CVE.report
CVE.report is the most up-to-date database of common vulnerabilities and exposures. Information is pulled in from several sources and processed in to a mobile friendly, easy to use page. Use the site to quickly check for vulnerabilities in products such as operating systems, applications, hardware, networks, databases, browsers, e-mail clients and more.
CVEs provide a unique and common naming scheme for publicly known cyber security vulnerabilities in order to quickly identify and share these vulnerabilities. You can use the search below to look for vulnerabilities based on product, vendor, or common tags
The form you will see after following this link allows you to fill out the various variables in the CVSS scoring system and receive the corresponding score. The description of each of the variables is also included for additional information.
cve.report now provides a free read-only JSON API for CVE details. Each record combines the CVE Program JSON record, NVD enrichment, KEV, and EPSS when available.
Recent CVEs
| CVE | Description | Updated |
|---|---|---|
| CVE-2026-121925 json | A stack-based buffer overflow in libsnowflakeclient and the Snowflake PHP PDO Driver could, under specific conditions, result... | |
| CVE-2026-114456 json | Multiple Snowflake client drivers implementing the `authenticator=externalbrowser` single sign-on flow could have allowed an ... | |
| CVE-2026-104799 json | The Mobile builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.4.2 via... | |
| CVE-2026-97397 json | The Remove Google Fonts – Disable, Block, or Replace with Bunny Fonts for GDPR Compliance plugin for WordPress is vulnerabl... | |
| CVE-2026-59267 json | A crafted DXF document causes a heap buffer overflow in Draw in Apache OpenOffice 4.1.16 and earlier. This could cause a cras... | |
| CVE-2026-121565 json | Tanium addressed an improper certificate validation vulnerability in multiple products. Products have been updated to distrus... | |
| CVE-2026-119551 json | Jellyfin through 12.4 contains an authorization bypass vulnerability in SuggestionsController.GetSuggestions that allows auth... | |
| CVE-2026-108500 json | Input validation vulnerability in Apache ActiveMQ configured to use the LDAPAuthorizationMapPlugin allows an authenticated a... | |
| CVE-2026-103582 json | Unbounded memory allocation and missing frame size validation in Apache NMS ActiveMQ (the .NET OpenWire client, package Apach... | |
| CVE-2026-102712 json | In Eclipse ThreadX NetX Duo versions up to and including 6.5.2.202603, built with DTLS server support, the NetX Secure DTLS s... | |
| CVE-2026-100302 json | Allocation of Resources Without Limits or Throttling in the multiRead request handler of Apache ZooKeeper allows a remote att... | |
| CVE-2026-100300 json | Improper handling of exceptional conditions in the quota subsystem of Apache ZooKeeper allows an attacker able to write under... | |
| CVE-2026-100252 json | Improper Authorization vulnerability in Apache ZooKeeper. When SASL authentication is enabled on the client port, the server... | |
| CVE-2026-100235 json | Incorrect authorization due to a time-of-check to time-of-use (TOCTOU) race condition in the setACL request handling of Apach... | |
| CVE-2026-90634 json | An uncontrolled memory access in the PDF import code of Apache OpenOffice versions through 4.1.16 allows a crafted PDF to cau... | |
| CVE-2026-90632 json | Apache OpenOffice documents can include multimedia content (audio, video, etc.) A crafted document could exploit the GStream... | |
| CVE-2026-90631 json | Apache OpenOffice documents can contain links. A missing Authorization vulnerability in Apache OpenOffice allowed an attacker... | |
| CVE-2026-90629 json | An uncontrolled memory access in the WMF import code of Apache OpenOffice versions through 4.1.16 allows a crafted WMF file t... | |
| CVE-2026-90628 json | An uncontrolled memory access in the PDF export code of Apache OpenOffice versions through 4.1.16 allows a crafted CFF font t... | |
| CVE-2026-115448 json | Uncontrolled recursion in Apache ZooKeeper. The server serializes its data tree to a snapshot by recursing one stack frame pe... | |
| CVE-2026-108946 json | Improper input validation vulnerability in Apache ActiveMQ, Apache ActiveMQ KahaDB. The ActiveMQ broker resolves connectio... | |
| CVE-2026-102728 json | In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, the NetX Secure TLS client's ServerHello parser and DTLS clie... | |
| CVE-2026-102727 json | In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, the FTP server accepts the first connection to a passive data... | |
| CVE-2026-102726 json | In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, the PPP IPCP code parses a peer's Configure-Nak without valid... | |
| CVE-2026-102725 json | In Eclipse ThreadX NetX Duo versions 6.4.0 through 6.5.2.202603a, built with VLAN and SRP support, the MSRP parser uses the a... | |
| CVE-2026-102724 json | In Eclipse ThreadX NetX Duo versions 6.4.0 through 6.5.2.202603a, built with VLAN and SRP support, evicting the last attribut... | |
| CVE-2026-102704 json | [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CV... | |
| CVE-2026-102703 json | [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CV... | |
