CVE.report
CVE.report is the most up-to-date database of common vulnerabilities and exposures. Information is pulled in from several sources and processed in to a mobile friendly, easy to use page. Use the site to quickly check for vulnerabilities in products such as operating systems, applications, hardware, networks, databases, browsers, e-mail clients and more.
CVEs provide a unique and common naming scheme for publicly known cyber security vulnerabilities in order to quickly identify and share these vulnerabilities. You can use the search below to look for vulnerabilities based on product, vendor, or common tags
The form you will see after following this link allows you to fill out the various variables in the CVSS scoring system and receive the corresponding score. The description of each of the variables is also included for additional information.
cve.report now provides a free read-only JSON API for CVE details. Each record combines the CVE Program JSON record, NVD enrichment, KEV, and EPSS when available.
Recent CVEs
| CVE | Description | Updated |
|---|---|---|
| CVE-2026-114173 json | The Ortto plugin for WordPress before 1.0.25 did not filter the WooCommerce product data it embedded in public storefront pag... | |
| CVE-2026-113409 json | The Ortto plugin for WordPress before 1.0.25 did not escape stored settings on its admin settings page, leading to stored cro... | |
| CVE-2026-113387 json | The Ortto plugin for WordPress before 1.0.25 did not authenticate configuration update requests, relying only on a secret exp... | |
| CVE-2026-106484 json | Insufficient policy enforcement in chrome-devtools-mcp in Google Chrome on Linux prior to 1.5.0 allowed a local attacker to p... | |
| CVE-2026-103410 json | An Integer Overflow vulnerability in the DPI certificate scanner in Juniper Networks Session Smart Router allows an unauthent... | |
| CVE-2026-103400 json | An Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in the em... | |
| CVE-2026-103394 json | An Improper Initialization vulnerability in the SSR software in Juniper Networks Session Smart Router allows an attacker to d... | |
| CVE-2026-103390 json | An Out-of-Bounds Read vulnerability in the HttpParser component in Juniper Networks Session Smart Router and Session Smart Co... | |
| CVE-2026-92665 json | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1... | |
| CVE-2026-86392 json | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1... | |
| CVE-2026-86391 json | Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.... | |
| CVE-2026-86377 json | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1... | |
| CVE-2026-66092 json | In openEQUELLA before 2026.2, the pre-login notice is stored as HTML and rendered on the legacy logon page without encoding o... | |
| CVE-2026-66091 json | In openEQUELLA before 2026.1, the GET /api/userquery/userinfobackup endpoint performs no authentication or authorisation chec... | |
| CVE-2026-66090 json | In openEQUELLA before 2026.1, the XML parser used for item metadata does not disable external entity resolution. A user permi... | |
| CVE-2026-66089 json | In openEQUELLA before 2026.1, the SOAP API parses XML supplied in the stopEdit operation with a parser that resolves external... | |
| CVE-2026-66088 json | In openEQUELLA before 2026.1, the system.execute() function available to the scripting engine runs supplied operating system ... | |
| CVE-2026-16889 json | In openEQUELLA before 2026.1, the pre-login notice image upload endpoint (PUT /api/preloginnotice/image/{name}) does not vali... | |
| CVE-2026-118169 json | The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to Stored Cross-Site Scrip... | |
| CVE-2026-116761 json | The CMB2 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cmb43ex1_grp[0][txt] (wysiwyg field insid... | |
| CVE-2026-116750 json | The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to blind SQL Injection via the 'catid' paramet... | |
| CVE-2026-116749 json | The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'classN... | |
| CVE-2026-116609 json | The WP Visitor Statistics (Real Time Traffic) plugin for WordPress is vulnerable to SQL Injection via the 'from' (and sibling... | |
| CVE-2026-111372 json | The AI ChatBot for WooCommerce – WoowBot plugin for WordPress is vulnerable to authorization bypass in all versions up to, ... | |
| CVE-2026-111213 json | The Travelly – Tour & Travel Booking Manager for WooCommerce plugin for WordPress is vulnerable to authorization bypass in ... | |
| CVE-2026-111111 json | The Prime Slider – Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons plugin for WordPress is vulnerable to ... | |
| CVE-2026-111068 json | The DesignSetGo plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tagName' parameter in all versions... | |
