CVE.report
CVE.report is the most up-to-date database of common vulnerabilities and exposures. Information is pulled in from several sources and processed in to a mobile friendly, easy to use page. Use the site to quickly check for vulnerabilities in products such as operating systems, applications, hardware, networks, databases, browsers, e-mail clients and more.
CVEs provide a unique and common naming scheme for publicly known cyber security vulnerabilities in order to quickly identify and share these vulnerabilities. You can use the search below to look for vulnerabilities based on product, vendor, or common tags
The form you will see after following this link allows you to fill out the various variables in the CVSS scoring system and receive the corresponding score. The description of each of the variables is also included for additional information.
cve.report now provides a free read-only JSON API for CVE details. Each record combines the CVE Program JSON record, NVD enrichment, KEV, and EPSS when available.
Recent CVEs
| CVE | Description | Updated |
|---|---|---|
| CVE-2026-103331 json | The UniPAY Payment Gateway For WooCommerce WordPress plugin before 2.4 does not properly verify the authenticity of payment n... | |
| CVE-2026-27542 json | Incorrect Privilege Assignment vulnerability in Rymera Web Co Pty Ltd. Woocommerce Wholesale Lead Capture allows Privilege Es... | |
| CVE-2026-27541 json | Incorrect Privilege Assignment vulnerability in Josh Kohlbach Wholesale Suite allows Privilege Escalation. This issue affect... | |
| CVE-2026-27540 json | Unrestricted Upload of File with Dangerous Type vulnerability in Rymera Web Co Pty Ltd. Woocommerce Wholesale Lead Capture al... | |
| CVE-2023-5341 json | A heap use-after-free flaw was found in coders/bmp.c in ImageMagick. | |
| CVE-2026-123036 json | A flaw was found in ansible-core. When a task marked `no_log: true` fails, the task result is censored before being emitted, ... | |
| CVE-2026-112257 json | A flaw was found in GIMP. The PSD thumbnail resource loader performs a BGR-to-RGB channel swap with a fixed 3-byte stride and... | |
| CVE-2026-13423 json | The Streamit WordPress theme before 4.5.2 does not perform any authorization or nonce verification on one of its unauthentica... | |
| CVE-2026-118869 json | An OS command injection vulnerability exists in SHIRASAGI, which may allow an authenticated attacker to execute arbitrary OS ... | |
| CVE-2026-117679 json | A cross-site scripting vulnerability exists in SHIRASAGI, which may allow an authenticated attacker to execute arbitrary scri... | |
| CVE-2026-89059 json | A flaw was found in RESTEasy's IIOImageProvider, which decodes attacker-supplied image request bodies without enforcing any l... | |
| CVE-2026-73996 json | Unrestricted Upload of File with Dangerous Type vulnerability in ThemeGrill Masteriyo - LMS learning-management-system allows... | |
| CVE-2020-25720 json | A vulnerability was found in Samba where a delegated administrator with permission to create objects in Active Directory can ... | |
| CVE-2026-112072 json | vault-java-driver, a Java client for HashiCorp Vault, parses Vault's JSON responses with a vendored minimal-json parser that ... | |
| CVE-2026-109408 json | vault-java-driver, a Java client for HashiCorp Vault, silently disables TLS certificate and hostname verification in three st... | |
| CVE-2026-107776 json | The Dokan WordPress plugin before 5.3.3 does not reconcile the amount credited to a vendor's reverse-withdrawal ledger agains... | |
| CVE-2026-100109 json | The Security For WooCommerce WordPress plugin from 1.0.10 to 1.0.16 does not perform capability checks when creating users th... | |
| CVE-2026-62041 json | Missing Authorization vulnerability in Ashok Dudhat WP Event Manager wp-event-manager allows Exploiting Incorrectly Configure... | |
| CVE-2026-123033 json | Authentication bypass in the HA heartbeat origin check in middlewared in TrueNAS SCALE before 25.10.8 (and in release trains ... | |
| CVE-2026-123029 json | Wowza Streaming Engine before 4.12.2 processes XML external entities, which allows remote attackers to read local files with ... | |
| CVE-2026-123025 json | An OS Command Injection vulnerability was discovered in the Google Cloud DNS validation module of the OPNsense os-acme-client... | |
| CVE-2026-123017 json | GodotSteam 4.17 through 4.23.2 trusts the peer value of 1 to mean that a player is the server. A grant_gold(1000000) call can... | |
| CVE-2026-80335 json | Memory Corruption when processing firmware update data in Download mode due to a missing bounds check. | |
| CVE-2026-79405 json | Transient DOS when processing a malformed NR RRC configuration message due to improper input validation. | |
| CVE-2026-16438 json | Incorrect Privilege Assignment vulnerability in Mitsubishi Electric GENESIS64 versions 10.97.3 and prior, ICONICS Suite versi... | |
| CVE-2026-16437 json | Weak Password Recovery Mechanism for Forgotten Password vulnerability in Mitsubishi Electric GENESIS versions 11.03 and prior... | |
| CVE-2026-16436 json | Weak Password Recovery Mechanism for Forgotten Password vulnerability in Mitsubishi Electric GENESIS versions 11.03 and prior... | |
