CVE.report
CVE.report is the most up-to-date database of common vulnerabilities and exposures. Information is pulled in from several sources and processed in to a mobile friendly, easy to use page. Use the site to quickly check for vulnerabilities in products such as operating systems, applications, hardware, networks, databases, browsers, e-mail clients and more.
CVEs provide a unique and common naming scheme for publicly known cyber security vulnerabilities in order to quickly identify and share these vulnerabilities. You can use the search below to look for vulnerabilities based on product, vendor, or common tags
The form you will see after following this link allows you to fill out the various variables in the CVSS scoring system and receive the corresponding score. The description of each of the variables is also included for additional information.
cve.report now provides a free read-only JSON API for CVE details. Each record combines the CVE Program JSON record, NVD enrichment, KEV, and EPSS when available.
Recent CVEs
| CVE | Description | Updated |
|---|---|---|
| CVE-2026-109575 json | In HAProxy Data Plane API 2.2.0 through 3.4.3 (and corresponding Enterprise Edition releases), Server.ConfigureAPI() has proc... | |
| CVE-2026-109425 json | Tink-go (tink-crypto/tink-go) through 2.8.0 contains an input-validation vulnerability where keyset.NewHandleWithNoSecrets() ... | |
| CVE-2026-109424 json | NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.39.205426 contains a weak encryption vulnerab... | |
| CVE-2026-109423 json | NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.39.205426 contains a TLS certificate validati... | |
| CVE-2026-96012 json | IBM Db2 Mirror for i 7.4, 7.5, and 7.6 is vulnerable to privilege escalation. An authenticated attacker could craft a malici... | |
| CVE-2026-95838 json | containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd's layer unpack handler ... | |
| CVE-2026-95837 json | containerd is an open-source container runtime. From 2.1.0 until 2.2.7 and 2.3.4, containerd's CRI CreateContainer checkpoint... | |
| CVE-2026-41510 json | OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.1, Coraza silently... | |
| CVE-2026-109422 json | NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.39.205426 contains a remote code execution vu... | |
| CVE-2026-108926 json | A security flaw has been discovered in itsourcecode Baptism Information Management System 1.0. This affects an unknown part o... | |
| CVE-2026-108924 json | A vulnerability was identified in getkirby Kirby up to 4.9.5/5.5.3. Affected by this issue is the function OptionsQuery::reso... | |
| CVE-2026-108923 json | A vulnerability was determined in 1024-lab smart-admin up to 3.30.0. Affected by this vulnerability is an unknown functionali... | |
| CVE-2026-108362 json | Privasys Remote Attestation TLS Clients provides multi-language utilities for verifying attested TLS connections. Prior to 0.... | |
| CVE-2026-108361 json | Privasys Remote Attestation TLS Clients provides multi-language utilities for verifying attested TLS connections. Before 0.9.... | |
| CVE-2026-105465 json | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to privilege escalation when db2locssh is enabled wit... | |
| CVE-2026-104774 json | OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, the t:jsDecode ... | |
| CVE-2026-104364 json | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 could allow a local attacker to cause a denial of service due to im... | |
| CVE-2026-104332 json | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to a denial of service when executing a specially cra... | |
| CVE-2026-97058 json | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | |
| CVE-2026-78404 json | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to a local privilege escalation via the db2pd utility... | |
| CVE-2025-27902 json | IBM DB2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 uses a web link with untrusted references to an external site. ... | |
| CVE-2025-27897 json | IBM Db2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 is vulnerable to cross-site scripting. This vulnerability allows... | |
| CVE-2025-27896 json | IBM Db2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 is vulnerable to cross-site scripting. This vulnerability allows... | |
| CVE-2025-27895 json | IBM DB2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 is vulnerable to cross-site scripting. This vulnerability all... | |
| CVE-2021-48009 json | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | |
| CVE-2026-78268 json | Unauthenticated Sensitive Data Exposure in Lead Generation Contact Widget & AI Chatbot: Chat Button, Phone Call, Telegram... | |
| CVE-2026-78002 json | A flaw was found in rsyslog. An unauthenticated remote attacker can trigger a heap buffer overflow in the RainerScript `repla... | |
| CVE-2026-66788 json | A flaw was found in Lighthouse. A remote attacker, by compromising a spoke cluster, can exploit a vulnerability where the des... | |
