1.5.6, jadx-gui is affected by an HTML injection vulnerability in the Summary tab ... | |
| CVE-2026-59674 json | A UNIX Symbolic Link (Symlink) Following vulnerability in openSUSE Tumbleweed suricata package allows the suricata user to es... | |
| CVE-2026-42049 json | jadx is a Dex to Java decompiler. Prior to 1.5.6, jadx inserts the android:versionName value from an AndroidManifest into the... | |
| CVE-2026-38450 json | An issue in Aetopia Digital Asset Management DAM v.1.0.0 allows a remote attacker to execute arbitrary code via the name and ... | |
| CVE-2026-15678 json | A security vulnerability has been detected in code-projects Online Job Portal 1.0. This impacts an unknown function of the fi... | |
| CVE-2026-15677 json | A weakness has been identified in code-projects Online Job Portal 1.0. This affects an unknown function of the file /JobSeeke... | |
| CVE-2026-15183 json | Multiple input validation vulnerabilities in the Snowflake Spark Connector (spark-snowflake) versions prior to 3.2.1 can allo... |