Vulnerabilities
All
My stack
Known exploited
Public exploit
Critical (9+)
Likely exploited (EPSS ≥ 50%)
Changed, 24 h
New, 24 h
Sort:
risk
modified
published
CVSS
EPSS
| CVE | CVSS | EPSS | Vendor, product | Description | Modified |
|---|---|---|---|---|---|
| CVE-2026-15087 | 5.9 medium | 0.00% | no CPE yet | vulnerability in Drupal Clean RESTful allows . This issue affects Clean RESTful versions: *.*. | Sun 25 Oct |
| CVE-2025-13081 | 5.9 medium | 0.00% | drupal | Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection.This issue affects Drupal core: from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, from 11.2.0 before 11.2.8. | 18 Oct |
| CVE-2026-10769 | 5.4 medium | 0.00% | centarro, commerce_core | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Commerce Core allows Stored XSS. This issue affects Commerce Core versions: from 3.3.0 to 3.3.6. | Sun 25 Oct |
| CVE-2026-11908 | 5.4 medium | 0.00% | factorial, tagify | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Tagify allows Stored XSS. This issue affects Tagify versions: from 0.0.0 to 1.2.52. | Sun 25 Oct |
| CVE-2026-15079 | 5.4 medium | 0.00% | budda, login_disable | Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Login Disable allows Brute Force. This issue affects Login Disable versions: from 0.0.0 to 2.1.4. | Sun 25 Oct |
| CVE-2026-15082 | 5.4 medium | 0.00% | ijsbrandy, siteimprove_analytics | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Siteimprove Analytics allows Cross-Site Scripting (XSS). This issue affects Siteimprove Analytics versions: from 0.0.0 to 2.0.1. | Sun 25 Oct |
| CVE-2026-15084 | 5.4 medium | 0.00% | ademarco, ui_patterns | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal UI Patterns (SDC in Drupal UI) allows Stored XSS. This issue affects UI Patterns (SDC in Drupal UI) versions: from 2.0.0 to 2.0.17. | Sun 25 Oct |
| CVE-2026-15085 | 5.4 medium | 0.00% | j-vee, ai_seo\/geo_analyzer | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI SEO/GEO Analyzer allows Stored XSS. This issue affects AI SEO/GEO Analyzer versions: from 0.0.0 to 1.1.3. | Sun 25 Oct |
| CVE-2026-55808 | 5.4 medium | 0.00% | drupal | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Drupal core versions: from 0.0.0 to 10.5.12, from 10.6.0 to 10.6.11, from 11.2.0 to 11.2.14, from 11.3.0 to 11.3.12, from 0.0.0 to 11.0.*, from 0.0.0 to 11.1.*. | Sun 25 Oct |
| CVE-2026-58589 | 5.4 medium | 0.00% | flowdrop_project, flowdrop | Missing Authorization vulnerability in Drupal FlowDrop allows Forceful Browsing. This issue affects FlowDrop versions: from 0.0.0 to 1.6.0. | Sun 25 Oct |
| CVE-2026-58590 | 5.4 medium | 0.00% | flowdrop_project, flowdrop | Missing Authorization vulnerability in Drupal FlowDrop allows Forceful Browsing. This issue affects FlowDrop versions: from 0.0.0 to 1.6.0. | Sun 25 Oct |
| CVE-2026-58591 | 5.4 medium | 0.00% | colorbox_project, colorbox | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Colorbox allows Cross-Site Scripting (XSS). This issue affects Colorbox versions: from 0.0.0 to 2.1.5, from 0.0.0 to 2.2.0. | Sun 25 Oct |
| CVE-2026-87940 | 5.4 medium | 0.00% | no CPE yet | Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Key auth allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Key auth versions: from 0.0.0 to 2.2.4. | 22 Oct |
| CVE-2026-81163 | 5.4 medium | 0.00% | no CPE yet | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Drupal Media Library Importer allows Path Traversal. This issue affects Media Library Importer versions: from 0.0.0 to 2.1.6. | 22 Oct |
| CVE-2026-84924 | 5.4 medium | 0.00% | no CPE yet | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Email Verification / SMS Verification / OTP Verification allows Reflected XSS. This issue affects Email Verification / SMS Verification / OTP Verification versions: from 0.0.0 to 2.4.0. | 22 Oct |
