CVE.report
CVE.report is the most up-to-date database of common vulnerabilities and exposures. Information is pulled in from several sources and processed in to a mobile friendly, easy to use page. Use the site to quickly check for vulnerabilities in products such as operating systems, applications, hardware, networks, databases, browsers, e-mail clients and more.
CVEs provide a unique and common naming scheme for publicly known cyber security vulnerabilities in order to quickly identify and share these vulnerabilities. You can use the search below to look for vulnerabilities based on product, vendor, or common tags
The form you will see after following this link allows you to fill out the various variables in the CVSS scoring system and receive the corresponding score. The description of each of the variables is also included for additional information.
cve.report now provides a free read-only JSON API for CVE details. Each record combines the CVE Program JSON record, NVD enrichment, KEV, and EPSS when available.
Recent CVEs
| CVE | Description | Updated |
|---|---|---|
| CVE-2026-7233 json | A vulnerability was determined in Artifex MuPDF. The impacted element is the function fz_subset_cff_for_gids of the file subs... | |
| CVE-2026-120218 json | A flaw has been found in Typemill up to 2.26.0. The impacted element is the function ControllerApiImage::saveImage of the fil... | |
| CVE-2026-120217 json | A vulnerability was detected in Delgan loguru 0.7.3. The affected element is the function AnsiParser.feed of the file loguru/... | |
| CVE-2026-120198 json | A vulnerability has been found in WAVLINK WL-WN530BE1-A V251117. Affected is the function con_check_read_finish of the file /... | |
| CVE-2026-118168 json | The MapPress WordPress plugin before 2.97.15 does not restrict which user's data its front-end map embed handler renders, al... | |
| CVE-2026-113482 json | The Media Library Assistant WordPress plugin before 3.44 does not escape one of its shortcode attributes before outputting it... | |
| CVE-2026-113481 json | The Media Library Assistant WordPress plugin before 3.44 does not check that the requesting user is allowed to view a post be... | |
| CVE-2026-107343 json | The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.30 does not perform a capability check on... | |
| CVE-2026-107342 json | The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.30 does not perform a capability check wh... | |
| CVE-2026-102010 json | A flaw was found in GCC. When an application calls the erase_if function on a binary heap priority queue in libstdc++, the li... | |
| CVE-2026-95619 json | A flaw was found in libstdc++. An integer overflow can occur when processing large inputs to the aligned operator new in the ... | |
| CVE-2026-120197 json | A flaw has been found in WAVLINK WL-WN530HG4B M_V260724. This impacts the function port_forward of the file /cgi-bin/wapi.cgi... | |
| CVE-2026-120196 json | A vulnerability was detected in WAVLINK WN579X3-D V250402. This affects the function port_forward of the file /cgi-bin/wapi.c... | |
| CVE-2026-120195 json | A security vulnerability has been detected in WAVLINK WL-WN579A3-A 2026-03-10-94f93d4. The impacted element is the function s... | |
| CVE-2026-120192 json | A security vulnerability has been detected in Presenton up to 0.9.11-beta. This affects an unknown part of the file /app_data... | |
| CVE-2026-15563 json | A flaw was found in EAP's IIOP. The listener's NameService would accept bind operations without authentication, allowing an a... | |
| CVE-2026-120252 json | imagecodecs 2023.1.23 through 2026.10.10 contains a stack-based buffer overflow vulnerability in the lossless JPEG Define Huf... | |
| CVE-2026-120251 json | imagecodecs 2026.3.6 through 2026.10.10 contains an infinite loop vulnerability in ccitt_fax4_decode_size() that allows attac... | |
| CVE-2026-120250 json | OpenAlgo 1.0.0.29 before 2.0.3.1 contains an improper certificate validation vulnerability in utils/email_utils.py and utils/... | |
