CVE.report
CVE.report is the most up-to-date database of common vulnerabilities and exposures. Information is pulled in from several sources and processed in to a mobile friendly, easy to use page. Use the site to quickly check for vulnerabilities in products such as operating systems, applications, hardware, networks, databases, browsers, e-mail clients and more.
CVEs provide a unique and common naming scheme for publicly known cyber security vulnerabilities in order to quickly identify and share these vulnerabilities. You can use the search below to look for vulnerabilities based on product, vendor, or common tags
The form you will see after following this link allows you to fill out the various variables in the CVSS scoring system and receive the corresponding score. The description of each of the variables is also included for additional information.
cve.report now provides a free read-only JSON API for CVE details. Each record combines the CVE Program JSON record, NVD enrichment, KEV, and EPSS when available.
Recent CVEs
| CVE | Description | Updated |
|---|---|---|
| CVE-2026-126261 json | A improper authorization vulnerability in Fortinet FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 t... | |
| CVE-2026-126187 json | React is a JavaScript library for building user interfaces. From 19.0.0 until 19.0.9, 19.1.10, 19.2.9, and 19.3.1, the react-... | |
| CVE-2026-125707 json | A flaw was found in GStreamer's MXF demuxer. When an application processes a crafted MXF file, an off-by-one bounds check can... | |
| CVE-2026-125706 json | A flaw was found in GStreamer's gst-plugins-bad MPEG Program Stream demuxer and resindvd DVD-playback plugin. The PES header ... | |
| CVE-2026-125703 json | A flaw was found in the GStreamer gst-plugins-bad MXF plugin. Insufficient bounds checks when parsing crafted VANC data can c... | |
| CVE-2026-125040 json | A flaw was found in the SRT and WebVTT subtitle parser in GStreamer's gst-plugins-base. While sanitizing inline subtitle mark... | |
| CVE-2026-123084 json | An **expression language injection** has been found in the HeaderContentGuard.permit function in publication.py of the conten... | |
| CVE-2026-20183 json | A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, r... | |
| CVE-2026-0480 json | Missing Authentication for Critical Function in AMD Secure Encrypted Virtualization (SEV) firmware could allow a malicious hy... | |
| CVE-2026-0454 json | An out-of-bounds write in the AMD Secure Encrypted Virtualization (SEV) firmware could allow a malicious hypervisor to corrup... | |
| CVE-2026-0435 json | Operation on a resource after expiration or release in the AMD Secure Encrypted Virtualization (SEV) firmware could allow an ... | |
| CVE-2026-0003 json | Use of a per-part static key in the ASP Bootloader could allow an attacker to downgrade the Secure Encrypted Virtualization (... | |
| CVE-2025-48504 json | Operation on a resource after expiration or release in the Secure Encrypted Virtualization (SEV) firmware could allow a malic... | |
| CVE-2025-29941 json | Incorrect usage of seeds in pseudo-random number generator in the Secure Encrypted Virtualization (SEV) firmware could allow ... | |
| CVE-2025-0008 json | Insufficient verification of data authenticity may allow a local attacker to bypass Secure Debug Unlock (SDU), potentially re... | |
| CVE-2024-36309 json | Missing Lock Bit Protection in the Northbridge IO (NBIO) could allow a privileged attacker to use an intentionally disabled d... | |
| CVE-2026-92091 json | A flaw was found in jwcrypto. The JWK.import_key() function validates the key_ops JWK member for duplicate values using an al... | |
| CVE-2026-79655 json | A flaw was found in sos clean, a utility within the sos package. This vulnerability allows a local attacker to perform arbitr... | |
| CVE-2026-62828 json | Improper input validation in Microsoft Edge for Android allows an unauthorized attacker to perform tampering over a network. | |
| CVE-2026-57990 json | Files or directories accessible to external parties in Microsoft Edge (Chromium-based) allows an unauthorized attacker to dis... | |
| CVE-2026-57084 json | Use of uninitialized resource in Windows File Explorer allows an unauthorized attacker to disclose information locally. | |
| CVE-2026-57083 json | Use of uninitialized resource in Microsoft Windows Codecs Library allows an unauthorized attacker to disclose information loc... | |
| CVE-2026-50498 json | Out-of-bounds read in Windows Universal Disk Format File System Driver (UDFS) allows an unauthorized attacker to elevate priv... | |
| CVE-2026-50431 json | Exposure of sensitive information to an unauthorized actor in Windows Quality of Service (QoS) Packet Scheduler allows an aut... | |
| CVE-2026-50423 json | Improper access control in Windows Kernel allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-50301 json | Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally. | |
