Vulnerabilities
All
My stack
Known exploited
Public exploit
Critical (9+)
Likely exploited (EPSS ≥ 50%)
Changed, 24 h
New, 24 h
Sort:
risk
modified
published
CVSS
EPSS
| CVE | CVSS | EPSS | Vendor, product | Description | Modified |
|---|---|---|---|---|---|
| CVE-2026-114542 | unscored | 0.00% | drupal, simple oauth (oauth2) & openid connect | Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Simple OAuth (OAuth2) & OpenID Connect allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Simple OAuth (OAuth2) & OpenID Connect versions: from 6.1.0 to 6.1.3. | Fri 30 Oct |
| CVE-2026-114544 | unscored | 0.00% | drupal, media bulk upload | Incorrect Authorization vulnerability in Drupal Media Bulk Upload allows Forceful Browsing. This issue affects Media Bulk Upload versions: from 0.0.0 to 3.0.6. | Fri 30 Oct |
| CVE-2026-114545 | unscored | 0.00% | drupal, fullcalendar view | Incorrect Authorization vulnerability in Drupal Fullcalendar View allows Forceful Browsing. This issue affects Fullcalendar View versions: from 0.0.0 to 5.2.6. | Fri 30 Oct |
| CVE-2026-114546 | unscored | 0.00% | drupal, media alias display | Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Media Alias Display allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Media Alias Display versions: from 0.0.0 to 2.1.2, from 3.0.0 to 3.0.2. | Fri 30 Oct |
| CVE-2026-114547 | unscored | 0.00% | drupal, tinypng | Missing Authorization vulnerability in Drupal TinyPNG allows Forceful Browsing. This issue affects TinyPNG versions: from 0.0.0 to 2.0.2. | Fri 30 Oct |
| CVE-2026-114548 | unscored | 0.00% | drupal, imageapi optimize webp | Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal ImageAPI Optimize WebP allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects ImageAPI Optimize WebP versions: from 0.0.0 to 2.1.2. | Fri 30 Oct |
| CVE-2026-107256 | unscored | 0.00% | drupal, shield | Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Shield allows Brute Force. This issue affects Shield versions: from 0.0.0 to 1.9.0. | Fri 30 Oct |
| CVE-2026-114554 | unscored | 0.00% | drupal, ai file to text | Incorrect Authorization vulnerability in Drupal AI File to Text allows Forceful Browsing. This issue affects AI File to Text versions: from 0.0.0 to 1.0.1. | Fri 30 Oct |
| CVE-2026-114571 | unscored | 0.00% | drupal, rabbit hole | Incorrect Authorization vulnerability in Drupal Rabbit Hole allows Forceful Browsing. This issue affects Rabbit Hole versions: from 0.0.0 to 1.3.0. | Fri 30 Oct |
| CVE-2026-114573 | unscored | 0.00% | drupal, monster menus | Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Monster Menus allows Object Injection. This issue affects Monster Menus versions: from 0.0.0 to 9.5.6. | Fri 30 Oct |
| CVE-2026-118540 | unscored | 0.00% | drupal, commerce core | Incorrect Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41, from 3.0.0 to 3.2.0. | Fri 30 Oct |
| CVE-2026-118541 | unscored | 0.00% | drupal, commerce core | Incorrect Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13. | Fri 30 Oct |
| CVE-2026-118542 | unscored | 0.00% | drupal, commerce core | Incorrect Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13. | Fri 30 Oct |
| CVE-2026-118543 | unscored | 0.00% | drupal, commerce core | Cross-Site Request Forgery (CSRF) vulnerability in Drupal Commerce Core allows Cross Site Request Forgery. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13. | Fri 30 Oct |
| CVE-2026-118544 | unscored | 0.00% | drupal, commerce core | Exposure of Sensitive Information Through Data Queries vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13. | Fri 30 Oct |
| CVE-2026-118555 | unscored | 0.00% | drupal, commerce license | Incorrect Authorization vulnerability in Drupal Commerce License allows Forceful Browsing. This issue affects Commerce License versions: from 0.0.0 to 3.1.1. | Fri 30 Oct |