| CVE-2026-120249 json | Thelia Back-office Default Twig Template before 1.1.1 contains a cross-site request forgery vulnerability in the /admin/produ... | |
| CVE-2026-120248 json | Thelia before 3.1.1 contains a stored cross-site scripting vulnerability that allows authenticated back-office administrators... | |
| CVE-2026-120247 json | FFmpeg 2.3 through 9.0.2 contains a use of uninitialized resource vulnerability in the Huffyuv decoder that allows attackers ... | |
| CVE-2026-120246 json | FFmpeg 4.4 through 9.0.2 contains a use of uninitialized variable vulnerability in the CDXL decoder that leaks stack memory i... | |
| CVE-2026-120245 json | FFmpeg 0.10 through 9.0.2 contains a use of uninitialized resource vulnerability in sunrast_decode_frame() that leaks heap me... | |
| CVE-2026-120244 json | FFmpeg 2.1 through 9.0.2 contains a use of uninitialized resource vulnerability in the PCX decoder that allows attackers to l... | |
| CVE-2026-120243 json | FFmpeg 2.0 through 9.0.2 contains a use of uninitialized variable vulnerability in the Go2Meeting decoder that allows attacke... | |
| CVE-2026-120191 json | A weakness has been identified in Presenton up to 0.9.11-beta. Affected by this issue is some unknown functionality of the co... | |
| CVE-2026-120190 json | A security flaw has been discovered in PostyBirb Plus up to 3.1.75. Affected by this vulnerability is an unknown functionalit... | |
| CVE-2026-120189 json | A vulnerability was identified in D-Link DIR-505 1.10B02. Affected is the function save_upload_file/mp_upload_file of the fil... | |
| CVE-2026-86404 json | EAP's Artemis deserialization configuration permits deserialization by default. ObjectMessage.getObject() uses ObjectInputStr... | |
| CVE-2026-15567 json | A flaw was found in Wildfly. A remote unauthenticated attacker can trigger OutOfMemoryError as CSIv2Util's GSS token decoder ... | |
| CVE-2026-15565 json | A flaw was found in Undertow. A remote attacker can cause Out of Memory on websockets endpoint without authentication on any ... | |
| CVE-2026-15562 json | A flaw was found in EAP's jboss-remoting. A remote unauthenticated attacker who can reach :8080 (or :9990, or :4447) and comp... | |
| CVE-2026-15561 json | A flaw was found in EAP's undertow http/1.1 chunked-transfer decoder. missing limits on size and count would allow an attacke... | |
| CVE-2026-15560 json | when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalli... | |
| CVE-2026-15556 json | A flaw was found in Picketlink's SP signature validation; a SAML response containing zero assertion elements matching the sig... | |
| CVE-2026-15555 json | A flaw was found in JBoss marshalling. The Infinispan session replication path deserializes replicated session data via the J... | |
| CVE-2026-15554 json | the Undertow AJP listener honours forged ssl_cert and is_ssl AJP attributes without requiring any shared-secret authenticatio... | |
| CVE-2026-10579 json | A flaw was found in Picketlink Federation SAML; the unsolcited response handler would accept forged assertions with no verifi... | |
| CVE-2025-32914 json | A flaw was found in libsoup, where the soup_multipart_new_from_message() function is vulnerable to an out-of-bounds read. Thi... | |
| CVE-2025-32913 json | A flaw was found in libsoup, where the soup_message_headers_get_content_disposition() function is vulnerable to a NULL pointe... | |
| CVE-2025-32911 json | A use-after-free type vulnerability was found in libsoup, in the soup_message_headers_get_content_disposition() function. Thi... | |
| CVE-2025-32906 json | A flaw was found in libsoup, where the soup_headers_parse_request() function may be vulnerable to an out-of-bound read. This ... | |
| CVE-2025-32049 json | A flaw was found in libsoup. The SoupWebsocketConnection may accept a large WebSocket message, which may cause libsoup to all... | |
| CVE-2025-4948 json | A flaw was found in the soup_multipart_new_from_message() function of the libsoup HTTP library, which is commonly used by GNO... | |
