CVEs

410,567 total · page 171 of 8,212

CVE	Vendor / Product	Sev	Risk	CVSS	Published	Description
CVE-2026-96375	Drupal Drupal Cloud	Med	0.24	4.8	Oct 22, 2026	Improper Certificate Validation vulnerability in Drupal Cloud allows Adversary in the Middle (AiTM). This issue affects Cloud versions: from 0.0.0 to 7.0.1.
CVE-2026-96374	Drupal Project Browser	Med	0.20	4.2	Oct 22, 2026	Cross-Site Request Forgery (CSRF) vulnerability in Drupal Project Browser allows Cross Site Request Forgery. This issue affects Project Browser versions: from 0.0.0 to 2.0.3, from 2.1.0 to 2.1.5.
CVE-2026-96373	Drupal webform	Low	0.14	3.3	Oct 22, 2026	Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
CVE-2026-96372	Drupal webform	Med	0.28	5.4	Oct 22, 2026	Insufficient Granularity of Access Control vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
CVE-2026-96371	Drupal webform	Med	0.28	5.4	Oct 22, 2026	Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
CVE-2026-96370	Drupal webform	Med	0.28	5.4	Oct 22, 2026	Incorrect Authorization vulnerability in Drupal Webform allows Server Side Request Forgery. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
CVE-2026-96369	Drupal webform	Low	0.13	3.1	Oct 22, 2026	Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Webform allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
CVE-2026-96368	Drupal webform	Med	0.23	4.6	Oct 22, 2026	Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
CVE-2026-96367	Drupal webform	Med	0.23	4.6	Oct 22, 2026	Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
CVE-2026-96366	Drupal webform	Med	0.27	5.3	Oct 22, 2026	Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
CVE-2026-96365	Drupal webform	Hig	0.42	7.5	Oct 22, 2026	Allocation of Resources Without Limits or Throttling vulnerability in Drupal Webform allows Excessive Allocation. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
CVE-2026-96364	Drupal webform	Med	0.27	5.3	Oct 22, 2026	Improper Control of Interaction Frequency vulnerability in Drupal Webform allows Functionality Misuse. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
CVE-2026-96363	Drupal webform	Low	0.13	3.1	Oct 22, 2026	Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
CVE-2026-96362	Drupal webform	Med	0.20	4.2	Oct 22, 2026	Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Cross-Site Scripting (XSS). This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
CVE-2026-96361	Drupal webform	Med	0.23	4.6	Oct 22, 2026	Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Cross-Site Scripting (XSS). This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
CVE-2026-96360	Drupal webform	Low	0.16	3.5	Oct 22, 2026	Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Cross-Site Scripting (XSS). This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
CVE-2026-96359	Drupal webform	Med	0.23	4.6	Oct 22, 2026	Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Cross-Site Scripting (XSS). This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
CVE-2026-96358	Drupal webform	Med	0.23	4.6	Oct 22, 2026	Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Cross-Site Scripting (XSS). This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
CVE-2026-96357	Drupal webform	Med	0.23	4.6	Oct 22, 2026	Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
CVE-2026-96356	Drupal webform	Med	0.27	5.3	Oct 22, 2026	Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
CVE-2026-96355	Drupal webform	Cri	0.52	9.1	Oct 22, 2026	Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Webform allows Code Injection. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
CVE-2026-87955	Drupal Ultimate Table Field	Med	0.21	4.3	Oct 22, 2026	Missing Authorization vulnerability in Drupal Ultimate Table Field allows Forceful Browsing. This issue affects Ultimate Table Field versions: from 0.0.0 to 1.1.1, from 2.0.0 to 2.0.1.
CVE-2026-87954	Drupal Taxonomy Term Glossary	Med	0.21	4.3	Oct 22, 2026	Missing Authorization vulnerability in Drupal Taxonomy Term Glossary allows Forceful Browsing. This issue affects Taxonomy Term Glossary versions: from 0.0.0 to 4.6.0.
CVE-2026-87953	Drupal SAML SSO - Service Provider	Low	0.14	3.3	Oct 22, 2026	Server-Side Request Forgery (SSRF) vulnerability in Drupal SAML SSO - Service Provider allows Server Side Request Forgery. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.
CVE-2026-87952	Drupal SAML SSO - Service Provider	Low	0.13	3.1	Oct 22, 2026	Authentication Bypass by Capture-replay vulnerability in Drupal SAML SSO - Service Provider allows Remote Services with Stolen Credentials. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.
