CVE.report
CVE.report is the most up-to-date database of common vulnerabilities and exposures. Information is pulled in from several sources and processed in to a mobile friendly, easy to use page. Use the site to quickly check for vulnerabilities in products such as operating systems, applications, hardware, networks, databases, browsers, e-mail clients and more.
CVEs provide a unique and common naming scheme for publicly known cyber security vulnerabilities in order to quickly identify and share these vulnerabilities. You can use the search below to look for vulnerabilities based on product, vendor, or common tags
The form you will see after following this link allows you to fill out the various variables in the CVSS scoring system and receive the corresponding score. The description of each of the variables is also included for additional information.
cve.report now provides a free read-only JSON API for CVE details. Each record combines the CVE Program JSON record, NVD enrichment, KEV, and EPSS when available.
Recent CVEs
| CVE | Description | Updated |
|---|---|---|
| CVE-2026-120075 json | The WP Activity Log plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5... | |
| CVE-2026-119160 json | The Smart Post – Post Grid, Post Carousel, Post Slider Gutenberg Blocks for Blog & News plugin for WordPress is vulnerable ... | |
| CVE-2026-118235 json | The SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications plugin for WordPress is vulnerable to... | |
| CVE-2026-117681 json | A flaw was found in konflux-ci. This vulnerability allows privilege escalation when the user interface proxy automatically di... | |
| CVE-2026-116964 json | A flaw was found in konflux-ci. An attacker with repository write access can achieve arbitrary code execution within the Cont... | |
| CVE-2026-116086 json | A flaw was found in konflux-ci. An attacker with permission to trigger automated workflow runs can cause an information discl... | |
| CVE-2026-114217 json | A flaw was found in konflux-ci. Continuous Integration (CI) automation scripts store sensitive GitHub access tokens in plaint... | |
| CVE-2026-110530 json | The FeedWordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2026.05... | |
| CVE-2026-109367 json | The All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) plugin for W... | |
| CVE-2026-103915 json | The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Sensitive Information Expos... | |
| CVE-2026-103882 json | The Acadlix LMS – AI Quiz Maker, Online Exam & Course Plugin for WordPress plugin for WordPress is vulnerable to arbitrary ... | |
| CVE-2026-101325 json | The Newsletters plugin for WordPress is vulnerable to time-based SQL Injection via the 'id' parameter in all versions up to, ... | |
| CVE-2026-77176 json | A flaw was found in Kata Containers. In configurations utilizing genpolicy for Confidential Containers guest protection, a ma... | |
| CVE-2026-120070 json | The User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Su... | |
| CVE-2026-119096 json | The Uncanny Toolkit for LearnDash plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and includin... | |
| CVE-2026-118057 json | The Shield Security – Smart Bot Blocking, Brute-Force Login Protection & File Scanning plugin for WordPress is vulnerable t... | |
| CVE-2026-116535 json | The SEOPress – AI SEO Plugin & On-site SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'displ... | |
| CVE-2026-116512 json | The Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker plugin for WordPress is v... | |
| CVE-2026-111592 json | The Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors plugin for WordPress is vulnera... | |
| CVE-2026-111070 json | The Content Pilot – Autoblogging & Affiliate Marketing Suite plugin for WordPress is vulnerable to Stored Cross-Site Script... | |
| CVE-2026-110023 json | The WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps plugin for WordPress is vulnerable to Sensiti... | |
| CVE-2026-107759 json | The WPO365 | MICROSOFT 365 GRAPH MAILER plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Subject (v... | |
| CVE-2026-104012 json | The Rox Appointment Booking – Appointment Booking Scheduling Solution plugin for WordPress is vulnerable to Privilege Escal... | |
| CVE-2026-103997 json | The Redux Framework plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.15. ... | |
| CVE-2026-103962 json | The User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Su... | |
| CVE-2026-103898 json | The Wp Social Login and Register Social Counter plugin for WordPress is vulnerable to Authentication Bypass in all versions u... | |
| CVE-2026-93834 json | A use-after-free vulnerability was found in QEMU's 9pfs subsystem. A race condition between the main thread and a worker thre... | |
