CVEs

410,382 total · page 89 of 8,208

CVE	Vendor / Product	Sev	Risk	CVSS	EPSS	Published	Description
CVE-2026-114543	Drupal Simple User Management		0.00	—	0.00	Oct 30, 2026	Incorrect Authorization vulnerability in Drupal Simple User Management allows Forceful Browsing. This issue affects Simple User Management versions: from 0.0.0 to 1.11.0.
CVE-2026-114542	Drupal Simple OAuth (OAuth2) & OpenID Connect	Med	0.28	5.4	0.00	Oct 30, 2026	Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Simple OAuth (OAuth2) & OpenID Connect allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Simple OAuth (OAuth2) & OpenID Connect versions: from 6.1.0 to…
CVE-2026-114541	Drupal Frontend Editing	Med	0.24	4.8	0.00	Oct 30, 2026	Cross-Site Request Forgery (CSRF) vulnerability in Drupal Frontend Editing allows Cross Site Request Forgery. This issue affects Frontend Editing versions: from 0.0.0 to 1.9.3.
CVE-2026-114540	Drupal Domain	Med	0.34	6.3	0.00	Oct 30, 2026	Incorrect Authorization vulnerability in Drupal Domain allows Forceful Browsing. This issue affects Domain versions: from 3.0.0 to 3.0.2.
CVE-2026-114539	Drupal DocCheck Basic	Med	0.41	6.3	0.00	Oct 30, 2026	Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal DocCheck Basic allows Authentication Bypass. This issue affects DocCheck Basic versions: 7.x.
CVE-2026-114538	Drupal Bootstrap	Hig	0.46	7.1	0.00	Oct 30, 2026	Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Bootstrap allows Cross-Site Scripting (XSS). This issue affects Bootstrap versions: from 0.0.0 to 3.45.0.
CVE-2026-114537	Drupal View Unpublished	Med	0.34	5.3	0.00	Oct 30, 2026	Incorrect Authorization vulnerability in Drupal View Unpublished allows Forceful Browsing. This issue affects View Unpublished versions: from 0.0.0 to 1.5.0.
CVE-2026-114536	Drupal USWDS Paragraph Components	Med	0.35	6.5	0.00	Oct 30, 2026	Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal USWDS Paragraph Components allows Stored XSS. This issue affects USWDS Paragraph Components versions: from 0.0.0 to 3.1.3.
CVE-2026-114535	Drupal Swiper formatter	Med	0.27	5.3	0.00	Oct 30, 2026	Missing Authorization vulnerability in Drupal Swiper formatter allows Forceful Browsing. This issue affects Swiper formatter versions: from 0.0.0 to 2.1.2, from 3.0.1 to 3.1.0.
CVE-2026-114534	Drupal Block Attributes	Med	0.31	5.9	0.00	Oct 30, 2026	Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Block Attributes allows Stored XSS. This issue affects Block Attributes versions: from 0.0.0 to 2.1.0.
CVE-2026-114533	Drupal Ágora Transparency Theme	Med	0.27	5.3	0.00	Oct 30, 2026	Missing Authorization vulnerability in Drupal Ágora Transparency Theme allows Forceful Browsing. This issue affects Ágora Transparency Theme versions: from 0.0.0 to 1.2.3.
CVE-2026-114532	Drupal UI Icons	Med	0.42	6.5	0.00	Oct 30, 2026	Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal UI Icons allows Cross-Site Scripting (XSS). This issue affects UI Icons versions: from 0.0.0 to 1.1.3, from 2.0.0 to 2.0.2.
CVE-2026-114531	Drupal Swiper formatter	Med	0.35	6.5	0.00	Oct 30, 2026	Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Swiper formatter allows Stored XSS. This issue affects Swiper formatter versions: from 0.0.0 to 2.1.2, from 3.0.1 to 3.1.0.
CVE-2026-114530	Drupal Dopup	Med	0.27	5.3	0.00	Oct 30, 2026	Incorrect Authorization vulnerability in Drupal Dopup allows Forceful Browsing. This issue affects Dopup versions: from 0.0.0 to 1.0.7.
CVE-2026-114529	Drupal CSV Field	Med	0.35	6.5	0.00	Oct 30, 2026	Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal CSV Field allows Stored XSS. This issue affects CSV Field versions: from 0.0.0 to 2.0.10, from 3.0.0 to 3.0.7.
