Vulnerabilities
All
My stack
Known exploited
Public exploit
Critical (9+)
Likely exploited (EPSS ≥ 50%)
Changed, 24 h
New, 24 h
Sort:
risk
modified
published
CVSS
EPSS
| CVE | CVSS | EPSS | Vendor, product | Description | Modified |
|---|---|---|---|---|---|
| CVE-2026-107306 | unscored | 0.00% | drupal, menu link attributes | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Menu Link Attributes allows Stored XSS. This issue affects Menu Link Attributes versions: from 0.0.0 to 1.8.0. | Fri 30 Oct |
| CVE-2026-107267 | unscored | 0.00% | drupal, dkan | Missing Authorization vulnerability in Drupal DKAN allows Forceful Browsing. This issue affects DKAN versions: from 0.0.0 to 4.0.4, from 4.1.0 to 4.1.5. | Fri 30 Oct |
| CVE-2026-96389 | unscored | 0.00% | drupal, xray audit | Missing Authorization vulnerability in Drupal Xray Audit allows Forceful Browsing. This issue affects Xray Audit versions: from 0.0.0 to 1.6.3, from 2.0.0 to 2.0.4, from 3.0.0 to 3.1.1. | Fri 30 Oct |
| CVE-2026-107265 | unscored | 0.00% | drupal, leaflet | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Leaflet allows Stored XSS. This issue affects Leaflet versions: from 0.0.0 to 10.4.13. | Fri 30 Oct |
| CVE-2026-107264 | unscored | 0.00% | drupal, inline formatter field | Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Inline Formatter Field allows Code Injection. This issue affects Inline Formatter Field versions: from 0.0.0 to 4.2.0. | Fri 30 Oct |
| CVE-2026-107263 | unscored | 0.00% | drupal, gutenberg | Incorrect Authorization vulnerability in Drupal Gutenberg allows Forceful Browsing. This issue affects Gutenberg versions: from 0.0.0 to 2.15.0, from 3.0.0 to 3.0.7. | Fri 30 Oct |
| CVE-2026-107261 | unscored | 0.00% | drupal, authenticator login plus (2fa) | Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Authenticator Login Plus (2FA) allows Authentication Bypass. This issue affects Authenticator Login Plus (2FA) versions: from 0.0.0 to 1.0.1. | Fri 30 Oct |
| CVE-2026-107259 | unscored | 0.00% | drupal, linked field | Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Linked Field allows Code Injection. This issue affects Linked Field versions: from 0.0.0 to 1.8.0. | Fri 30 Oct |
| CVE-2026-107258 | unscored | 0.00% | drupal, inline entity form dialog | Incorrect Authorization vulnerability in Drupal Inline Entity Form Dialog allows Forceful Browsing. This issue affects Inline Entity Form Dialog versions: from 0.0.0 to 1.0.6. | Fri 30 Oct |
| CVE-2026-107250 | unscored | 0.00% | drupal, eca helper | Vulnerability in Drupal ECA Helper. This issue affects ECA Helper versions: *.*. | Fri 30 Oct |
| CVE-2026-107253 | unscored | 0.00% | drupal, orphans media | Vulnerability in Drupal Orphans Media. This issue affects Orphans Media versions: *.*. | Fri 30 Oct |
| CVE-2026-96391 | unscored | 0.00% | no CPE yet | Missing Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. This issue affects Webform REST versions: from 0.0.0 to 4.2.1. | Fri 30 Oct |
| CVE-2026-96379 | unscored | 0.00% | no CPE yet | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal CookieCuttr allows Stored XSS. This issue affects CookieCuttr versions: from 2.0.0 to 2.0.3. | Fri 30 Oct |
| CVE-2026-96363 | unscored | 0.00% | no CPE yet | Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1. | Fri 30 Oct |
| CVE-2026-87938 | unscored | 0.00% | no CPE yet | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal CSP log allows SQL Injection. This issue affects CSP log versions: from 0.0.0 to 1.0.2. | Fri 30 Oct |
| CVE-2026-107257 | unscored | 0.00% | drupal, actstream | Incorrect Authorization vulnerability in Drupal Actstream allows Forceful Browsing. This issue affects Actstream versions: from 0.0.0 to 2.0.1, from 2.1.0 to 2.1.1. | Fri 30 Oct |
| CVE-2026-107254 | unscored | 0.00% | drupal, authenticator login plus (2fa) | Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Authenticator Login Plus (2FA) allows Authentication Bypass. This issue affects Authenticator Login Plus (2FA) versions: from 0.0.0 to 1.0.1. | Fri 30 Oct |
