CVE - Common Vulnerabilities and Exposures (CVE)

Submit a CVE Request

NOTICE: This web form will be deprecated on November 1, 2026. Requests for CVE Program Support after this date will be through the web forms located here.

* Required

* Select a request type

NOTE: If your request is related to joining a working group, please select "Other".

* Enter your e-mail address

alert

IMPORTANT: Please add cve-request@mitre.org and cve@mitre.org as safe senders in your email client before completing this form.

Enter a PGP Key (to encrypt)

The software performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer.

Cross Site Scripting (XSS)

The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.

The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

XML External Entity (XXE)

The software processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

Insecure Permissions

The software, upon installation, sets incorrect permissions for an object that exposes it to an unintended actor.

Incorrect Access Control

The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

The software performs a calculation that can produce an integer overflow or wraparound, when the logic assumes that the resulting value will always be larger than the original value. This can introduce other weaknesses when the calculation is used for resource management or execution control.

Cross Site Request Forgery (CSRF)

The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

Missing SSL certification verification

The software uses OpenSSL and trusts or uses a certificate without using the SSL_get_verify_result() function to ensure that the certificate satisfies all necessary security requirements.

The software contains a mistake other than above which can be directly used by a hacker to gain access to a system or network.

Algorithm complexity
Array index error
Auth bypass using cookie
Buffer Overflow
Cross-Site Request Forgery (CSRF)
Cross-Site Scripting (XSS)
Directory Traversal
Double free
Eval injection
File Upload
Format String
HTTP Response Splitting

HTTP Request Splitting
Incomplete blacklist
Integer Overflow
Integer Signedness
Memory Leak
Shell Metacharacter Injection
Open Redirect
Redirect without Exit
Path Disclosure
Insecure Permissions
PHP remote file inclusion
Session Fixation

SQL Injection
Symbolic Link Following
Untrusted Search Path
Unquoted Windows search path
Use after free
Default user/password
Large or infinite loop
Exposed insecure/unsafe method in ActiveX control
Generation of insufficiently random numbers
XML Extneral Entity (XXE)
Incorrect Access Control
Missing SSL certificate validation

The vulnerability can be exploited through a network. The attacker may be either on the adjacent or remote network.

To exploit the vulnerability, the attacker needs to be logged into the operating system on a local machine or a guest operating system.

The attacker needs to be located near the victim or have physical access to the vulnerable system to exploit the vulnerability. Examples include touching a workstation keyboard or USB device, "shoulder surfing" to see a workstation's display, and touching the screen of a mobile device.

The type of access needed to exploit the vulnerability is dependent on how the vulnerable product is used. This is most often used for libraries.

More than one CVE ID has been assigned to a single vulnerability.

Vendor rejects the assignment of a particular CVE ID.

A single CVE Entry should be split into two or more CVE Entries OR Two or more existing CVE Entries should be merged into a single CVE Entry.

Update the description in an existing CVE Entry.

Add, remove, or change a reference for an existing CVE Entry.

Any request related to an existing CVE Entry that does not fall within one of the other categories.