| CVE-2026-13584 json | Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability in Mitsubishi Electric... | |
| CVE-2026-91049 json | The EWWW Image Optimizer WordPress plugin before 8.9.1 does not properly sanitize and restrict a value in post content before... | |
| CVE-2026-90967 json | The Essential Real Estate WordPress plugin before 5.3.5 does not verify ownership of an invoice before rendering it in one of... | |
| CVE-2026-90966 json | The Essential Real Estate WordPress plugin before 5.3.5 does not verify, in one of its AJAX actions, that a listing package s... | |
| CVE-2026-90965 json | The Essential Real Estate WordPress plugin before 5.3.5 does not perform a publication-status or authorization check in two o... | |
| CVE-2026-90964 json | The Essential Real Estate WordPress plugin before 5.3.5 does not restrict the recipient of one of its contact email actions, ... | |
| CVE-2026-90963 json | The Essential Real Estate WordPress plugin before 5.3.5 does not perform any authorization or publication-status check in one... | |
| CVE-2026-88814 json | The YITH WooCommerce Gift Cards WordPress plugin before 4.38.1 does not lock or atomically update a gift card's balance when ... | |
| CVE-2026-87856 json | The Subscriptions for WooCommerce WordPress plugin before 2.1.1 only enforces its membership content restrictions on standard... | |
| CVE-2026-86795 json | The Community Events WordPress plugin before 1.6.0 does not have authorisation or nonce checks in one of its AJAX actions, al... | |
| CVE-2026-123014 json | iTerm2 before 3.7.7beta2 has an argument injection vulnerability in the x-man-page: URL handler, allowing an attacker to exec... | |
| CVE-2026-109150 json | The WP PageNavi Style WordPress plugin through 1.4 does not sanitise and escape some of its settings, and has no CSRF check w... | |
| CVE-2026-107787 json | The CatFolders WordPress plugin before 2.5.7 does not have authorisation checks on a folder maintenance action, allowing use... | |
| CVE-2026-107786 json | The CatFolders WordPress plugin before 2.5.7 does not properly sanitize and escape a user-controlled sort setting before usi... | |
| CVE-2026-107775 json | The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.3.3 does not verify that the ac... | |
| CVE-2026-107774 json | The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.3.3 does not use a trusted site... | |
| CVE-2026-107773 json | The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.3.3 does not correctly verify a... | |
| CVE-2026-105971 json | The Car Dealer (Dealership) and Vehicle sales WordPress plugin through 4.73 does not restrict its unauthenticated single-list... | |
| CVE-2026-105259 json | The Easy Social Icons WordPress plugin before 4.0.3 does not sanitise SVG files, which it adds to the list of file types that... | |
| CVE-2026-100144 json | The IVPAY payments WordPress plugin through 1.0.8 does not sanitise a value from its payment callback before using it in a SQ... | |
| CVE-2026-86442 json | The WP Event Manager WordPress plugin before 3.4.2 does not verify the ownership or the post type of a user supplied post id... | |
| CVE-2026-85570 json | The Tutor LMS WordPress plugin before 4.2.0 does not prevent the correct answers to quiz questions from being included in th... | |
| CVE-2026-85351 json | The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not validate a user-supplied URL before performing a ... | |
| CVE-2026-85347 json | The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not sanitize and escape a user-supplied value before ... | |
| CVE-2026-85346 json | The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not perform authorization or CSRF checks on several o... | |
| CVE-2026-19256 json | The All In One Login WordPress plugin before 2.5.0 does not adequately restrict the number of attempts that can be made again... | |
| CVE-2026-16304 json | The WP Event Manager WordPress plugin before 3.4.2 does not properly validate ownership or the type of the user-supplied pos... | |
| CVE-2025-15702 json | The Cloud Blocks WordPress plugin through 1.1.8 does not perform any authorisation or sanitisation when storing block asset U... | |
| CVE-2025-15701 json | The Easy Social Icons WordPress plugin before 4.0.3 does not sanitise and escape some of its settings before outputting them ... | |
| CVE-2026-123012 json | In Gogs 0.14.3, the Git Smart HTTP authorization layer in internal/route/repo/http.go allows a push when only read access was... | |
| CVE-2026-123011 json | STMicroelectronics st-mems-android-linux-sensors-hal before 7bdf334 does not check whether the allowed number of channels is ... | |
| CVE-2026-123010 json | @twilio-labs/netlify-okta-auth through 1.0.2 relies on an unverified iss claim. This affects an outbound HTTP request to retr... | |
| CVE-2026-120553 json | The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'slides_to_sho... | |
| CVE-2026-120533 json | The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via theme_opts Parameter via User Profi... | |
| CVE-2026-118193 json | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Privilege Escalation in all ver... | |