CVE-2026-87951	Drupal SAML SSO - Service Provider	Low	0.18	3.8	Oct 22, 2026	Insecure Storage of Sensitive Information vulnerability in Drupal SAML SSO - Service Provider allows Retrieve Embedded Sensitive Data. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.
CVE-2026-87950	Drupal SAML SSO - Service Provider	Med	0.27	5.3	Oct 22, 2026	Use of Hard-coded Credentials vulnerability in Drupal SAML SSO - Service Provider allows Retrieve Embedded Sensitive Data. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.
CVE-2026-87949	Drupal SAML SSO - Service Provider	Low	0.14	3.3	Oct 22, 2026	Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal SAML SSO - Service Provider allows Cross-Site Scripting (XSS). This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.
CVE-2026-87948	Drupal SAML SSO - Service Provider	Low	0.16	3.5	Oct 22, 2026	Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal SAML SSO - Service Provider allows Cross-Site Scripting (XSS). This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.
CVE-2026-87947	Drupal SAML SSO - Service Provider	Med	0.24	4.8	Oct 22, 2026	Improper Verification of Cryptographic Signature vulnerability in Drupal SAML SSO - Service Provider allows Signature Spoof. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.
CVE-2026-87946	Drupal SAML SSO - Service Provider	Med	0.24	4.8	Oct 22, 2026	Observable Timing Discrepancy vulnerability in Drupal SAML SSO - Service Provider allows Brute Force. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.
CVE-2026-87945	Drupal SAML SSO - Service Provider	Med	0.28	5.4	Oct 22, 2026	URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal SAML SSO - Service Provider allows Fake the Source of Data. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.
CVE-2026-87944	Drupal SAML SSO - Service Provider	Med	0.24	4.8	Oct 22, 2026	Improper Certificate Validation vulnerability in Drupal SAML SSO - Service Provider allows Adversary in the Middle (AiTM). This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.
CVE-2026-87943	Drupal SAML SSO - Service Provider	Med	0.35	6.5	Oct 22, 2026	Missing Authorization vulnerability in Drupal SAML SSO - Service Provider allows Forceful Browsing. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.
CVE-2026-87942	Drupal SafeDelete	Med	0.23	4.6	Oct 22, 2026	Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal SafeDelete allows Stored XSS. This issue affects SafeDelete versions: from 0.0.0 to 1.0.88.
CVE-2026-87941	Drupal Patreon	Med	0.38	5.9	Oct 22, 2026	Vulnerability in Drupal Patreon. This issue affects Patreon versions: 7.x.
CVE-2026-87940	Drupal Key auth	Med	0.28	5.4	Oct 22, 2026	Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Key auth allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Key auth versions: from 0.0.0 to 2.2.4.
CVE-2026-87939	Drupal Feed Block	Med	0.20	4.2	Oct 22, 2026	Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Feed Block allows Stored XSS. This issue affects Feed Block versions: from 0.0.0 to 2.0.2, from 3.0.0 to 3.0.2.
CVE-2026-87938	Drupal CSP log	Med	0.35	6.5	Oct 22, 2026	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal CSP log allows SQL Injection. This issue affects CSP log versions: from 0.0.0 to 1.0.2.
CVE-2026-87937	Drupal Central Authentication System (CAS) Server	Med	0.35	6.5	Oct 22, 2026	URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal Central Authentication System (CAS) Server allows Fake the Source of Data. This issue affects Central Authentication System (CAS) Server versions: from 0.0.0 to 2.0.4, from 2.1.0 to 2.1.3.
CVE-2026-87936	Drupal amazee.ai Private AI Provider	Med	0.35	6.5	Oct 22, 2026	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal amazee.ai Private AI Provider allows SQL Injection. This issue affects amazee.ai Private AI Provider versions: from 0.0.0 to 1.3.7, from 1.4.0 to 1.4.3.
CVE-2026-84924	Drupal Email Verification / SMS Verification / OTP Verification	Med	0.35	5.4	Oct 22, 2026	Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Email Verification / SMS Verification / OTP Verification allows Reflected XSS. This issue affects Email Verification / SMS Verification / OTP Verification versions: from…
CVE-2026-84923	Drupal Email Verification / SMS Verification / OTP Verification	Med	0.42	6.5	Oct 22, 2026	Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Email Verification / SMS Verification / OTP Verification allows Authentication Bypass. This issue affects Email Verification / SMS Verification / OTP Verification versions: from 0.0.0 to 2.4.0.
CVE-2026-84921	Drupal Webform Submissions Delete	Med	0.34	5.3	Oct 22, 2026	Missing Authorization vulnerability in Drupal Webform Submissions Delete allows Forceful Browsing. This issue affects Webform Submissions Delete versions: from 0.0.0 to 1.2.0.