| CVE-2026-49790 json | Integer underflow (wrap or wraparound) in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attack... | |
| CVE-2026-45489 json | Exposed dangerous method or function in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing o... | |
| CVE-2026-20286 json | A vulnerability in the web-based management interface of Cisco Identify Services Engine (ISE) could allow an authenticated, r... | |
| CVE-2026-20285 json | A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity ... | |
| CVE-2026-10757 json | There is a SQL injection vulnerability in Esri ArcGIS Server versions 12.1 and earlier on Windows and Linux that may allow a ... | |
| CVE-2026-96437 json | The ai-azure-content-safety plugin in Kong Gateway Enterprise skips inspection of request bodies larger than the in-memory bo... | |
| CVE-2026-92558 json | The proxy-cache and proxy-cache-advanced plugins in Kong Gateway Enterprise and Kong AI Gateway do not escape separator chara... | |
| CVE-2026-92545 json | The proxy-cache and proxy-cache-advanced plugins in Kong Gateway Enterprise and Kong AI Gateway omit the request hostname fro... | |
| CVE-2026-92443 json | The caching plugins in Kong Gateway Enterprise and Kong AI Gateway may serve a response cached for a request carrying an Auth... | |
| CVE-2026-92442 json | The graphql-proxy-cache-advanced plugin in Kong Gateway Enterprise omits the caller's identity from the cache key, allowing a... | |
| CVE-2026-92441 json | Kong Gateway Enterprise and Kong AI Gateway include decoded CR/LF characters from the request path in the X-Forwarded-Prefix ... | |
| CVE-2026-92439 json | The SAML plugin in Kong Gateway Enterprise does not enforce AudienceRestriction, allowing a valid assertion issued for anothe... | |
| CVE-2026-91000 json | Missing authentication for critical function vulnerability in N-able N-central allows Privilege Escalation. This issue affec... | |
| CVE-2026-90834 json | The user-mode syscall verifiers for the 16-bit ("wide data") UART API in drivers/serial/uart_handlers.c validated the wrong d... | |
| CVE-2026-90833 json | The simulated EEPROM driver validated access ranges in eeprom_range_is_valid() (drivers/eeprom/eeprom_simulator.c) with a sin... | |
| CVE-2026-90832 json | bt_hci_le_per_adv_report_common() in subsys/bluetooth/host/scan.c handles the HCI_LE_Periodic_Advertising_Report (and _v2) ev... | |
| CVE-2026-89324 json | The Basel Post Types plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.18. ... | |
| CVE-2026-87042 json | The IEEE 1588 (PTP) port implementation in subsys/net/lib/ptp/port.c adopted the logMessageInterval field of a received Delay... | |
| CVE-2026-82391 json | The HTTP/2 front-end of the Zephyr HTTP server aliased connection receive state as a scratch output. In subsys/net/lib/http/h... | |
| CVE-2026-77685 json | The RFCOMM multiplexer control-channel handler in subsys/bluetooth/host/classic/rfcomm.c computed the echo length for a BT_RF... | |
| CVE-2026-67177 json | Chargemap contains a stored cross site scripting vulnerability. A remote, unauthenticated attacker could craft a payload in t... | |
| CVE-2026-67176 json | Chargemap contains an open redirect vulnerability in the authentication login endpoint. A remote, unauthenticated attacker co... | |
| CVE-2026-67175 json | Chargemap contains a stored cross-site scripting vulnerability that allows a remote, authenticated attacker to craft a malici... | |
| CVE-2026-126186 json | Active Storage makes it simple to upload and reference files in cloud services and attach those files to Active Record object... | |
| CVE-2026-126129 json | The Auth0 ASP.NET Core Authentication SDK incorrectly determines a session's OIDC Back-Channel Logout status, which may resul... | |
| CVE-2026-126123 json | BeeS Software Solutions ERP before 04 September 2026 allows any low-privileged user to navigate directly to the administrativ... | |
| CVE-2026-126085 json | Active Storage makes it simple to upload and reference files in cloud services and attach those files to Active Record object... | |
| CVE-2026-125958 json | Download of code without integrity check vulnerability in N-able N-central allows Remote Code Inclusion. This issue affects ... | |
| CVE-2026-125883 json | Improper restriction of XML external entity reference vulnerability in N-able N-central allows XML Schema Poisoning. This is... | |
| CVE-2026-125882 json | Relative path traversal vulnerability in N-able N-central allows Path Traversal. This issue affects N-central: before 26.4.1... | |
| CVE-2026-125881 json | Server-Side request forgery (SSRF) vulnerability in N-able N-central allows Server Side Request Forgery. This issue affects ... | |
| CVE-2026-125880 json | Improper neutralization of HTTP headers for scripting syntax vulnerability in N-able N-central allows Cross-Site Scripting (X... | |
