CVE.report
CVE.report is the most up-to-date database of common vulnerabilities and exposures. Information is pulled in from several sources and processed in to a mobile friendly, easy to use page. Use the site to quickly check for vulnerabilities in products such as operating systems, applications, hardware, networks, databases, browsers, e-mail clients and more.
CVEs provide a unique and common naming scheme for publicly known cyber security vulnerabilities in order to quickly identify and share these vulnerabilities. You can use the search below to look for vulnerabilities based on product, vendor, or common tags
The form you will see after following this link allows you to fill out the various variables in the CVSS scoring system and receive the corresponding score. The description of each of the variables is also included for additional information.
cve.report now provides a free read-only JSON API for CVE details. Each record combines the CVE Program JSON record, NVD enrichment, KEV, and EPSS when available.
Recent CVEs
| CVE | Description | Updated |
|---|---|---|
| CVE-2026-116137 json | adm-zip through 0.6.1 contains a duplicate-entry validation bypass that allows attackers to evade the readEntries() check by ... | |
| CVE-2026-116136 json | ProjectSend 2.0.0 through 2.7.1 contains an incomplete authorization vulnerability in FileVersions::link() that allows staff ... | |
| CVE-2026-116073 json | Leon before commit 50df142 contains a path traversal vulnerability in getModelFileNameFromURL() that allows attackers to writ... | |
| CVE-2026-116072 json | Infinity for Reddit through 8.3.4 contains a login cross-site request forgery vulnerability that allows attackers to log vict... | |
| CVE-2026-116071 json | rotki before 1.44.2 contains a weak key derivation vulnerability that allows attackers to brute-force backups because the pre... | |
| CVE-2026-116070 json | Docker-Proxy through 5.1.9 contains a missing authentication vulnerability in the hubcmdui routes/config.js that allows unaut... | |
| CVE-2026-116069 json | NiubiGEO before 0.3.2 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to m... | |
| CVE-2026-116068 json | Dokploy through 0.30.10 contains an authorization bypass vulnerability that allows owners or admins of any organization to co... | |
| CVE-2026-116067 json | Paisa before 0.7.8 contains a path traversal vulnerability in the GetFile, GetSheet, DeleteBackups, and DeleteSheetBackups ha... | |
| CVE-2026-116066 json | Firecrawl before 2.11.586 contains a server-side request forgery vulnerability in the Playwright service SSRF proxy that allo... | |
| CVE-2026-116050 json | A vulnerability has been found in krupalshah Employee Recruitment System up to 922ff6d208278282e7c8e36d70d9ae356adec9fe. This... | |
| CVE-2026-116049 json | A flaw has been found in krupalshah EmployeeRecruitmentSystem up to 922ff6d208278282e7c8e36d70d9ae356adec9fe. Affected by thi... | |
| CVE-2026-116048 json | A vulnerability was detected in krupalshah EmployeeRecruitmentSystem up to 922ff6d208278282e7c8e36d70d9ae356adec9fe. Affected... | |
| CVE-2026-116047 json | A vulnerability has been found in Privoce Vocechat up to 0.9.121. This issue affects some unknown processing of the file widg... | |
| CVE-2026-116046 json | A flaw has been found in eventcatalog sdk up to 2.29.0. This vulnerability affects the function getCustomDoc/writeCustomDoc/r... | |
| CVE-2026-116045 json | A vulnerability was detected in 1999AZZAR designer-mcp up to 2.1.0. This affects the function get_reference of the file skill... | |
| CVE-2026-114406 json | The system certificate authority (CA) store in Red Hat products, distributed via ca-certificates RPM packages, included multi... | |
| CVE-2026-116044 json | A security vulnerability has been detected in prasathmani TinyFileManager up to 2.6. Affected by this issue is some unknown f... | |
| CVE-2026-115251 json | The Duplicator WordPress plugin before 5.0.0 does not restrict its one-click upgrade routine to users allowed to install Dup... | |
