CVE.report
CVE.report is the most up-to-date database of common vulnerabilities and exposures. Information is pulled in from several sources and processed in to a mobile friendly, easy to use page. Use the site to quickly check for vulnerabilities in products such as operating systems, applications, hardware, networks, databases, browsers, e-mail clients and more.
CVEs provide a unique and common naming scheme for publicly known cyber security vulnerabilities in order to quickly identify and share these vulnerabilities. You can use the search below to look for vulnerabilities based on product, vendor, or common tags
The form you will see after following this link allows you to fill out the various variables in the CVSS scoring system and receive the corresponding score. The description of each of the variables is also included for additional information.
cve.report now provides a free read-only JSON API for CVE details. Each record combines the CVE Program JSON record, NVD enrichment, KEV, and EPSS when available.
Recent CVEs
| CVE | Description | Updated |
|---|---|---|
| CVE-2026-124959 json | The loadIndex function in nmslib hnswlib and Spotify Voyager does not verify that the element count in a serialized HNSW inde... | |
| CVE-2026-124916 json | PrestaShop contains an authenticated PHP code injection vulnerability in the back-office Performance debug-mode configuration... | |
| CVE-2026-124850 json | A SQL injection vulnerability exists in a database migration script in flowintel. The migration process reads stored connect... | |
| CVE-2026-124636 json | A security flaw has been discovered in kevquirk PureBlog up to 3.7.2. The affected element is the function save_page of the f... | |
| CVE-2026-124249 json | http.cookiejar.CookieJar deleted a stored cookie when a response carried an already expired Set-Cookie header for it, using t... | |
| CVE-2026-123751 json | The WP Duplicate WordPress plugin through 1.1.11 does not properly verify a request authentication value and does not valida... | |
| CVE-2026-123145 json | The WooCommerce Stripe Payment Gateway WordPress plugin before 11.1.0 does not exclude the account password from the checkout... | |
| CVE-2026-121843 json | Privilege escalation in Firefox for iOS. This vulnerability was fixed in Firefox for iOS 160.0. | |
| CVE-2026-121842 json | Privilege escalation in the Reader View component in Firefox for iOS. This vulnerability was fixed in Firefox for iOS 160.0. | |
| CVE-2026-120367 json | Allocation of Resources Without Limits or Throttling vulnerability in Apache Axis2/Java. The JSON message builders, including... | |
| CVE-2026-119474 json | Incorrect Permission Assignment for Critical Resource vulnerability in HAVELSAN Inc. Liman Render Engine allows Privilege Esc... | |
| CVE-2026-119274 json | Infoblox NIOS version upto 9.1.0 contain a vulnerability related to improper input validation that allows a stored XSS | |
| CVE-2026-111421 json | Apache Airflow's Task Execution API stored XCom values written by a task without the reserved-key check applied elsewhere, so... | |
| CVE-2026-104620 json | A path traversal attack in simulation of actions in the Zypp backend of PackageKit before 1.4.1 could be used by local attack... | |
| CVE-2026-81422 json | The Advanced Appointment Booking & Scheduling WordPress plugin before 2.7 does not verify the site's user-registration settin... | |
| CVE-2026-19552 json | When ca_certs parameter was supplied to ssl.get_server_certificate() function, the identity of the certificate is not checked... | |
| CVE-2026-124566 json | A vulnerability was detected in fushengqian fuint up to 36cc31b08d77facc94e8959afa02224891b4fe5f. This vulnerability affects ... | |
| CVE-2026-124562 json | A vulnerability was identified in D-Link DIR-878 1.20B05. Affected is the function SetWanSettings of the component HNAP Handl... | |
| CVE-2026-123131 json | The GemBooking WordPress plugin before 1.7.1 does not properly verify that a REST request is addressed to its own routes bef... | |