| CVE-2026-96370 | 5.4 medium | 0.00% | no CPE yet | Incorrect Authorization vulnerability in Drupal Webform allows Server Side Request Forgery. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1. | 22 Oct |
| CVE-2026-96371 | 5.4 medium | 0.00% | no CPE yet | Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1. | 22 Oct |
| CVE-2026-96372 | 5.4 medium | 0.00% | no CPE yet | Insufficient Granularity of Access Control vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1. | 22 Oct |
| CVE-2026-96388 | 5.4 medium | 0.00% | no CPE yet | Cross-Site Request Forgery (CSRF) vulnerability in Drupal Tawk.to - Live chat application allows Cross Site Request Forgery. This issue affects Tawk.to - Live chat application versions: from 0.0.0 to 3.0.4. | 22 Oct |
| CVE-2026-87945 | 5.4 medium | 0.00% | no CPE yet | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal SAML SSO - Service Provider allows Fake the Source of Data. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0. | 22 Oct |
| CVE-2025-12760 | 5.4 medium | 0.00% | email_tfa_project, email_tfa | Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Email TFA allows Functionality Bypass.This issue affects Email TFA: from 0.0.0 before 2.0.6. | 18 Oct |
| CVE-2026-84920 | 5.3 medium | 0.00% | no CPE yet | Incorrect Authorization vulnerability in Drupal Unpublished Node Permissions allows Forceful Browsing. This issue affects Unpublished Node Permissions versions: from 0.0.0 to 1.8.0. | 22 Oct |
| CVE-2026-84921 | 5.3 medium | 0.00% | no CPE yet | Missing Authorization vulnerability in Drupal Webform Submissions Delete allows Forceful Browsing. This issue affects Webform Submissions Delete versions: from 0.0.0 to 1.2.0. | 22 Oct |
| CVE-2026-84914 | 5.3 medium | 0.00% | no CPE yet | Missing Authorization vulnerability in Drupal Calculate Working Days allows Forceful Browsing. This issue affects Calculate Working Days versions: from 0.0.0 to 2.0.3. | 22 Oct |
| CVE-2026-96366 | 5.3 medium | 0.00% | no CPE yet | Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1. | 22 Oct |
| CVE-2026-96364 | 5.3 medium | 0.00% | no CPE yet | Improper Control of Interaction Frequency vulnerability in Drupal Webform allows Functionality Misuse. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1. | 22 Oct |
| CVE-2026-96377 | 5.3 medium | 0.00% | no CPE yet | Allocation of Resources Without Limits or Throttling vulnerability in Drupal Combined image style allows Excessive Allocation. This issue affects Combined image style versions: from 0.0.0 to 1.0.7. | 22 Oct |
| CVE-2026-96356 | 5.3 medium | 0.00% | no CPE yet | Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1. | 22 Oct |
| CVE-2026-87950 | 5.3 medium | 0.00% | no CPE yet | Use of Hard-coded Credentials vulnerability in Drupal SAML SSO - Service Provider allows Retrieve Embedded Sensitive Data. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0. | 22 Oct |
| CVE-2025-13080 | 5.3 medium | 0.00% | drupal | Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal Drupal core allows Forceful Browsing.This issue affects Drupal core: from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, from 11.2.0 before 11.2.8. | 18 Oct |
| CVE-2025-9552 | 5.3 medium | 0.00% | synchronize_composer.json_with_contrib_modules_project, synchronize_composer.json_with_contrib_modules | Vulnerability in Drupal Synchronize composer.Json With Contrib Modules.This issue affects Synchronize composer.Json With Contrib Modules: *.*. | 8 Oct |
| CVE-2025-9553 | 5.3 medium | 0.00% | api_key_manager_project, api_key_manager | Vulnerability in Drupal API Key manager.This issue affects API Key manager: *.*. | 8 Oct |
| CVE-2025-9554 | 5.3 medium | 0.00% | owl_carousel_2_project, owl_carousel_2 | Vulnerability in Drupal Owl Carousel 2.This issue affects Owl Carousel 2: *.*. | 8 Oct |