CVE-2026-84920	Drupal Unpublished Node Permissions	Med	0.34	5.3	Oct 22, 2026	Incorrect Authorization vulnerability in Drupal Unpublished Node Permissions allows Forceful Browsing. This issue affects Unpublished Node Permissions versions: from 0.0.0 to 1.8.0.
CVE-2026-84919	Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery	Med	0.23	4.6	Oct 22, 2026	Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery allows Stored XSS. This issue affects PhotoSwipe - Responsive JavaScript Modal Image Gallery versions: from 0.0.0…
CVE-2026-84918	Drupal Monobank payment API	Low	0.17	3.7	Oct 22, 2026	Improper Verification of Cryptographic Signature vulnerability in Drupal Monobank payment API allows Signature Spoof. This issue affects Monobank payment API versions: from 0.0.0 to 1.0.3.
CVE-2026-84917	Drupal Jsonapi Role Access	Med	0.35	6.5	Oct 22, 2026	Incorrect Authorization vulnerability in Drupal Jsonapi Role Access allows Forceful Browsing. This issue affects Jsonapi Role Access versions: from 0.0.0 to 2.0.2.
CVE-2026-84916	Drupal Islandora	Low	0.17	3.7	Oct 22, 2026	Missing Authorization vulnerability in Drupal Islandora allows Forceful Browsing. This issue affects Islandora versions: from 0.0.0 to 2.19.0.
CVE-2026-84915	Drupal Component blocks	Med	0.23	4.6	Oct 22, 2026	Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Component blocks allows Stored XSS. This issue affects Component blocks versions: from 0.0.0 to 1.2.7.

CVE-2026-96375MedOct 22, 2026
Drupal
Drupal Cloud
risk 0.24cvss 4.8epss 0.00
Improper Certificate Validation vulnerability in Drupal Cloud allows Adversary in the Middle (AiTM). This issue affects Cloud versions: from 0.0.0 to 7.0.1.
CVE-2026-96374MedOct 22, 2026
Drupal
Project Browser
risk 0.20cvss 4.2epss 0.00
Cross-Site Request Forgery (CSRF) vulnerability in Drupal Project Browser allows Cross Site Request Forgery. This issue affects Project Browser versions: from 0.0.0 to 2.0.3, from 2.1.0 to 2.1.5.
CVE-2026-96373LowOct 22, 2026
Drupal
webform
risk 0.14cvss 3.3epss 0.00
Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
CVE-2026-96372MedOct 22, 2026
Drupal
webform
risk 0.28cvss 5.4epss 0.00
Insufficient Granularity of Access Control vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
CVE-2026-96371MedOct 22, 2026
Drupal
webform
risk 0.28cvss 5.4epss 0.00
Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
CVE-2026-96370MedOct 22, 2026
Drupal
webform
risk 0.28cvss 5.4epss 0.00
Incorrect Authorization vulnerability in Drupal Webform allows Server Side Request Forgery. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
CVE-2026-96369LowOct 22, 2026
Drupal
webform
risk 0.13cvss 3.1epss 0.00
Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Webform allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
CVE-2026-96368MedOct 22, 2026
Drupal
webform
risk 0.23cvss 4.6epss 0.00
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
CVE-2026-96367MedOct 22, 2026
Drupal
webform
risk 0.23cvss 4.6epss 0.00
Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
CVE-2026-96366MedOct 22, 2026
Drupal
webform
risk 0.27cvss 5.3epss 0.00
Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
CVE-2026-96365HigOct 22, 2026
Drupal
webform
risk 0.42cvss 7.5epss 0.00
Allocation of Resources Without Limits or Throttling vulnerability in Drupal Webform allows Excessive Allocation. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
CVE-2026-96364MedOct 22, 2026
Drupal
webform
risk 0.27cvss 5.3epss 0.00
Improper Control of Interaction Frequency vulnerability in Drupal Webform allows Functionality Misuse. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
CVE-2026-96363LowOct 22, 2026
Drupal
webform
risk 0.13cvss 3.1epss 0.00
Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
CVE-2026-96362MedOct 22, 2026
Drupal
webform
risk 0.20cvss 4.2epss 0.00
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Cross-Site Scripting (XSS). This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
CVE-2026-96361MedOct 22, 2026
Drupal
webform
risk 0.23cvss 4.6epss 0.00
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Cross-Site Scripting (XSS). This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
CVE-2026-96360LowOct 22, 2026
Drupal
webform
risk 0.16cvss 3.5epss 0.00
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Cross-Site Scripting (XSS). This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
CVE-2026-96359MedOct 22, 2026
Drupal
webform
risk 0.23cvss 4.6epss 0.00
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Cross-Site Scripting (XSS). This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
CVE-2026-96358MedOct 22, 2026
Drupal
webform
risk 0.23cvss 4.6epss 0.00
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Cross-Site Scripting (XSS). This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
CVE-2026-96357MedOct 22, 2026
Drupal
webform
risk 0.23cvss 4.6epss 0.00
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
CVE-2026-96356MedOct 22, 2026
Drupal
webform
risk 0.27cvss 5.3epss 0.00
Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
CVE-2026-96355CriOct 22, 2026
Drupal
webform
risk 0.52cvss 9.1epss 0.00
Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Webform allows Code Injection. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
CVE-2026-87955MedOct 22, 2026
Drupal
Ultimate Table Field
risk 0.21cvss 4.3epss 0.00
Missing Authorization vulnerability in Drupal Ultimate Table Field allows Forceful Browsing. This issue affects Ultimate Table Field versions: from 0.0.0 to 1.1.1, from 2.0.0 to 2.0.1.