| CVE-2026-123129 json | The Event Tickets Manager for WooCommerce WordPress plugin before 1.6.0 does not validate the ticket-type price sent to one o... | |
| CVE-2026-123128 json | The GemBooking WordPress plugin before 1.7.1 does not serialise concurrent booking requests per team member, allowing unauth... | |
| CVE-2026-123091 json | The Vigilant WordPress plugin before 2.11.0 does not enforce its two-factor authentication on login forms other than the def... | |
| CVE-2026-123088 json | The UniPAY Payment Gateway For WooCommerce WordPress plugin before 2.4 does not perform any authorization check before return... | |
| CVE-2026-123064 json | The WP BASE Booking of Appointments, Services and Events WordPress plugin before 6.5.1 does not properly restrict access to o... | |
| CVE-2026-121875 json | The Post Duplicator WordPress plugin before 3.0.18 does not validate the capabilities assigned to roles through its permissio... | |
| CVE-2026-121874 json | The Post Duplicator WordPress plugin before 3.0.18 does not restrict settings saves to its own options, allowing a site admin... | |
| CVE-2026-121759 json | The Fusion Page Builder WordPress plugin before 1.7.1 does not check that the user owns the content it moves to the trash, wh... | |
| CVE-2026-120409 json | The All-in-One Video Gallery WordPress plugin before 5.1.1 does not check whether a video is password protected before servi... | |
| CVE-2026-118202 json | The Limit Login Attempts Security WordPress plugin before 3.4.1 does not confirm that its two-factor authentication step suc... | |
| CVE-2026-118201 json | The Limit Login Attempts Security WordPress plugin before 3.4.1 does not enforce its two-factor authentication on every pass... | |
| CVE-2026-115256 json | The Mail Debug for WooCommerce WordPress plugin through 1.3.0 does not perform any capability, authentication, or nonce check... | |
| CVE-2026-115237 json | The Grand Job WordPress plugin through 1.2.1 does not correctly verify the password reset code before updating a user's passw... | |
| CVE-2026-115213 json | The EASY-JS-WPAPI Client HANDLE for the WordPress REST-API WordPress plugin through 2.0 does not prevent the administrator cr... | |
| CVE-2026-115212 json | The mView 豆瓣电影 WordPress plugin through 1.0.3 does not validate the type, name, or source of a remotely fetched file,... | |
| CVE-2026-115204 json | The AZEXO Store Locator WordPress plugin through 1.4 does not perform capability or nonce checks on its AJAX actions and does... | |
| CVE-2026-124557 json | A vulnerability was detected in OtterMind Chat2DB up to 5.3.8. Impacted is the function DbMybatisGenerateServiceImpl.generate... | |
| CVE-2026-124509 json | A vulnerability was identified in floci-io Floci up to 2.1.0. The affected element is the function S3Destination.bucketName o... | |
| CVE-2026-124505 json | A flaw has been found in Dianping CAT 3.0.0/3.1.0/4.0-RC1. This affects the function Handler.redirect of the file Handler.jav... | |
| CVE-2026-124500 json | A security flaw has been discovered in Fengoffice Feng Office up to 3.11.13.11/4.2.1.2. This impacts the function upload_docu... | |
| CVE-2026-120115 json | IBM Aspera Connect 1.6.1 through 4.2.19 fails to consistently enforce origin verification across all REST API endpoints. An a... | |
| CVE-2026-119506 json | Incorrect Privilege Assignment vulnerability in DynamiApps Frontend Admin by DynamiApps acf-frontend-form-element allows Priv... | |
| CVE-2026-113698 json | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to a denial of service when executing a specially craf... | |
| CVE-2026-108284 json | IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.10 could allow an authenticated user with the Reader role to... | |
| CVE-2026-103320 json | IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.10 could allow an authenticated user with the Reader role to... | |
| CVE-2026-93879 json | Hibernate Validator could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption resul... | |
| CVE-2026-78537 json | IBM Guardium Key Lifecycle Manager 4.1, 4.1.1, 4.2, 4.2.1, 5.0, and 5.1 could allow a local attacker to obtain sensitive info... | |