| CVE-2026-110662 json | The MxChat – AI Chatbot & Content Generation for WordPress plugin for WordPress is vulnerable to Stored DOM-Based Cross-Sit... | |
| CVE-2026-101935 json | The Echo Knowledge Base – Documentation, FAQs, Chat & Smart Search plugin for WordPress is vulnerable to Reflected Cross-Si... | |
| CVE-2026-92797 json | The MemberPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.14.1. Th... | |
| CVE-2026-90721 json | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1... | |
| CVE-2026-85655 json | The Enable Media Replace plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.2... | |
| CVE-2026-77871 json | The Post Snippets – Custom WordPress Code Snippets Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scrip... | |
| CVE-2026-77188 json | The Waitlist Woocommerce ( Back in stock notifier ) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'ty... | |
| CVE-2026-76780 json | The Beyondseo plugin for WordPress is vulnerable to unauthorized access in versions up to, and including, 1.3.6. This is due ... | |
| CVE-2026-76005 json | The WP Inventory Manager plugin for WordPress is vulnerable to time-based SQL Injection via 'sort_order' Shortcode Attribute ... | |
| CVE-2026-2839 json | The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to unauthorized access of data and triggering of serv... | |
| CVE-2026-110071 json | The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'align' parameter in all versions up... | |
| CVE-2026-110020 json | The Rich Showcase for Google Reviews plugin for WordPress is vulnerable to authorization bypass in all versions up to, and in... | |
| CVE-2026-109988 json | The Product Addons for Woocommerce – Product Options with Custom Fields plugin for WordPress is vulnerable to Stored Cross-... | |
| CVE-2026-109979 json | The Related Posts for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and i... | |
| CVE-2026-109978 json | The Cozy Blocks – Website Builder for WordPress Block Editor | Gutenberg Blocks, Patterns & Templates plugin for WordPress ... | |
| CVE-2026-109975 json | The Cozy Blocks – Website Builder for WordPress Block Editor | Gutenberg Blocks, Patterns & Templates plugin for WordPress ... | |
| CVE-2026-109590 json | The Tour Booking Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'width', 'height' and 'zoo... | |
| CVE-2026-109385 json | The UiChemy – Convert Figma, Prompts and AI Builds to Elementor, Gutenberg and Bricks plugin for WordPress is vulnerable to... | |
| CVE-2026-109384 json | The The Innovative Form Builder – IvyForms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up t... | |
| CVE-2026-109370 json | The Document Embedder – let visitors read files without downloading plugin for WordPress is vulnerable to Stored DOM-Based ... | |
| CVE-2026-109218 json | The Contact Manager plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 9.1.2 v... | |
| CVE-2026-108366 json | The easy.jobs – AI powered Job Listing, Job Board, Career Page, Recruitment & Hiring Solution plugin for WordPress is vulne... | |
| CVE-2026-104743 json | The Tainacan plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.3.0 via the 't... | |
| CVE-2026-104740 json | The If-So Dynamic Content – Elementor & All Page Builders Personalization plugin for WordPress is vulnerable to Stored Cros... | |
| CVE-2026-104729 json | The Avada (Fusion) Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tab_index, empty_notice... | |
| CVE-2026-103370 json | The Awesome Support – WordPress HelpDesk & Support Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting... | |
| CVE-2026-100175 json | The Postie plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Email Body URL Autolink in all versions up t... | |
| CVE-2026-15323 json | The Product Designer for WooCommerce WordPress | Lumise plugin for WordPress is vulnerable to Directory Traversal in all vers... | |
| CVE-2026-116613 json | The Animated Text Block plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including... | |
| CVE-2026-111727 json | The Appointment Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'vs_text_submitbtn... | |
| CVE-2026-111314 json | The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin for WordPress is vulnerable to Stored Cross... | |
| CVE-2026-109995 json | The Advanced Views – Display Framework for Gutenberg & Elementor plugin for WordPress is vulnerable to Stored Cross-Site Sc... | |
| CVE-2026-109974 json | The All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos plugin for WordPress is vul... | |
| CVE-2026-109209 json | The All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos plugin for WordPress is vul... | |
| CVE-2026-107745 json | The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to limited media file dele... | |