| CVE-2026-125879 json | Incorrect privilege assignment vulnerability in N-able N-central allows Privilege Escalation. This issue affects N-central: ... | |
| CVE-2026-125878 json | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in N-able N-central allows... | |
| CVE-2026-125298 json | AsiaInfo Business Support System (BSS) 9.2.0 through 9.2.40 does not correctly verify cryptographic signatures for JSON Web T... | |
| CVE-2026-125297 json | AsiaInfo Business Support System (BSS) 9.2.0 through 9.2.40 accepts unauthenticated requests via the management API '/bss/sys... | |
| CVE-2026-123341 json | Adobe Experience Manager is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is... | |
| CVE-2026-123267 json | CAI Content Credentials is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vuln... | |
| CVE-2026-40670 json | Improper check for unusual or exceptional conditions in AMD Secure Encrypted Virtualization - Secure Nested Paging (SEV-SNP) ... | |
| CVE-2026-40669 json | An off-by-one error in AMD Secure Encrypted Virtualization (SEV) firmware could allow an attacker with hypervisor access to c... | |
| CVE-2026-40668 json | Authentication bypass by spoofing in AMD Secure Encrypted Virtualization (SEV) firmware could allow a malicious hypervisor to... | |
| CVE-2026-28249 json | Improper preservation of consistency between independent representations of shared state in AMD Secure Encrypted Virtualizati... | |
| CVE-2026-28248 json | Improper enforcement of behavioral workflow in AMD Secure Encrypted Virtualization (SEV) firmware could allow a malicious hyp... | |
| CVE-2026-28247 json | Improper Access Control Applied to Mirrored or Aliased Memory Regions in AMD Secure Encrypted Virtualization (SEV) firmware c... | |
| CVE-2026-123262 json | CAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that could result in... | |
| CVE-2026-123261 json | CAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that could result in... | |
| CVE-2026-123260 json | CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature byp... | |
| CVE-2026-123259 json | Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privi... | |
| CVE-2026-123258 json | Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this ... | |
| CVE-2026-123041 json | The request-callout plugin in Kong Gateway Enterprise and Kong AI Gateway omits callout headers not sent by the client from i... | |
| CVE-2026-122102 json | Adobe Connect is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attac... | |
| CVE-2026-122101 json | CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature byp... | |
| CVE-2026-122100 json | CAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that could result in... | |
| CVE-2026-122099 json | CAI Content Credentials is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypas... | |
| CVE-2026-122098 json | CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a Security featu... | |
| CVE-2026-122097 json | CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application deni... | |
| CVE-2026-121913 json | Adobe Connect is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. A low-privil... | |
| CVE-2026-121912 json | Adobe Connect is affected by a Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to ... | |
| CVE-2026-121910 json | Adobe Connect is affected by a Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a v... | |
| CVE-2026-121908 json | Adobe Connect is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerab... | |
| CVE-2026-121906 json | Adobe Connect is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability ... | |
| CVE-2026-121904 json | Adobe Connect is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attac... | |
| CVE-2026-121902 json | Adobe Connect is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerab... | |
| CVE-2026-121900 json | Adobe Connect is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerab... | |
| CVE-2026-121898 json | Adobe Connect is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerab... | |
| CVE-2026-121896 json | Adobe Connect is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerab... | |
| CVE-2026-121894 json | Adobe Connect is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerab... | |
| CVE-2026-121892 json | Adobe Connect is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in ... | |
| CVE-2026-121890 json | Adobe Connect is affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could lead t... | |
| CVE-2026-121889 json | Adobe Connect is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Ex... | |
| CVE-2026-121887 json | Adobe Connect is affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result... | |
| CVE-2026-121356 json | Adobe Connect is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Ex... | |
| CVE-2026-121355 json | Adobe Connect is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker ... | |
| CVE-2026-121354 json | Adobe Connect is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability ... |