CVEs

410,382 total · page 88 of 8,208

CVE	Vendor / Product	Sev	Risk	CVSS	EPSS	Published	Description
CVE-2026-118584	Drupal Field Permissions	Med	0.34	5.3	0.00	Oct 30, 2026	Incorrect Authorization vulnerability in Drupal Field Permissions allows Forceful Browsing. This issue affects Field Permissions versions: from 0.0.0 to 1.6.0.
CVE-2026-118583	Drupal Field Permissions	Med	0.34	5.3	0.00	Oct 30, 2026	Incorrect Authorization vulnerability in Drupal Field Permissions allows Forceful Browsing. This issue affects Field Permissions versions: from 0.0.0 to 1.6.0.
CVE-2026-118582	Drupal CAPTCHA	Hig	0.40	7.3	0.00	Oct 30, 2026	Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal CAPTCHA allows Functionality Bypass. This issue affects CAPTCHA versions: from 0.0.0 to 1.18.0, from 2.0.0 to 2.0.11.
CVE-2026-118576	Drupal Stage File Proxy	Med	0.35	6.5	0.00	Oct 30, 2026	Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Stage File Proxy allows Cross-Site Scripting (XSS). This issue affects Stage File Proxy versions: from 0.0.0 to 3.1.7, from 4.0.0 to 4.0.1.
CVE-2026-118575	Drupal Signature pad widget	Med	0.40	6.1	0.00	Oct 30, 2026	Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Signature pad widget allows Stored XSS. This issue affects Signature pad widget versions: from 0.0.0 to 1.15.0.
CVE-2026-118574	Drupal S3 File System	Med	0.36	5.6	0.00	Oct 30, 2026	Incorrect Permission Assignment for Critical Resource vulnerability in Drupal S3 File System allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects S3 File System versions: from 0.0.0 to 3.12.0.
CVE-2026-118573	Drupal OAuth2 Token Manager	Med	0.31	4.8	0.00	Oct 30, 2026	Missing Authorization vulnerability in Drupal OAuth2 Token Manager allows Forceful Browsing. This issue affects OAuth2 Token Manager versions: from 0.0.0 to 1.2.0.
CVE-2026-118572	Drupal OAuth Login - OAuth OIDC SSO	Med	0.24	4.8	0.00	Oct 30, 2026	Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal OAuth Login - OAuth OIDC SSO allows Authentication Bypass. This issue affects OAuth Login - OAuth OIDC SSO versions: from 0.0.0 to 3.1.1.
CVE-2026-118571	Drupal Media Alias Display	Med	0.31	5.9	0.00	Oct 30, 2026	Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Media Alias Display allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Media Alias Display versions: from 0.0.0 to 2.1.3, from 3.0.0 to 3.0.3.
CVE-2026-118570	Drupal Fasttoggle	Med	0.35	6.5	0.00	Oct 30, 2026	Cross-Site Request Forgery (CSRF) vulnerability in Drupal Fasttoggle allows Cross Site Request Forgery. This issue affects Fasttoggle versions: from 0.0.0 to 4.1.1.
CVE-2026-118569	Drupal Fasttoggle	Med	0.28	5.4	0.00	Oct 30, 2026	Incorrect Authorization vulnerability in Drupal Fasttoggle allows Forceful Browsing. This issue affects Fasttoggle versions: from 0.0.0 to 4.1.1.
CVE-2026-118568	Drupal Content Sync	Low	0.14	3.3	0.00	Oct 30, 2026	Insecure Storage of Sensitive Information vulnerability in Drupal Content Sync (content-sync.io) allows Retrieve Embedded Sensitive Data. This issue affects Content Sync (content-sync.io) versions: from 0.0.0 to 3.2.2.
CVE-2026-118567	Drupal Bulk Update User Roles	Med	0.24	4.7	0.00	Oct 30, 2026	Incorrect Authorization vulnerability in Drupal Bulk Update User Roles allows Forceful Browsing. This issue affects Bulk Update User Roles versions: from 0.0.0 to 1.0.5.
CVE-2026-118565	Daxko GroupEx PRO	Hig	0.47	7.2	0.00	Oct 30, 2026	Vulnerability in Drupal GroupEx PRO ( Daxko ) integration. This issue affects GroupEx PRO ( Daxko ) integration versions: ..
CVE-2026-118564	Drupal PayUmoney for Drupal Commerce	Med	0.43	6.6	0.00	Oct 30, 2026	Vulnerability in Drupal PayUmoney for Drupal Commerce. This issue affects PayUmoney for Drupal Commerce versions: ..