| CVE-2026-118556 | unscored | 0.00% | drupal, commerce shipping | Incorrect Authorization vulnerability in Drupal Commerce Shipping allows Forceful Browsing. This issue affects Commerce Shipping versions: from 0.0.0 to 2.16.0, from 3.0.0 to 3.0.6. | Fri 30 Oct |
| CVE-2026-118557 | unscored | 0.00% | drupal, commerce shipping | Incorrect Authorization vulnerability in Drupal Commerce Shipping allows Forceful Browsing. This issue affects Commerce Shipping versions: from 0.0.0 to 2.16.0, from 3.0.0 to 3.0.6. | Fri 30 Oct |
| CVE-2026-118558 | unscored | 0.00% | drupal, commerce stripe | Cross-Site Request Forgery (CSRF) vulnerability in Drupal Commerce Stripe allows Cross Site Request Forgery. This issue affects Commerce Stripe versions: from 2.0.0 to 2.2.3. | Fri 30 Oct |
| CVE-2026-118559 | unscored | 0.00% | drupal, commerce stripe | Improper Verification of Cryptographic Signature vulnerability in Drupal Commerce Stripe allows Signature Spoof. This issue affects Commerce Stripe versions: from 0.0.0 to 1.4, from 2.0.0 to 2.2.3. | Fri 30 Oct |
| CVE-2026-118560 | unscored | 0.00% | drupal, commerce stripe | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Commerce Stripe allows Cross-Site Scripting (XSS). This issue affects Commerce Stripe versions: from 2.0.0 to 2.2.3. | Fri 30 Oct |
| CVE-2026-118545 | unscored | 0.00% | drupal, ai (artificial intelligence) | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Cross-Site Scripting (XSS). This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2. | Fri 30 Oct |
| CVE-2026-118546 | unscored | 0.00% | drupal, ai (artificial intelligence) | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Cross-Site Scripting (XSS). This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2. | Fri 30 Oct |
| CVE-2026-118548 | unscored | 0.00% | drupal, ai (artificial intelligence) | Incorrect Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Resource Injection. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2. | Fri 30 Oct |
| CVE-2026-118549 | unscored | 0.00% | drupal, ai (artificial intelligence) | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Cross-Site Scripting (XSS). This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2. | Fri 30 Oct |
| CVE-2026-118550 | unscored | 0.00% | drupal, ai (artificial intelligence) | Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal AI (Artificial Intelligence) allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2. | Fri 30 Oct |
| CVE-2026-118551 | unscored | 0.00% | drupal, ai (artificial intelligence) | Insecure Storage of Sensitive Information vulnerability in Drupal AI (Artificial Intelligence) allows Retrieve Embedded Sensitive Data. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2. | Fri 30 Oct |
| CVE-2026-118552 | unscored | 0.00% | drupal, ai (artificial intelligence) | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Cross-Site Scripting (XSS). This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2. | Fri 30 Oct |
| CVE-2026-118553 | unscored | 0.00% | drupal, ai (artificial intelligence) | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Stored XSS. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2. | Fri 30 Oct |
| CVE-2026-118561 | unscored | 0.00% | drupal, single content sync | External Control of File Name or Path vulnerability in Drupal Single Content Sync allows Path Traversal. This issue affects Single Content Sync versions: from 0.0.0 to 1.4.19. | Fri 30 Oct |
| CVE-2026-118562 | unscored | 0.00% | drupal, single content sync | Deserialization of Untrusted Data vulnerability in Drupal Single Content Sync allows Object Injection. This issue affects Single Content Sync versions: from 0.0.0 to 1.4.19. | Fri 30 Oct |
| CVE-2026-118563 | unscored | 0.00% | drupal, cacheflush | Vulnerability in Drupal CacheFlush. This issue affects CacheFlush versions: *.*. | Fri 30 Oct |
| CVE-2026-118564 | unscored | 0.00% | drupal, payumoney for drupal commerce | Vulnerability in Drupal PayUmoney for Drupal Commerce. This issue affects PayUmoney for Drupal Commerce versions: *.*. | Fri 30 Oct |
