CVE.report
CVE.report is the most up-to-date database of common vulnerabilities and exposures. Information is pulled in from several sources and processed in to a mobile friendly, easy to use page. Use the site to quickly check for vulnerabilities in products such as operating systems, applications, hardware, networks, databases, browsers, e-mail clients and more.
CVEs provide a unique and common naming scheme for publicly known cyber security vulnerabilities in order to quickly identify and share these vulnerabilities. You can use the search below to look for vulnerabilities based on product, vendor, or common tags
The form you will see after following this link allows you to fill out the various variables in the CVSS scoring system and receive the corresponding score. The description of each of the variables is also included for additional information.
cve.report now provides a free read-only JSON API for CVE details. Each record combines the CVE Program JSON record, NVD enrichment, KEV, and EPSS when available.
Recent CVEs
| CVE | Description | Updated |
|---|---|---|
| CVE-2026-114570 json | WordPress Core is vulnerable to Stored Cross-Site Scripting via Quick Edit in all versions up to, and including, 7.0.2 due to... | |
| CVE-2026-111972 json | The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.5.8 does not verify that a user is authorised to act... | |
| CVE-2026-111971 json | The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.5.8 does not sanitise and escape collection and gall... | |
| CVE-2026-111958 json | The Royal MCP WordPress plugin before 1.5.7 does not limit a preview-link token to the single preview it was issued for, so ... | |
| CVE-2026-110011 json | The MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.12.3 does not perform a capability check in its export... | |
| CVE-2026-110010 json | The MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.12.3 does not perform any capability or authentication... | |
| CVE-2026-109987 json | The PixelYourSite WordPress plugin before 11.4.3, PixelYourSite Pro WordPress plugin before 12.6.8 do not sanitise and escap... | |
| CVE-2026-109931 json | The Infility Global WordPress plugin before 2.16.25 does not perform any authorisation or nonce check on an AJAX action avail... | |
| CVE-2026-109927 json | The HIPAA Forms WordPress plugin before 3.3.2 does not perform a capability check when handling a request that rebuilds its o... | |
| CVE-2026-103234 json | The WP Ultimate Review WordPress plugin before 2.4.5 does not neutralise shortcodes in all of the review fields submitted thr... | |
| CVE-2026-100142 json | The FluentCart A New Era of eCommerce WordPress plugin before 2.2.0 does not verify that a stored customer address selected ... | |
| CVE-2026-97328 json | The WebP Express WordPress plugin before 0.25.16 does not escape values that its bundled HTML parser re-emits into element at... | |
| CVE-2026-96512 json | A flaw was found in sudo. When sudoers rules use NOTBEFORE or NOTAFTER time-based access restrictions with timestamps that om... | |
| CVE-2026-88849 json | The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.55 does not verify that a user targeted through its student... | |
| CVE-2026-86332 json | A flaw was found in odh-dashboard in Red Hat OpenShift AI. The backend-for-frontend route GET /api/nim-serving/:nimResource r... | |
| CVE-2026-78392 json | The Link Library WordPress plugin before 7.9.6 does not sanitise and escape a link field before outputting it inside an attri... | |
| CVE-2026-18949 json | A flaw was found in odh-dashboard. This vulnerability allows an attacker, who has compromised the dashboard's Service Account... | |
| CVE-2026-15574 json | A flaw was found in the vllm-orchestrator-gateway component. The system's production binary logs all incoming authorization h... | |
| CVE-2026-15143 json | A flaw was found in the file_type content detector of guardrails-detectors. This vulnerability allows a remote attacker to su... | |
| CVE-2026-114223 json | NT OneAPP developed by NewType Infortech has an Exposure of Sensitive Information vulnerability. Unauthenticated local attack... | |
| CVE-2026-114222 json | NT OneAPP developed by NewType Infortech has an Authentication Bypass vulnerability. Unauthenticated local attackers can bypa... | |
| CVE-2026-114221 json | NT OneAPP developed by NewType Infortech has a Credential Disclosure vulnerability. Unauthenticated remote attackers can trig... | |
| CVE-2026-114220 json | NT OneAPP developed by NewType Infortech has an Improper Certificate Validation vulnerability. Unauthenticated network-adjace... | |
| CVE-2026-114219 json | NT OneAPP developed by NewType Infortech has a Hard-coded Credentials vulnerability. Unauthenticated remote attackers can obt... | |
| CVE-2026-114406 json | The system certificate authority (CA) store in Red Hat products, distributed via ca-certificates RPM packages, included multi... | |
| CVE-2026-112309 json | @rvf/set-get before 7.0.4 contains a prototype pollution vulnerability in setPath that allows unauthenticated attackers to ov... | |
| CVE-2026-112304 json | docTR through 1.1.0 contains an unsafe deserialization vulnerability in load_pretrained_params() that loads checkpoints with ... | |
