CVE.report
CVE.report is the most up-to-date database of common vulnerabilities and exposures. Information is pulled in from several sources and processed in to a mobile friendly, easy to use page. Use the site to quickly check for vulnerabilities in products such as operating systems, applications, hardware, networks, databases, browsers, e-mail clients and more.
CVEs provide a unique and common naming scheme for publicly known cyber security vulnerabilities in order to quickly identify and share these vulnerabilities. You can use the search below to look for vulnerabilities based on product, vendor, or common tags
The form you will see after following this link allows you to fill out the various variables in the CVSS scoring system and receive the corresponding score. The description of each of the variables is also included for additional information.
cve.report now provides a free read-only JSON API for CVE details. Each record combines the CVE Program JSON record, NVD enrichment, KEV, and EPSS when available.
Recent CVEs
| CVE | Description | Updated |
|---|---|---|
| CVE-2026-19421 json | Zohocorp ManageEngine DDI Central versions below 6301 is affected by a PowerShell injection vulnerability due to insuffi... | |
| CVE-2026-2982 json | The WP Table Builder – Drag & Drop Table Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ... | |
| CVE-2026-127046 json | The MISP Modules website component contains an information disclosure vulnerability in the external tools management interfac... | |
| CVE-2026-127036 json | Improper neutralization of CRLF sequences ('CRLF injection') vulnerability in ibi WebFOCUS. This issue affects WebFOCUS: 9.1... | |
| CVE-2026-124817 json | The Clockinator Lite WordPress plugin before 1.1.0 does not check authorisation or ownership when updating leave requests, al... | |
| CVE-2026-124815 json | The Clockinator Lite WordPress plugin before 1.1.0 does not restrict access to several of its record deletion actions, and us... | |
| CVE-2026-124814 json | The Ultimate Addons for Elementor Forms WordPress plugin before 1.0.8 does not properly validate the extension of uploaded fi... | |
| CVE-2026-124705 json | In Progress® Telerik® UI for .NET MAUI prior to version 16.0.0, an untrusted URL redirection vulnerability in the RadRichTe... | |
| CVE-2026-124665 json | The Order Tracking WordPress plugin before 3.6.2 does not verify that a visitor owns the customer or sales representative ac... | |
| CVE-2026-124653 json | The Mine CloudVod WordPress plugin before 2.6.6 does not restrict who can request cloud storage upload credentials from sever... | |
| CVE-2026-124652 json | The Mine CloudVod WordPress plugin before 2.6.6 does not verify that an order belongs to the requesting user before returning... | |
| CVE-2026-124648 json | The TI WooCommerce Wishlist WordPress plugin before 2.13.0 does not verify that a visitor who is not logged in owns a registe... | |
| CVE-2026-124647 json | The TI WooCommerce Wishlist WordPress plugin before 2.0.7 does not sanitise and escape user input before using it in a SQL st... | |
| CVE-2026-124023 json | Out-of-bounds Read vulnerability in the Guththila XML parser wrapper of Apache Axis2/C. On some malformed XML input the Gutht... | |
| CVE-2026-123092 json | The WP Remote Users Sync WordPress plugin before 2.3.0 does not restrict which user metadata keys may be written through its ... | |
| CVE-2026-123044 json | The ContentPen WordPress plugin before 1.1.1 discloses its REST API key to unauthenticated users, who can then use it to crea... | |
| CVE-2026-122003 json | The Abilities Bridge WordPress plugin before 1.4.2 does not require a valid nonce before re-authenticating a REST API request... | |
| CVE-2026-121498 json | The AskAny WordPress plugin before 2.2.1 does not verify that a chat session belongs to the requester before returning or ch... | |
| CVE-2026-119040 json | The Defender Security WordPress plugin before 6.4.1 does not limit the number of failed two-factor authentication attempts i... | |
| CVE-2026-119039 json | The Defender Security WordPress plugin before 6.4.1 does not verify that the client IP address it derives for its firewall a... | |
| CVE-2026-114369 json | Resource exhaustion vulnerability in the Qt Framework QWebSocket and QWebSocketServer classes of the Qt WebSockets module | |
| CVE-2026-76792 json | The User Verification by PickPlugins WordPress plugin before 2.0.49 does not rate limit the verification step of its one-time... | |
| CVE-2026-16135 json | The VibeBP plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.9.9.8.1. This i... | |
| CVE-2026-15309 json | The CourseCure Courses plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 1.5.1. Th... | |
| CVE-2026-13764 json | The Masterstudy - Education WordPress Theme theme for WordPress is vulnerable to Privilege Escalation in all versions up to, ... | |
| CVE-2026-124058 json | A weakness has been identified in TOTOLINK CA300-PoE 6.2c.884. Affected is the function setWiFiRepeaterConfig of the file /cg... | |
| CVE-2026-118531 json | The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11.1 does not prevent a l... | |