| CVE-2026-114555 | unscored | 0.00% | drupal, data field | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Data field allows Stored XSS. This issue affects Data field versions: from 0.0.0 to 2.0.14. | Fri 30 Oct |
| CVE-2026-114572 | unscored | 0.00% | drupal, domain login restrict | Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Domain Login Restrict allows Authentication Bypass. This issue affects Domain Login Restrict versions: from 0.0.0 to 1.5.0. | Fri 30 Oct |
| CVE-2026-107252 | unscored | 0.00% | drupal, mathjax: latex for drupal | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal MathJax: LaTeX for Drupal allows Cross-Site Scripting (XSS). This issue affects MathJax: LaTeX for Drupal versions: from 0.0.0 to 4.1.2. | Fri 30 Oct |
| CVE-2026-107251 | unscored | 0.00% | drupal, entity reference manager (merge entities) | Incorrect Authorization vulnerability in Drupal Entity Reference Manager (Merge entities) allows Forceful Browsing. This issue affects Entity Reference Manager (Merge entities) versions: from 0.0.0 to 1.0.3. | Fri 30 Oct |
| CVE-2026-107249 | unscored | 0.00% | drupal, block ajax | Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Block AJAX allows Object Injection. This issue affects Block AJAX versions: from 0.0.0 to 3.0.2. | Fri 30 Oct |
| CVE-2026-87941 | unscored | 0.00% | no CPE yet | Vulnerability in Drupal Patreon. This issue affects Patreon versions: 7.x. | Fri 30 Oct |
| CVE-2026-107266 | unscored | 0.00% | drupal, views share | Missing Authorization vulnerability in Drupal Views Share allows Forceful Browsing. This issue affects Views Share versions: from 0.0.0 to 2.0.1. | Fri 30 Oct |
| CVE-2026-107255 | unscored | 0.00% | drupal, restrict route by ip | Incorrect Authorization vulnerability in Drupal Restrict route by IP allows Forceful Browsing. This issue affects Restrict route by IP versions: from 0.0.0 to 1.3.1, from 2.0.0 to 2.0.1. | Fri 30 Oct |
| CVE-2026-110738 | unscored | 0.00% | drupal, gin admin theme | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Gin Admin Theme allows Cross-Site Scripting (XSS). This issue affects Gin Admin Theme versions: from 0.0.0 to 4.1.4, from 5.0.0 to 5.0.16. | Fri 30 Oct |
| CVE-2026-108515 | unscored | 0.00% | drupal, drupal core | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Drupal core versions: from 8.9.0 to 10.6.19, from 11.0.0 to 11.3.19, from 11.4.0 to 11.4.10, from 12.0.0-alpha1 to 12.0.0-beta2. | Fri 30 Oct |
| CVE-2026-108514 | unscored | 0.00% | drupal, drupal core | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Drupal core versions: from 10.3.0 to 10.6.19, from 11.0.0 to 11.3.19, from 11.4.0 to 11.4.10, from 12.0.0-alpha1 to 12.0.0-beta2. | Fri 30 Oct |
| CVE-2026-108099 | unscored | 0.00% | drupal, entity list | Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Drupal Entity List allows Reflection Injection. This issue affects Entity List versions: from 0.0.0 to 3.0.10. | Fri 30 Oct |
| CVE-2026-114527 | unscored | 0.00% | drupal, ui icons | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal UI Icons allows Cross-Site Scripting (XSS). This issue affects UI Icons versions: from 0.0.0 to 1.1.3, from 2.0.0 to 2.0.2. | Fri 30 Oct |
| CVE-2026-114528 | unscored | 0.00% | drupal, zero point | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Zero Point allows Stored XSS. This issue affects Zero Point versions: from 0.0.0 to 1.30.0, from 2.0.0 to 2.0.1. | Fri 30 Oct |
| CVE-2026-114526 | unscored | 0.00% | drupal, black hole | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Black Hole allows Stored XSS. This issue affects Black Hole versions: from 0.0.0 to 1.26.0, from 2.0.0 to 2.0.1. | Fri 30 Oct |
| CVE-2026-114525 | unscored | 0.00% | drupal, abc | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal ABC allows Stored XSS. This issue affects ABC versions: from 0.0.0 to 1.25.0, from 2.0.0 to 2.0.1. | Fri 30 Oct |
| CVE-2026-114524 | unscored | 0.00% | drupal, custom formatters | Privilege Defined With Unsafe Actions vulnerability in Drupal Custom Formatters allows Privilege Escalation. This issue affects Custom Formatters versions: from 0.0.0 to 4.2.1. | Fri 30 Oct |