| CVE-2026-115214 json | The Datawiza Proxy Auth Plugin WordPress plugin before 1.1.1 does not verify that the user-identity and role HTTP request he... | |
| CVE-2026-115183 json | The Qi Addons For Elementor WordPress plugin before 1.11.2 does not properly sanitise a widget's heading text after decoding ... | |
| CVE-2026-114743 json | The InstaWP Connect WordPress plugin before 0.1.4.2 does not perform a capability check on its InstaWP Connect WordPress pl... | |
| CVE-2026-114742 json | The WPVR WordPress plugin before 9.0.3 does not perform object-level ownership checks when updating virtual tours, allowing ... | |
| CVE-2026-114741 json | The WPVR WordPress plugin before 9.0.3 does not perform object-level authorization checks when reading and updating virtual ... | |
| CVE-2026-114740 json | The WPVR WordPress plugin before 9.1.3 does not correctly check user capabilities when creating a tour through its setup wiz... | |
| CVE-2026-111981 json | The GiveWP WordPress plugin before 4.19.0.1 does not perform a capability check when handling donor address changes, allowin... | |
| CVE-2026-111980 json | The GiveWP WordPress plugin before 4.19.0.1 does not correctly determine which page a page-capability request applies to, al... | |
| CVE-2026-111979 json | The GiveWP WordPress plugin before 4.19.0.1 does not properly sanitise and escape one of its donation form template settings... | |
| CVE-2026-111978 json | The GiveWP WordPress plugin before 4.19.0.1 does not properly validate a user-supplied filename before reading it from disk,... | |
| CVE-2026-111976 json | The GiveWP WordPress plugin before 4.19.0.1 does not perform any status or capability check when rendering a donation form o... | |
| CVE-2026-110285 json | The WP Stripe Checkout WordPress plugin before 1.2.2.62 does not verify the Stripe webhook signature when no signing secret i... | |
| CVE-2026-94295 json | The Chikkili- Google Pay India for Woocommerce WordPress plugin through 1.0.6 does not verify that a payment notification act... | |
| CVE-2025-15705 json | The Contact Form by Supsystic WordPress plugin before 1.8.0 does not sanitise and escape a form name, allowing users with ac... | |
| CVE-2026-116007 json | A flaw has been found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.09. The impacted element is the function SmsCodeServic... | |
| CVE-2026-116006 json | A vulnerability was detected in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.09. The affected element is an unknown function... | |
| CVE-2026-114820 json | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (com... | |
| CVE-2026-116004 json | A security vulnerability has been detected in onyx-dot-app Onyx up to 5.0.0. Impacted is an unknown function of the file web/... | |
| CVE-2026-116000 json | A security flaw has been discovered in Zylon PrivateGPT 1.0.0/1.0.1. This vulnerability affects the function load_file_from_u... | |
| CVE-2026-115999 json | A vulnerability has been found in mansi-k Restaurant_IMS d7ad49f61ab7cc1ec6eb359ac2b5378bdbde0694. Affected is the function m... | |
| CVE-2026-115557 json | Python has added a denylist for known compromised certificates to the "ssl" module to ensure user safety even without certifi... | |
| CVE-2025-60493 json | A segmentation violation in the check_media_profile function (/mp4box/mp4box.c) of GPAC Project/MP4Box before 2.5 allows atta... | |
| CVE-2026-115997 json | A flaw has been found in pig-mesh pig up to 4.1.0. This impacts the function orderItem.getColumn of the file pig-common/pig-c... | |
| CVE-2026-115996 json | A vulnerability was detected in Unitree Robotics Unitree Go2 up to 1.1.13/1.1.14.1/1.1.15.1. This affects the function WebSoc... | |
| CVE-2026-115995 json | A security vulnerability has been detected in Unitree Robotics Unitree Go2 up to 1.1.11.4. The impacted element is the functi... | |
| CVE-2026-111326 json | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | |
| CVE-2026-89284 json | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | |
| CVE-2026-109111 json | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | |
| CVE-2026-61434 json | PraisonAI versions before 4.6.78 contain an allowlist bypass vulnerability in shell command execution that allows attackers t... | |
| CVE-2026-61432 json | PraisonAI (praisonaiagents) before 1.6.78 contains a path traversal vulnerability in the FastContext feature (praisonaiagents... | |
| CVE-2026-61431 json | PraisonAI before 4.6.78 contains a path traversal vulnerability in ContextGatherer that fails to validate include paths in .p... | |
| CVE-2026-60091 json | PraisonAI before 4.6.78 contains an unauthenticated server-side request forgery vulnerability in the Jobs API /api/v1/runs en... | |
| CVE-2026-60089 json | PraisonAI (pip package praisonaiagents) before 1.6.78 automatically loads defaults from a project-local .praisonai/config.tom... | |
| CVE-2026-60086 json | PraisonAI before 4.6.78 contains a prompt injection defense bypass vulnerability where the injection defense only blocks thre... | |
| CVE-2026-59796 json | In JetBrains TeamCity before 2026.1.2 pipeline modification was possible due to improper permission checks | |
| CVE-2026-59795 json | In JetBrains TeamCity before 2026.1.2 stored XSS via unauthenticated agent registration was possible | |
| CVE-2026-59794 json | In JetBrains TeamCity before 2026.1.2 stored XSS on the cloud profile page was possible via agent-reported data | |
| CVE-2026-59793 json | In JetBrains TeamCity before 2026.1.2 arbitrary file access was possible via the Perforce VCS integration | |
| CVE-2026-59792 json | In JetBrains IntelliJ IDEA before 2026.1.4, 2026.2 code execution via path traversal in project workspace ID handling was po... | |
| CVE-2026-59791 json | In JetBrains YouTrack before 2026.2.17012 cSS injection via Mermaid diagram rendering was possible | |
| CVE-2026-56813 json | Improper Neutralization of Parameter/Argument Delimiters vulnerability in elixir-plug plug allows an attacker to inject or ov... | |
| CVE-2026-54470 json | Dell Unisphere for PowerMax, version(s) 10.3.0.5 and prior contain(s) an Improper Restriction of XML External Entity Referenc... | |
| CVE-2026-54469 json | Dell Unisphere for PowerMax, version(s) 10.3.0.5 and prior, contain(s) a Deserialization of Untrusted Data vulnerability. A l... | |
| CVE-2026-58225 json | SQL Injection vulnerability in elixir-ecto postgrex allows an attacker who can influence a LISTEN channel name to inject SQL ... | |
| CVE-2026-56814 json | Plug.Parsers.MULTIPART, the multipart request-body parser used to handle file uploads and multipart forms, does not enforce i... | |
| CVE-2026-54468 json | Dell Unisphere for PowerMax, version(s) 10.3.0.5 and prior, contain(s) a path traversal vulnerability. A low privileged attac... | |
| CVE-2026-41880 json | R-SOFT DMS is vulnerable to OS Command Injection in the Optical Character Recognition (OCR) module. Multiple command executi... | |
| CVE-2026-41879 json | R-SOFT DMS stores superadmin credentials using a non-salted nested MD5 hash. This allows an attacker who obtain password has... | |
| CVE-2026-14461 json | mtr is vulnerable to Out-of-bound read vulnerability in ipinfo_lookup() function. An attacker who can influence the TXT respo... | |
| CVE-2026-115982 json | A vulnerability was detected in phpIPAM up to 1.8.3. Affected by this issue is the function create_rack_link of the file app/... | |
| CVE-2026-115981 json | A security vulnerability has been detected in phpIPAM up to 1.8.3. Affected by this vulnerability is an unknown functionality... | |
| CVE-2026-58655 json | The bundled Grav Flex Objects plugin (getgrav/grav-plugin-flex-objects) before 1.4.0 contains a stored server-side template i... | |
| CVE-2026-56764 json | Hono before 4.11.10 contains a timing attack vulnerability in the basicAuth and bearerAuth middlewares due to non-constant-ti... | |
| CVE-2026-59235 json | Missing Authorization (CWE-862) in BankAccountListController (app/Http/Controllers/Api/BankAccount/BankAccountListController.... | |
| CVE-2026-58077 json | Joomla Extension - weeblr.com - Unauthenticated stored XSS in 4Analytics < 5.0.2 - The Joomla extension 4Analytics is vulnera... | |
