Vulnerabilities
All
My stack
Known exploited
Public exploit
Critical (9+)
Likely exploited (EPSS ≥ 50%)
Changed, 24 h
New, 24 h
Sort:
risk
modified
published
CVSS
EPSS
| CVE | CVSS | EPSS | Vendor, product | Description | Modified |
|---|---|---|---|---|---|
| CVE-2026-10768 | 9.8 critical | 2.0% | localgovdrupal, localgov_workflows | Missing Authorization vulnerability in Drupal LocalGov Workflows allows Forceful Browsing. This issue affects LocalGov Workflows versions: from 0.0.0 to 1.6.0. | Sun 25 Oct |
| CVE-2026-9726 | 9.8 critical | 1.0% | alternativecommerce | Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal AlternativeCommerce (Basket) allows Object Injection. This issue affects Drupal AlternativeCommerce (Basket) versions: from 0.0.0 to 2.1.17. | Sun 25 Oct |
| CVE-2026-12535 | 9.8 critical | 1.0% | zroger, formatter_field | Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Formatter Field allows Object Injection. This issue affects Formatter Field versions: from 0.0.0 to 2.0.0. | Sun 25 Oct |
| CVE-2026-11913 | 9.8 critical | 1.0% | no CPE yet | vulnerability in Drupal Mother May I allows . This issue affects Mother May I versions: *.*. | Sun 25 Oct |
| CVE-2026-15089 | 9.1 critical | 0.00% | no CPE yet | Vulnerability in Drupal Commerce guest registration. This issue affects Commerce guest registration versions: *.*. | Sun 25 Oct |
| CVE-2026-96355 | 9.1 critical | 0.00% | no CPE yet | Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Webform allows Code Injection. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1. | 23 Oct |
6 of 6
Download these 6 as CSV · subscribe to this list.
EPSS scores: 2026-10-31. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.