| CVE-2026-114529 | unscored | 0.00% | drupal, csv field | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal CSV Field allows Stored XSS. This issue affects CSV Field versions: from 0.0.0 to 2.0.10, from 3.0.0 to 3.0.7. | Fri 30 Oct |
| CVE-2026-114530 | unscored | 0.00% | drupal, dopup | Incorrect Authorization vulnerability in Drupal Dopup allows Forceful Browsing. This issue affects Dopup versions: from 0.0.0 to 1.0.7. | Fri 30 Oct |
| CVE-2026-114531 | unscored | 0.00% | drupal, swiper formatter | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Swiper formatter allows Stored XSS. This issue affects Swiper formatter versions: from 0.0.0 to 2.1.2, from 3.0.1 to 3.1.0. | Fri 30 Oct |
| CVE-2026-107260 | unscored | 0.00% | drupal, sector distribution | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Sector Distribution allows Stored XSS. This issue affects Sector Distribution versions: from 0.0.0 to 10.3.3, from 10.4.0 to 10.4.2. | Fri 30 Oct |
| CVE-2026-114532 | unscored | 0.00% | drupal, ui icons | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal UI Icons allows Cross-Site Scripting (XSS). This issue affects UI Icons versions: from 0.0.0 to 1.1.3, from 2.0.0 to 2.0.2. | Fri 30 Oct |
| CVE-2026-114533 | unscored | 0.00% | drupal, ágora transparency theme | Missing Authorization vulnerability in Drupal Ágora Transparency Theme allows Forceful Browsing. This issue affects Ágora Transparency Theme versions: from 0.0.0 to 1.2.3. | Fri 30 Oct |
| CVE-2026-114534 | unscored | 0.00% | drupal, block attributes | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Block Attributes allows Stored XSS. This issue affects Block Attributes versions: from 0.0.0 to 2.1.0. | Fri 30 Oct |
| CVE-2026-114535 | unscored | 0.00% | drupal, swiper formatter | Missing Authorization vulnerability in Drupal Swiper formatter allows Forceful Browsing. This issue affects Swiper formatter versions: from 0.0.0 to 2.1.2, from 3.0.1 to 3.1.0. | Fri 30 Oct |
| CVE-2026-114536 | unscored | 0.00% | drupal, uswds paragraph components | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal USWDS Paragraph Components allows Stored XSS. This issue affects USWDS Paragraph Components versions: from 0.0.0 to 3.1.3. | Fri 30 Oct |
| CVE-2026-114537 | unscored | 0.00% | drupal, view unpublished | Incorrect Authorization vulnerability in Drupal View Unpublished allows Forceful Browsing. This issue affects View Unpublished versions: from 0.0.0 to 1.5.0. | Fri 30 Oct |
| CVE-2026-114538 | unscored | 0.00% | drupal, bootstrap | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Bootstrap allows Cross-Site Scripting (XSS). This issue affects Bootstrap versions: from 0.0.0 to 3.45.0. | Fri 30 Oct |
| CVE-2026-114539 | unscored | 0.00% | drupal, doccheck basic | Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal DocCheck Basic allows Authentication Bypass. This issue affects DocCheck Basic versions: 7.x. | Fri 30 Oct |
| CVE-2026-114540 | unscored | 0.00% | drupal, domain | Incorrect Authorization vulnerability in Drupal Domain allows Forceful Browsing. This issue affects Domain versions: from 3.0.0 to 3.0.2. | Fri 30 Oct |
| CVE-2026-114543 | unscored | 0.00% | drupal, simple user management | Incorrect Authorization vulnerability in Drupal Simple User Management allows Forceful Browsing. This issue affects Simple User Management versions: from 0.0.0 to 1.11.0. | Fri 30 Oct |
| CVE-2026-114541 | unscored | 0.00% | drupal, frontend editing | Cross-Site Request Forgery (CSRF) vulnerability in Drupal Frontend Editing allows Cross Site Request Forgery. This issue affects Frontend Editing versions: from 0.0.0 to 1.9.3. | Fri 30 Oct |
| CVE-2026-114553 | unscored | 0.00% | drupal, frontend editing | Incorrect Authorization vulnerability in Drupal Frontend Editing allows Forceful Browsing. This issue affects Frontend Editing versions: from 0.0.0 to 1.9.3. | Fri 30 Oct |
Download these 248 as CSV · subscribe to this list.
EPSS scores: 2026-10-30. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.