CVE-2026-118563	Drupal CacheFlush	Med	0.43	6.6	0.00	Oct 30, 2026	Vulnerability in Drupal CacheFlush. This issue affects CacheFlush versions: ..
CVE-2026-118562	Drupal Single Content Sync	Hig	0.40	7.2	0.00	Oct 30, 2026	Deserialization of Untrusted Data vulnerability in Drupal Single Content Sync allows Object Injection. This issue affects Single Content Sync versions: from 0.0.0 to 1.4.19.
CVE-2026-118561	Drupal Single Content Sync	Hig	0.40	7.2	0.00	Oct 30, 2026	External Control of File Name or Path vulnerability in Drupal Single Content Sync allows Path Traversal. This issue affects Single Content Sync versions: from 0.0.0 to 1.4.19.
CVE-2026-118560	Drupal Commerce Stripe	Med	0.26	5.1	0.00	Oct 30, 2026	Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Commerce Stripe allows Cross-Site Scripting (XSS). This issue affects Commerce Stripe versions: from 2.0.0 to 2.2.3.
CVE-2026-118559	Drupal Commerce Stripe	Med	0.27	5.3	0.00	Oct 30, 2026	Improper Verification of Cryptographic Signature vulnerability in Drupal Commerce Stripe allows Signature Spoof. This issue affects Commerce Stripe versions: from 0.0.0 to 1.4, from 2.0.0 to 2.2.3.
CVE-2026-118558	Drupal Commerce Stripe	Hig	0.40	7.3	0.00	Oct 30, 2026	Cross-Site Request Forgery (CSRF) vulnerability in Drupal Commerce Stripe allows Cross Site Request Forgery. This issue affects Commerce Stripe versions: from 2.0.0 to 2.2.3.
CVE-2026-118557	Drupal Commerce Shipping	Low	0.11	2.7	0.00	Oct 30, 2026	Incorrect Authorization vulnerability in Drupal Commerce Shipping allows Forceful Browsing. This issue affects Commerce Shipping versions: from 0.0.0 to 2.16.0, from 3.0.0 to 3.0.6.
CVE-2026-118556	Drupal Commerce Shipping	Med	0.35	6.5	0.00	Oct 30, 2026	Incorrect Authorization vulnerability in Drupal Commerce Shipping allows Forceful Browsing. This issue affects Commerce Shipping versions: from 0.0.0 to 2.16.0, from 3.0.0 to 3.0.6.
CVE-2026-118555	Drupal Commerce License	Med	0.34	6.3	0.00	Oct 30, 2026	Incorrect Authorization vulnerability in Drupal Commerce License allows Forceful Browsing. This issue affects Commerce License versions: from 0.0.0 to 3.1.1.
CVE-2026-118554	Drupal OpenID Connect Client	Med	0.28	5.4	0.00	Oct 30, 2026	Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal OpenID Connect Client allows Authentication Bypass. This issue affects OpenID Connect Client versions: from 0.0.0 to 2.3.1.
CVE-2026-118553	Drupal AI (Artificial Intelligence)	Med	0.29	5.5	0.00	Oct 30, 2026	Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Stored XSS. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2.
CVE-2026-118552	Drupal AI (Artificial Intelligence)	Med	0.35	6.5	0.00	Oct 30, 2026	Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Cross-Site Scripting (XSS). This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2.
CVE-2026-118551	Drupal AI (Artificial Intelligence)	Low	0.13	3.1	0.00	Oct 30, 2026	Insecure Storage of Sensitive Information vulnerability in Drupal AI (Artificial Intelligence) allows Retrieve Embedded Sensitive Data. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2.
CVE-2026-118550	Drupal AI (Artificial Intelligence)	Med	0.31	5.9	0.00	Oct 30, 2026	Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal AI (Artificial Intelligence) allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.5.0 to…
CVE-2026-118549	Drupal AI (Artificial Intelligence)	Hig	0.39	7.1	0.00	Oct 30, 2026	Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Cross-Site Scripting (XSS). This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2.
CVE-2026-118548	Drupal AI (Artificial Intelligence)	Low	0.17	3.7	0.00	Oct 30, 2026	Incorrect Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Resource Injection. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2.
CVE-2026-118546	Drupal AI (Artificial Intelligence)	Med	0.35	6.5	0.00	Oct 30, 2026	Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Cross-Site Scripting (XSS). This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2.
