CVE.report
CVE.report is the most up-to-date database of common vulnerabilities and exposures. Information is pulled in from several sources and processed in to a mobile friendly, easy to use page. Use the site to quickly check for vulnerabilities in products such as operating systems, applications, hardware, networks, databases, browsers, e-mail clients and more.
CVEs provide a unique and common naming scheme for publicly known cyber security vulnerabilities in order to quickly identify and share these vulnerabilities. You can use the search below to look for vulnerabilities based on product, vendor, or common tags
The form you will see after following this link allows you to fill out the various variables in the CVSS scoring system and receive the corresponding score. The description of each of the variables is also included for additional information.
cve.report now provides a free read-only JSON API for CVE details. Each record combines the CVE Program JSON record, NVD enrichment, KEV, and EPSS when available.
Recent CVEs
| CVE | Description | Updated |
|---|---|---|
| CVE-2026-121803 json | In UFS Field Firmware Update (FFU) functionality, there is a possible out-of-bounds write due to missing bounds checking on t... | |
| CVE-2026-95209 json | An issue in gnutls v3.8.13 causes legitimate CA certificates to be rejected, leading to a Denial of Service (DoS). NOTE: this... | |
| CVE-2026-88648 json | In GnuTLS v3.8.13, an excluded msUPN/SRV otherName is never checked. NOTE: the Supplier does not consider this an actionable ... | |
| CVE-2026-80335 json | In the bootloader download module, there is a possible out-of-bounds write due to a failure to reset a global offset variable... | |
| CVE-2026-79405 json | In Modem Firmware, there is a possible system crash due to improper input validation of dedicated PUCCH configuration. This c... | |
| CVE-2026-95184 json | GnuTLS v3.8.13 does not properly enforce name constraints, as demonstrated by a permitted subtree violation for "EE O=Evil ac... | |
| CVE-2026-88647 json | GnuTLS v3.8.13 can perhaps unexpectedly trust a certificate on the basis of Common Name when Subject Alternative Name has an ... | |
| CVE-2026-67693 json | An issue in gnutls v.3.8.13 allows an attacker to obtain sensitive information via failing to reject end-entity X.509 certifi... | |
| CVE-2026-49293 json | js-toml is a TOML parser for JavaScript, fully compliant with the TOML 1.0.0 Spec. Versions up to and including 1.1.1 parse h... | |
| CVE-2026-44009 json | vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.2, VM2 suffers from a sandbox breakout vulnerability. This allows... | |
| CVE-2026-44008 json | vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.2, the new method neutralizeArraySpeciesBatch works with objects ... | |
| CVE-2026-44007 json | vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.1, when a NodeVM is created with nesting: true, sandbox code can ... | |
| CVE-2026-39892 json | cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 45.0.0 to before... | |
| CVE-2026-121802 json | @better-auth/expo before 1.7.16 allows certain account-takeover outcomes (e.g., unauthenticated changes of any account's emai... | |
| CVE-2026-121618 json | A weakness has been identified in Linksys E5600 1.1.0.26. This affects an unknown part of the file /cgi-bin/fqc.cgi of the co... | |
| CVE-2026-121617 json | A security flaw has been discovered in Linksys E5600 1.1.0.26. Affected by this issue is the function init_multipart of the f... | |
| CVE-2026-121616 json | A vulnerability was identified in Linksys E5600 1.1.0.26. Affected by this vulnerability is the function strcpy of the file /... | |
| CVE-2026-121615 json | A vulnerability was determined in Linksys E5600 1.1.0.26. Affected is an unknown function of the file /cgi-bin/mesh_login.cgi... | |
| CVE-2026-119415 json | CakePHP through 5.4.3 contains a header injection vulnerability in FormDataPart that allows attackers to inject MIME part hea... | |
| CVE-2026-121610 json | A security flaw has been discovered in funadmin 7.1.0. Impacted is the function Curd::selectList of the file /frontend/ajax/i... | |
| CVE-2026-121609 json | A vulnerability was identified in Qihoo 360 Whole Home Router M5 4.0.17.1566. This issue affects the function Home of the fil... | |
| CVE-2026-121608 json | A vulnerability was determined in Qihoo 360 D603-2, D600-2 and D606-6 up to 6.3.2. This vulnerability affects the function on... | |
| CVE-2026-121607 json | A vulnerability was found in Qihoo 360 D603-2, D600-2, D606-6 and D706 up to 6.4.9. This affects the function testspeed_comma... | |
| CVE-2026-119407 json | Element Web and Element Desktop before 1.12.32 accept guest credentials from URL fragment parameters in loadSession, allowing... | |
| CVE-2026-119376 json | SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITE_LIMIT_EXPR_DEPTH li... | |
| CVE-2026-119372 json | SQLite before 3.54.0 built with FTS3/FTS4 and SQLITE_ENABLE_FTS3_PARENTHESIS contains a use-after-free vulnerability in fts3B... | |
| CVE-2026-119146 json | ProFTPD before 1.3.9e and 1.3.10rc5 contains a buffer overflow vulnerability in the mod_rewrite int:utf8trans RewriteMap that... | |
