CVE.report
CVE.report is the most up-to-date database of common vulnerabilities and exposures. Information is pulled in from several sources and processed in to a mobile friendly, easy to use page. Use the site to quickly check for vulnerabilities in products such as operating systems, applications, hardware, networks, databases, browsers, e-mail clients and more.
CVEs provide a unique and common naming scheme for publicly known cyber security vulnerabilities in order to quickly identify and share these vulnerabilities. You can use the search below to look for vulnerabilities based on product, vendor, or common tags
The form you will see after following this link allows you to fill out the various variables in the CVSS scoring system and receive the corresponding score. The description of each of the variables is also included for additional information.
cve.report now provides a free read-only JSON API for CVE details. Each record combines the CVE Program JSON record, NVD enrichment, KEV, and EPSS when available.
Recent CVEs
| CVE | Description | Updated |
|---|---|---|
| CVE-2026-111357 json | Ivanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts DSCache configuration data, leading... | |
| CVE-2026-109468 json | Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a n... | |
| CVE-2026-108455 json | Microsoft Office PowerPoint Information Disclosure Vulnerability | |
| CVE-2026-108454 json | Microsoft Office PowerPoint Information Disclosure Vulnerability | |
| CVE-2026-108453 json | Microsoft Office PowerPoint Information Disclosure Vulnerability | |
| CVE-2026-108452 json | Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office SharePoint allows an autho... | |
| CVE-2026-108451 json | Numeric truncation error in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-108450 json | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-108449 json | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-108448 json | Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-108447 json | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-108446 json | Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-108445 json | Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-108444 json | Microsoft Office Remote Code Execution Vulnerability | |
| CVE-2026-108443 json | Off-by-one error in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-108442 json | Use after free in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-108441 json | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-108440 json | Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-108439 json | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-108438 json | Use after free in Microsoft Office Word allows an unauthorized attacker to disclose information over a network. | |
| CVE-2026-108437 json | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-108436 json | Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network. | |
| CVE-2026-108435 json | Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to disclose information over a network... | |
| CVE-2026-108434 json | Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network. | |
| CVE-2026-108433 json | Reliance on untrusted inputs in a security decision in Microsoft Office Word allows an unauthorized attacker to bypass a secu... | |
| CVE-2026-108432 json | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-108431 json | Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-108430 json | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-111233 json | Netgate pfSense CE 2.7.1 through 2.9.0 contains a reflected cross-site scripting vulnerability in firewall_rules.php that all... | |
| CVE-2026-108429 json | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-108428 json | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-108427 json | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-108426 json | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-105040 json | The EnergizeLab Eilik NestJS auth service accepts a user-controlled user ID in account update requests (mass assignment). A r... | |
| CVE-2026-105039 json | EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 do not check user roles on administrative APIs. Any... | |
| CVE-2026-105038 json | The EnergizeLab Eilik and EilikO FastAPI AI inference and profiling services expose AI model administration functions without... | |
| CVE-2026-105037 json | EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 allow any registered, low-privilege account to read... | |
| CVE-2026-105036 json | EnergizeLab AI Station firmware, EilikO Linux robot firmware v2.1_20260617182218_release, and the EnergizeLab Windows desktop... | |
| CVE-2026-105035 json | The EnergizeLab FirmwareUpdater (AArch64 ELF, distributed in the CDN bin.zip) uses a single hard-coded AES key shared by all ... | |
| CVE-2026-105034 json | The EnergizeLab Eilik NestJS auth service issues device tokens for arbitrary robot serial numbers without authentication. An ... | |
| CVE-2026-105033 json | The EnergizeLab AI Station (RK3562) firmware image ships with default root credentials and SSH enabled. An attacker with netw... | |
| CVE-2026-105032 json | The EnergizeLab Eilik and EilikO AI skill upload endpoint, served by the FastAPI AI inference and profiling services, does no... | |
| CVE-2026-104198 json | ZoneMinder is a free, open source closed-circuit television software application. In versions 1.34.0 through 1.36.38, the web... | |
| CVE-2026-102764 json | The vulnerability exists within internal components of BeyondTrust’s Remote Support product. The components did not adequat... | |
| CVE-2026-63430 json | ammonia is a Rust library for repairing and securing untrusted HTML. Prior to 3.3.2, 4.0.2, and 4.1.3, applications that expl... | |
| CVE-2026-55840 json | Scoold is a Q&A and a knowledge sharing platform for teams. Prior to 1.69.1, the getBackToUrl() method in src/main/java/com/e... | |
| CVE-2026-45165 json | An authorization flaw in Idira Conjur version 13.9.0 allows an authenticated user with limited privileges to perform unauthor... | |
| CVE-2026-111232 json | Netgate pfSense CE 2.3.0 through 2.9.0 contains a stored cross-site scripting vulnerability that allows authenticated users w... | |
| CVE-2026-111231 json | Netgate pfSense CE through 2.9.0 contains an authorization bypass vulnerability that allows read-only WebGUI users to replace... | |
| CVE-2026-111230 json | Netgate pfSense CE through 2.9.0 contains a local file read vulnerability that allows users with the Dynamic DNS client privi... | |
| CVE-2026-111229 json | pfSense CE 2.7.0 through 2.9.0 contains a command injection vulnerability in services_captiveportal_hasync.php that allows us... | |