CVE-2026-114528	Drupal Zero Point	Hig	0.39	7.1	0.00	Oct 30, 2026	Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Zero Point allows Stored XSS. This issue affects Zero Point versions: from 0.0.0 to 1.30.0, from 2.0.0 to 2.0.1.
CVE-2026-114527	Drupal UI Icons	Hig	0.46	7.1	0.00	Oct 30, 2026	Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal UI Icons allows Cross-Site Scripting (XSS). This issue affects UI Icons versions: from 0.0.0 to 1.1.3, from 2.0.0 to 2.0.2.
CVE-2026-114526	Drupal Black Hole	Hig	0.39	7.1	0.00	Oct 30, 2026	Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Black Hole allows Stored XSS. This issue affects Black Hole versions: from 0.0.0 to 1.26.0, from 2.0.0 to 2.0.1.
CVE-2026-114525	Drupal ABC	Hig	0.39	7.1	0.00	Oct 30, 2026	Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal ABC allows Stored XSS. This issue affects ABC versions: from 0.0.0 to 1.25.0, from 2.0.0 to 2.0.1.
CVE-2026-114524	Drupal Custom Formatters	Hig	0.40	7.2	0.00	Oct 30, 2026	Privilege Defined With Unsafe Actions vulnerability in Drupal Custom Formatters allows Privilege Escalation. This issue affects Custom Formatters versions: from 0.0.0 to 4.2.1.
CVE-2026-114523	Drupal Ffmpeg Image Toolkit	Cri	0.57	9.8	0.01	Oct 30, 2026	Improper Neutralization of Special Elements used in an OS Command ("OS Command Injection") vulnerability in Drupal Ffmpeg Image Toolkit allows OS Command Injection. This issue affects Ffmpeg Image Toolkit versions: from 0.0.0 to 1.0.3.
CVE-2026-110738	Drupal Gin Admin Theme	Med	0.35	6.5	0.00	Oct 30, 2026	Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Gin Admin Theme allows Cross-Site Scripting (XSS). This issue affects Gin Admin Theme versions: from 0.0.0 to 4.1.4, from 5.0.0 to 5.0.16.
CVE-2026-108515	Drupal Drupal Core	Med	0.35	6.5	0.00	Oct 30, 2026	Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Drupal core versions: from 8.9.0 to 10.6.19, from 11.0.0 to 11.3.19, from 11.4.0 to 11.4.10, from…
CVE-2026-108514	Drupal Drupal Core	Med	0.35	6.5	0.00	Oct 30, 2026	Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Drupal core versions: from 10.3.0 to 10.6.19, from 11.0.0 to 11.3.19, from 11.4.0 to 11.4.10, from…
CVE-2026-108099	Drupal Entity List	Hig	0.46	8.1	0.00	Oct 30, 2026	Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Drupal Entity List allows Reflection Injection. This issue affects Entity List versions: from 0.0.0 to 3.0.10.
CVE-2026-108097	Drupal Drupal Core	Hig	0.46	8.1	0.01	Oct 30, 2026	Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Drupal Drupal core allows Reflection Injection. This issue affects Drupal core versions: from 8.9.0 to 10.6.19, from 11.0.0 to 11.3.19, from 11.4.0 to 11.4.10, from 12.0.0-alpha1…
CVE-2026-107312	Drupal Examples for Developers	Med	0.21	4.3	0.00	Oct 30, 2026	Allocation of Resources Without Limits or Throttling vulnerability in Drupal Examples for Developers allows Excessive Allocation. This issue affects Examples for Developers versions: from 0.0.0 to 4.0.7.
CVE-2026-107311	Drupal Permissions by Term	Low	0.17	3.7	0.00	Oct 30, 2026	Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal Permissions by Term allows Forceful Browsing. This issue affects Permissions by Term versions: from 0.0.0 to 3.1.41.
CVE-2026-107310	Drupal Freelnking	Med	0.21	4.3	0.00	Oct 30, 2026	Server-Side Request Forgery (SSRF) vulnerability in Drupal Freelinking allows Server Side Request Forgery. This issue affects Freelinking versions: from 0.0.0 to 4.0.3.