| CVE-2026-118947 json | A flaw was found in the UMA resource registration endpoint of the keycloak-services component, which provides the core logic ... | |
| CVE-2026-117346 json | Bitcoin Core through 31.1 is vulnerable to Denial of Service via undo files having no size limit | |
| CVE-2026-115455 json | A flaw was found in GCC libstdc++. When an application extracts data into a bitset from a wide-character stream, internal sta... | |
| CVE-2026-112116 json | An exposed IOCTL with insufficient access control in ASUS System Control Interface allows a local, low-privileged user to rea... | |
| CVE-2026-110464 json | Missing authorization in ASUS Armoury Crate allows a local attacker to write content into a specific file or registry locatio... | |
| CVE-2026-84730 json | Stack-based buffer overflow in certain ASUS Router firmware allows an unauthenticated nearby attacker to execute arbitrary co... | |
| CVE-2026-84729 json | Out-of-bounds write in certain ASUS Router firmware allow an unauthenticated nearby attacker to write data beyond the intende... | |
| CVE-2026-61673 json | WeGIA is a web manager for charitable institutions. Prior to 3.8.7, a stored DOM cross-site scripting vulnerability in `web/h... | |
| CVE-2026-45049 json | Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the `Cross-Domain Single Sign-On` (`CDSSO`... | |
| CVE-2026-119285 json | Fiber is an Express inspired web framework written in Go. From 2.52.1 until 2.52.3, the CORS middleware's validateDomain wild... | |
| CVE-2026-119281 json | MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7,... | |
| CVE-2026-119277 json | MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7,... | |
| CVE-2026-119208 json | pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can consume excessive time and memory when an... | |
| CVE-2026-119204 json | pypdf is a free and open-source pure-python PDF library. Prior to 6.21.4, pypdf can consume excessive memory while parsing a ... | |
| CVE-2026-119200 json | Nuxt is an open-source web development framework for Vue.js. From 4.6.0 until 4.6.3, Nuxt resolves literal or percent-encoded... | |
| CVE-2026-119196 json | pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, constructed BIT STRING decoding repeatedly shifts and copies th... | |
| CVE-2026-119191 json | Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affe... | |
| CVE-2026-119187 json | Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affe... | |
| CVE-2026-119143 json | Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability that allows guest code to t... | |
| CVE-2026-119139 json | Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a leftover assertion in component::Func::call that rejects gu... | |
| CVE-2026-119135 json | Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 panics when the host reads a component model stream as a different Rus... | |
| CVE-2026-119131 json | Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability in wasmtime-wasi-http that ... | |
| CVE-2026-119127 json | ZITADEL 4.0.0 before 4.19.5 contains a host header injection vulnerability in the Login V2 UI that allows unauthenticated att... | |
| CVE-2026-118780 json | Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affe... | |
| CVE-2026-118776 json | Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affe... | |
| CVE-2026-118772 json | joi is a schema description language and data validator for JavaScript. From 17.1.1 until 17.13.9 and 18.3.1, the Joi.string(... | |
| CVE-2026-118766 json | Botan is a C++ cryptography library. Prior to 3.13.0, Botan's online OCSP client allowed a single HTTP redirect while posting... | |
| CVE-2026-118762 json | Monkeytype is a minimalistic and customizable typing test. Prior to 26.43.0, the .github/workflows/fix-formatting.yml workflo... | |
| CVE-2026-62374 json | SD JWT JS is a JavaScript implementation of the Selective Disclosure JWT (SD-JWT) specification. In version 0.19.0 and earlie... | |
| CVE-2026-119123 json | ImageMagick before 7.1.2-34 contains a stack overflow vulnerability in the TIFF decoder that occurs when the DNG decoder is d... | |
| CVE-2026-119119 json | Crawl4AI before 0.9.5 contains a denial of service vulnerability in the Docker API server where _clamp_untrusted() fails to c... | |
| CVE-2026-119054 json | Multiple Pages Generator by Themeisle before 4.2.5 contains a stored cross-site scripting vulnerability that allows Contribut... | |
| CVE-2026-110245 json | IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote attacker to obtain sensitive information due to improper authentic... | |
| CVE-2026-110192 json | IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote authenticated attacker to obtain sensitive information due to insu... | |
| CVE-2026-104331 json | IBM Langflow OSS 1.0.0 through 1.12.3 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated at... | |
| CVE-2026-104315 json | IBM Langflow OSS 1.0.0 through 1.12.3 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated at... | |
| CVE-2026-104308 json | IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to cause a denial of service due to imprope... | |