CVE-2026-87954MedOct 22, 2026
Drupal
Taxonomy Term Glossary
risk 0.21cvss 4.3epss 0.00
Missing Authorization vulnerability in Drupal Taxonomy Term Glossary allows Forceful Browsing. This issue affects Taxonomy Term Glossary versions: from 0.0.0 to 4.6.0.
CVE-2026-87953LowOct 22, 2026
Drupal
SAML SSO - Service Provider
risk 0.14cvss 3.3epss 0.00
Server-Side Request Forgery (SSRF) vulnerability in Drupal SAML SSO - Service Provider allows Server Side Request Forgery. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.
CVE-2026-87952LowOct 22, 2026
Drupal
SAML SSO - Service Provider
risk 0.13cvss 3.1epss 0.00
Authentication Bypass by Capture-replay vulnerability in Drupal SAML SSO - Service Provider allows Remote Services with Stolen Credentials. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.
CVE-2026-87951LowOct 22, 2026
Drupal
SAML SSO - Service Provider
risk 0.18cvss 3.8epss 0.00
Insecure Storage of Sensitive Information vulnerability in Drupal SAML SSO - Service Provider allows Retrieve Embedded Sensitive Data. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.
CVE-2026-87950MedOct 22, 2026
Drupal
SAML SSO - Service Provider
risk 0.27cvss 5.3epss 0.00
Use of Hard-coded Credentials vulnerability in Drupal SAML SSO - Service Provider allows Retrieve Embedded Sensitive Data. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.
CVE-2026-87949LowOct 22, 2026
Drupal
SAML SSO - Service Provider
risk 0.14cvss 3.3epss 0.00
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal SAML SSO - Service Provider allows Cross-Site Scripting (XSS). This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.
CVE-2026-87948LowOct 22, 2026
Drupal
SAML SSO - Service Provider
risk 0.16cvss 3.5epss 0.00
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal SAML SSO - Service Provider allows Cross-Site Scripting (XSS). This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.
CVE-2026-87947MedOct 22, 2026
Drupal
SAML SSO - Service Provider
risk 0.24cvss 4.8epss 0.00
Improper Verification of Cryptographic Signature vulnerability in Drupal SAML SSO - Service Provider allows Signature Spoof. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.
CVE-2026-87946MedOct 22, 2026
Drupal
SAML SSO - Service Provider
risk 0.24cvss 4.8epss 0.00
Observable Timing Discrepancy vulnerability in Drupal SAML SSO - Service Provider allows Brute Force. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.
CVE-2026-87945MedOct 22, 2026
Drupal
SAML SSO - Service Provider
risk 0.28cvss 5.4epss 0.00
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal SAML SSO - Service Provider allows Fake the Source of Data. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.
CVE-2026-87944MedOct 22, 2026
Drupal
SAML SSO - Service Provider
risk 0.24cvss 4.8epss 0.00
Improper Certificate Validation vulnerability in Drupal SAML SSO - Service Provider allows Adversary in the Middle (AiTM). This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.
CVE-2026-87943MedOct 22, 2026
Drupal
SAML SSO - Service Provider
risk 0.35cvss 6.5epss 0.00
Missing Authorization vulnerability in Drupal SAML SSO - Service Provider allows Forceful Browsing. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.
CVE-2026-87942MedOct 22, 2026
Drupal
SafeDelete
risk 0.23cvss 4.6epss 0.00
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal SafeDelete allows Stored XSS. This issue affects SafeDelete versions: from 0.0.0 to 1.0.88.