CVE-2026-107309	Drupal Easy Breadcrumb	Low	0.17	3.7	0.00	Oct 30, 2026	Missing Authorization vulnerability in Drupal Easy Breadcrumb allows Forceful Browsing. This issue affects Easy Breadcrumb versions: from 0.0.0 to 2.0.11.
CVE-2026-107308	Drupal Country	Low	0.13	3.1	0.00	Oct 30, 2026	Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Country allows Cross-Site Scripting (XSS). This issue affects Country versions: from 0.0.0 to 2.1.3, from 2.2.0 to 2.2.1.
CVE-2026-107307	Drupal SmartLinker AI	Med	0.21	4.3	0.00	Oct 30, 2026	Incorrect Authorization vulnerability in Drupal SmartLinker AI allows Forceful Browsing. This issue affects SmartLinker AI versions: from 0.0.0 to 1.0.3.
CVE-2026-107306	Drupal Menu Link Attributes	Low	0.25	3.8	0.00	Oct 30, 2026	Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Menu Link Attributes allows Stored XSS. This issue affects Menu Link Attributes versions: from 0.0.0 to 1.8.0.
CVE-2026-107268	Drupal Two Factor Authentication - TFA / Passwordless Login	Med	0.21	4.3	0.00	Oct 30, 2026	Insertion of Sensitive Information Into Sent Data vulnerability in Drupal Two Factor Authentication - TFA / Passwordless Login allows Forceful Browsing. This issue affects Two Factor Authentication - TFA / Passwordless Login versions: from 0.0.0 to 5.4.1, from 5.5.0 to 5.5.2.
CVE-2026-107267	Drupal DKAN	Med	0.27	5.3	0.00	Oct 30, 2026	Missing Authorization vulnerability in Drupal DKAN allows Forceful Browsing. This issue affects DKAN versions: from 0.0.0 to 4.0.4, from 4.1.0 to 4.1.5.
CVE-2026-107266	Drupal Views Share	Med	0.27	5.3	0.00	Oct 30, 2026	Missing Authorization vulnerability in Drupal Views Share allows Forceful Browsing. This issue affects Views Share versions: from 0.0.0 to 2.0.1.
CVE-2026-107265	Drupal Leaflet	Med	0.28	5.4	0.00	Oct 30, 2026	Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Leaflet allows Stored XSS. This issue affects Leaflet versions: from 0.0.0 to 10.4.13.
CVE-2026-107264	Drupal Inline Formatter Field	Med	0.28	5.4	0.00	Oct 30, 2026	Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Inline Formatter Field allows Code Injection. This issue affects Inline Formatter Field versions: from 0.0.0 to 4.2.0.
CVE-2026-107263	Drupal Gutenberg	Med	0.28	5.4	0.00	Oct 30, 2026	Incorrect Authorization vulnerability in Drupal Gutenberg allows Forceful Browsing. This issue affects Gutenberg versions: from 0.0.0 to 2.15.0, from 3.0.0 to 3.0.7.
CVE-2026-107262	Drupal Advanced Filesystem	Med	0.27	5.3	0.00	Oct 30, 2026	Cross-Site Request Forgery (CSRF) vulnerability in Drupal Advanced Filesystem allows Cross Site Request Forgery. This issue affects Advanced Filesystem versions: from 0.0.0 to 1.0.28.
CVE-2026-107261	Drupal Authenticator Login Plus (2FA)	Med	0.20	4.2	0.00	Oct 30, 2026	Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Authenticator Login Plus (2FA) allows Authentication Bypass. This issue affects Authenticator Login Plus (2FA) versions: from 0.0.0 to 1.0.1.
CVE-2026-107260	Drupal Sector Distribution	Med	0.35	6.5	0.00	Oct 30, 2026	Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Sector Distribution allows Stored XSS. This issue affects Sector Distribution versions: from 0.0.0 to 10.3.3, from 10.4.0 to 10.4.2.
CVE-2026-107259	Drupal Linked Field	Med	0.35	5.4	0.00	Oct 30, 2026	Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Linked Field allows Code Injection. This issue affects Linked Field versions: from 0.0.0 to 1.8.0.
CVE-2026-107258	Drupal Inline Entity Form Dialog	Med	0.28	5.4	0.00	Oct 30, 2026	Incorrect Authorization vulnerability in Drupal Inline Entity Form Dialog allows Forceful Browsing. This issue affects Inline Entity Form Dialog versions: from 0.0.0 to 1.0.6.