| CVE-2026-112157 json | A weakness has been identified in MemTensor memmy-agent up to 1.0.9/1.1.1/1.2.2. The impacted element is the function require... | |
| CVE-2026-111056 json | FOSSBilling is an open source billing and client-management platform. From 0.1.0 until 0.8.7, the unauthenticated POST /api/g... | |
| CVE-2026-114732 json | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an improper authentication vulnerability in multi-host ... | |
| CVE-2026-114731 json | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an uncontrolled resource consumption vulnerability in t... | |
| CVE-2026-114730 json | Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a server-side request forgery filter bypass. The... | |
| CVE-2026-114729 json | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass. rcube_washtml inspect... | |
| CVE-2026-113406 json | BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary S... | |
| CVE-2026-110354 json | HAProxy 3 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (persistent worker-thread CPU ex... | |
| CVE-2026-110353 json | HAProxy 3.2 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (worker-thread CPU exhaustion)... | |
| CVE-2026-113405 json | BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary S... | |
| CVE-2026-112329 json | The Sensei LMS WordPress plugin before 4.26.4 contains a broken access control vulnerability in the legacy save_new_message h... | |
| CVE-2026-112293 json | BoxyHQ Enterprise SaaS Starter Kit through 1.6.0 contains a missing authorization vulnerability that allows non-owner team me... | |
| CVE-2026-112288 json | Krayin CRM 2.2.5 before 2.2.7 contains a server-side request forgery filter bypass that allows users with webhook permissions... | |
| CVE-2026-112283 json | VideoLAN libbluray through 1.5.1 contains an uncontrolled memory allocation vulnerability in _parse_extent_start_points() in ... | |
| CVE-2026-112278 json | rdesktop through 1.9.0 contains a heap out-of-bounds read vulnerability in process_raw_bmpcache() in orders.c that allows mal... | |
| CVE-2026-112273 json | libtins through 4.6 contains a heap out-of-bounds read vulnerability in DNS::compose_name in src/dns.cpp that allows remote a... | |
| CVE-2026-112268 json | sglang-router (sgl-model-gateway) through 0.3.2 contains an authorization bypass vulnerability that allows holders of the dat... | |
| CVE-2026-112263 json | Television (tv) 0.15.0 through 0.15.9 contains an OS command injection vulnerability that allows attackers to run shell comma... | |
| CVE-2026-112150 json | A security flaw has been discovered in vraj404 Criminal-Management-System up to 2808d057e7ddc5295519a487365b0cacfd0ba8c4. Aff... | |
| CVE-2026-112145 json | A security vulnerability has been detected in speaches-ai speaches up to 0.9.0-rc.3. This vulnerability affects the function ... | |
| CVE-2026-111936 json | Sigma File Manager through 2.2.0 contains a server-side request forgery vulnerability because validate_remote_url() in securi... | |
| CVE-2026-107081 json | SQL injection via identifier injection in the tableName and tableFields POST parameters of admin AJAX endpoints (admin/AJAX_l... | |
| CVE-2025-55654 json | A use-after-free in the gf_filter_pid_get_packet function (filter_core/filter_pid.c) of GPAC MP4Box v2.4 allows attackers to ... | |
| CVE-2026-112141 json | A vulnerability was determined in satya-vinay Events-Management-System up to 437c77ceb69bf9fe2e3f4f46f7871b83f425383a. Affect... | |
| CVE-2026-112108 json | A vulnerability was determined in ztxz16 fastllm up to 0.1.8.2. This impacts the function GGUFBuffer::ReadString of the file ... | |
| CVE-2026-112104 json | A flaw has been found in eremef bandcamp-player up to 1.8.33-beta. The impacted element is an unknown function of the file da... | |
| CVE-2026-112100 json | A vulnerability was determined in DeepPavlov up to 1.7.0. This affects the function MultiTaskPipelinePreprocessor.__init__ of... | |
| CVE-2026-112095 json | A flaw has been found in SourceCodester Inventory System 1.0. This affects an unknown part of the file /api/products_handler.... | |
| CVE-2026-112091 json | A flaw has been found in Dav-ee dairy-management-system 31ace9692d1e1e6d64339a42c463b361319c615c/f31a584c3330c013b61f8b0306d9... | |
| CVE-2026-112087 json | A weakness has been identified in itsourcecode Online Cake Ordering System 1.0. This issue affects some unknown processing of... | |
| CVE-2026-112081 json | A vulnerability was determined in hankcs HanLP up to 2.1.0-beta.64. This affects the function hanlp.load of the file plugins/... | |
| CVE-2026-112077 json | A vulnerability was detected in radareorg radare2 6.2.0/6.2.2. This issue affects the function r_core_cmd_str_pipe in the lib... | |
| CVE-2026-112073 json | A vulnerability was identified in Tencent ncnn up to 44b02dabdcf97499281a4692ebd65bad73dcf8b6. Affected by this vulnerability... | |
| CVE-2026-112042 json | A security flaw has been discovered in diem-project diem up to 116974edfb9a5b8bd69cb13586dc62bcdbb485ad. This issue affects t... | |
| CVE-2026-112038 json | A vulnerability has been found in diem-project diem up to 116974edfb9a5b8bd69cb13586dc62bcdbb485ad. Affected by this vulnerab... | |