| CVE-2025-10929 | 5.3 medium | 0.00% | reverse_proxy_header_project, reverse_proxy_header | Improper Validation of Consistency within Input vulnerability in Drupal Reverse Proxy Header allows Manipulating User-Controlled Variables.This issue affects Reverse Proxy Header: from 0.0.0 before 1.1.2. | 8 Oct |
| CVE-2026-13237 | 4.8 medium | 0.00% | artificial_intelligence_project, artificial_intelligence | Incorrect Authorization vulnerability in Drupal AI Agents allows Forceful Browsing. This issue affects AI Agents versions: from 0.0.0 to 1.1.4, from 1.2.0 to 1.2.5, from 1.3.0 to 1.3.1. | Sun 25 Oct |
| CVE-2026-13238 | 4.8 medium | 0.00% | stella, commerce_realex_\/_global_payments | Incorrect Authorization vulnerability in Drupal Commerce Realex / Global Payments allows Forceful Browsing. This issue affects Commerce Realex / Global Payments versions: from 0.0.0 to 3.0.2. | Sun 25 Oct |
| CVE-2026-13243 | 4.8 medium | 0.00% | victorkane, salesforce_suite | Cross-Site Request Forgery (CSRF) vulnerability in Drupal Salesforce Suite allows Cross Site Request Forgery. This issue affects Salesforce Suite versions: from 0.0.0 to 5.1.3. | Sun 25 Oct |
| CVE-2026-96375 | 4.8 medium | 0.00% | no CPE yet | Improper Certificate Validation vulnerability in Drupal Cloud allows Adversary in the Middle (AiTM). This issue affects Cloud versions: from 0.0.0 to 7.0.1. | 22 Oct |
| CVE-2026-87944 | 4.8 medium | 0.00% | no CPE yet | Improper Certificate Validation vulnerability in Drupal SAML SSO - Service Provider allows Adversary in the Middle (AiTM). This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0. | 22 Oct |
| CVE-2026-87946 | 4.8 medium | 0.00% | no CPE yet | Observable Timing Discrepancy vulnerability in Drupal SAML SSO - Service Provider allows Brute Force. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0. | 22 Oct |
| CVE-2026-87947 | 4.8 medium | 0.00% | no CPE yet | Improper Verification of Cryptographic Signature vulnerability in Drupal SAML SSO - Service Provider allows Signature Spoof. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0. | 22 Oct |
| CVE-2026-87942 | 4.6 medium | 0.00% | no CPE yet | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal SafeDelete allows Stored XSS. This issue affects SafeDelete versions: from 0.0.0 to 1.0.88. | 22 Oct |
| CVE-2026-84919 | 4.6 medium | 0.00% | no CPE yet | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery allows Stored XSS. This issue affects PhotoSwipe - Responsive JavaScript Modal Image Gallery versions: from 0.0.0 to 5.0.9. | 22 Oct |
| CVE-2026-84915 | 4.6 medium | 0.00% | no CPE yet | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Component blocks allows Stored XSS. This issue affects Component blocks versions: from 0.0.0 to 1.2.7. | 22 Oct |
| CVE-2026-96361 | 4.6 medium | 0.00% | no CPE yet | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Cross-Site Scripting (XSS). This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1. | 22 Oct |
| CVE-2026-96358 | 4.6 medium | 0.00% | no CPE yet | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Cross-Site Scripting (XSS). This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1. | 22 Oct |
| CVE-2026-96359 | 4.6 medium | 0.00% | no CPE yet | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Cross-Site Scripting (XSS). This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1. | 22 Oct |
| CVE-2026-96367 | 4.6 medium | 0.00% | no CPE yet | Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1. | 22 Oct |
| CVE-2026-96368 | 4.6 medium | 0.00% | no CPE yet | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1. | 22 Oct |
| CVE-2026-96357 | 4.6 medium | 0.00% | no CPE yet | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1. | 22 Oct |
Download these 247 as CSV · subscribe to this list.
EPSS scores: 2026-10-29. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.