CVE-2026-107257	Drupal Actstream	Med	0.35	6.5	0.00	Oct 30, 2026	Incorrect Authorization vulnerability in Drupal Actstream allows Forceful Browsing. This issue affects Actstream versions: from 0.0.0 to 2.0.1, from 2.1.0 to 2.1.1.
CVE-2026-107256	Drupal Shield	Med	0.34	5.3	0.00	Oct 30, 2026	Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Shield allows Brute Force. This issue affects Shield versions: from 0.0.0 to 1.9.0.
CVE-2026-107255	Drupal Restrict route by IP	Hig	0.40	7.3	0.00	Oct 30, 2026	Incorrect Authorization vulnerability in Drupal Restrict route by IP allows Forceful Browsing. This issue affects Restrict route by IP versions: from 0.0.0 to 1.3.1, from 2.0.0 to 2.0.1.
CVE-2026-107254	Drupal Authenticator Login Plus (2FA)	Med	0.24	4.8	0.00	Oct 30, 2026	Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Authenticator Login Plus (2FA) allows Authentication Bypass. This issue affects Authenticator Login Plus (2FA) versions: from 0.0.0 to 1.0.1.
CVE-2026-107253	Drupal Orphans Media	Med	0.38	5.9	0.00	Oct 30, 2026	Vulnerability in Drupal Orphans Media. This issue affects Orphans Media versions: ..
CVE-2026-107252	Drupal MathJax: LaTeX for Drupal	Med	0.28	5.4	0.00	Oct 30, 2026	Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal MathJax: LaTeX for Drupal allows Cross-Site Scripting (XSS). This issue affects MathJax: LaTeX for Drupal versions: from 0.0.0 to 4.1.2.

CVE-2026-114543Oct 30, 2026
Drupal
Simple User Management
risk 0.00cvss —epss 0.00
Incorrect Authorization vulnerability in Drupal Simple User Management allows Forceful Browsing. This issue affects Simple User Management versions: from 0.0.0 to 1.11.0.
CVE-2026-114542MedOct 30, 2026
Drupal
Simple OAuth (OAuth2) & OpenID Connect
risk 0.28cvss 5.4epss 0.00
Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Simple OAuth (OAuth2) & OpenID Connect allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Simple OAuth (OAuth2) & OpenID Connect versions: from 6.1.0 to…
CVE-2026-114541MedOct 30, 2026
Drupal
Frontend Editing
risk 0.24cvss 4.8epss 0.00
Cross-Site Request Forgery (CSRF) vulnerability in Drupal Frontend Editing allows Cross Site Request Forgery. This issue affects Frontend Editing versions: from 0.0.0 to 1.9.3.
CVE-2026-114540MedOct 30, 2026
Drupal
Domain
risk 0.34cvss 6.3epss 0.00
Incorrect Authorization vulnerability in Drupal Domain allows Forceful Browsing. This issue affects Domain versions: from 3.0.0 to 3.0.2.
CVE-2026-114539MedOct 30, 2026
Drupal
DocCheck Basic
risk 0.41cvss 6.3epss 0.00
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal DocCheck Basic allows Authentication Bypass. This issue affects DocCheck Basic versions: 7.x.
CVE-2026-114538HigOct 30, 2026
Drupal
Bootstrap
risk 0.46cvss 7.1epss 0.00
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Bootstrap allows Cross-Site Scripting (XSS). This issue affects Bootstrap versions: from 0.0.0 to 3.45.0.
CVE-2026-114537MedOct 30, 2026
Drupal
View Unpublished
risk 0.34cvss 5.3epss 0.00
Incorrect Authorization vulnerability in Drupal View Unpublished allows Forceful Browsing. This issue affects View Unpublished versions: from 0.0.0 to 1.5.0.
CVE-2026-114536MedOct 30, 2026
Drupal
USWDS Paragraph Components
risk 0.35cvss 6.5epss 0.00
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal USWDS Paragraph Components allows Stored XSS. This issue affects USWDS Paragraph Components versions: from 0.0.0 to 3.1.3.