CVE-2026-118545	Drupal AI (Artificial Intelligence)	Med	0.35	6.5	0.00	Oct 30, 2026	Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Cross-Site Scripting (XSS). This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2.
CVE-2026-118544	Drupal Commerce Core	Low	0.24	3.7	0.00	Oct 30, 2026	Exposure of Sensitive Information Through Data Queries vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13.
CVE-2026-118543	Drupal Commerce Core	Med	0.34	5.3	0.00	Oct 30, 2026	Cross-Site Request Forgery (CSRF) vulnerability in Drupal Commerce Core allows Cross Site Request Forgery. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13.
CVE-2026-118542	Drupal Commerce Core	Low	0.18	2.7	0.00	Oct 30, 2026	Incorrect Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13.
CVE-2026-118541	Drupal Commerce Core	Med	0.28	4.3	0.00	Oct 30, 2026	Incorrect Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13.
CVE-2026-118540	Drupal Commerce Core	Med	0.27	5.3	0.00	Oct 30, 2026	Incorrect Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41, from 3.0.0 to 3.2.0.
CVE-2026-118539	Drupal Commerce Core	Med	0.42	6.5	0.01	Oct 30, 2026	Missing Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41, from 3.0.0 to 3.3.13.
CVE-2026-114573	Drupal Monster Menus	Hig	0.50	8.8	0.00	Oct 30, 2026	Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Monster Menus allows Object Injection. This issue affects Monster Menus versions: from 0.0.0 to 9.5.6.
CVE-2026-114572	Drupal Domain Login Restrict	Med	0.35	5.4	0.00	Oct 30, 2026	Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Domain Login Restrict allows Authentication Bypass. This issue affects Domain Login Restrict versions: from 0.0.0 to 1.5.0.
CVE-2026-114571	Drupal Rabbit Hole	Med	0.42	6.5	0.00	Oct 30, 2026	Incorrect Authorization vulnerability in Drupal Rabbit Hole allows Forceful Browsing. This issue affects Rabbit Hole versions: from 0.0.0 to 1.3.0.
CVE-2026-114555	Drupal Data field	Low	0.16	3.5	0.00	Oct 30, 2026	Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Data field allows Stored XSS. This issue affects Data field versions: from 0.0.0 to 2.0.14.
CVE-2026-114554	Drupal AI File to Text	Med	0.21	4.3	0.00	Oct 30, 2026	Incorrect Authorization vulnerability in Drupal AI File to Text allows Forceful Browsing. This issue affects AI File to Text versions: from 0.0.0 to 1.0.1.
CVE-2026-114553	Drupal Frontend Editing	Med	0.28	5.4	0.00	Oct 30, 2026	Incorrect Authorization vulnerability in Drupal Frontend Editing allows Forceful Browsing. This issue affects Frontend Editing versions: from 0.0.0 to 1.9.3.
CVE-2026-114548	Drupal ImageAPI Optimize WebP	Low	0.17	3.7	0.00	Oct 30, 2026	Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal ImageAPI Optimize WebP allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects ImageAPI Optimize WebP versions: from 0.0.0 to 2.1.2.
CVE-2026-114547	Drupal TinyPNG	Low	0.17	3.7	0.00	Oct 30, 2026	Missing Authorization vulnerability in Drupal TinyPNG allows Forceful Browsing. This issue affects TinyPNG versions: from 0.0.0 to 2.0.2.
CVE-2026-114546	Drupal Media Alias Display	Low	0.17	3.7	0.00	Oct 30, 2026	Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Media Alias Display allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Media Alias Display versions: from 0.0.0 to 2.1.2, from 3.0.0 to 3.0.2.
CVE-2026-114545	Drupal Fullcalendar View	Med	0.28	5.4	0.00	Oct 30, 2026	Incorrect Authorization vulnerability in Drupal Fullcalendar View allows Forceful Browsing. This issue affects Fullcalendar View versions: from 0.0.0 to 5.2.6.
CVE-2026-114544	Drupal Media Bulk Upload	Med	0.28	5.4	0.00	Oct 30, 2026	Incorrect Authorization vulnerability in Drupal Media Bulk Upload allows Forceful Browsing. This issue affects Media Bulk Upload versions: from 0.0.0 to 3.0.6.

CVE-2026-118584MedOct 30, 2026
Drupal
Field Permissions
risk 0.34cvss 5.3epss 0.00
Incorrect Authorization vulnerability in Drupal Field Permissions allows Forceful Browsing. This issue affects Field Permissions versions: from 0.0.0 to 1.6.0.
