CVE.report
CVE.report is the most up-to-date database of common vulnerabilities and exposures. Information is pulled in from several sources and processed in to a mobile friendly, easy to use page. Use the site to quickly check for vulnerabilities in products such as operating systems, applications, hardware, networks, databases, browsers, e-mail clients and more.
CVEs provide a unique and common naming scheme for publicly known cyber security vulnerabilities in order to quickly identify and share these vulnerabilities. You can use the search below to look for vulnerabilities based on product, vendor, or common tags
The form you will see after following this link allows you to fill out the various variables in the CVSS scoring system and receive the corresponding score. The description of each of the variables is also included for additional information.
cve.report now provides a free read-only JSON API for CVE details. Each record combines the CVE Program JSON record, NVD enrichment, KEV, and EPSS when available.
Recent CVEs
| CVE | Description | Updated |
|---|---|---|
| CVE-2026-124318 json | Treeio through 2.0 contains an insecure deserialization vulnerability in UpdateRecord.get_format_strings and ModuleSetting.lo... | |
| CVE-2026-124317 json | libexpat through 2.10.0 contains an out-of-bounds read vulnerability in unknown_toUtf8() and unknown_toUtf16() in xmltok.c wh... | |
| CVE-2026-124316 json | Frappe ERPNext before 15.121.4 and 16.x before 16.36.0 contains a missing authorization vulnerability in the whitelisted erpn... | |
| CVE-2026-124315 json | Frappe ERPNext before 15.121.4 and 16.x before 16.36.0 contains a missing authorization vulnerability in the whitelisted get_... | |
| CVE-2026-124314 json | Frappe ERPNext before 15.121.4 and 16.x before 16.36.0 contains a missing authorization vulnerability in erpnext.crm.utils.ge... | |
| CVE-2026-124313 json | Frappe ERPNext before 15.121.4 and 16.x before 16.36.0 contains a missing authorization vulnerability in the whitelisted get_... | |
| CVE-2026-124312 json | Fraunhofer HHI VVdeC through 3.2.1 contains a heap out-of-bounds read vulnerability that allows attackers to crash the decode... | |
| CVE-2026-124311 json | Fraunhofer HHI VVdeC through 3.2.1 contains a NULL pointer dereference vulnerability in InterPrediction::xPredInterBlk that a... | |
| CVE-2026-124310 json | Fraunhofer HHI VVdeC before 3.2.1 contains an out-of-bounds read vulnerability that allows attackers to crash the decoder by ... | |
| CVE-2026-124309 json | Fraunhofer HHI VVdeC before 3.2.1 contains a heap out-of-bounds read vulnerability in SEIReader::xParseSEIScalableNesting tha... | |
| CVE-2026-124308 json | Fraunhofer HHI VVdeC before 3.2.1 contains a heap use-after-free vulnerability in DecLibRecon::createSubPicRefBufs because de... | |
| CVE-2026-124307 json | Fraunhofer HHI VVdeC before 3.2.1 contains a heap use-after-free vulnerability that allows attackers to corrupt memory by red... | |
| CVE-2026-123989 json | A vulnerability was found in ESEngine DeepSeek-Reasonix up to 1.33.0. Impacted is the function loadGitStatus of the file buil... | |
| CVE-2026-117691 json | A flaw was found in the SAML HTTP-Redirect binding implementation of Keycloak. The issue occurs because the server processes ... | |
| CVE-2026-123988 json | A vulnerability has been found in SililaWijesinghe Food Ordering System up to ba314e897e3365600461e5ea59432e39ceaa0fa5. This ... | |
| CVE-2026-123966 json | A vulnerability was determined in Tenda AC19 16.03.10.07. Affected by this issue is the function saveParentControlInfo of the... | |
| CVE-2026-120984 json | A flaw was found in the Keycloak server's client management component. When a client is created or imported with authorizatio... | |
| CVE-2026-99282 json | In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_teql: fix use-after-free on lower qdisc d... | |
| CVE-2026-99281 json | In the Linux kernel, the following vulnerability has been resolved: tun: Require CAP_NET_ADMIN to attach to an ownerless dev... | |
| CVE-2026-99280 json | In the Linux kernel, the following vulnerability has been resolved: ksmbd: drain session procfs readers before dropping tabl... | |
| CVE-2026-99279 json | In the Linux kernel, the following vulnerability has been resolved: ksmbd: reclaim ended sessions on logoff and expiration ... | |
| CVE-2026-99278 json | In the Linux kernel, the following vulnerability has been resolved: ksmbd: limit sessions on each connection The pending se... | |
| CVE-2026-99277 json | In the Linux kernel, the following vulnerability has been resolved: ksmbd: hold a connection reference for each session chan... | |
| CVE-2026-99276 json | In the Linux kernel, the following vulnerability has been resolved: ksmbd: defer connection scavenging while session locks a... | |
| CVE-2026-99275 json | In the Linux kernel, the following vulnerability has been resolved: smb: client: reject short SESSION_SETUP responses smb2_... | |
| CVE-2026-99274 json | In the Linux kernel, the following vulnerability has been resolved: smb: client: fix fiemap wild read on empty truncated res... | |