| CVE-2026-118565 | unscored | 0.00% | drupal, groupex pro ( daxko ) integration | Vulnerability in Drupal GroupEx PRO ( Daxko ) integration. This issue affects GroupEx PRO ( Daxko ) integration versions: *.*. | Fri 30 Oct |
| CVE-2026-118582 | unscored | 0.00% | drupal, captcha | Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal CAPTCHA allows Functionality Bypass. This issue affects CAPTCHA versions: from 0.0.0 to 1.18.0, from 2.0.0 to 2.0.11. | Fri 30 Oct |
| CVE-2026-118569 | unscored | 0.00% | drupal, fasttoggle | Incorrect Authorization vulnerability in Drupal Fasttoggle allows Forceful Browsing. This issue affects Fasttoggle versions: from 0.0.0 to 4.1.1. | Fri 30 Oct |
| CVE-2026-118570 | unscored | 0.00% | drupal, fasttoggle | Cross-Site Request Forgery (CSRF) vulnerability in Drupal Fasttoggle allows Cross Site Request Forgery. This issue affects Fasttoggle versions: from 0.0.0 to 4.1.1. | Fri 30 Oct |
| CVE-2026-118574 | unscored | 0.00% | drupal, s3 file system | Incorrect Permission Assignment for Critical Resource vulnerability in Drupal S3 File System allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects S3 File System versions: from 0.0.0 to 3.12.0. | Fri 30 Oct |
| CVE-2026-118567 | unscored | 0.00% | drupal, bulk update user roles | Incorrect Authorization vulnerability in Drupal Bulk Update User Roles allows Forceful Browsing. This issue affects Bulk Update User Roles versions: from 0.0.0 to 1.0.5. | Fri 30 Oct |
| CVE-2026-118572 | unscored | 0.00% | drupal, oauth login - oauth oidc sso | Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal OAuth Login - OAuth OIDC SSO allows Authentication Bypass. This issue affects OAuth Login - OAuth OIDC SSO versions: from 0.0.0 to 3.1.1. | Fri 30 Oct |
| CVE-2026-118575 | unscored | 0.00% | drupal, signature pad widget | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Signature pad widget allows Stored XSS. This issue affects Signature pad widget versions: from 0.0.0 to 1.15.0. | Fri 30 Oct |
| CVE-2026-118576 | unscored | 0.00% | drupal, stage file proxy | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Stage File Proxy allows Cross-Site Scripting (XSS). This issue affects Stage File Proxy versions: from 0.0.0 to 3.1.7, from 4.0.0 to 4.0.1. | Fri 30 Oct |
| CVE-2026-118554 | unscored | 0.00% | drupal, openid connect client | Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal OpenID Connect Client allows Authentication Bypass. This issue affects OpenID Connect Client versions: from 0.0.0 to 2.3.1. | Fri 30 Oct |
| CVE-2026-118583 | unscored | 0.00% | drupal, field permissions | Incorrect Authorization vulnerability in Drupal Field Permissions allows Forceful Browsing. This issue affects Field Permissions versions: from 0.0.0 to 1.6.0. | Fri 30 Oct |
| CVE-2026-118584 | unscored | 0.00% | drupal, field permissions | Incorrect Authorization vulnerability in Drupal Field Permissions allows Forceful Browsing. This issue affects Field Permissions versions: from 0.0.0 to 1.6.0. | Fri 30 Oct |
| CVE-2026-118573 | unscored | 0.00% | drupal, oauth2 token manager | Missing Authorization vulnerability in Drupal OAuth2 Token Manager allows Forceful Browsing. This issue affects OAuth2 Token Manager versions: from 0.0.0 to 1.2.0. | Fri 30 Oct |
| CVE-2026-118568 | unscored | 0.00% | drupal, content sync (content-sync.io) | Insecure Storage of Sensitive Information vulnerability in Drupal Content Sync (content-sync.io) allows Retrieve Embedded Sensitive Data. This issue affects Content Sync (content-sync.io) versions: from 0.0.0 to 3.2.2. | Fri 30 Oct |
| CVE-2026-118571 | unscored | 0.00% | drupal, media alias display | Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Media Alias Display allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Media Alias Display versions: from 0.0.0 to 2.1.3, from 3.0.0 to 3.0.3. | Fri 30 Oct |
248 of 248 · Previous
Download these 248 as CSV · subscribe to this list.
EPSS scores: 2026-10-31. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.