CVE-2026-114535MedOct 30, 2026
Drupal
Swiper formatter
risk 0.27cvss 5.3epss 0.00
Missing Authorization vulnerability in Drupal Swiper formatter allows Forceful Browsing. This issue affects Swiper formatter versions: from 0.0.0 to 2.1.2, from 3.0.1 to 3.1.0.
CVE-2026-114534MedOct 30, 2026
Drupal
Block Attributes
risk 0.31cvss 5.9epss 0.00
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Block Attributes allows Stored XSS. This issue affects Block Attributes versions: from 0.0.0 to 2.1.0.
CVE-2026-114533MedOct 30, 2026
Drupal
Ágora Transparency Theme
risk 0.27cvss 5.3epss 0.00
Missing Authorization vulnerability in Drupal Ágora Transparency Theme allows Forceful Browsing. This issue affects Ágora Transparency Theme versions: from 0.0.0 to 1.2.3.
CVE-2026-114532MedOct 30, 2026
Drupal
UI Icons
risk 0.42cvss 6.5epss 0.00
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal UI Icons allows Cross-Site Scripting (XSS). This issue affects UI Icons versions: from 0.0.0 to 1.1.3, from 2.0.0 to 2.0.2.
CVE-2026-114531MedOct 30, 2026
Drupal
Swiper formatter
risk 0.35cvss 6.5epss 0.00
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Swiper formatter allows Stored XSS. This issue affects Swiper formatter versions: from 0.0.0 to 2.1.2, from 3.0.1 to 3.1.0.
CVE-2026-114530MedOct 30, 2026
Drupal
Dopup
risk 0.27cvss 5.3epss 0.00
Incorrect Authorization vulnerability in Drupal Dopup allows Forceful Browsing. This issue affects Dopup versions: from 0.0.0 to 1.0.7.
CVE-2026-114529MedOct 30, 2026
Drupal
CSV Field
risk 0.35cvss 6.5epss 0.00
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal CSV Field allows Stored XSS. This issue affects CSV Field versions: from 0.0.0 to 2.0.10, from 3.0.0 to 3.0.7.
CVE-2026-114528HigOct 30, 2026
Drupal
Zero Point
risk 0.39cvss 7.1epss 0.00
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Zero Point allows Stored XSS. This issue affects Zero Point versions: from 0.0.0 to 1.30.0, from 2.0.0 to 2.0.1.
CVE-2026-114527HigOct 30, 2026
Drupal
UI Icons
risk 0.46cvss 7.1epss 0.00
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal UI Icons allows Cross-Site Scripting (XSS). This issue affects UI Icons versions: from 0.0.0 to 1.1.3, from 2.0.0 to 2.0.2.
CVE-2026-114526HigOct 30, 2026
Drupal
Black Hole
risk 0.39cvss 7.1epss 0.00
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Black Hole allows Stored XSS. This issue affects Black Hole versions: from 0.0.0 to 1.26.0, from 2.0.0 to 2.0.1.
CVE-2026-114525HigOct 30, 2026
Drupal
ABC
risk 0.39cvss 7.1epss 0.00
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal ABC allows Stored XSS. This issue affects ABC versions: from 0.0.0 to 1.25.0, from 2.0.0 to 2.0.1.
CVE-2026-114524HigOct 30, 2026
Drupal
Custom Formatters
risk 0.40cvss 7.2epss 0.00
Privilege Defined With Unsafe Actions vulnerability in Drupal Custom Formatters allows Privilege Escalation. This issue affects Custom Formatters versions: from 0.0.0 to 4.2.1.
CVE-2026-114523CriOct 30, 2026
Drupal
Ffmpeg Image Toolkit
risk 0.57cvss 9.8epss 0.01
Improper Neutralization of Special Elements used in an OS Command ("OS Command Injection") vulnerability in Drupal Ffmpeg Image Toolkit allows OS Command Injection. This issue affects Ffmpeg Image Toolkit versions: from 0.0.0 to 1.0.3.
CVE-2026-110738MedOct 30, 2026
Drupal
Gin Admin Theme
risk 0.35cvss 6.5epss 0.00
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Gin Admin Theme allows Cross-Site Scripting (XSS). This issue affects Gin Admin Theme versions: from 0.0.0 to 4.1.4, from 5.0.0 to 5.0.16.