| CVE-2026-90627 json | The flat file database driver in Apache Openoffice versions through 4.1.16 allows a crafted document to read the contents of ... | |
| CVE-2026-90626 json | An uncontrolled memory access in the PDF import code of Apache OpenOffice versions through 4.1.16 allows a crafted PDF to cau... | |
| CVE-2026-90624 json | An unchecked memory access in the PDF import code of Apache OpenOffice versions through 4.1.16 on allows a crafted PDF to exe... | |
| CVE-2026-86848 json | A flaw was found in DPDK lib/vhost vhost-crypto. The indirect-descriptor snapshot double-fetches a guest descriptor next inde... | |
| CVE-2026-86567 json | A flaw was found in DPDK lib/vhost. The VDUSE handler fails to invalidate vring pointers when the IOTLB is invalidated, leadi... | |
| CVE-2026-59268 json | An out-of-bounds Write vulnerability in Apache OpenOffice versions through 4.1.16 could allow an attacker to craft a Microsof... | |
| CVE-2026-59264 json | The Windows installers of Apache OpenOffice 4.1.16 and earlier allow an already manipulated system to run external code with ... | |
| CVE-2026-59263 json | A manipulated document opened in Apache OpenOffice 4.1.16 or earlier may allow substituted content to be displayed manipulati... | |
| CVE-2026-12859 json | Missing Authorization vulnerability in Caz Informatics Services Trade Inc. Advancity ALMS Cloud allows Accessing Functionalit... | |
| CVE-2026-102723 json | In Eclipse ThreadX NetX Duo versions 6.4.0 through 6.5.2.202603a, built with VLAN and SRP support, the MSRP attribute lookup ... | |
| CVE-2026-12610 json | A flaw was found in sssd. When authenticating with a YubiKey, the SSSD PAM responder can crash due to a use-after-free vulner... | |
| CVE-2026-121259 json | A flaw was found in the GStreamer JPEG 2000 decimator in gst-plugins-bad. Crafted JPEG 2000 media can cause integer overflows... | |
| CVE-2026-120554 json | The Import and export users and customers plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, a... | |
| CVE-2026-120422 json | Sogou Input Method for Windows contains a vulnerability in the configuration retrieval mechanism of its SGTool.exe component.... | |
| CVE-2026-119728 json | A flaw was found in the H.264 video parser in gst-plugins-bad. When processing a specially crafted H.264 video file or networ... | |
| CVE-2026-119727 json | A flaw was found in GStreamer's gst-plugins-bad H.265 video parser. When parsing a specially crafted H.265 bitstream containi... | |
| CVE-2026-115498 json | The Slim Jetpack plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'g<PAGE_ID>-website (Website conta... | |
| CVE-2026-111822 json | Improper invalidation of cached authorizations vulnerability in Apache ActiveMQ, Apache ActiveMQ Runtime Config. After the... | |
| CVE-2026-111821 json | Improper input validation vulnerability in Apache ActiveMQ, Apache ActiveMQ KahaDB. A user can create a durable subscripti... | |
| CVE-2026-111040 json | The platform allows persistent HTML injection into editable fields managed by TinyMCE. An authenticated attacker with low pri... | |
| CVE-2026-111038 json | CSV formula injection vulnerability in the export functionality of the Coupa Supplier Portal SaaS platform. The vulnerability... | |
| CVE-2026-111037 json | A reflected Cross-Site Scripting (XSS) vulnerability in the Tenders module of the Coupa Supplier Portal SaaS platform. The vu... | |
| CVE-2026-111036 json | Server-side request forgery (SSRF) vulnerability in the Coupa Supplier Portal SaaS platform, specifically in the document con... | |
| CVE-2026-110935 json | The PFI plugin framework deployment routine does not validate path components when extracting archive entries to the local pl... | |
| CVE-2026-110022 json | The PFI plugin framework deploys executable assemblies (DLLs) from a signed plugin package into the local plugin repository a... | |
| CVE-2026-110021 json | PLCnext Engineer checks GSDX manifest reference digests but does not cryptographically verify the XML `SignatureValue` over c... | |
| CVE-2026-108949 json | Denial of Service via OOM vulnerability in Apache ActiveMQ, ActiveMQ Broker. An authenticated OpenWire client that sends a... | |
| CVE-2026-102722 json | In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, the FTP client in IPv4 passive mode opens its data connection... | |
| CVE-2026-102721 json | In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, the TFTP client copies the message of a received ERROR packet... | |
| CVE-2026-102720 json | In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, the DHCP client's option walk advances its offset one byte le... | |
| CVE-2026-102719 json | In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, the NetX Secure DTLS server fills HelloVerifyRequest cookies ... | |
| CVE-2026-95649 json | IRISPowerscan insufficiently restrict the use of untrusted scripts. An authenticated user with access to script functionality... | |
| CVE-2026-94460 json | IRISPowerscan contain an insecure default configuration where the built-in installation account is assigned elevated privileg... | |
| CVE-2026-94459 json | IRISPowerscan contain default user accounts with predictable credentials. An unauthenticated attacker with access to an affec... | |
| CVE-2026-93900 json | The Simple CAPTCHA with Cloudflare Turnstile plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' a... | |