| CVE-2026-99273 json | In the Linux kernel, the following vulnerability has been resolved: ksmbd: reserve space for the UTF-16 terminator in stream... | |
| CVE-2026-99272 json | In the Linux kernel, the following vulnerability has been resolved: smb: client: validate the data area in SMB2_read() SMB2... | |
| CVE-2026-99271 json | In the Linux kernel, the following vulnerability has been resolved: ALSA: line6: Clear prev_fbuf on capture buffer release ... | |
| CVE-2024-2905 json | A security vulnerability has been discovered within rpm-ostree, pertaining to the /etc/shadow file in default builds having t... | |
| CVE-2024-2698 json | A vulnerability was found in FreeIPA in how the initial implementation of MS-SFU by MIT Kerberos was missing a condition for ... | |
| CVE-2023-2593 json | A flaw exists within the Linux kernel's handling of new TCP connections. The issue results from the lack of memory release af... | |
| CVE-2023-5236 json | A flaw was found in Infinispan, which does not detect circular object references when unmarshalling. An authenticated attacke... | |
| CVE-2023-5088 json | A bug in QEMU could cause a guest I/O operation otherwise addressed to an arbitrary disk offset to be targeted to offset 0 in... | |
| CVE-2023-4732 json | A flaw was found in pfn_swap_entry_to_page in memory management subsystem in the Linux Kernel. In this flaw, an attacker with... | |
| CVE-2023-4385 json | A NULL pointer dereference flaw was found in dbFree in fs/jfs/jfs_dmap.c in the journaling file system (JFS) in the Linux Ker... | |
| CVE-2023-3773 json | A flaw was found in the Linux kernel’s IP framework for transforming packets (XFRM subsystem). This issue may allow a malic... | |
| CVE-2023-3772 json | A flaw was found in the Linux kernel’s IP framework for transforming packets (XFRM subsystem). This issue may allow a malic... | |
| CVE-2023-3397 json | A race condition occurred between the functions lmLogClose and txEnd in JFS, in the Linux Kernel, executed in different threa... | |
| CVE-2020-27792 json | A heap-based buffer overwrite vulnerability was found in GhostScript's lp8000_print_page() function in the gdevlp8k.c file. T... | |
| CVE-2026-123964 json | A vulnerability was detected in OpenBMB Internet of Agents up to 9d78e88e47160eb42ee1ee8538c05e1c2c47877a. This affects the f... | |
| CVE-2026-123963 json | A security vulnerability has been detected in OpenBMB Internet of Agents up to 9d78e88e47160eb42ee1ee8538c05e1c2c47877a. The ... | |
| CVE-2026-123861 json | Authorization Bypass Through User-Controlled Key vulnerability in CrocoBlock JetFormBuilder – Hierarchical Select jet-form-... | |
| CVE-2026-123860 json | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Crocoblock JetFormBuilder jetf... | |
| CVE-2026-123483 json | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Crocoblock JetFormBuilder jetf... | |
| CVE-2026-123477 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine je... | |
| CVE-2026-123474 json | Missing Authorization vulnerability in LeapWorx Premium Blocks – Gutenberg Blocks for WordPress premium-blocks-for-gutenber... | |
| CVE-2026-123467 json | Missing Authorization vulnerability in StylemixThemes Motors motors-car-dealership-classified-listings allows Exploiting Inco... | |
| CVE-2026-123462 json | Missing Authorization vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control Security ... | |
| CVE-2026-123183 json | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in PluginUs.Net Active Products T... | |
| CVE-2026-122669 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Everest Forms Everest F... | |
| CVE-2026-122663 json | Missing Authorization vulnerability in VillaTheme CURCY woo-multi-currency allows Exploiting Incorrectly Configured Access Co... | |
| CVE-2026-122660 json | Missing Authorization vulnerability in BAKKBONE Australia FloristPress bakkbone-florist-companion allows Exploiting Incorrect... | |
| CVE-2026-122659 json | Missing Authorization vulnerability in WP ManageNinja LLC Fluent Booking fluent-booking allows Exploiting Incorrectly Configu... | |
| CVE-2026-122041 json | The Checkout Field Editor for WooCommerce (Pro) plugin for WordPress is vulnerable to unauthorized deletion of arbitrary atta... | |
| CVE-2026-121784 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Magepeople inc. WpBooki... | |
| CVE-2026-121777 json | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Cool Plugins Cool Formkit Lite... | |
| CVE-2026-121775 json | Missing Authorization vulnerability in VillaTheme CURCY woo-multi-currency allows Exploiting Incorrectly Configured Access Co... | |
| CVE-2026-121579 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unlimited Elements Unli... | |
| CVE-2026-121575 json | Missing Authorization vulnerability in WP User Manager WP User Manager wp-user-manager allows Exploiting Incorrectly Configur... | |
| CVE-2026-120841 json | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mage... | |
| CVE-2026-120839 json | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mage... | |