| CVE-2026-93009 json | A flaw was found in dnsmasq. The DHCPv6 client hostname parser can read one byte past the end of a crafted FQDN option becaus... | |
| CVE-2026-91440 json | Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versio... | |
| CVE-2026-91439 json | Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versio... | |
| CVE-2026-91437 json | Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versio... | |
| CVE-2026-91438 json | Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versio... | |
| CVE-2026-121606 json | A vulnerability has been found in Qihoo 360 D621-2, D603-2, D600-2, D619, D606-6 and D706 up to 6.4.9. Affected by this issue... | |
| CVE-2026-121600 json | A flaw has been found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected by this vulnerability is the function setMacFilterR... | |
| CVE-2026-121599 json | A vulnerability was detected in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected is the function setWiFiMultipleConfig/delWiF... | |
| CVE-2026-121598 json | A security vulnerability has been detected in TOTOLINK A950RG 4.1.2cu.5268_B20221104. This impacts the function strcpy of the... | |
| CVE-2026-119050 json | Agno through 3.1.11 contains an unsafe reflection vulnerability in PandasTools that allows attackers to invoke arbitrary pand... | |
| CVE-2026-118590 json | A security vulnerability has been detected in nipy nibabel up to 5.4.2. The affected element is the function array_from_file ... | |
| CVE-2026-117548 json | A NULL pointer dereference flaw was found in 389-ds-base. This flaw occurs when a ModifyDN (rename) operation uses an attribu... | |
| CVE-2026-116876 json | Semantic MediaWiki from 2.5.0 before 7.3.1 contains an improper authorization vulnerability that allows ordinary editors to p... | |
| CVE-2026-116873 json | Semantic MediaWiki from 7.3.0 before 7.3.1 contains a missing authorization vulnerability in the smwtask API module that allo... | |
| CVE-2026-116872 json | Semantic MediaWiki from 3.0.0 before 7.3.1 contains an algorithmic complexity vulnerability in TermParser::normalize_compact_... | |
| CVE-2026-107056 json | Insecure permissions in the io.file.importer.ImportActivity component of OpenTracks versionCode 6751 allows unauthorized atta... | |
| CVE-2026-107050 json | An issue in libretro RetroArch v1.22.2 allows attackers to force another user into loading attacker-supplied code in their ui... | |
| CVE-2026-107045 json | Insecure permissions in the CitrineContentProvider component of Citrine v3.1.0 (versionCode 62) allows unauthorized attackers... | |
| CVE-2026-107040 json | Insecure permissions in MBasov OMN-Go versionCode 26080824 allows unauthorized attackers to invoke an exported component, lea... | |
| CVE-2026-51912 json | OpenBMB XAgent v1.0.0 contains directory traversal vulnerability in main-upload_file-the-preserved-live-upload-file-witness-d... | |
| CVE-2026-51851 json | modelscope agent-zero 1.7, 1.8, 1.9, and 1.10 is vulnerable to Directory Traversal in python/helpers/file_browser.py:FileBrow... | |
| CVE-2026-49142 json | OpenEMR before 8.5.0 contains an authenticated SQL injection vulnerability in the Syndromic Surveillance module that allows u... | |
| CVE-2026-112679 json | A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS ... | |
| CVE-2024-53691 json | A link following vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerab... | |
| CVE-2024-9264 json | The SQL Expressions experimental feature of Grafana allows for the evaluation of `duckdb` queries containing user input. Thes... | |
| CVE-2026-116877 json | Semantic MediaWiki from 2.5.0 before 7.3.1 contains an uncontrolled resource consumption vulnerability that allows low-privil... | |
| CVE-2026-92211 json | Pixar Animation Studio OpenUSD Crate File Parsing Double Free Remote Code Execution Vulnerability. This vulnerability allows ... | |
| CVE-2026-92200 json | Quest Foglight for Databases Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability all... | |
| CVE-2026-92199 json | Quest Foglight for Databases EncryptionUtil Hardcoded Encyption Key Local Privilege Escalation Vulnerability. This vulnerabil... | |
| CVE-2026-92198 json | Quest Foglight for Databases getSource XML External Entity Processing Information Disclosure Vulnerability. This vulnerabilit... | |
| CVE-2026-92197 json | Quest Foglight for Databases unzipFile Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows rem... | |
| CVE-2026-121597 json | A weakness has been identified in TOTOLINK A950RG 4.1.2cu.5268_B20221104. This affects the function setAppEasyWizardConfig of... | |
| CVE-2026-121589 json | A weakness has been identified in spatie url-signer up to 2.1.3. Affected is the function AbstractUrlSigner::validate of the ... | |
| CVE-2026-121585 json | A security flaw has been discovered in InfiniFlow RAGFlow up to 0.27.2/1.0.0-rc2. This impacts the function RunSQL of the fil... | |
| CVE-2026-121583 json | A vulnerability was identified in Sanluan PublicCMS 5. This affects the function TradePaymentService.pendingRefund of the fil... | |
| CVE-2026-120651 json | CGI versions before 5.00 for Perl allow an infinite loop on a short request body when $DISABLE_UPLOADS is set. When $CGI::PU... |