| CVE-2026-34892 json | Missing Authorization vulnerability in Rank Math SEO Rank Math SEO seo-by-rank-math allows Exploiting Incorrectly Configured ... | |
| CVE-2025-11455 json | The Perfect Images plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check ... | |
| CVE-2025-9462 json | The WP2LEADS plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order’ parameter in all versions up ... | |
| CVE-2025-2241 json | A flaw was found in Hive, a component of Multicluster Engine (MCE) and Advanced Cluster Management (ACM). This vulnerability ... | |
| CVE-2026-120040 json | The Mail logging & Catcher plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and in... | |
| CVE-2026-120019 json | The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versi... | |
| CVE-2026-119980 json | The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress is vulnerable ... | |
| CVE-2026-119166 json | The Welcart e-Commerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and incl... | |
| CVE-2026-119163 json | The FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce plugin for WordPress is vulnerab... | |
| CVE-2026-119162 json | The User Submitted Posts – Enable Users to Submit Posts from the Front End plugin for WordPress is vulnerable to Stored DOM... | |
| CVE-2026-119089 json | The ThirstyAffiliates – Affiliate Links, Link Branding, Link Tracking & Marketing Plugin plugin for WordPress is vulnerable... | |
| CVE-2026-119065 json | The Shipping Zones by Drawing for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'szbd... | |
| CVE-2026-118070 json | The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gid' parameter in all versi... | |
| CVE-2026-116557 json | The WP Booking System - Booking Calendar plugin for WordPress is vulnerable to unauthorized modification of data due to a mis... | |
| CVE-2026-116548 json | The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'option... | |
| CVE-2026-116546 json | The WP Job Portal – AI-Powered Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to St... | |
| CVE-2026-116522 json | The Relevanssi – A Better Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parame... | |
| CVE-2026-115840 json | The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'poplin... | |
| CVE-2026-111254 json | The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versi... | |
| CVE-2026-111109 json | The Webmention plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Open Graph og:title meta tag of a we... | |
| CVE-2026-110251 json | The Photo Reviews for WooCommerce plugin for WordPress is vulnerable to unauthorized Media Library File Deletion in all versi... | |
| CVE-2026-109386 json | The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to authorization bypass in... | |
| CVE-2026-109220 json | The PDF Invoice for WooCommerce + Drag and Drop Template Builder plugin for WordPress is vulnerable to PHP Object Injection i... | |
| CVE-2026-109217 json | The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all ... | |
| CVE-2026-107765 json | The Discussion Board – WordPress Forum Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions... | |
| CVE-2026-107750 json | The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'b... | |
| CVE-2026-107653 json | The SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments p... | |
| CVE-2026-90960 json | The Seraphinite Accelerator plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and i... | |
| CVE-2026-89270 json | The Popup Builder – Create highly converting, mobile friendly marketing popups. plugin for WordPress is vulnerable to autho... | |
| CVE-2026-88942 json | The Product Filter for WooCommerce by WBW plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'wpf_fid' ... | |
| CVE-2026-11396 json | The Product Filter for WooCommerce by WBW plugin for WordPress is vulnerable to Missing Authorization / Information Disclosur... | |
| CVE-2026-119977 json | WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessib... | |
| CVE-2026-118638 json | The Mapster WP Maps WordPress plugin before 2.0.6 does not perform any authorization check on a REST API route that writes po... | |
| CVE-2026-118629 json | The All-in-One Video Gallery WordPress plugin before 5.0.0 does not check a video's publication status before rendering it o... | |
| CVE-2026-118438 json | The Firelight Lightbox WordPress plugin before 2.3.24 does not properly escape image attribute values before processing them ... | |
| CVE-2026-118437 json | The BuddyForms WordPress plugin before 2.10.1 does not properly verify ownership before deleting guest-uploaded attachments, ... | |