CVE-2026-118583MedOct 30, 2026
Drupal
Field Permissions
risk 0.34cvss 5.3epss 0.00
Incorrect Authorization vulnerability in Drupal Field Permissions allows Forceful Browsing. This issue affects Field Permissions versions: from 0.0.0 to 1.6.0.
CVE-2026-118582HigOct 30, 2026
Drupal
CAPTCHA
risk 0.40cvss 7.3epss 0.00
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal CAPTCHA allows Functionality Bypass. This issue affects CAPTCHA versions: from 0.0.0 to 1.18.0, from 2.0.0 to 2.0.11.
CVE-2026-118576MedOct 30, 2026
Drupal
Stage File Proxy
risk 0.35cvss 6.5epss 0.00
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Stage File Proxy allows Cross-Site Scripting (XSS). This issue affects Stage File Proxy versions: from 0.0.0 to 3.1.7, from 4.0.0 to 4.0.1.
CVE-2026-118575MedOct 30, 2026
Drupal
Signature pad widget
risk 0.40cvss 6.1epss 0.00
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Signature pad widget allows Stored XSS. This issue affects Signature pad widget versions: from 0.0.0 to 1.15.0.
CVE-2026-118574MedOct 30, 2026
Drupal
S3 File System
risk 0.36cvss 5.6epss 0.00
Incorrect Permission Assignment for Critical Resource vulnerability in Drupal S3 File System allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects S3 File System versions: from 0.0.0 to 3.12.0.
CVE-2026-118573MedOct 30, 2026
Drupal
OAuth2 Token Manager
risk 0.31cvss 4.8epss 0.00
Missing Authorization vulnerability in Drupal OAuth2 Token Manager allows Forceful Browsing. This issue affects OAuth2 Token Manager versions: from 0.0.0 to 1.2.0.
CVE-2026-118572MedOct 30, 2026
Drupal
OAuth Login - OAuth OIDC SSO
risk 0.24cvss 4.8epss 0.00
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal OAuth Login - OAuth OIDC SSO allows Authentication Bypass. This issue affects OAuth Login - OAuth OIDC SSO versions: from 0.0.0 to 3.1.1.
CVE-2026-118571MedOct 30, 2026
Drupal
Media Alias Display
risk 0.31cvss 5.9epss 0.00
Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Media Alias Display allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Media Alias Display versions: from 0.0.0 to 2.1.3, from 3.0.0 to 3.0.3.
CVE-2026-118570MedOct 30, 2026
Drupal
Fasttoggle
risk 0.35cvss 6.5epss 0.00
Cross-Site Request Forgery (CSRF) vulnerability in Drupal Fasttoggle allows Cross Site Request Forgery. This issue affects Fasttoggle versions: from 0.0.0 to 4.1.1.
CVE-2026-118569MedOct 30, 2026
Drupal
Fasttoggle
risk 0.28cvss 5.4epss 0.00
Incorrect Authorization vulnerability in Drupal Fasttoggle allows Forceful Browsing. This issue affects Fasttoggle versions: from 0.0.0 to 4.1.1.
CVE-2026-118568LowOct 30, 2026
Drupal
Content Sync
risk 0.14cvss 3.3epss 0.00
Insecure Storage of Sensitive Information vulnerability in Drupal Content Sync (content-sync.io) allows Retrieve Embedded Sensitive Data. This issue affects Content Sync (content-sync.io) versions: from 0.0.0 to 3.2.2.
CVE-2026-118567MedOct 30, 2026
Drupal
Bulk Update User Roles
risk 0.24cvss 4.7epss 0.00
Incorrect Authorization vulnerability in Drupal Bulk Update User Roles allows Forceful Browsing. This issue affects Bulk Update User Roles versions: from 0.0.0 to 1.0.5.
CVE-2026-118565HigOct 30, 2026
Daxko
GroupEx PRO
risk 0.47cvss 7.2epss 0.00
Vulnerability in Drupal GroupEx PRO ( Daxko ) integration. This issue affects GroupEx PRO ( Daxko ) integration versions: *.*.
CVE-2026-118564MedOct 30, 2026
Drupal
PayUmoney for Drupal Commerce
risk 0.43cvss 6.6epss 0.00
Vulnerability in Drupal PayUmoney for Drupal Commerce. This issue affects PayUmoney for Drupal Commerce versions: *.*.
CVE-2026-118563MedOct 30, 2026
Drupal
CacheFlush
risk 0.43cvss 6.6epss 0.00
Vulnerability in Drupal CacheFlush. This issue affects CacheFlush versions: *.*.
