CVE.report
CVE.report is the most up-to-date database of common vulnerabilities and exposures. Information is pulled in from several sources and processed in to a mobile friendly, easy to use page. Use the site to quickly check for vulnerabilities in products such as operating systems, applications, hardware, networks, databases, browsers, e-mail clients and more.
CVEs provide a unique and common naming scheme for publicly known cyber security vulnerabilities in order to quickly identify and share these vulnerabilities. You can use the search below to look for vulnerabilities based on product, vendor, or common tags
The form you will see after following this link allows you to fill out the various variables in the CVSS scoring system and receive the corresponding score. The description of each of the variables is also included for additional information.
cve.report now provides a free read-only JSON API for CVE details. Each record combines the CVE Program JSON record, NVD enrichment, KEV, and EPSS when available.
Recent CVEs
| CVE | Description | Updated |
|---|---|---|
| CVE-2026-96542 json | Incorrect permission assignment (CWE-732) in the standalone installer for EA Javelin Anticheat (versions 1.0.14329371, 1.0.14... | |
| CVE-2026-64862 json | Frappe HR is an open-source human resources management solution (HRMS). Prior to 15.58.3 and 16.4.3, HRMS PWA API endpoints f... | |
| CVE-2026-111688 json | Exrick XBoot through 3.3.4 contains an authorization bypass vulnerability that allows authenticated users to evade role data-... | |
| CVE-2026-110816 json | ### Summary `qs.stringify` with `arrayFormat: 'comma'` throws `TypeError: Cannot convert object to primitive value` when a... | |
| CVE-2026-109924 json | undici is an HTTP client library for Node.js. In versions 6.5.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.... | |
| CVE-2026-109869 json | undici is an HTTP client library for Node.js. In versions 6.23.0 through 6.29.0, 7.18.0 through 7.30.0, and 8.0.0 through 8.1... | |
| CVE-2026-109841 json | undici is an HTTP client library for Node.js. In versions 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1, its fetch() impleme... | |
| CVE-2026-109829 json | undici is an HTTP client library for Node.js. In versions 7.0.0 through 7.30.0 and 8.0.0 through 8.12.1, when an originless A... | |
| CVE-2026-109383 json | undici is an HTTP client library for Node.js. In versions 4.0.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.... | |
| CVE-2026-108743 json | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Kylin. Im... | |
| CVE-2026-108709 json | Authentication bypass within in-house network in Apache Kylin. Impact most to the kylin services that are directly exposed t... | |
| CVE-2026-108374 json | ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.121.0 and 16.34.0, certain endpoints for sta... | |
| CVE-2026-108373 json | ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.118.0 and 16.27.0, certain endpoints in the ... | |
| CVE-2026-105660 json | Improper Validation of Syntactic Correctness of Input vulnerability in mtrudel bandit allows an unauthenticated remote attack... | |
| CVE-2026-102631 json | In authd before 0.7.1, the user identity matching in UpdateUser (internal/users/manager.go) resolves an incoming login by the... | |
| CVE-2026-80092 json | Authentication bypass by assumed-immutable data in Microsoft Identity Web allows an authorized attacker to elevate privileges... | |
| CVE-2026-69080 json | Exposure of SQL Black List to an Unauthorized Actor vulnerability in Apache Kylin. This issue affects Apache Kylin: from 4... | |
| CVE-2026-69077 json | Exposure of unauthorized cross-project job manipulation vulnerability in Apache Kylin. Impact most to the kylin services th... | |
| CVE-2026-69076 json | Exposure of Job Discard to an Unauthorized Actor vulnerability in Apache Kylin. Impact most to the kylin services that are d... | |
| CVE-2026-68573 json | Improper Authentication vulnerability in Apache Kylin. Unauthenticated user may access to system cleanup actions. Impact mos... | |
| CVE-2026-68572 json | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Kylin. This issue affects Apache Kylin:... | |
| CVE-2026-55796 json | Frappe HR is an open-source human resources management solution (HRMS). Prior to 15.60.3 and 16.7.1, the Salary Payments via ... | |
| CVE-2026-108337 json | An administrator could retrieve the password reset code for any user and take over the account. The password reset codes w... | |
| CVE-2026-107349 json | An infinite loop in PgBouncer 1.20.0 through 1.26.0 allows an unauthenticated remote attacker to cause a denial of service. A... | |
| CVE-2026-107348 json | Integer overflow in the message buffer growth logic (mbuf_make_room) in PgBouncer 1.21.0 through 1.26.0 allows a remote attac... | |
| CVE-2026-106465 json | The NetX Secure DTLS server sends a HelloVerifyRequest carrying a freshly generated cookie, but never checks the cookie a cli... | |
| CVE-2026-106464 json | `_nx_secure_x509_parse_signature_data` computes the certificate signature's length as `tlv_length - 1` without first checking... | |