CVE-2026-108515MedOct 30, 2026
Drupal
Drupal Core
risk 0.35cvss 6.5epss 0.00
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Drupal core versions: from 8.9.0 to 10.6.19, from 11.0.0 to 11.3.19, from 11.4.0 to 11.4.10, from…
CVE-2026-108514MedOct 30, 2026
Drupal
Drupal Core
risk 0.35cvss 6.5epss 0.00
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Drupal core versions: from 10.3.0 to 10.6.19, from 11.0.0 to 11.3.19, from 11.4.0 to 11.4.10, from…
CVE-2026-108099HigOct 30, 2026
Drupal
Entity List
risk 0.46cvss 8.1epss 0.00
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Drupal Entity List allows Reflection Injection. This issue affects Entity List versions: from 0.0.0 to 3.0.10.
CVE-2026-108097HigOct 30, 2026
Drupal
Drupal Core
risk 0.46cvss 8.1epss 0.01
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Drupal Drupal core allows Reflection Injection. This issue affects Drupal core versions: from 8.9.0 to 10.6.19, from 11.0.0 to 11.3.19, from 11.4.0 to 11.4.10, from 12.0.0-alpha1…
CVE-2026-107312MedOct 30, 2026
Drupal
Examples for Developers
risk 0.21cvss 4.3epss 0.00
Allocation of Resources Without Limits or Throttling vulnerability in Drupal Examples for Developers allows Excessive Allocation. This issue affects Examples for Developers versions: from 0.0.0 to 4.0.7.
CVE-2026-107311LowOct 30, 2026
Drupal
Permissions by Term
risk 0.17cvss 3.7epss 0.00
Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal Permissions by Term allows Forceful Browsing. This issue affects Permissions by Term versions: from 0.0.0 to 3.1.41.
CVE-2026-107310MedOct 30, 2026
Drupal
Freelnking
risk 0.21cvss 4.3epss 0.00
Server-Side Request Forgery (SSRF) vulnerability in Drupal Freelinking allows Server Side Request Forgery. This issue affects Freelinking versions: from 0.0.0 to 4.0.3.
CVE-2026-107309LowOct 30, 2026
Drupal
Easy Breadcrumb
risk 0.17cvss 3.7epss 0.00
Missing Authorization vulnerability in Drupal Easy Breadcrumb allows Forceful Browsing. This issue affects Easy Breadcrumb versions: from 0.0.0 to 2.0.11.
CVE-2026-107308LowOct 30, 2026
Drupal
Country
risk 0.13cvss 3.1epss 0.00
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Country allows Cross-Site Scripting (XSS). This issue affects Country versions: from 0.0.0 to 2.1.3, from 2.2.0 to 2.2.1.
CVE-2026-107307MedOct 30, 2026
Drupal
SmartLinker AI
risk 0.21cvss 4.3epss 0.00
Incorrect Authorization vulnerability in Drupal SmartLinker AI allows Forceful Browsing. This issue affects SmartLinker AI versions: from 0.0.0 to 1.0.3.
CVE-2026-107306LowOct 30, 2026
Drupal
Menu Link Attributes
risk 0.25cvss 3.8epss 0.00
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Menu Link Attributes allows Stored XSS. This issue affects Menu Link Attributes versions: from 0.0.0 to 1.8.0.
CVE-2026-107268MedOct 30, 2026
Drupal
Two Factor Authentication - TFA / Passwordless Login
risk 0.21cvss 4.3epss 0.00
Insertion of Sensitive Information Into Sent Data vulnerability in Drupal Two Factor Authentication - TFA / Passwordless Login allows Forceful Browsing. This issue affects Two Factor Authentication - TFA / Passwordless Login versions: from 0.0.0 to 5.4.1, from 5.5.0 to 5.5.2.
CVE-2026-107267MedOct 30, 2026
Drupal
DKAN
risk 0.27cvss 5.3epss 0.00
Missing Authorization vulnerability in Drupal DKAN allows Forceful Browsing. This issue affects DKAN versions: from 0.0.0 to 4.0.4, from 4.1.0 to 4.1.5.
CVE-2026-107266MedOct 30, 2026
Drupal
Views Share
risk 0.27cvss 5.3epss 0.00
Missing Authorization vulnerability in Drupal Views Share allows Forceful Browsing. This issue affects Views Share versions: from 0.0.0 to 2.0.1.