| CVE-2026-94361 json | The Payable Payment Gateway for WooCommerce WordPress plugin before 1.3.1 does not verify the authenticity of an incoming pay... | |
| CVE-2026-92294 json | The Spectra Gutenberg Blocks – Website Builder for the Block Editor plugin for WordPress is vulnerable to limited file dele... | |
| CVE-2026-82214 json | The Quick Event Manager WordPress plugin before 9.19 does not verify the status or type of the requested post before returnin... | |
| CVE-2026-118185 json | The Security Optimizer WordPress plugin before 1.6.9 does not limit the number of two-factor authentication codes that can b... | |
| CVE-2026-118184 json | The Premium Packages WordPress plugin before 7.2.2 does not prevent unauthenticated visitors from overwriting the stored pri... | |
| CVE-2026-118043 json | The Bulk Media Register WordPress plugin before 2.01 does not properly validate a user-supplied path before moving a file on ... | |
| CVE-2026-116563 json | The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Stored DOM-Based Cr... | |
| CVE-2026-116520 json | The PPWP – Password Protect Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment / shor... | |
| CVE-2026-110808 json | The Essential Addons for Elementor WordPress plugin before 6.8.8 does not correctly restrict who may set the role assigned t... | |
| CVE-2026-110042 json | The Payment Forms for Paystack WordPress plugin before 4.0.6 does not properly restrict access to a page that displays its st... | |
| CVE-2026-109997 json | The Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin for WordPress is vuln... | |
| CVE-2026-109234 json | The Meow Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_content (bbPress reply body... | |
| CVE-2026-101326 json | The The Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin for WordPress is ... | |
| CVE-2026-100155 json | The The Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin for WordPress is ... | |
| CVE-2026-119528 json | A flaw was found in GIMP. The PSD plug-in’s image resource header loader uses an incorrect destination size when copying a ... | |
| CVE-2026-118697 json | In JetBrains Toolbox App before 3.9.1 and 3.8.2; IntelliJ IDEA before 2026.3 and 2026.2.4, the jetbrainsd daemon trusted comp... | |
| CVE-2026-118696 json | In JetBrains IntelliJ IDEA, PyCharm, PhpStorm, RubyMine and WebStorm before 2026.3, 2026.2.4, 2026.1.5.1, and 2025.3.6.2; GoL... | |
| CVE-2026-112816 json | Improper certificate validation in the HTTPS listener in Canonical LXD 4.0.14, 5.0.10, 5.21.8, 6.9 before 4.0.15, 5.0.11, 5.... | |
| CVE-2026-91917 json | Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Input Validation vulnerability. A low privileged at... | |
| CVE-2026-91915 json | Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements in Output Used b... | |
| CVE-2026-91913 json | Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an OS Co... | |
| CVE-2026-84243 json | The gettext family of functions in the GNU C Library version 2.0 and later accept LANGUAGE environment variable entries that ... | |
| CVE-2026-69446 json | Incorrect authorization in Microsoft Edge (Chromium-based) allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-118539 json | Missing Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versio... | |
| CVE-2026-111505 json | Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an OS Co... | |
| CVE-2026-111504 json | Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Argument Delimiters in a Command ... | |
| CVE-2026-101214 json | Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an OS Co... | |
| CVE-2026-101213 json | Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Privilege Management vulnerability. A low privilege... | |
| CVE-2026-101210 json | Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an OS Co... | |
| CVE-2026-76031 json | Use after free in Input in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside th... | |
| CVE-2026-76030 json | Memory corruption in FileSystem in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbi... | |
| CVE-2026-76029 json | Memory corruption in Network in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitra... | |
| CVE-2026-76028 json | Use after free in FileSystem in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code insi... | |
| CVE-2026-76026 json | Memory corruption in Autofill in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code ins... | |
| CVE-2026-76025 json | Use after free in FileSystem in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code insi... | |
| CVE-2026-119271 json | Use after free in Skia in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the... | |
| CVE-2026-119270 json | Improper input validation in CacheStorage in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially ex... |