| CVE-2026-106090 json | ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the conte... | |
| CVE-2026-106089 json | ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the conte... | |
| CVE-2026-105994 json | ColdFusion is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A low-priv... | |
| CVE-2026-105659 json | Uncontrolled Resource Consumption vulnerability in mtrudel bandit allows an unauthenticated remote attacker to pin HTTP/2 str... | |
| CVE-2026-105236 json | Improper Certificate Validation vulnerability in the ssl application in Erlang/OTP allows a client that holds a certificate t... | |
| CVE-2026-103415 json | When a TLS 1.3 client processes a HelloRetryRequest, it copies the server's cookie into its second ClientHello without checki... | |
| CVE-2026-103414 json | The GUIX binary resource (theme) loader sizes its arena and populates it in two separate passes that traverse the resource fi... | |
| CVE-2026-96596 json | Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Erlang OTP stdlib (erl_tar module), hexpm hex_core (h... | |
| CVE-2026-94200 json | Improper Validation of Consistency within Input vulnerability in Erlang OTP ssl (tls_handshake_1_3, ssl_handshake and tls_cli... | |
| CVE-2026-79957 json | ServiceNext contains an insecure direct object reference (IDOR) in the /api/Usuario/GetUsuarios endpoint, which accepts a use... | |
| CVE-2026-104040 json | A flaw was found in SSSD. When configured with the Entra ID identity provider, input lookup names containing single quotes ar... | |
| CVE-2026-21589 json | Rejected reason: This CVE's publication may have been a false positive or a mistake. As a result, we have rejected this recor... | |
| CVE-2026-105903 json | ColdFusion is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arb... | |
| CVE-2026-105901 json | ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the conte... | |
| CVE-2026-105900 json | ColdFusion is affected by an Improper Input Validation vulnerability that could result in an application denial-of-service. A... | |
| CVE-2026-105897 json | ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Explo... | |
| CVE-2026-105751 json | Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem... | |
| CVE-2026-102779 json | Joomla Extension - joomlafry.com - Unauthenticated forced execution of published automation tasks in TF Content 2.9.0 - 2.9.4... | |
| CVE-2026-96915 json | Integer overflow or wraparound in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-105760 json | vLLM is an inference and serving engine for large language models. Prior to 0.30.0, a caller can use the request-level media_... | |
| CVE-2026-105759 json | vLLM is an inference and serving engine for large language models. Prior to 0.30.0, the Rust frontend's track_http_metrics mi... | |
| CVE-2026-93590 json | ImageMagick before 7.1.2-31 contains a policy bypass vulnerability in the UHDR encoder that fails to perform policy checks du... | |
| CVE-2026-77396 json | PJSIP is a free and open source multimedia communication library written in C. In 2.17 and earlier, the PJSIP AVI parser in p... | |
| CVE-2024-9375 json | The WordPress Captcha Plugin by Captcha Bank plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the ... | |
| CVE-2026-96620 json | Claude Agent SDK is a Python SDK for Claude Code. Prior to 0.2.121, the resume option is passed to the Claude CLI as a separa... | |
| CVE-2026-61726 json | Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.12, StepVie... | |
| CVE-2026-111718 json | AipexBase through commit 690adb9 contains a sql injection vulnerability that allows attackers to inject SQL through the order... | |
| CVE-2026-111708 json | WhaTicket Community through commit cf04795 contains an authentication bypass vulnerability that allows unauthenticated attack... | |
| CVE-2026-111703 json | yshop-crm through 2.1.3 contains an insecure direct object reference vulnerability that allows authenticated sales users to a... | |
| CVE-2026-111698 json | HUIZHI ChargeOS cloud through 3.0.9 contains a missing authorization vulnerability in the hcp-mp PayController.xcxRecharge en... | |
| CVE-2026-102834 json | JavaCV provides Java interfaces to OpenCV, FFmpeg, and other multimedia libraries. Prior to 1.5.14, IPCameraFrameGrabber doub... | |
| CVE-2026-102608 json | ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.38.3, downloadEvents() manually ... | |
| CVE-2026-102607 json | ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.38.3, the exportEvents() functio... | |
| CVE-2026-85231 json | A flaw was found in libtirpc. An authenticated remote attacker could exploit this vulnerability by sending oversized wrapped ... | |
| CVE-2026-59970 json | Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, passes ... | |
| CVE-2026-59966 json | Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, execute... | |
| CVE-2026-59963 json | Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, recipe ... | |
| CVE-2026-30971 json | ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.39.2, 1.38.2, and 1.36.40, ZoneM... | |
| CVE-2026-17275 json | IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote attacker to perform unauthorized manipulation of distributed transactions d... | |