| CVE-2026-57831 json | Joomla Extension - digital-peak.com - Unauthenticated blind SQL injection in DP Calendar 8.18.0 - 10.11.2 - The Joomla extens... | |
| CVE-2026-57821 json | A SQL Injection vulnerability exists in Apache Fineract's Office Search API (GET /api/v1/offices) in versions up to and inclu... | |
| CVE-2026-56287 json | A boolean-based SQL Injection vulnerability exists in Apache Fineract's Client Search API (GET /api/v1/clients) in versions u... | |
| CVE-2026-42936 json | The installer of HYPER SBI 2 insecurely loads Dynamic Link Libraries. If there is a crafted DLL at the same directory when in... | |
| CVE-2026-35152 json | A SQL Injection vulnerability exists in Apache Fineract's Report Execution API (runreports endpoint) in versions up to and in... | |
| CVE-2026-15804 json | The HCM developed by MetaGuru has a SQL Injection vulnerability. Authenticated remote attackers can inject SQL commands via s... | |
| CVE-2026-15583 json | A confused-deputy flaw in Grafana MCP Server allows an unauthenticated remote attacker to exfiltrate the server's environment... | |
| CVE-2026-14251 json | A flaw was found in the OpenShift GitOps operator. The ClusterRole reconciler does not validate resource ownership when recon... | |
| CVE-2026-8920 json | Improper Restriction of Communication Channel to Intended Endpoints and External Control of File Name or Path in Aura Wallpap... | |
| CVE-2026-54684 json | jadx is a Dex to Java decompiler. From 1.5.2 to 1.5.5, a malicious .xapk file can cause jadx to write attacker-controlled arc... | |
| CVE-2026-49981 json | Twig is a template language for PHP. Prior to 3.27.0, the per-template filter, tag, and function allow-list verdict is comput... | |
| CVE-2026-48808 json | Twig is a template language for PHP. Prior to 3.27.0, the column filter passes the active sandbox state as a boolean but does... | |
| CVE-2026-48807 json | Twig is a template language for PHP. Prior to 3.27.0, the sandbox __toString() checks do not fully cover Traversable values p... | |
| CVE-2026-48806 json | Twig is a template language for PHP. Prior to 3.27.0, ArrayExpression does not guard dynamic mapping keys that are coerced to... | |
| CVE-2026-48805 json | Twig is a template language for PHP. Prior to 3.27.0, deprecated internal wrappers in src/Resources/core.php do not forward t... | |
| CVE-2026-15753 json | A vulnerability was determined in zhinianboke xianyu-auto-reply on Server. Affected by this vulnerability is an unknown funct... | |
| CVE-2026-15752 json | A vulnerability was found in zhinianboke xianyu-auto-reply up to dcb445ad97816ad65299a7580ee0c8c8f929da84. Affected is an unk... | |
| CVE-2026-15751 json | A security vulnerability has been detected in mastergo-design mastergo-magic-mcp up to 0.2.0. The affected element is the fun... | |
| CVE-2026-13385 json | An Improper Validation of Integrity Check Value and Improper Certificate Validation in certain ASUS router models allows a re... | |
| CVE-2026-11851 json | Improper Neutralization of Special Elements used in an SQL Command ("SQL Injection") in the web management interface of certa... | |
| CVE-2026-8919 json | Permissive Cross-domain Security Policy with Untrusted Domains in ASUS GameSDK allows a remote user to obtain a local user’... | |
| CVE-2026-47732 json | Twig is a template language for PHP. Prior to 3.26.0, several Twig language constructs trigger PHP string coercion on a Strin... | |
| CVE-2026-47730 json | Twig is a template language for PHP. From 3.0.0 until 3.26.0, Twig\Profiler\Dumper\HtmlDumper writes Profile::getTemplate() a... | |
| CVE-2026-46640 json | Twig is a template language for PHP. From 3.15.0 until 3.26.0, _self.(<string>) and import-alias dynamic attribute syntax can... | |
| CVE-2026-46639 json | Twig is a template language for PHP. From 3.24.0 until 3.26.0, object-destructuring assignment compiles CoreExtension::getAtt... | |
| CVE-2026-46638 json | Twig is a template language for PHP. Prior to 3.26.0, {% sandbox %}{% include %} can include a template that was previously l... |