| CVE-2026-76052 json | IBM Storage Scale System 6.2.3.0 through 6.2.3.6, and 7.0.0.0 through 7.0.1.0 and IBM Storage Scale 6.0.0.0 through 6.0.1.0, ... | |
| CVE-2026-18668 json | IBM Sterling File Gateway 6.2.1.0 through 6.2.1.2_1 and 6.2.2.0 - 6.2.2.1_1 could allow a remote attacker to perform protoc... | |
| CVE-2026-18195 json | IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2, and 12.0.1.0 through 12.0.12.30 could allow a remote attacker to perfor... | |
| CVE-2026-17426 json | IBM Power Systems Firmware FW1060.00 through FW1060.81 could allow a remote attacker to cause a denial of service due to an u... | |
| CVE-2026-16699 json | IBM Netezza Appliance 11.3.0.2 Interim Fix 002 through 11.3.1.3 Interim Fix 006 could allow a remote authenticated attacker ... | |
| CVE-2026-14434 json | IBM Turbonomic kubeturbo agent 8.16.0 through 8.21.2 does not validate or improperly validates TLS certificate validation, wh... | |
| CVE-2026-2700 json | IBM watsonx Orchestrate Cartridge for Cloud Pak for Data 4.8.4 through 4.8.5, and 5.0.0 through 5.4.2 allows low-privileged u... | |
| CVE-2026-124553 json | BabelDOC from 0.3.61 before 0.7.0 contains a resource exhaustion vulnerability that allows remote attackers to exhaust CPU an... | |
| CVE-2026-124491 json | SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability in the FileUpload plugin create() method that ass... | |
| CVE-2026-124487 json | OpenEMR before 8.4.0 contains an improper authorization vulnerability in the non-patient POST /fhir/DocumentReference/$docref... | |
| CVE-2026-124483 json | OpenEMR before 8.4.0 contains an incorrect authorization vulnerability because the prescription REST API routes check the pat... | |
| CVE-2026-124479 json | OpenEMR before 8.4.0 contains an arbitrary local file read vulnerability in REST document download, where the controller pass... | |
| CVE-2026-124475 json | OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in portal/lib/persist.php that allows authent... | |
| CVE-2026-124470 json | OpenEMR before 8.3.0 contains a broken object level authorization vulnerability in portal/report/portal_custom_report.php tha... | |
| CVE-2026-124466 json | OpenEMR before 8.4.0 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the s... | |
| CVE-2026-124465 json | Trendyol kafka-konsumer from 2.3.3 before 2.6.18 contains a denial of service vulnerability in batch_consumer.go that panics ... | |
| CVE-2026-124461 json | OpenEMR before 8.3.0 contains a missing authorization vulnerability in library/ajax/upload.php that allows any authenticated ... | |
| CVE-2026-124457 json | OpenEMR before 8.3.0 contains a path traversal vulnerability in interface/billing/sl_eob_process.php that allows authenticate... | |
| CVE-2026-124452 json | OpenEMR before 8.3.0 contains a stored cross-site scripting vulnerability in interface/forms/eye_mag/report.php that allows a... | |
| CVE-2026-124448 json | OpenEMR before 8.3.0 contains a stored cross-site scripting vulnerability in the CCDA/CCD preview stylesheets, where cda.xsl ... | |
| CVE-2026-124444 json | OpenEMR before 8.4.0 contains a mass assignment vulnerability in the patient portal OnsiteDocument query API that lets reques... | |
| CVE-2026-124440 json | Kyverno from 1.19.1 before 1.19.2 contains an authorization bypass vulnerability in the apiCall namespace clamp that allows n... | |
| CVE-2026-124436 json | OpenRemote before 1.32.2 contains an improper authorization vulnerability that allows realm administrators to access and modi... | |
| CVE-2025-0166 json | IBM watsonx Orchestrate Cartridge for Cloud Pak for Data 4.8.4 through 4.8.5, and 5.0.0 through 5.4.2 could disclose sensitiv... | |
| CVE-2026-124432 json | phpMyFAQ 4.1.9 before 4.1.11 and 4.2.0 pre-releases before 4.2.0-beta.3 contain an account enumeration vulnerability in the u... | |
| CVE-2026-124428 json | Craft CMS from 5.7.0 before 5.11.2 contains an arbitrary file read vulnerability that allows authenticated control panel user... | |
