CVE.report
CVE.report is the most up-to-date database of common vulnerabilities and exposures. Information is pulled in from several sources and processed in to a mobile friendly, easy to use page. Use the site to quickly check for vulnerabilities in products such as operating systems, applications, hardware, networks, databases, browsers, e-mail clients and more.
CVEs provide a unique and common naming scheme for publicly known cyber security vulnerabilities in order to quickly identify and share these vulnerabilities. You can use the search below to look for vulnerabilities based on product, vendor, or common tags
The form you will see after following this link allows you to fill out the various variables in the CVSS scoring system and receive the corresponding score. The description of each of the variables is also included for additional information.
cve.report now provides a free read-only JSON API for CVE details. Each record combines the CVE Program JSON record, NVD enrichment, KEV, and EPSS when available.
Recent CVEs
| CVE | Description | Updated |
|---|---|---|
| CVE-2026-96741 json | The DSGVO All in one for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Output ... | |
| CVE-2026-96669 json | The Food Store – Online Food Delivery & Pickup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'servi... | |
| CVE-2026-96666 json | The Schema App Structured Data plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via 'Rem... | |
| CVE-2026-96228 json | SSL Wireless SMS Notification for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 3.8.... | |
| CVE-2026-93904 json | The Social Web Suite – Social Media Auto Post, Social Media Auto Publish plugin for WordPress is vulnerable to generic SQL ... | |
| CVE-2026-93855 json | The SendPress Newsletters plugin for WordPress is vulnerable to time-based SQL Injection via the 'subscriberid' parameter in ... | |
| CVE-2026-118426 json | In affected versions of Octopus Server with the LDAP authentication provider enabled, any authenticated user could call the L... | |
| CVE-2026-114173 json | The Ortto plugin for WordPress before 1.0.25 did not filter the WooCommerce product data it embedded in public storefront pag... | |
| CVE-2026-113409 json | The Ortto plugin for WordPress before 1.0.25 did not escape stored settings on its admin settings page, leading to stored cro... | |
| CVE-2026-113387 json | The Ortto plugin for WordPress before 1.0.25 did not authenticate configuration update requests, relying only on a secret exp... | |
| CVE-2026-109516 json | The Bot for Telegram on WooCommerce plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover i... | |
| CVE-2026-93757 json | The Wild Apricot Login plugin for WordPress is vulnerable to Authentication Bypass via SSO Email-Collision Account Binding in... | |
| CVE-2026-78674 json | The BPMN System REST APIs do not sufficiently validate input parameters, allowing authenticated users to submit crafted reque... | |
| CVE-2026-76418 json | A vulnerability in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and ... | |
| CVE-2026-66092 json | In openEQUELLA before 2026.2, the pre-login notice is stored as HTML and rendered on the legacy logon page without encoding o... | |
| CVE-2026-66091 json | In openEQUELLA before 2026.1, the GET /api/userquery/userinfobackup endpoint performs no authentication or authorisation chec... | |
| CVE-2026-66090 json | In openEQUELLA before 2026.1, the XML parser used for item metadata does not disable external entity resolution. A user permi... | |
| CVE-2026-66089 json | In openEQUELLA before 2026.1, the SOAP API parses XML supplied in the stopEdit operation with a parser that resolves external... | |
| CVE-2026-66088 json | In openEQUELLA before 2026.1, the system.execute() function available to the scripting engine runs supplied operating system ... | |
| CVE-2026-42949 json | A authorization bypass vulnerability exists in the /api/runscript functionality of FUXA (version(s): 1.3.2-2809). A specially... | |
| CVE-2026-42922 json | A authorization bypass vulnerability exists in the /nodered functionality of FUXA (version(s): 1.3.2-2809). A specially craft... | |
| CVE-2026-40063 json | A information disclosure vulnerability exists in the /nodered/fuxa/scripts functionality of FUXA (version(s): 1.3.2-2809). A ... | |
| CVE-2026-16889 json | In openEQUELLA before 2026.1, the pre-login notice image upload endpoint (PUT /api/preloginnotice/image/{name}) does not vali... | |
| CVE-2026-6647 json | In deployments of WSO2 Identity Server configured with a case-insensitive user store and a case-sensitive database for identi... | |
| CVE-2026-3583 json | When the `allowed_scopes` configuration is enabled, the OAuth2 token introspection mechanism does not immediately invalidate ... | |