| CVE-2026-19654 json | A unauthenticated remote peer may lead rsyslogd to crash due to a flaw in the optional imptcp module. A crafted input sequenc... | |
| CVE-2025-49795 json | A NULL pointer dereference vulnerability was found in libxml2 when processing XPath XML expressions. This flaw allows an atta... | |
| CVE-2025-49794 json | A use-after-free vulnerability was found in libxml2. This issue occurs when parsing XPath elements under certain circumstance... | |
| CVE-2025-6032 json | A flaw was found in Podman. The podman machine init command fails to verify the TLS certificate when downloading the VM image... | |
| CVE-2025-6020 json | A flaw was found in linux-pam. The module pam_namespace may use access user-controlled paths without proper protection, allow... | |
| CVE-2025-5914 json | A vulnerability has been identified in the libarchive library, specifically within the archive_read_format_rar_seek_data() fu... | |
| CVE-2026-89140 json | Temporal Server does not bind internal completion callbacks to the namespace that attached them, which allows an authenticate... | |
| CVE-2026-87744 json | A flaw was found in Quarkus REST Data Panache. This vulnerability allows unauthenticated attackers to bypass security control... | |
| CVE-2026-85471 json | A flaw was found in Quay. An authenticated repository administrator could bypass the hostname blacklist in webhook notificati... | |
| CVE-2026-83536 json | A flaw was found in openstack-network-exporter. The HTTP server within the component is configured without essential timeout ... | |
| CVE-2026-83535 json | A flaw was found in openstack-network-exporter. When an operator configures user authentication but omits or misconfigures Tr... | |
| CVE-2026-65954 json | PHPCSUtils is a suite of utility functions for use with PHP_CodeSniffer. From 1.0.0-alpha1 until 1.2.3, PHPCSUtils\AbstractSn... | |
| CVE-2026-59977 json | ConvertX is a self-hosted file conversion service. Prior to 0.18.0, the /delete/{id} endpoint uses HTTP GET for permanent del... | |
| CVE-2026-108922 json | A flaw has been found in KusalkaSilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. Affected is ... | |
| CVE-2026-108921 json | A vulnerability was detected in KusalkaSilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. This ... | |
| CVE-2026-108920 json | A security vulnerability has been detected in SourceCodester Drug Recommendation System 1.0. This affects an unknown function... | |
| CVE-2026-108919 json | A weakness has been identified in SourceCodester Drug Recommendation System 1.0. The impacted element is an unknown function ... | |
| CVE-2026-107226 json | The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP re... | |
| CVE-2026-105466 json | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to a denial of service when inserting into a table wit... | |
| CVE-2026-105464 json | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows (includes DB2 Connect Server) could allo... | |
| CVE-2026-59976 json | ConvertX is a self-hosted file conversion service. Prior to 0.18.0, the ImageMagick converter uses the unsanitized convert_to... | |
| CVE-2026-57143 json | PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.62, searxng_search and the search_web SearxNG provider ... | |
| CVE-2026-57118 json | PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, AgentTeam.launch and the Agents alias register GET ... | |
| CVE-2026-18166 json | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows (includes DB2 Connect Server) could allo... | |
| CVE-2026-105274 json | Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in hexpm hex_core allows an untrusted reposito... | |
| CVE-2026-104355 json | A connected peer cluster can modify a Temporal Server cluster's local namespaces, which are never replicated to that peer, be... | |
| CVE-2026-104102 json | copyparty is a portable file server. Prior to 1.20.19, FTP upload path handling does not confine destinations to configured c... | |
| CVE-2026-103061 json | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in gleam-lang gleam allows a mal... | |
| CVE-2026-102663 json | OpenList is a file list program that supports multiple storage backends. Prior to 4.2.4, the OpenList search API uses a non-s... | |
| CVE-2025-69947 json | SourceCodester Tailor Management System 1.0 is vulnerable to SQL Injection in customeredit.php?id=1. | |
| CVE-2025-69945 json | kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in /doctor/edit-patient.php?editid=1. | |
| CVE-2025-69944 json | kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in the view-medhistory.php endpoint via the viewid p... | |
| CVE-2025-69943 json | kishan0725 Hospital Management System 4.0 is vulnerale to SQL Injection in get_doctor.php via the parameters doctor and speci... | |
| CVE-2025-69942 json | kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in /hms/doctor/view-patient.php?viewid=1. | |
| CVE-2025-69938 json | CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in renew.php via the parameter membershipType. | |
| CVE-2025-69936 json | CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /edit_member.php?id=1. | |