| CVE-2026-118494 json | Joomla Extension - jreviews.com - Secret configs cached in a web-accessible in JReviews 1.0.0-5.12.0, 6.0.0-6.6.9 - JReviews ... | |
| CVE-2026-118421 json | The WP Directory Kit WordPress plugin before 1.6.3 does not properly sanitise and escape a parameter used to order results on... | |
| CVE-2026-110959 json | The Descope WordPress plugin before 1.2.0 does not validate the authentication token it receives before creating a WordPress ... | |
| CVE-2026-110072 json | The Photo Gallery by 10Web WordPress plugin before 1.8.49 does not escape a shortcode attribute that sets a gallery watermar... | |
| CVE-2026-110041 json | The Crop Thumbnails WordPress plugin before 1.10.0 does not perform object-level authorization when reading and re-cropping m... | |
| CVE-2026-106027 json | The Oxygen MyData for WooCommerce WordPress plugin before 3.0.9 does not have proper authorisation, nor validate the authenti... | |
| CVE-2026-91151 json | A flaw was found in Cockpit. A local authenticated user with control over a target account's home directory can exploit a pri... | |
| CVE-2026-91150 json | A flaw was found in Cockpit. This vulnerability allows a remote attacker, without prior authentication, to send specially cra... | |
| CVE-2026-84838 json | A flaw was found in rpmuncompress. This command injection vulnerability allows a local attacker to execute arbitrary commands... | |
| CVE-2026-84837 json | A flaw was found in rpm. An attacker can exploit a command injection vulnerability by influencing the path or filename of a t... | |
| CVE-2026-84233 json | A flaw was found in rpm. A local attacker could supply a specially crafted `.gem` filename containing RPM macro syntax. When ... | |
| CVE-2026-78367 json | A vulnerability was found in RPM's rpmbuild tarball processing. When processing a crafted source archive, the getTarSpec() fu... | |
| CVE-2026-59599 json | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | |
| CVE-2026-13732 json | A flaw was found in GDB's STABS debug format parser. The read_member_functions() function in gdb/stabsread.c contains a linke... | |
| CVE-2025-66365 json | Incorrect handling of SIP packets leads to baseband crashes | |
| CVE-2022-4329 json | The Product list Widget for Woocommerce WordPress plugin before 3.4.0 does not sanitise and escape a parameter before outputt... | |
| CVE-2026-116606 json | An authentication bypass in Barracuda Email Security Gateway versions earlier than 9.4.0.030 allows an unauthenticated remote... | |
| CVE-2026-126644 json | A link-following flaw was found in the authorized_key module of the ansible.posix collection, residual to the fix for CVE-202... | |
| CVE-2026-126643 json | A cleartext storage flaw was found in the AAP Gateway Operator. When reconciling an AutomationController, the operator reads ... | |
| CVE-2026-126641 json | A host key verification flaw was found in ansible-pylibssh and in the ansible.netcommon libssh connection plugin. When trust-... | |
| CVE-2026-126229 json | A authorization bypass through user-controlled key vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer... | |
| CVE-2026-124704 json | In Telerik UI for WPF, versions prior to 2026.4.1110, a deserialization of untrusted data vulnerability exists that allows an... | |
| CVE-2026-124703 json | In Telerik UI for WPF, versions prior to 2026.4.1110, an improper control of code generation vulnerability exists that allows... | |
| CVE-2026-124701 json | In Telerik UI for WinForms, versions prior to 2026.4.1111, a deserialization of untrusted data vulnerability exists that allo... | |
| CVE-2026-123765 json | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS. xssAP... | |
| CVE-2026-83542 json | Improper Control of Generation of Code ('Code Injection') in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a rem... | |
| CVE-2026-68524 json | An unauthenticated attacker can exploit temporary-file handling, access an open file descriptor, and inject a "file:" URI to ... | |
| CVE-2026-55655 json | A flaw was found in OpenSSH. A local unprivileged attacker on a Linux client host can hijack client-side X11 forwarding conne... | |
| CVE-2026-55653 json | A flaw was found in OpenSSH. A malicious SSH server can exploit a double free vulnerability in the Diffie-Hellman Group Excha... | |
| CVE-2026-13595 json | A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and Uni... | |
| CVE-2026-127016 json | The MISP Modules website component exposes external tool management endpoints (add, delete, change status, and change configu... | |
| CVE-2026-124699 json | In Telerik UI for WinForms, versions prior to 2026.4.1111, an improper control of code generation vulnerability exists that a... | |
| CVE-2026-124617 json | Rejected reason: 歸類為 JSONCPP Open Source 之問題 | |
| CVE-2026-119618 json | Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server's mod_http2 in a... | |
| CVE-2026-118975 json | In Progress® Telerik® Reporting prior to version 20.3.26.1110, improper restriction of XML external entity references in th... | |
| CVE-2026-117476 json | Rejected reason: none | |
| CVE-2026-117475 json | Rejected reason: none | |
| CVE-2026-117474 json | Rejected reason: none | |
| CVE-2026-111436 json | Missing release of memory after effective lifetime vulnerability in openEuler iSulad on Linux. This vulnerability is associa... | |