| CVE-2026-102711 json | In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the Module Manager loaders take a module image without its length and... | |
| CVE-2026-97024 json | A path traversal vulnerability in Flatpak's handling of the files/etc directory during app deployment allows a malicious Flat... | |
| CVE-2026-97023 json | A path traversal vulnerability in Flatpak's handling of the export/bin directory during app deployment allows a malicious Fla... | |
| CVE-2026-114426 json | SEPPmail Secure Email Gateway before 15.1.1 processes and writes v1 file-interface upload data before authenticating the call... | |
| CVE-2026-114425 json | SEPPmail Secure Email Gateway before 15.1.1 trusts a file path supplied in externally provided Large File Transfer attachment... | |
| CVE-2026-114424 json | SEPPmail Secure Email Gateway before 15.1.1 can evaluate attacker-influenced replacement text as Perl code in sender or recip... | |
| CVE-2026-114421 json | SEPPmail Secure Email Gateway before 15.1.1 permits password recovery for a created but unregistered GINA account whose initi... | |
| CVE-2026-114420 json | SEPPmail Secure Email Gateway before 15.1.1 does not neutralize LDAP metacharacters in an unauthenticated account-selection i... | |
| CVE-2026-19731 json | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in TÜBİTAK BİLGEM Software Te... | |
| CVE-2026-19721 json | Improper restriction of XML external entity reference vulnerability in TÜBİTAK BİLGEM Software Technologies Research Insti... | |
| CVE-2026-62126 json | Allocation of Resources Without Limits or Throttling vulnerability in miniOrange SAML SP Single Sign On miniorange-saml-20-si... | |
| CVE-2026-62007 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unlimited Elements Unli... | |
| CVE-2026-57775 json | Authentication Bypass Using an Alternate Path or Channel vulnerability in RelyWP Simple Cloudflare Turnstile simple-cloudflar... | |
| CVE-2026-57666 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aguila Technologies WP ... | |
| CVE-2026-119477 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jacob N. Breetvelt WP P... | |
| CVE-2026-119366 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AdvancedCoding wpDiscuz... | |
| CVE-2026-110944 json | Resource exhaustion vulnerability in the HTTP request handling of the QHttpServer component of Qt HTTP Server. | |
| CVE-2026-57639 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Roland Murg WP Booking ... | |
| CVE-2026-56065 json | Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in Doofinder Doofinder for WooC... | |
| CVE-2026-54861 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aguila Technologies WP ... | |
| CVE-2026-121818 json | Herowatch Mini developed by About Time Technologies has a system signing vulnerability. Authenticated local attackers can exp... | |
| CVE-2026-121817 json | Herowatch Go Server developed by About Time Technologies has a Insecure Direct Object Reference vulnerability. Authenticated ... | |
| CVE-2026-121816 json | Herowatch Mini developed by About Time Technologies has a Missing Authentication vulnerability. Unauthenticated remote attack... | |
| CVE-2026-62000 json | Missing Authorization vulnerability in WC Lovers WCFM Marketplace wc-multivendor-marketplace allows Exploiting Incorrectly Co... | |
| CVE-2026-54851 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Awesomemotive Contact F... | |
| CVE-2024-33605 json | Improper processing of some parameters of installed_emanual_list.html and installed_emanual_down.html leads to a path travers... | |
| CVE-2026-87044 json | The Mbed TLS crypto shim driver in drivers/crypto/crypto_mbedtls_shim.c drives PSA multipart cipher and AEAD operations. In m... | |
| CVE-2026-118983 json | The VikWidgetsLoader WordPress plugin before 1.12.3 does not sanitise or escape several block attributes before outputting t... | |
| CVE-2026-118783 json | The All-in-One Video Gallery WordPress plugin before 5.0.0 does not validate and escape some of its shortcode attributes bef... | |
| CVE-2026-118637 json | The Simple Download Monitor WordPress plugin before 4.1.3 does not properly check the visibility of the content referenced by... | |
| CVE-2026-118523 json | The EventPrime WordPress plugin before 4.3.6.1 does not keep the built-in Pending Review post status non-public, allowing un... | |
| CVE-2026-118422 json | The Stape Conversion Tracking WordPress plugin before 2.3.11 does not validate the sub-path appended to its same-origin proxy... | |
| CVE-2026-118407 json | The Premium Packages WordPress plugin before 7.3.1 does not verify that a user claiming a guest order is the original buyer,... | |
| CVE-2026-118404 json | The Premium Packages WordPress plugin before 7.3.1 does not verify ownership or session binding when loading a previously sa... | |
| CVE-2026-87043 json | The entropy-device random number generator in subsys/random/random_entropy_device.c returned early with -ENODEV from rand_get... | |
| CVE-2026-87041 json | The RTIO submission-queue verifier rtio_vrfy_sqe() in subsys/rtio/rtio_syscalls.c (subsys/rtio/rtio_handlers.c before v4.3.0)... | |
| CVE-2026-87040 json | The nRF link-layer receive paths of the open-source Bluetooth LE Controller did not validate the on-air LENGTH field of a rec... |