| CVE-2025-2784 json | A flaw was found in libsoup. The package is vulnerable to a heap buffer over-read when sniffing content via the skip_insight_... | |
| CVE-2026-115946 json | XS::libbrotli versions before 1.2.1.0 for Perl bundle a brotli library with an out-of-bounds write in the decoder. Affected ... | |
| CVE-2026-120185 json | A security flaw has been discovered in ken678 YznCMS up to 2.2.0. The affected element is the function Backend of the file ap... | |
| CVE-2026-120135 json | Uncontrolled Recursion vulnerability in Apache Thrift Java bindings. This issue affects Apache Thrift: before 0.24.0. U... | |
| CVE-2026-118636 json | **UNSUPPORTED WHEN ASSIGNED** JavaNativeMessageDecoder in the MINA 3.0 codec module calls ObjectInputStream.readObject() o... | |
| CVE-2026-98432 json | In the Linux kernel, the following vulnerability has been resolved: ipv4: free inet_opt and ireq_opt after an RCU grace peri... | |
| CVE-2026-118147 json | Improper certificate validation in Visual Studio allows an unauthorized attacker to perform spoofing over a network. | |
| CVE-2026-85908 json | Heap-based buffer overflow in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-83651 json | Out-of-bounds read in Windows GDI allows an unauthorized attacker to disclose information over a network. | |
| CVE-2026-70211 json | Out-of-bounds read in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally. | |
| CVE-2026-120210 json | FFmpeg 5.0 through 9.0.2 contains a path traversal vulnerability in the IMF demuxer that allows attackers to open files outsi... | |
| CVE-2026-120209 json | AJ-Report through 1.7.1 signs share tokens with a hard-coded JWT secret, allowing attackers to forge valid Share-Tokens offli... | |
| CVE-2026-120208 json | libheif 1.18.0 before 1.23.3 contains a heap-based buffer overflow vulnerability in unc_decoder_mixed_interleave::processTile... | |
| CVE-2026-120207 json | Thelia Page Module before 2.0.4 contains a cross-site request forgery vulnerability that allows remote attackers to delete pa... | |
| CVE-2026-120206 json | Thelia before 3.2.0 contains a cross-site request forgery vulnerability in the back office that allows attackers to forge adm... | |
| CVE-2026-120205 json | Thelia before 3.1.0 contains a stored cross-site scripting vulnerability in ForSomeCustomers::getSummary() that allows unauth... | |
| CVE-2026-120204 json | DeepInfer through 0.1.0 contains a path traversal vulnerability in the unauthenticated /profile endpoint that allows remote a... | |
| CVE-2026-120203 json | ShowDoc 2.8.14 before 3.9.6 contains a code injection vulnerability in its Mock feature that allows authenticated users to ex... | |
| CVE-2026-120202 json | Highflame ramparts 0.8.1 through 0.8.10 contains a security scan bypass vulnerability that allows attackers to hide malicious... | |
| CVE-2026-120201 json | Jpom 2.10.0 through 2.11.12 contains an authentication bypass vulnerability that allows unauthenticated attackers to gain sup... | |
| CVE-2026-120200 json | Nexterm through 1.2.2-BETA contains a missing authorization vulnerability that allows authenticated users to hibernate, resum... | |
| CVE-2026-120199 json | LearnHouse before 1.1.1 contains a missing authorization vulnerability in the assignment API that allows authenticated users ... | |
| CVE-2026-83831 json | Double free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-70271 json | Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-70106 json | Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-83943 json | Exposure of sensitive information to an unauthorized actor in Azure API Center allows an unauthorized attacker to disclose in... | |
| CVE-2026-69399 json | Unintended proxy or intermediary in Azure Arc allows an authorized attacker to elevate privileges over a network. | |
| CVE-2026-118384 json | GNU mtools before 4.0.50 has an out-of-bounds write in parse_vses in vfat.c. | |
| CVE-2026-102212 json | Heap-based buffer overflow in Opengear IM72XX, CM71XX, and ACM70XX firmware versions 4.8.0 through 5.5.2 on console server ap... | |