| CVE-2026-111435 json | Relative path traversal vulnerability in openEuler iSulad on Linux. This vulnerability is associated with program file src/d... | |
| CVE-2026-111434 json | Use of Externally-Controlled format string vulnerability in openEuler iSulad on Linux. This vulnerability is associated with... | |
| CVE-2026-111433 json | UNIX symbolic link (symlink) following vulnerability in openEuler iSulad on Linux. This vulnerability is associated with pro... | |
| CVE-2026-106140 json | In Progress® Telerik® Reporting prior to version 20.3.26.1110, a deserialization of untrusted data vulnerability in the .NE... | |
| CVE-2026-76173 json | Blind SQL injection vulnerability in the public endpoint `public/webhook/receiver.php` of the WhatsApp module for Dolibarr 1.... | |
| CVE-2026-54825 json | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TMS wpDataTables wpdata... | |
| CVE-2026-126642 json | An incorrect authorization flaw was found in AWX, the automation controller component of Red Hat Ansible Automation Platform.... | |
| CVE-2026-110003 json | A vulnerability in the administration REST interface of Azul Payara allows a remote, unauthenticated attacker to bypass secur... | |
| CVE-2026-90908 json | A vulnerability in the GenericAdminAuthenticator component of Azul Payara Server and Azul Payara Micro allows a remote, unaut... | |
| CVE-2026-126991 json | The Wikidata Lookup expansion module (wiki.py) in MISP misp-modules contained a SPARQL injection vulnerability. The handler f... | |
| CVE-2026-125836 json | Cross-Site Request Forgery (CSRF) vulnerability in Nicu Micle Simple JWT Login simple-jwt-login allows Cross Site Request For... | |
| CVE-2026-123133 json | Rejected reason: This CVE ID is a duplicate of CVE-2026-116518 and was never published. Both IDs were assigned to the same vu... | |
| CVE-2026-118855 json | Akaunting 3.3.0 contains a stored cross-site scripting vulnerability through invoice import. An authenticated user with invoi... | |
| CVE-2026-82292 json | A NULL pointer dereference vulnerability in the Qt Framework QDomDocument::setContent() XML parsing path of the Qt XML module... | |
| CVE-2026-47832 json | The vulnerability lies in the way application credentials are handled within the BOSH deployment. bosh-openstack-cpi-release:... | |
| CVE-2026-40820 json | A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getVpnData function due t... | |
| CVE-2026-87772 json | Incorrect Authorization vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute Pardus About allows Privi... | |
| CVE-2026-12591 json | Zohocorp ManageEngine M365 Manager Plus versions below 4818 is affected by an authenticated technician may exploit insuf... | |
| CVE-2026-12507 json | Zohocorp ManageEngine AssetExplorer versions below 7860, ServiceDesk Plus versions below 15290, ServiceDesk Plus MSP versions... | |
| CVE-2026-8333 json | A stored cross-site scripting vulnerability in Microchip the TimePictra platform could allow an authenticated, low-privileged... | |
| CVE-2026-8332 json | A hard-coded root password in Microchip TimePictra platform installation files could allow an attacker with access to those f... | |
| CVE-2026-8331 json | An unrestricted upload of files with dangerous type vulnerability in the Microchip TimePictra platform allows functionality n... | |
| CVE-2026-113408 json | Path traversal in Git allows writing to arbitrary file via cloning and committing to bad repository | |
| CVE-2026-96834 json | Missing Authorization vulnerability in Liquid Web / StellarWP GiveWP give allows Retrieve Embedded Sensitive Data.This issue ... | |
| CVE-2025-47541 json | Insertion of Sensitive Information Into Sent Data vulnerability in WPFunnels Team Mail Mint mail-mint allows Retrieve Embedde... | |
| CVE-2025-2399 json | Improper Validation of Specified Index, Position, or Offset in Input vulnerability in Mitsubishi Electric CNC M800V Series M8... | |
| CVE-2026-118597 json | Akaunting 3.3.0 contains a stored cross-site scripting vulnerability in custom invoice payment terms. An authenticated Manage... | |
| CVE-2026-126673 json | Data::Dump::Streamer versions before 3.00 for Perl allow code injection via unescaped Regexp patterns in _dump_qr. A Regexp'... | |
| CVE-2026-125712 json | A flaw was found in GStreamer's gst-plugins-base RTCP SDES packet parser. A remote sender able to reach an active media sessi... | |
| CVE-2026-125704 json | A use-after-free flaw was found in GStreamer core buffer value deserialization. When serialized buffer text contains an inval... | |
| CVE-2026-121629 json | A flaw was found in GStreamer's adaptive streaming demuxers (HLS, DASH, MSS). When processing a media playlist or manifest, U... | |
| CVE-2026-119528 json | A flaw was found in GIMP. The PSD plug-in’s image resource header loader uses an incorrect destination size when copying a ... | |
| CVE-2026-117477 json | KUSANAGI provided by GMO Prime Strategy Co., Ltd. contains an HTTP header injection vulnerability that may allow arbitrary HT... | |
| CVE-2026-115207 json | A flaw was found in GNU patch. An attacker can achieve arbitrary file creation outside the intended working directory by enti... |