CVE-2026-87941MedOct 22, 2026
Drupal
Patreon
risk 0.38cvss 5.9epss 0.00
Vulnerability in Drupal Patreon. This issue affects Patreon versions: 7.x.
CVE-2026-87940MedOct 22, 2026
Drupal
Key auth
risk 0.28cvss 5.4epss 0.00
Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Key auth allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Key auth versions: from 0.0.0 to 2.2.4.
CVE-2026-87939MedOct 22, 2026
Drupal
Feed Block
risk 0.20cvss 4.2epss 0.00
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Feed Block allows Stored XSS. This issue affects Feed Block versions: from 0.0.0 to 2.0.2, from 3.0.0 to 3.0.2.
CVE-2026-87938MedOct 22, 2026
Drupal
CSP log
risk 0.35cvss 6.5epss 0.00
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal CSP log allows SQL Injection. This issue affects CSP log versions: from 0.0.0 to 1.0.2.
CVE-2026-87937MedOct 22, 2026
Drupal
Central Authentication System (CAS) Server
risk 0.35cvss 6.5epss 0.00
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal Central Authentication System (CAS) Server allows Fake the Source of Data. This issue affects Central Authentication System (CAS) Server versions: from 0.0.0 to 2.0.4, from 2.1.0 to 2.1.3.
CVE-2026-87936MedOct 22, 2026
Drupal
amazee.ai Private AI Provider
risk 0.35cvss 6.5epss 0.00
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal amazee.ai Private AI Provider allows SQL Injection. This issue affects amazee.ai Private AI Provider versions: from 0.0.0 to 1.3.7, from 1.4.0 to 1.4.3.
CVE-2026-84924MedOct 22, 2026
Drupal
Email Verification / SMS Verification / OTP Verification
risk 0.35cvss 5.4epss 0.00
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Email Verification / SMS Verification / OTP Verification allows Reflected XSS. This issue affects Email Verification / SMS Verification / OTP Verification versions: from…
CVE-2026-84923MedOct 22, 2026
Drupal
Email Verification / SMS Verification / OTP Verification
risk 0.42cvss 6.5epss 0.00
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Email Verification / SMS Verification / OTP Verification allows Authentication Bypass. This issue affects Email Verification / SMS Verification / OTP Verification versions: from 0.0.0 to 2.4.0.
CVE-2026-84921MedOct 22, 2026
Drupal
Webform Submissions Delete
risk 0.34cvss 5.3epss 0.00
Missing Authorization vulnerability in Drupal Webform Submissions Delete allows Forceful Browsing. This issue affects Webform Submissions Delete versions: from 0.0.0 to 1.2.0.
CVE-2026-84920MedOct 22, 2026
Drupal
Unpublished Node Permissions
risk 0.34cvss 5.3epss 0.00
Incorrect Authorization vulnerability in Drupal Unpublished Node Permissions allows Forceful Browsing. This issue affects Unpublished Node Permissions versions: from 0.0.0 to 1.8.0.
CVE-2026-84919MedOct 22, 2026
Drupal
PhotoSwipe - Responsive JavaScript Modal Image Gallery
risk 0.23cvss 4.6epss 0.00
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery allows Stored XSS. This issue affects PhotoSwipe - Responsive JavaScript Modal Image Gallery versions: from 0.0.0…
CVE-2026-84918LowOct 22, 2026
Drupal
Monobank payment API
risk 0.17cvss 3.7epss 0.00
Improper Verification of Cryptographic Signature vulnerability in Drupal Monobank payment API allows Signature Spoof. This issue affects Monobank payment API versions: from 0.0.0 to 1.0.3.
CVE-2026-84917MedOct 22, 2026
Drupal
Jsonapi Role Access
risk 0.35cvss 6.5epss 0.00
Incorrect Authorization vulnerability in Drupal Jsonapi Role Access allows Forceful Browsing. This issue affects Jsonapi Role Access versions: from 0.0.0 to 2.0.2.
CVE-2026-84916LowOct 22, 2026
Drupal
Islandora
risk 0.17cvss 3.7epss 0.00
Missing Authorization vulnerability in Drupal Islandora allows Forceful Browsing. This issue affects Islandora versions: from 0.0.0 to 2.19.0.
CVE-2026-84915MedOct 22, 2026
Drupal
Component blocks
risk 0.23cvss 4.6epss 0.00
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Component blocks allows Stored XSS. This issue affects Component blocks versions: from 0.0.0 to 1.2.7.