CVE-2026-107265MedOct 30, 2026
Drupal
Leaflet
risk 0.28cvss 5.4epss 0.00
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Leaflet allows Stored XSS. This issue affects Leaflet versions: from 0.0.0 to 10.4.13.
CVE-2026-107264MedOct 30, 2026
Drupal
Inline Formatter Field
risk 0.28cvss 5.4epss 0.00
Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Inline Formatter Field allows Code Injection. This issue affects Inline Formatter Field versions: from 0.0.0 to 4.2.0.
CVE-2026-107263MedOct 30, 2026
Drupal
Gutenberg
risk 0.28cvss 5.4epss 0.00
Incorrect Authorization vulnerability in Drupal Gutenberg allows Forceful Browsing. This issue affects Gutenberg versions: from 0.0.0 to 2.15.0, from 3.0.0 to 3.0.7.
CVE-2026-107262MedOct 30, 2026
Drupal
Advanced Filesystem
risk 0.27cvss 5.3epss 0.00
Cross-Site Request Forgery (CSRF) vulnerability in Drupal Advanced Filesystem allows Cross Site Request Forgery. This issue affects Advanced Filesystem versions: from 0.0.0 to 1.0.28.
CVE-2026-107261MedOct 30, 2026
Drupal
Authenticator Login Plus (2FA)
risk 0.20cvss 4.2epss 0.00
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Authenticator Login Plus (2FA) allows Authentication Bypass. This issue affects Authenticator Login Plus (2FA) versions: from 0.0.0 to 1.0.1.
CVE-2026-107260MedOct 30, 2026
Drupal
Sector Distribution
risk 0.35cvss 6.5epss 0.00
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Sector Distribution allows Stored XSS. This issue affects Sector Distribution versions: from 0.0.0 to 10.3.3, from 10.4.0 to 10.4.2.
CVE-2026-107259MedOct 30, 2026
Drupal
Linked Field
risk 0.35cvss 5.4epss 0.00
Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Linked Field allows Code Injection. This issue affects Linked Field versions: from 0.0.0 to 1.8.0.
CVE-2026-107258MedOct 30, 2026
Drupal
Inline Entity Form Dialog
risk 0.28cvss 5.4epss 0.00
Incorrect Authorization vulnerability in Drupal Inline Entity Form Dialog allows Forceful Browsing. This issue affects Inline Entity Form Dialog versions: from 0.0.0 to 1.0.6.
CVE-2026-107257MedOct 30, 2026
Drupal
Actstream
risk 0.35cvss 6.5epss 0.00
Incorrect Authorization vulnerability in Drupal Actstream allows Forceful Browsing. This issue affects Actstream versions: from 0.0.0 to 2.0.1, from 2.1.0 to 2.1.1.
CVE-2026-107256MedOct 30, 2026
Drupal
Shield
risk 0.34cvss 5.3epss 0.00
Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Shield allows Brute Force. This issue affects Shield versions: from 0.0.0 to 1.9.0.
CVE-2026-107255HigOct 30, 2026
Drupal
Restrict route by IP
risk 0.40cvss 7.3epss 0.00
Incorrect Authorization vulnerability in Drupal Restrict route by IP allows Forceful Browsing. This issue affects Restrict route by IP versions: from 0.0.0 to 1.3.1, from 2.0.0 to 2.0.1.
CVE-2026-107254MedOct 30, 2026
Drupal
Authenticator Login Plus (2FA)
risk 0.24cvss 4.8epss 0.00
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Authenticator Login Plus (2FA) allows Authentication Bypass. This issue affects Authenticator Login Plus (2FA) versions: from 0.0.0 to 1.0.1.
CVE-2026-107253MedOct 30, 2026
Drupal
Orphans Media
risk 0.38cvss 5.9epss 0.00
Vulnerability in Drupal Orphans Media. This issue affects Orphans Media versions: *.*.
CVE-2026-107252MedOct 30, 2026
Drupal
MathJax: LaTeX for Drupal
risk 0.28cvss 5.4epss 0.00
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal MathJax: LaTeX for Drupal allows Cross-Site Scripting (XSS). This issue affects MathJax: LaTeX for Drupal versions: from 0.0.0 to 4.1.2.