| CVE-2026-124424 json | WWBN AVideo contains a path traversal vulnerability in plugin/AI/receiveAsync.json.php that allows holders of any valid AI to... | |
| CVE-2026-124330 json | A vulnerability was determined in FlowCI flow-core-x up to 1.23.49. This affects the function exist/save/read/remove of the f... | |
| CVE-2026-123992 json | A flaw has been found in DataEase up to 2.10.27. Affected by this issue is the function StaticResourceServer.validateSvgConte... | |
| CVE-2026-123574 json | The zone file parser in the hickory-proto crate of Hickory DNS 0.24.0 before 0.26.2 panics when a single token in a zone file... | |
| CVE-2026-123530 json | Vikunja before 2.7.1 contains a missing authentication vulnerability that allows attackers holding a stolen session to enroll... | |
| CVE-2026-123469 json | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Liquid Web / StellarWP The Eve... | |
| CVE-2026-121554 json | cordova-plugin-advanced-http 1.5.0 through 3.3.1 contains an information disclosure vulnerability that leaks cookies to third... | |
| CVE-2026-121550 json | nnn through 5.3 contains an insecure file handling vulnerability that allows local attackers to redirect writes because main(... | |
| CVE-2026-121546 json | ruTorrent before 5.3.20 contains a path traversal vulnerability in the datadir plugin that allows authenticated users to esca... | |
| CVE-2026-121455 json | DbGate before 7.3.3 contains a missing authorization vulnerability that allows connection-restricted authenticated users to b... | |
| CVE-2026-121451 json | AB Download Manager before 1.11.2 contains a cross-site request forgery vulnerability in its unauthenticated browser-integrat... | |
| CVE-2026-121443 json | svg-sanitizer from 1.1.0 before 1.1.1 contains a denial of service vulnerability that allows remote attackers to crash reques... | |
| CVE-2026-121439 json | Wasmtime 46.0.0 before 48.0.7 and 49.0.0 before 49.0.4 contains a response splitting vulnerability in wasi-http p3 that allow... | |
| CVE-2026-120749 json | A flaw was found in D-Bus. With a privileged Monitoring client attached (for example dbus-monitor or busctl monitor), an unpr... | |
| CVE-2026-17401 json | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execu... | |
| CVE-2026-17354 json | IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to perform arbitrary file writes due to... | |
| CVE-2026-17340 json | IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to execute arbitrary code due to a path traversal vul... | |
| CVE-2026-17335 json | IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to path t... | |
| CVE-2026-17239 json | IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to a path... | |
| CVE-2026-17117 json | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execu... | |
| CVE-2026-121435 json | Froxlor before 2.3.15 contains an authorization bypass vulnerability that allows authenticated customers to create MySQL data... | |
| CVE-2026-121431 json | AzuraCast before 0.24.0 contains a server-side request forgery vulnerability that allows station users with WebHooks permissi... | |
| CVE-2026-121427 json | AzuraCast through 0.23.8 fails to remove frontend_config.custom_config in PUT /station/{id}/profile/edit for users lacking th... | |
| CVE-2026-121423 json | SurrealDB before 3.3.0 contains an unbounded recursion vulnerability that allows authenticated users to abort the surreald pr... | |
| CVE-2026-121419 json | SurrealDB from 3.1.0 before 3.3.0 contains an improper authentication vulnerability where the MCP BoundSubject fingerprint us... | |
| CVE-2026-121415 json | Parse Server before 8.6.111 and 9.0.0 before 9.10.6-alpha.3 on MongoDB skips field type validation for null-valued dot notati... | |
| CVE-2026-121411 json | FreeRDP before 3.32.2 fails to bound server-supplied target dimensions and output origin in RDPGFX MAPSURFACETOSCALEDOUTPUT P... | |
| CVE-2026-121407 json | FreeRDP before 3.32.2 contains a denial of service vulnerability in the shadow server's remdesk_server_thread that allows aut... |