| CVE-2026-14164 json | A double free issue has been identified in libarchive's RAR5 reader. During parsing of a specially crafted RAR5 archive, the ... | |
| CVE-2026-11850 json | An integer underflow vulnerability was found in MIT krb5 in the berval2tl_data() function in plugins/kdb/ldap/libkdb_ldap/lda... | |
| CVE-2026-78192 json | WebDyne versions from 2.022 before 3.022 for Perl disclose application source to unauthenticated clients via the viewer in th... | |
| CVE-2026-113380 json | In the RingRTC library before 2.72.0 for Signal, a peer that saturates a call's FSM queue can interfere with the ability of a... | |
| CVE-2026-78191 json | WebDyne versions from 2.031 before 3.022 for Perl execute files with .psp anywhere in the name as Perl pages. WebDyne decide... | |
| CVE-2026-78190 json | WebDyne versions from 2.014 before 3.022 for Perl reflect request parameters unescaped into form field values, allowing cross... | |
| CVE-2026-78189 json | WebDyne versions from 3.007 before 3.022 for Perl execute .psp files outside the document root via path traversal in the PSGI... | |
| CVE-2026-78188 json | WebDyne versions from 2.014 before 3.022 for Perl issue session cookies without the Secure, HttpOnly and SameSite attributes.... | |
| CVE-2026-16313 json | A flaw was found in sg3_utils. The sg_inq command, when invoked with the --export option, outputs device identification data ... | |
| CVE-2026-11332 json | A flaw was found in ansible-core. The ansible-galaxy role install command processes dependency specifications from a role's m... | |
| CVE-2026-119250 json | A malicious actor with local access and low privileges could exploit an External Control of File Name or Path vulnerability f... | |
| CVE-2026-119249 json | A malicious actor with access to the network could exploit a Binding to an Unrestricted IP Address vulnerability found in WiF... | |
| CVE-2024-5154 json | A flaw was found in cri-o. A malicious container can create a symbolic link to arbitrary files on the host via directory trav... | |
| CVE-2026-99216 json | In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: Don't reset VMBus connection state on error... | |
| CVE-2026-99213 json | In the Linux kernel, the following vulnerability has been resolved: vsock: treat TCP_CLOSING as once-established Handle the... | |
| CVE-2026-99212 json | In the Linux kernel, the following vulnerability has been resolved: net/rds: don't let the rdma_cm destroy an id RDS still o... | |
| CVE-2026-99203 json | In the Linux kernel, the following vulnerability has been resolved: pipe: preserve existing fasync readers on writer setup f... | |
| CVE-2026-99185 json | In the Linux kernel, the following vulnerability has been resolved: firewire: core: fix race condition in split transaction ... | |
| CVE-2026-99180 json | In the Linux kernel, the following vulnerability has been resolved: unicode: free the map after a grace period generic_ci_d... | |
| CVE-2026-99177 json | In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Fix page dirtying in sev_gmem_post_populate() ... | |
| CVE-2026-99173 json | In the Linux kernel, the following vulnerability has been resolved: eventfs: Free the eventfs_inode after an rcu grace perio... | |
| CVE-2026-99170 json | In the Linux kernel, the following vulnerability has been resolved: namespace: a mount that copy_tree() leaves out can't tak... | |
| CVE-2026-99167 json | In the Linux kernel, the following vulnerability has been resolved: net/sched: fix use-after-free in __tcf_action_put() __t... | |
| CVE-2026-99164 json | In the Linux kernel, the following vulnerability has been resolved: spi: imx: fix slab corruption from undersized DMA bounce... | |
| CVE-2026-99163 json | In the Linux kernel, the following vulnerability has been resolved: tracing/histograms: Reject non-stacktrace fields for syn... | |
| CVE-2026-99156 json | In the Linux kernel, the following vulnerability has been resolved: scsi: st: Fix use-after-free race between st_remove() an... |