| CVE-2026-118359 json | Memory corruption in V8 in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary co... | |
| CVE-2026-110541 json | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1... | |
| CVE-2026-103792 json | Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.... | |
| CVE-2026-103780 json | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1... | |
| CVE-2026-103779 json | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1... | |
| CVE-2026-87880 json | Sensitive information disclosure due to missing SSL certificate verification affecting one component. The following products ... | |
| CVE-2026-87878 json | Linux binaries have executable stack attribute enabled. The following products are affected: Acronis Cyber Protect 17 (Linux)... | |
| CVE-2026-87103 json | Sensitive information disclosure and manipulation due to improper token validation. The following products are affected: Acro... | |
| CVE-2026-87102 json | Sensitive information disclosure and manipulation due to improper token validation. The following products are affected: Acro... | |
| CVE-2026-86385 json | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, contain an Improper Check for Dropped Privileges... | |
| CVE-2026-86384 json | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1... | |
| CVE-2026-86380 json | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1... | |
| CVE-2026-86379 json | Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.... | |
| CVE-2026-86378 json | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1... | |
| CVE-2026-81472 json | Dell iDRAC Service Module (iSM) for Windows, Dell iDRAC Service Module (iSM) for Linux, and Dell iDRAC Service Module (iSM) f... | |
| CVE-2026-11854 json | The authentication endpoint generates an error message that includes reflected data directly from the request without suffici... | |
| CVE-2025-30414 json | Local privilege escalation due to improper authentication. The following products are affected: Acronis Cyber Protect Cloud A... | |
| CVE-2025-14260 json | Due to the improper implementation of access control rules, the WSO2 product accepts user-supplied input related to resource ... | |
| CVE-2026-118358 json | Memory corruption in WebAudio in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitr... | |
| CVE-2026-118357 json | Use after free in FileSystem in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitra... | |
| CVE-2026-118356 json | Use after free in WTF in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the ... | |
| CVE-2026-118354 json | Improper input validation in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute ar... | |
| CVE-2026-118353 json | Use after free in Paint in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside th... | |
| CVE-2026-118352 json | Memory corruption in Cache in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary... | |
| CVE-2026-118351 json | Memory corruption in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside ... | |
| CVE-2026-118350 json | Use after free in Turbolev in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside... | |
| CVE-2026-118349 json | Memory corruption in Payments in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code ins... | |
| CVE-2026-118348 json | Improper input validation in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute ar... | |
| CVE-2026-118347 json | Use after free in FileSystem in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code insi... | |
| CVE-2026-118346 json | Use after free in Compositing in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitr... | |
| CVE-2026-118344 json | Use after free in Layout in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside t... | |
| CVE-2026-118343 json | Improper input validation in ReadingList in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially exe... | |
| CVE-2026-118341 json | Use after free in Modularization in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code ... | |
| CVE-2026-118339 json | Use after free in Animation in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code insid... | |
| CVE-2026-118338 json | Use after free in Animation in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrar... | |
| CVE-2026-118336 json | Improper input validation in Headless in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execut... | |
| CVE-2026-118335 json | Improper input validation in Metrics in Google Chrome on on Mac prior to 156.0.8078.73 allowed a remote attacker to potential... | |
| CVE-2026-118334 json | Use after free in ImageCapture in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code in... | |
| CVE-2026-118331 json | Improper input validation in FileAPI in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute... | |