| CVE-2026-111692 json | DataBuff ai-apm-web through 0.1.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to f... | |
| CVE-2026-111687 json | WeRSS (we-mp-rss) through 1.5.3 contains a remote code execution vulnerability that allows unauthenticated attackers to run c... | |
| CVE-2026-111682 json | EFAK 5.0.0 through 5.1.0 contains a missing authorization vulnerability that allows authenticated low-privilege users to read... | |
| CVE-2026-111673 json | IceCMS through 4.1.5 contains a missing authentication vulnerability that allows unauthenticated attackers to modify, delete,... | |
| CVE-2026-111662 json | Chaskiq through 2.0.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the ... | |
| CVE-2026-111657 json | BeikeShop through 2.0.0.31 contains an insecure direct object reference vulnerability in the markAsShipped handler of RmaCont... | |
| CVE-2026-111652 json | Engineercms through 2.0.5 contains a missing authorization vulnerability in AttachController.Attachment that allows unauthent... | |
| CVE-2026-111647 json | PickMall lilishop through 5.0.0 contains an insecure direct object reference vulnerability that allows authenticated buyers t... | |
| CVE-2026-111642 json | FastapiAdmin through 3.0 contains a hard-coded JWT signing secret in backend/app/config/setting.py that allows low-privileged... | |
| CVE-2026-111637 json | NexoPOS through 6.2.4 contains a missing authentication vulnerability that allows unauthenticated attackers to read accountin... | |
| CVE-2026-111632 json | Aureus ERP through 1.6.0 contains an authorization bypass vulnerability that allows authenticated API users to create or move... | |
| CVE-2026-111627 json | HestiaCP before 1.10.5 contains an authorization bypass vulnerability that allows non-ROOT_USER administrators to perform wri... | |
| CVE-2026-111622 json | smart-sso through 2.1.1 contains an open redirect vulnerability in the /login handler that allows unauthenticated attackers t... | |
| CVE-2026-111617 json | WHartTest through 2.8.1 contains a missing authentication vulnerability that allows unauthenticated attackers to connect to t... | |
| CVE-2026-111612 json | netdisk-fast-download through 0.4.8 contains an information disclosure vulnerability that allows unauthenticated attackers to... | |
| CVE-2026-111607 json | Jeepay through 3.2.9 contains an insecure direct object reference vulnerability that allows authenticated merchant users to o... | |
| CVE-2026-111392 json | SGLang through 0.5.21 trusts caller-supplied mm_hashes values as the multimodal prefix-cache key, allowing remote attackers t... | |
| CVE-2026-111322 json | Archon 0.2.13 through 0.11.1 contains a missing authentication vulnerability that allows unauthenticated attackers to access ... | |
| CVE-2026-111284 json | Aureus ERP through 1.6.0 contains a stored cross-site scripting vulnerability in HolidayAction.php that allows authenticated ... | |
| CVE-2026-111279 json | Dragonfly through 2.0.2 contains an unbounded memory allocation vulnerability that allows unauthenticated clients to exhaust ... | |
| CVE-2026-111273 json | unarr through 1.1.1 contains an off-by-one heap-based buffer overflow in tar_get_name() in tar/parse-tar.c, reachable through... | |
| CVE-2026-109839 json | IBM Db2 Genius Hub 1.0 could allow a remote authenticated attacker to bypass security restrictions due to a missing initializ... | |
| CVE-2026-109838 json | IBM Db2 Genius Hub 1.0 could allow a local attacker to obtain sensitive information due to improper verification of cryptogr... | |
| CVE-2026-102693 json | RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. P... | |
| CVE-2026-88755 json | Z.ai ZCode v3.11.2.6792 was discovered to automatically establish connections with MCP servers declared inside a repository's... | |
| CVE-2026-57488 json | pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.2, raw_to_int in upnp/src/genlib/... | |
| CVE-2026-55862 json | pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.0, multiple ixml DOM traversal fu... | |
| CVE-2024-58397 json | MP4v2 through 2.1.3 contains a heap-based out-of-bounds read in MP4File::GetChapters() that allows attackers to read past hea... | |
| CVE-2026-111252 json | A denial of service vulnerability exists in the XML parsing of multiple versions of OpenNMS Meridian and Horizon. OpenNMS par... | |
| CVE-2026-111235 json | An authorization bypass vulnerability exists in the REST API of multiple versions of OpenNMS Meridian and Horizon. The /rest/... | |
| CVE-2026-111169 json | La Suite Docs through 6.0.1 contains an authorization bypass vulnerability that allows authenticated users to write comments ... | |
| CVE-2026-109932 json | undici is an HTTP client library for Node.js. In versions 5.15.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12... | |
| CVE-2026-107794 json | ExtUtils::Typemaps::STL::List versions before 1.07 for Perl allocate a 32 GiB array on an empty list. The OUTPUT typemaps ca... | |
| CVE-2026-105040 json | The EnergizeLab Eilik NestJS auth service accepts a user-controlled user ID in account update requests (mass assignment). A r... |