CVE-2026-118562HigOct 30, 2026
Drupal
Single Content Sync
risk 0.40cvss 7.2epss 0.00
Deserialization of Untrusted Data vulnerability in Drupal Single Content Sync allows Object Injection. This issue affects Single Content Sync versions: from 0.0.0 to 1.4.19.
CVE-2026-118561HigOct 30, 2026
Drupal
Single Content Sync
risk 0.40cvss 7.2epss 0.00
External Control of File Name or Path vulnerability in Drupal Single Content Sync allows Path Traversal. This issue affects Single Content Sync versions: from 0.0.0 to 1.4.19.
CVE-2026-118560MedOct 30, 2026
Drupal
Commerce Stripe
risk 0.26cvss 5.1epss 0.00
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Commerce Stripe allows Cross-Site Scripting (XSS). This issue affects Commerce Stripe versions: from 2.0.0 to 2.2.3.
CVE-2026-118559MedOct 30, 2026
Drupal
Commerce Stripe
risk 0.27cvss 5.3epss 0.00
Improper Verification of Cryptographic Signature vulnerability in Drupal Commerce Stripe allows Signature Spoof. This issue affects Commerce Stripe versions: from 0.0.0 to 1.4, from 2.0.0 to 2.2.3.
CVE-2026-118558HigOct 30, 2026
Drupal
Commerce Stripe
risk 0.40cvss 7.3epss 0.00
Cross-Site Request Forgery (CSRF) vulnerability in Drupal Commerce Stripe allows Cross Site Request Forgery. This issue affects Commerce Stripe versions: from 2.0.0 to 2.2.3.
CVE-2026-118557LowOct 30, 2026
Drupal
Commerce Shipping
risk 0.11cvss 2.7epss 0.00
Incorrect Authorization vulnerability in Drupal Commerce Shipping allows Forceful Browsing. This issue affects Commerce Shipping versions: from 0.0.0 to 2.16.0, from 3.0.0 to 3.0.6.
CVE-2026-118556MedOct 30, 2026
Drupal
Commerce Shipping
risk 0.35cvss 6.5epss 0.00
Incorrect Authorization vulnerability in Drupal Commerce Shipping allows Forceful Browsing. This issue affects Commerce Shipping versions: from 0.0.0 to 2.16.0, from 3.0.0 to 3.0.6.
CVE-2026-118555MedOct 30, 2026
Drupal
Commerce License
risk 0.34cvss 6.3epss 0.00
Incorrect Authorization vulnerability in Drupal Commerce License allows Forceful Browsing. This issue affects Commerce License versions: from 0.0.0 to 3.1.1.
CVE-2026-118554MedOct 30, 2026
Drupal
OpenID Connect Client
risk 0.28cvss 5.4epss 0.00
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal OpenID Connect Client allows Authentication Bypass. This issue affects OpenID Connect Client versions: from 0.0.0 to 2.3.1.
CVE-2026-118553MedOct 30, 2026
Drupal
AI (Artificial Intelligence)
risk 0.29cvss 5.5epss 0.00
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Stored XSS. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2.
CVE-2026-118552MedOct 30, 2026
Drupal
AI (Artificial Intelligence)
risk 0.35cvss 6.5epss 0.00
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Cross-Site Scripting (XSS). This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2.
CVE-2026-118551LowOct 30, 2026
Drupal
AI (Artificial Intelligence)
risk 0.13cvss 3.1epss 0.00
Insecure Storage of Sensitive Information vulnerability in Drupal AI (Artificial Intelligence) allows Retrieve Embedded Sensitive Data. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2.
CVE-2026-118550MedOct 30, 2026
Drupal
AI (Artificial Intelligence)
risk 0.31cvss 5.9epss 0.00
Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal AI (Artificial Intelligence) allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.5.0 to…
CVE-2026-118549HigOct 30, 2026
Drupal
AI (Artificial Intelligence)
risk 0.39cvss 7.1epss 0.00
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Cross-Site Scripting (XSS). This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2.
CVE-2026-118548LowOct 30, 2026
Drupal
AI (Artificial Intelligence)
risk 0.17cvss 3.7epss 0.00
Incorrect Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Resource Injection. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2.
CVE-2026-118546MedOct 30, 2026
Drupal
AI (Artificial Intelligence)
risk 0.35cvss 6.5epss 0.00
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Cross-Site Scripting (XSS). This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2.