| CVE-2026-118330 json | Use after free in Browser in Google Chrome on on Windows prior to 156.0.8078.73 allowed a remote attacker to execute arbitrar... | |
| CVE-2026-118329 json | Improper input validation in ANGLE in Google Chrome on on Mac prior to 156.0.8078.73 allowed a remote attacker to potentially... | |
| CVE-2026-118328 json | Improper input validation in WebRTC in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute ... | |
| CVE-2026-118327 json | Memory corruption in Media in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary... | |
| CVE-2026-118320 json | Memory corruption in V8 in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary co... | |
| CVE-2026-118317 json | Memory corruption in HTML in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary ... | |
| CVE-2026-118315 json | Improper input validation in SVG in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arb... | |
| CVE-2026-118314 json | Improper input validation in UI in Google Chrome on on Android prior to 156.0.8078.73 allowed a remote attacker to potentiall... | |
| CVE-2026-118313 json | Use after free in Video in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside th... | |
| CVE-2026-118311 json | Memory corruption in Media in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary... | |
| CVE-2026-118307 json | Use after free in Paint in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary co... | |
| CVE-2026-118304 json | Improper input validation in SVG in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arb... | |
| CVE-2026-113775 json | A maliciously crafted dynamic library, when loaded from an arbitrary path through the TextCommands.LoadDll command exposed by... | |
| CVE-2026-104349 json | Creative Cloud Desktop is affected by an Uncontrolled Search Path Element vulnerability that could result in arbitrary code e... | |
| CVE-2026-102815 json | An operating-system command injection vulnerability exists in the tmpServer service of TP-Link RE305 V3. The service runs wit... | |
| CVE-2026-102814 json | An authentication weakness exists in the TP-Link TDDP v2 service of TP-Link RE305 V3. TDDP v2 uses a fixed and derivable cryp... | |
| CVE-2026-85898 json | Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attac... | |
| CVE-2026-83831 json | Double free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-48379 json | Substance3D - Painter is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code executio... | |
| CVE-2026-48360 json | Adobe Connect is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in ... | |
| CVE-2026-115725 json | Chatwoot before 4.17.0 contains an authorization bypass vulnerability that allows authenticated agent bots to access other ac... | |
| CVE-2026-115535 json | A vulnerability was identified in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. The affected... | |
| CVE-2026-112904 json | Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. In versions 1.0.8.6 a... | |
| CVE-2026-111422 json | In apache-airflow-providers-ssh before 7.0.1, SSHRemoteJobOperator quoted the values of its templated `environment` parameter... | |
| CVE-2026-107672 json | A maliciously crafted .stack.json file can trigger a trusted Markdown injection vulnerability in Autodesk Fusion Post Process... | |
| CVE-2026-106764 json | An issue in @rog0x/mcp-git-tools 1.0.1 allows a remote attacker to execute arbitrary code via the resolveBaseBranch function. | |
| CVE-2026-103593 json | A stack-based buffer overflow vulnerability in the Fireware OS logging service allows a network-adjacent attacker who can imp... | |
| CVE-2026-94347 json | PowerProtect Data Domain Virtual Edition, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 thr... | |
| CVE-2026-94346 json | PowerProtect Data Domain Virtual Edition, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 thr... | |
| CVE-2026-93865 json | A missing authentication vulnerability in the Fireware OS FireCluster synchronization daemon allows a remote, unauthenticated... | |
| CVE-2026-93864 json | A link following vulnerability in WatchGuard Fireware OS’s firewall daemon allows a local attacker with code execution as a... | |
| CVE-2026-93857 json | A stack-based buffer overflow vulnerability in Fireware OS's SIP proxy allows a remote, unauthenticated attacker to execute a... | |
| CVE-2026-90729 json | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through 7.13.1... | |
| CVE-2026-90728 json | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through 7.13.1... | |
| CVE-2026-90465 json | A missing authentication vulnerability in the FireCluster Sync processing allows an attacker positioned on the cluster interc... | |
| CVE-2026-86018 json | Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.2, Part-DB allows auth... |