| CVE-2026-111228 json | Netgate pfSense CE from 2.7.1 through 2.9.0 contains a CRLF injection vulnerability in services_unbound_advanced.php that all... | |
| CVE-2026-111227 json | Netgate pfSense CE through 2.9.0 contains a CRLF injection vulnerability in services_unbound_acls.php that allows authenticat... | |
| CVE-2026-111226 json | pfSense CE 2.4.5 through 2.9.0 contains an OS command injection vulnerability that allows authenticated WebGUI users with Adv... | |
| CVE-2026-111225 json | Netgate pfSense CE 2.5.0 through 2.9.0 contains an OS command injection vulnerability in openvpn.learn-address.sh that allows... | |
| CVE-2026-111224 json | pfSense CE through 2.9.0 contains an OS command injection vulnerability in the OpenVPN openvpn.connect_async.sh script that a... | |
| CVE-2026-111223 json | Netgate pfSense CE 2.7.0 through 2.9.0 contains a configuration injection vulnerability that allows authenticated users with ... | |
| CVE-2026-111222 json | Netgate pfSense CE through 2.9.0 contains a php.ini injection vulnerability that allows authenticated users with General Setu... | |
| CVE-2026-111221 json | Netgate pfSense CE through 2.9.0 contains a configuration injection vulnerability that allows authenticated WebGUI users to i... | |
| CVE-2026-111220 json | pfSense CE through 2.9.0 contains a crontab injection vulnerability in interfaces_ppps_edit.php that allows authenticated use... | |
| CVE-2026-111219 json | Netgate pfSense CE through 2.9.0 contains a newline injection vulnerability in services_pppoe_edit.php that allows privileged... | |
| CVE-2026-111218 json | Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Tr... | |
| CVE-2026-111217 json | Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Virtual ... | |
| CVE-2026-111216 json | Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with gateway ... | |
| CVE-2026-111215 json | Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users to execute co... | |
| CVE-2026-111214 json | Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Qi... | |
| CVE-2026-110364 json | Missing Authorization vulnerability in WP Desk Flexible Quantity – Measurement Price Calculator for WooCommerce flexible-qu... | |
| CVE-2026-110361 json | Insertion of Sensitive Information Into Sent Data vulnerability in ClikIT Infinite Uploads infinite-uploads allows Retrieve E... | |
| CVE-2026-108499 json | Missing Authorization vulnerability in WebberZone Knowledge Base knowledgebase allows Exploiting Incorrectly Configured Acces... | |
| CVE-2026-77470 json | Lychee is a free, open-source photo-management tool. Prior to 7.7.1, the Supporter or Pro webshop POST /api/v2/Shop/Checkout/... | |
| CVE-2026-77468 json | Lychee is a free, open-source photo-management tool. Prior to 7.7.0, GET /docs/api exposes the Scramble-generated OpenAPI doc... | |
| CVE-2026-77467 json | Lychee is a free, open-source photo-management tool. Prior to 7.7.0, Lychee enables ImageMagick PDF support with Ghostscript ... | |
| CVE-2026-77466 json | Lychee is a free, open-source photo-management tool. Prior to 7.7.0, Lychee hides the Omnipay Dummy test provider from the ch... | |
| CVE-2026-71490 json | OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.11, OPNsense\Core\ACL::hasPrivilege() appends a dire... | |
| CVE-2026-63442 json | OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the unauthenticated WebGUI login usernam... | |
| CVE-2026-62679 json | Lychee is a free, open-source photo-management tool. Prior to 7.6.4, SecurePathController, which serves GET /image/{path}, co... | |
| CVE-2026-61838 json | Lychee is a free, open-source photo-management tool. Prior to 7.6.3, GET /api/v2/Zip authorizes album and photo archives thro... | |
| CVE-2026-61611 json | Lychee is a free, open-source photo-management tool. Prior to 7.6.1, POST /api/v2/Album::unlock has no throttle, attempt coun... | |
| CVE-2026-61610 json | Lychee is a free, open-source photo-management tool. Prior to 7.6.1, when photos_star_visibility is set to anonymous, POST /a... | |
| CVE-2026-57569 json | Lychee is a free, open-source photo-management tool. Prior to 7.6.0, the POST /api/v2/Photo::fromUrl flow validates a hostnam... | |
| CVE-2026-57568 json | Lychee is a free, open-source photo-management tool. Prior to 7.6.0, Lychee permits an authenticated user with album-edit per... | |
| CVE-2026-110934 json | Improper validation of array index vulnerability in Samsung Open Source Vyond allows Input Data Manipulation. This issue aff... | |
| CVE-2026-110933 json | Uncaught exception vulnerability in Samsung Open Source Vyond allows Input Data Manipulation. This issue affects Vyond: befo... | |
| CVE-2026-93484 json | Znuny through 7.3.6 constructs a ticket-search database query by directly concatenating user-supplied input into the SQL stat... | |
| CVE-2026-93483 json | In Znuny through 7.3.6, an attacker can bypass specific standard login procedures and gain unauthorized access to sensitive s... | |
| CVE-2026-58395 json | OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the safe-delete path reached through Api... | |
| CVE-2026-58394 json | OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, src/www/system_advanced_admin.php reads ... | |
| CVE-2026-58393 json | OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the OpenVPN Client Specific Override com... | |
| CVE-2026-58392 json | OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the NTP GPS page stores the operator-sup... | |
| CVE-2026-58391 json | OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, Firewall Rules and NAT views place store... | |
| CVE-2026-58390 json | OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the OpenVPN connection-status dashboard ... | |
| CVE-2026-57155 json | OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the Firewall Alias GeoIP importer's proc... | |
| CVE-2026-55387 json | InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and esti... | |
| CVE-2026-55386 json | InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and esti... | |
| CVE-2026-55385 json | InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and esti... | |
| CVE-2026-55384 json | InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and esti... | |
| CVE-2026-55383 json | InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and esti... | |
| CVE-2026-53582 json | OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.10, the Trust module stores attacker-control... | |
| CVE-2026-97780 json | Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-97779 json | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network. |