CVE-2026-118545MedOct 30, 2026
Drupal
AI (Artificial Intelligence)
risk 0.35cvss 6.5epss 0.00
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Cross-Site Scripting (XSS). This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2.
CVE-2026-118544LowOct 30, 2026
Drupal
Commerce Core
risk 0.24cvss 3.7epss 0.00
Exposure of Sensitive Information Through Data Queries vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13.
CVE-2026-118543MedOct 30, 2026
Drupal
Commerce Core
risk 0.34cvss 5.3epss 0.00
Cross-Site Request Forgery (CSRF) vulnerability in Drupal Commerce Core allows Cross Site Request Forgery. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13.
CVE-2026-118542LowOct 30, 2026
Drupal
Commerce Core
risk 0.18cvss 2.7epss 0.00
Incorrect Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13.
CVE-2026-118541MedOct 30, 2026
Drupal
Commerce Core
risk 0.28cvss 4.3epss 0.00
Incorrect Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13.
CVE-2026-118540MedOct 30, 2026
Drupal
Commerce Core
risk 0.27cvss 5.3epss 0.00
Incorrect Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41, from 3.0.0 to 3.2.0.
CVE-2026-118539MedOct 30, 2026
Drupal
Commerce Core
risk 0.42cvss 6.5epss 0.01
Missing Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41, from 3.0.0 to 3.3.13.
CVE-2026-114573HigOct 30, 2026
Drupal
Monster Menus
risk 0.50cvss 8.8epss 0.00
Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Monster Menus allows Object Injection. This issue affects Monster Menus versions: from 0.0.0 to 9.5.6.
CVE-2026-114572MedOct 30, 2026
Drupal
Domain Login Restrict
risk 0.35cvss 5.4epss 0.00
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Domain Login Restrict allows Authentication Bypass. This issue affects Domain Login Restrict versions: from 0.0.0 to 1.5.0.
CVE-2026-114571MedOct 30, 2026
Drupal
Rabbit Hole
risk 0.42cvss 6.5epss 0.00
Incorrect Authorization vulnerability in Drupal Rabbit Hole allows Forceful Browsing. This issue affects Rabbit Hole versions: from 0.0.0 to 1.3.0.
CVE-2026-114555LowOct 30, 2026
Drupal
Data field
risk 0.16cvss 3.5epss 0.00
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Data field allows Stored XSS. This issue affects Data field versions: from 0.0.0 to 2.0.14.
CVE-2026-114554MedOct 30, 2026
Drupal
AI File to Text
risk 0.21cvss 4.3epss 0.00
Incorrect Authorization vulnerability in Drupal AI File to Text allows Forceful Browsing. This issue affects AI File to Text versions: from 0.0.0 to 1.0.1.
CVE-2026-114553MedOct 30, 2026
Drupal
Frontend Editing
risk 0.28cvss 5.4epss 0.00
Incorrect Authorization vulnerability in Drupal Frontend Editing allows Forceful Browsing. This issue affects Frontend Editing versions: from 0.0.0 to 1.9.3.
CVE-2026-114548LowOct 30, 2026
Drupal
ImageAPI Optimize WebP
risk 0.17cvss 3.7epss 0.00
Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal ImageAPI Optimize WebP allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects ImageAPI Optimize WebP versions: from 0.0.0 to 2.1.2.
CVE-2026-114547LowOct 30, 2026
Drupal
TinyPNG
risk 0.17cvss 3.7epss 0.00
Missing Authorization vulnerability in Drupal TinyPNG allows Forceful Browsing. This issue affects TinyPNG versions: from 0.0.0 to 2.0.2.
CVE-2026-114546LowOct 30, 2026
Drupal
Media Alias Display
risk 0.17cvss 3.7epss 0.00
Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Media Alias Display allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Media Alias Display versions: from 0.0.0 to 2.1.2, from 3.0.0 to 3.0.2.
CVE-2026-114545MedOct 30, 2026
Drupal
Fullcalendar View
risk 0.28cvss 5.4epss 0.00
Incorrect Authorization vulnerability in Drupal Fullcalendar View allows Forceful Browsing. This issue affects Fullcalendar View versions: from 0.0.0 to 5.2.6.
CVE-2026-114544MedOct 30, 2026
Drupal
Media Bulk Upload
risk 0.28cvss 5.4epss 0.00
Incorrect Authorization vulnerability in Drupal Media Bulk Upload allows Forceful Browsing. This issue affects Media Bulk Upload versions: from 0.0.0 to 3.0.6.