| CVE-2026-112034 json | A weakness has been identified in aircheng-org iWebShop-5 up to 5.16. The impacted element is the function IController::redir... | |
| CVE-2026-111883 json | Locust through 2.46.7 contains a cross-site request forgery vulnerability that allows remote attackers to stop load tests or ... | |
| CVE-2026-112059 json | libLAS through 1.8.1 contains a heap out-of-bounds write vulnerability in the point record reader caused by truncating the sc... | |
| CVE-2026-112054 json | Schroedinger libschroedinger through 1.0.11 contains a divide by zero vulnerability that allows attackers to crash applicatio... | |
| CVE-2026-112049 json | Vita3K before build 4187 contains a path traversal (zip slip) vulnerability in install_archive_content() that allows attacker... | |
| CVE-2026-112030 json | A vulnerability was found in diem-project diem up to 5.1.3. This vulnerability affects unknown code of the file dmCorePlugin/... | |
| CVE-2026-112026 json | A security vulnerability has been detected in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c381... | |
| CVE-2026-112020 json | LodePNG through 20261006 contains a heap out-of-bounds read vulnerability in lodepng::getFilterTypesInterlaced() in lodepng_u... | |
| CVE-2026-112005 json | WhoDB 0.104.0 before 0.135.0 contains a path traversal vulnerability that allows remote attackers to read and write arbitrary... | |
| CVE-2026-112000 json | Vanus 0.8.0 through 0.9.0 contains a missing authorization vulnerability in the gateway that allows any authenticated user to... | |
| CVE-2026-111991 json | A security vulnerability has been detected in WongKinYiu yolov9 0.1. This vulnerability affects the function DetectMultiBacke... | |
| CVE-2026-111986 json | A vulnerability was determined in AUTOMATIC1111 stable-diffusion-webui up to 1.10.1. Affected is the function get_obj_from_st... | |
| CVE-2026-111932 json | Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contains a stored HTML injection v... | |
| CVE-2026-111877 json | A vulnerability was determined in dext34-morgan Books4Cash up to a8d3e357db75c07ac5ffbadcbaee2aeb4db3e571. This affects an un... | |
| CVE-2026-111873 json | A vulnerability was detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. This... | |
| CVE-2026-111869 json | A vulnerability was identified in makeplane plane up to 1.4.2. Impacted is an unknown function of the component API Endpoint.... | |
| CVE-2026-96398 json | Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0... | |
| CVE-2026-96392 json | Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal AI CKEditor allows Code Injecti... | |
| CVE-2026-96391 json | Missing Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. This issue affects Webform REST versions... | |
| CVE-2026-96390 json | Privilege Defined With Unsafe Actions vulnerability in Drupal Editoria11y Accessibility Checker allows Privilege Escalation. ... | |
| CVE-2026-96388 json | Cross-Site Request Forgery (CSRF) vulnerability in Drupal Tawk.to - Live chat application allows Cross Site Request Forgery. ... | |
| CVE-2026-96387 json | Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Stop administrator login allows Authenticati... | |
| CVE-2026-96386 json | Missing Authorization vulnerability in Drupal Smart Content allows Forceful Browsing. This issue affects Smart Content versio... | |
| CVE-2026-96385 json | Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal REST & JSON API Authentication for Drupal al... | |
| CVE-2026-96384 json | Incorrect Authorization vulnerability in Drupal Mermaid Diagram Field allows Forceful Browsing. This issue affects Mermaid Di... | |
| CVE-2026-96382 json | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Diba carousel sl... | |
| CVE-2026-96380 json | Missing Authorization vulnerability in Drupal CSS Usage Analyzer allows Forceful Browsing. This issue affects CSS Usage Analy... | |
| CVE-2026-96379 json | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal CookieCuttr allo... | |
| CVE-2026-96378 json | Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Commerce Decoupled Che... | |
| CVE-2026-96377 json | Allocation of Resources Without Limits or Throttling vulnerability in Drupal Combined image style allows Excessive Allocation... | |
| CVE-2026-96376 json | Improper Neutralization of Special Elements used in an OS Command ("OS Command Injection") vulnerability in Drupal Cloud allo... | |
| CVE-2026-96375 json | Improper Certificate Validation vulnerability in Drupal Cloud allows Adversary in the Middle (AiTM). This issue affects Cloud... | |
| CVE-2026-96374 json | Cross-Site Request Forgery (CSRF) vulnerability in Drupal Project Browser allows Cross Site Request Forgery. This issue affec... | |
| CVE-2026-96373 json | Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0... | |
| CVE-2026-96372 json | Insufficient Granularity of Access Control vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webfo... | |
| CVE-2026-96371 json | Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions:... | |
| CVE-2026-96370 json | Incorrect Authorization vulnerability in Drupal Webform allows Server Side Request Forgery. This issue affects Webform versio... | |
| CVE-2026-96369 json | Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Webform allows Exploiting Incorrectly Confi... |