| CVE-2026-120579 json | The Active Woot Products Tables for WooCommerce. 100% FREE plugin for WordPress is vulnerable to Stored Cross-Site Scripting ... | |
| CVE-2026-119156 json | The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpdm_reg[first_name], wpdm_re... | |
| CVE-2026-109973 json | The Image Hover Effects Ultimate Visual Composer (Flipbox - Awesomes Flip Boxes Image Overlay) plugin for WordPress is vulner... | |
| CVE-2026-96565 json | The WP-Members Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via WooCommerce Checkout M... | |
| CVE-2026-93766 json | The Happyforms Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'happyforms_client_referer' para... | |
| CVE-2026-123776 json | RRD::CGI::Image versions through 0.01 for Perl pass CGI query parameters containting "tz" to tzset(), , so a FIFO or device p... | |
| CVE-2026-123418 json | The Church Admin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'lat' parameter in all versions up... | |
| CVE-2026-122231 json | The WS Form LITE – Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via t... | |
| CVE-2026-122059 json | The WP ImageViewer plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'img.alt' parameter in... | |
| CVE-2026-121977 json | The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ... | |
| CVE-2026-121976 json | The Modula plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'items' parameter in versions up to, and... | |
| CVE-2026-121765 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cozmoslabs TranslatePre... | |
| CVE-2026-121265 json | SQL::Abstract versions before 2.000003 for Perl allow SQL injection via an arrayref column value in insert and update. With ... | |
| CVE-2026-120685 json | The Real Testimonials – Testimonial Slider, Collect Customer Reviews and Video Testimonials plugin for WordPress is vulnera... | |
| CVE-2026-120683 json | The Real Testimonials – Testimonial Slider, Collect Customer Reviews and Video Testimonials plugin for WordPress is vulnera... | |
| CVE-2026-120509 json | The Real Testimonials – Testimonial Slider, Collect Customer Reviews and Video Testimonials plugin for WordPress is vulnera... | |
| CVE-2026-119498 json | Authentication Bypass Using an Alternate Path or Channel vulnerability in RelyWP Simple Cloudflare Turnstile simple-cloudflar... | |
| CVE-2026-119183 json | The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ... | |
| CVE-2026-119075 json | The Registration Form for WooCommerce plugin for WordPress is vulnerable to privilege escalation due to a missing allow-list ... | |
| CVE-2026-118267 json | The WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps plugin for WordPress is vulnerable to Incorre... | |
| CVE-2026-118066 json | The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Auth... | |
| CVE-2026-118056 json | The Image Hover Effects Ultimate ( Image Gallery, Effects, Lightbox, Comparison & Magnifier ) plugin for WordPress is vulnera... | |
| CVE-2026-118050 json | The Football Pool plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'shouttext' parameter in all vers... | |
| CVE-2026-118047 json | The Falang multilanguage for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'falang_term... | |
| CVE-2026-116751 json | The Booking for Appointments and Events Calendar – Amelia Pro plugin for WordPress is vulnerable to time-based SQL Injectio... | |
| CVE-2026-116537 json | The Link Library plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'link_description' parameter in al... | |
| CVE-2026-93755 json | The Happyforms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via spoofable client IP headers in versions ... | |
| CVE-2026-93429 json | The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'guests[][][d... | |
| CVE-2026-115548 json | The Quttera ThreatSign – Web Malware Scanner for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scriptin... | |
| CVE-2026-111370 json | The WP Visitor Statistics (Real Time Traffic) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'os (... | |
| CVE-2026-111317 json | The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ... | |
| CVE-2026-109991 json | The FunnelKit Payment Gateway for Stripe WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference i... | |
| CVE-2026-109230 json | The WP Visitor Statistics (Real Time Traffic) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'brow... | |
| CVE-2026-109214 json | The User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Su... | |
| CVE-2026-104768 json | The AutomatorWP – No-Code Workflow Automation, Integration & Webhooks Plugin, now with AI plugin for WordPress is vulnerabl... | |
| CVE-2026-104760 json | The weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot plugin for WordPress is vulnerable to Stored Cr... | |
| CVE-2026-104746 json | The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to arbitrary file deletion due ... | |
| CVE-2026-104014 json | The Naimur Email OTP Verification for WooCommerce plugin for WordPress is vulnerable to authentication bypass in versions up ... |