| CVE-2025-63823 json | My Safetipin Android Application 5.2.1 contains Hardcoded credentials in the authentication module, which allows remote attac... | |
| CVE-2025-63822 json | SirenGPS Android Application 2.19.44 is vulnerable to Incorrect Access Control. An authenticated attacker can manipulate user... | |
| CVE-2025-71375 json | picklescan before 0.0.34 fails to detect the _operator.methodcaller built-in function when scanning pickle files for maliciou... | |
| CVE-2025-71373 json | picklescan before 0.0.33 fails to detect operator.methodcaller function calls in pickle files, allowing attackers to bypass s... | |
| CVE-2025-71372 json | Picklescan before 0.0.33 fails to detect the numpy.f2py.crackfortran.getlincoef gadget in pickle __reduce__ methods, allowing... | |
| CVE-2025-71369 json | picklescan before 0.0.28 fails to detect malicious pickle files that use torch.utils.data.datapipes.utils.decoder.basichandle... | |
| CVE-2025-71367 json | picklescan before 0.0.34 fails to detect _operator.attrgetter function calls in pickle payloads, allowing attackers to bypass... | |
| CVE-2025-71366 json | picklescan before 0.0.28 fails to detect malicious torch.utils.bottleneck.__main__.run_cprofile function calls in pickle file... | |
| CVE-2025-68640 json | The Apple Find My backend service through 2025-12-17 allows an attacker in possession of a valid PET (Private Endpoint Token)... | |
| CVE-2025-67405 json | Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in update_password.php via the parameter ... | |
| CVE-2025-67404 json | Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in save_stud.php via the parameters fname... | |
| CVE-2025-67403 json | Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in update_class.php via the parameter cla... | |
| CVE-2025-66390 json | In Microsoft Azure API Management through 2025-10-17, when self-service signup (username/password Basic Authentication) is en... | |
| CVE-2025-65337 json | Sourcecodester Fantastic Blog CMS 1.0 is vulnerable to Cross Site Scripting (XSS) in pageEditMember.php via the address field... | |
| CVE-2025-60835 json | An issue in the unrar.dll component of IZArc v4.6 allows attackers to execute a path traversal. | |
| CVE-2025-15667 json | A vulnerability was determined in GPAC up to 2.5-DEV. This vulnerability affects the function gf_isom_nalu_sample_rewrite of ... | |
| CVE-2025-71364 json | picklescan before 0.0.30 fails to detect the asyncio.unix_events._UnixSubprocessTransport._start function in pickle reduce me... | |
| CVE-2026-77366 json | obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, tool dispatch does ... | |
| CVE-2026-77364 json | obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, undefined readPaths... | |
| CVE-2026-77363 json | obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, the Streamable HTTP... | |
| CVE-2026-61994 json | Missing Authorization vulnerability in RocketGeek WP-Members wp-members allows Exploiting Incorrectly Configured Access Contr... | |
| CVE-2026-6232 json | An out-of-bounds write vulnerability in the SPI host command interface of Semtech's LR11xx transceiver firmware where a craft... | |
| CVE-2026-109448 json | Integer wraparound in psqlODBC SQLBindParameter allows an application, or an attacker who controls how many parameters the ap... | |
| CVE-2026-109222 json | Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All refere... | |
| CVE-2026-108918 json | A vulnerability was identified in Edimax BR-6208AC 1.32. Impacted is an unknown function of the file /goform/formWlanMP. The ... | |
| CVE-2026-108917 json | A vulnerability was determined in Edimax BR-6208AC 1.32. This issue affects some unknown processing of the file /goform/formA... | |
| CVE-2026-108916 json | A vulnerability was found in Edimax BR-6208AC 1.32. This vulnerability affects unknown code of the file /goform/formAccept. P... | |
| CVE-2026-108915 json | A vulnerability has been found in Edimax BR-6208AC 1.32. This affects an unknown part of the file /goform/formWlanMP. Such ma... | |
| CVE-2026-108486 json | Missing Authorization vulnerability in WPMU DEV Forminator forminator allows Exploiting Incorrectly Configured Access Control... | |
| CVE-2026-108482 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LeapWorx Premium Addons... | |
| CVE-2026-108481 json | Cross-Site Request Forgery (CSRF) vulnerability in Patreon Patreon WordPress patreon-connect allows Cross Site Request Forger... | |
| CVE-2026-108479 json | Cross-Site Request Forgery (CSRF) vulnerability in Patreon Patreon WordPress patreon-connect allows Cross Site Request Forger... | |
| CVE-2026-107862 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ExpressTech Quiz And Su... | |
| CVE-2026-107418 json | Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Control Se... | |
| CVE-2026-103080 json | External Control of Assumed-Immutable Web Parameter vulnerability in VillaTheme Salevo woo-boost-sales allows Input Data Mani... | |
| CVE-2026-84286 json | ExLlamaV3’s EXL3 loader uses an untrusted, model-supplied index to select a CUDA kernel without first verifying that the in... |