| CVE-2026-106013 json | The Jupiter X Core plugin for WordPress is vulnerable to Authentication Bypass via the Twitter/X Social Login handler in all ... | |
| CVE-2026-97019 json | The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'headline-*... | |
| CVE-2026-93862 json | An out-of-bounds read vulnerability in the FireCluster Sync processing allows an attacker positioned on the cluster interconn... | |
| CVE-2026-90732 json | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through LTS 2026, LTS2024 release versions 7.13.1.0 through 7... | |
| CVE-2026-90731 json | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through 7.13.1... | |
| CVE-2026-90725 json | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1... | |
| CVE-2026-84999 json | The Pie Register Premium plugin for WordPress is vulnerable to Unrestricted File Type Upload in all versions up to, and inclu... | |
| CVE-2026-75891 json | The Kirki plugin for WordPress is vulnerable to Privilege Escalation via PHP Object Injection in all versions up to, and incl... | |
| CVE-2026-68866 json | PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through 7.13.1.70, ... | |
| CVE-2026-10752 json | The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to authorization bypass in all versions up to, and in... | |
| CVE-2026-10511 json | The Jupiter X Core plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'forget_password_link' parameter... | |
| CVE-2026-1928 json | The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to PHP Object Injection in all... | |
| CVE-2026-116839 json | A malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Site Request Forgery (CSRF) vulne... | |
| CVE-2026-115807 json | The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vuln... | |
| CVE-2026-115806 json | The Prime Mover – Backup and Migration plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, an... | |
| CVE-2026-115417 json | Memory allocation with excessive size value in the MQTT 3.1.1 compatibility adapter in AWS aws-c-mqtt before 0.16.2 might all... | |
| CVE-2026-114645 json | A 32-bit integer wraparound in the MongoDB C Driver's Windows-only Kerberos/SSPI authentication code can cause an undersized ... | |
| CVE-2026-111820 json | The Analytics Insights – Google Analytics Dashboard for WordPress plugin for WordPress is vulnerable to Stored Cross-Site S... | |
| CVE-2026-101593 json | Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product... | |
| CVE-2026-101584 json | Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-webclient-websocket). Supported version... | |
| CVE-2026-101583 json | Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-common-mapper). Supported versions that... | |
| CVE-2026-101575 json | Vulnerability in the Helidon product of Oracle Fusion Middleware (component: LRA). Supported versions that are affected are ... | |
| CVE-2026-101570 json | Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-webserver-http2). Supported versions th... | |
| CVE-2026-101524 json | Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Security Framew... | |
| CVE-2026-101502 json | Vulnerability in Oracle Trusted Answer Search (component: PLSQL package). The supported version that is affected is 26.1. D... | |
| CVE-2026-101497 json | Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: Connector Framework). Supported... | |
| CVE-2026-101488 json | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Business Interlink). Support... | |
| CVE-2026-101474 json | Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product... | |
| CVE-2026-101471 json | Vulnerability in the Oracle Product Lifecycle Analytics product of Oracle Supply Chain (component: Installation Issues). Th... | |
| CVE-2026-101459 json | Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versio... | |
| CVE-2026-91247 json | Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Runtime Tools). Supported versi... | |
| CVE-2026-91238 json | Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions that... | |
| CVE-2026-57184 json | Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1... | |
| CVE-2026-25716 json | Missing Authorization vulnerability in Hallo Welt! GmbH BlueSpice (Extension:BlueSpiceUserManager) allows any authenticated u... | |
| CVE-2025-65200 json | An issue was discovered in localstack 4.9.2 allowing attackers to execute arbitrary code via crafted content hosted on a web-... | |
| CVE-2026-101432 json | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Test Framework). Supported v... | |
| CVE-2026-101415 json | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Analytic Server). Supported ... | |
| CVE-2026-101412 json | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Analytic Server). Supported ... |