| CVE-2026-116617 json | The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to File Deletion in all version... | |
| CVE-2026-109518 json | On Debian, Ubuntu, and derivative Linux distributions, an on-path attacker who can manipulate the HTTP traffic (including a m... | |
| CVE-2026-104812 json | The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'multi_media' Field Array Key in al... | |
| CVE-2026-93389 json | The LiteSpeed Cache plugin for WordPress is vulnerable to unauthenticated disclosure of sensitive WooCommerce customer data i... | |
| CVE-2026-90634 json | An uncontrolled memory access in the PDF import code of Apache OpenOffice versions through 4.1.16 allows a crafted PDF to cau... | |
| CVE-2026-90629 json | An uncontrolled memory access in the WMF import code of Apache OpenOffice versions through 4.1.16 allows a crafted WMF file t... | |
| CVE-2026-76506 json | A vulnerability in the web-based management interface of Cisco UCS Central Software could allow an authenticated, remote atta... | |
| CVE-2026-59267 json | A crafted DXF document causes a heap buffer overflow in Draw in Apache OpenOffice 4.1.16 and earlier. This could cause a cras... | |
| CVE-2026-121621 json | A command injection vulnerability was found in Argo CD Image Updater, where a proxy URL configured on an SSH Git repository i... | |
| CVE-2026-121257 json | Use after free in TabStrip in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary... | |
| CVE-2026-121256 json | Use of released resource in GPU in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the ren... | |
| CVE-2026-121249 json | Buffer overflow in ANGLE in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside ... | |
| CVE-2026-121241 json | Use after free in Navigation in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially e... | |
| CVE-2026-121238 json | Use after free in Source in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside t... | |
| CVE-2026-121234 json | Privilege elevation in Contacts in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentiall... | |
| CVE-2026-121230 json | Race condition in ANGLE in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary co... | |
| CVE-2026-120931 json | Out of bounds write in WebGL in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbit... | |
| CVE-2026-118865 json | An authenticated OS command injection vulnerability exists in the Offline Download component (USB storage allocation) of Arch... | |
| CVE-2026-118627 json | MLflow SHAP load_explainer Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows r... | |
| CVE-2026-118626 json | MLflow Tracking Server Issues Missing Authorization Privilege Escalation Vulnerability. This vulnerability allows remote atta... | |
| CVE-2026-118625 json | MLflow Tracking Server Missing Authorization Privilege Escalation Vulnerability. This vulnerability allows remote attackers t... | |
| CVE-2026-118623 json | MLflow PickleEvaluationArtifact Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability all... | |
| CVE-2026-100252 json | Improper Authorization vulnerability in Apache ZooKeeper. When SASL authentication is enabled on the client port, the server... | |
| CVE-2026-90628 json | An uncontrolled memory access in the PDF export code of Apache OpenOffice versions through 4.1.16 allows a crafted CFF font t... | |
| CVE-2026-90626 json | An uncontrolled memory access in the PDF import code of Apache OpenOffice versions through 4.1.16 allows a crafted PDF to cau... | |
| CVE-2026-90624 json | An unchecked memory access in the PDF import code of Apache OpenOffice versions through 4.1.16 on allows a crafted PDF to exe... | |
| CVE-2026-84730 json | Stack-based buffer overflow in certain ASUS Router firmware allows an unauthenticated nearby attacker to execute arbitrary co... | |
| CVE-2026-82155 json | Dell OS Recovery tool versions, prior to 2.4.4, contain a use of Untrusted Search Path vulnerability. An unauthenticated atta... | |
| CVE-2026-77690 json | ZohoCorp ManageEngine Key Manager Plus versions before 7151 were vulnerable to a Command Injection vulnerability that allowed... | |
| CVE-2026-59268 json | An out-of-bounds Write vulnerability in Apache OpenOffice versions through 4.1.16 could allow an attacker to craft a Microsof... | |
| CVE-2026-59264 json | The Windows installers of Apache OpenOffice 4.1.16 and earlier allow an already manipulated system to run external code with ... | |
| CVE-2026-121226 json | Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code ... | |
| CVE-2026-121224 json | Security issue in Desktop in Google Chrome on on Mac prior to 157.0.8103.38 allowed a remote attacker who had compromised the... | |
| CVE-2026-121221 json | Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code ... | |
| CVE-2026-121219 json | Integer overflow in GPU in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer pr... | |
| CVE-2026-121218 json | Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the s... | |
| CVE-2026-121217 json | Use after free in Streaming in Google Chrome prior to 157.0.8103.38 allowed an adjacent attacker to execute arbitrary code in... | |
| CVE-2026-121214 json | Use after free in Passwords in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrar... |