Vulnerabilities
All
My stack
Known exploited
Public exploit
Critical (9+)
Likely exploited (EPSS ≥ 50%)
Changed, 24 h
New, 24 h
Sort:
risk
modified
published
CVSS
EPSS
| CVE | CVSS | EPSS | Vendor, product | Description | Modified |
|---|---|---|---|---|---|
| CVE-2026-13233exploit | 3.3 low | 0.00% | openai_provider_project, openai_provider | Server-Side Request Forgery (SSRF) vulnerability in Drupal OpenAI Provider allows Server Side Request Forgery. This issue affects OpenAI Provider versions: from 0.0.0 to 1.1.1, from 1.2.0 to 1.2.2. | Sun 25 Oct |
| CVE-2026-107268exploit | unscored | — | drupal, two factor authentication - tfa / passwordless login | Insertion of Sensitive Information Into Sent Data vulnerability in Drupal Two Factor Authentication - TFA / Passwordless Login allows Forceful Browsing. This issue affects Two Factor Authentication - TFA / Passwordless Login versions: from 0.0.0 to 5.4.1, from 5.5.0 to 5.5.2. | 19 h ago |
| CVE-2026-108097exploit ×3 | unscored | — | drupal, drupal core | Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Drupal Drupal core allows Reflection Injection. This issue affects Drupal core versions: from 8.9.0 to 10.6.19, from 11.0.0 to 11.3.19, from 11.4.0 to 11.4.10, from 12.0.0-alpha1 to 12.0.0-beta2. | 19 h ago |
| CVE-2026-10768 | 9.8 critical | 2.0% | localgovdrupal, localgov_workflows | Missing Authorization vulnerability in Drupal LocalGov Workflows allows Forceful Browsing. This issue affects LocalGov Workflows versions: from 0.0.0 to 1.6.0. | Sun 25 Oct |
| CVE-2026-9726 | 9.8 critical | 1.0% | alternativecommerce | Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal AlternativeCommerce (Basket) allows Object Injection. This issue affects Drupal AlternativeCommerce (Basket) versions: from 0.0.0 to 2.1.17. | Sun 25 Oct |
| CVE-2026-12535 | 9.8 critical | 1.0% | zroger, formatter_field | Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Formatter Field allows Object Injection. This issue affects Formatter Field versions: from 0.0.0 to 2.0.0. | Sun 25 Oct |
| CVE-2026-11913 | 9.8 critical | 1.0% | no CPE yet | vulnerability in Drupal Mother May I allows . This issue affects Mother May I versions: *.*. | Sun 25 Oct |
| CVE-2026-96376 | 6.4 medium | 1.0% | no CPE yet | Improper Neutralization of Special Elements used in an OS Command ("OS Command Injection") vulnerability in Drupal Cloud allows OS Command Injection. This issue affects Cloud versions: from 0.0.0 to 7.0.1. | 23 Oct |
| CVE-2012-1624 | 3.5 low | 1.0% | lingotek, ray_enterprise_translation | Multiple cross-site scripting (XSS) vulnerabilities in the Lingotek module 6.x-1.x before 6.x-1.40 for Drupal allow remote authenticated users to inject arbitrary web script or HTML when (1) creating or (2) editing page content. | 20 Oct |
| CVE-2026-15089 | 9.1 critical | 0.00% | no CPE yet | Vulnerability in Drupal Commerce guest registration. This issue affects Commerce guest registration versions: *.*. | Sun 25 Oct |
| CVE-2026-96355 | 9.1 critical | 0.00% | no CPE yet | Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Webform allows Code Injection. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1. | 23 Oct |
| CVE-2025-8093 | 8.8 high | 0.00% | authenticator_login_project, authenticator_login | Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Authenticator Login allows Authentication Bypass.This issue affects Authenticator Login: from 0.0.0 before 2.1.8. | 8 Oct |
| CVE-2026-13244 | 8.1 high | 0.00% | dakku, tealium_iq_tag_management | Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Tealium iQ Tag Management allows Object Injection. This issue affects Tealium iQ Tag Management versions: from 0.0.0 to 2.4.0. | Sun 25 Oct |
| CVE-2026-55809 | 8.1 high | 0.00% | flag_attendance_field_project, flag_attendance_field | Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Flag attendance field allows Object Injection. This issue affects Flag attendance field versions: from 0.0.0 to 1.2. | Sun 25 Oct |
| CVE-2026-55810 | 8.1 high | 0.00% | plotly, plotly.js_graphing | Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Plotly.js Graphing allows Object Injection. This issue affects Plotly.js Graphing versions: from 0.0.0 to 3.0.2. | Sun 25 Oct |
| CVE-2026-96365 | 7.5 high | 0.00% | no CPE yet | Allocation of Resources Without Limits or Throttling vulnerability in Drupal Webform allows Excessive Allocation. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1. | 22 Oct |
| CVE-2025-12082 | 7.5 high | 0.00% | salsa.digital, civictheme_design_system | Incorrect Authorization vulnerability in Drupal CivicTheme Design System allows Forceful Browsing.This issue affects CivicTheme Design System: from 0.0.0 before 1.12.0. | 8 Oct |
| CVE-2025-12466 | 7.5 high | 0.00% | simple_oauth_project, simple_oauth | Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Simple OAuth (OAuth2) & OpenID Connect allows Authentication Bypass.This issue affects Simple OAuth (OAuth2) & OpenID Connect: from 6.0.0 before 6.0.7. | 8 Oct |
| CVE-2025-9954 | 7.5 high | 0.00% | acquia, dam | Missing Authorization vulnerability in Drupal Acquia DAM allows Forceful Browsing.This issue affects Acquia DAM: from 0.0.0 before 1.1.5. | 8 Oct |
| CVE-2026-15081 | 7.4 high | 0.00% | handkerchief, location_selector | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Location Selector allows SQL Injection. This issue affects Location Selector versions: from 0.0.0 to 1.3.0. | Sun 25 Oct |
| CVE-2026-13239 | 6.5 medium | 0.00% | wiss-ki, wisski | Missing Authorization vulnerability in Drupal WissKI allows Forceful Browsing. This issue affects WissKI versions: from 0.0.0 to 4.2.0. | Sun 25 Oct |
| CVE-2026-13240 | 6.5 medium | 0.00% | md-systems, paragraphs | Missing Authorization vulnerability in Drupal Paragraphs allows Forceful Browsing. This issue affects Paragraphs versions: from 0.0.0 to 1.21.0. | Sun 25 Oct |
| CVE-2026-13241 | 6.5 medium | 0.00% | md-systems, paragraphs | Missing Authorization vulnerability in Drupal Paragraphs allows Forceful Browsing. This issue affects Paragraphs versions: from 0.0.0 to 1.21.0. | Sun 25 Oct |
| CVE-2026-13242 | 6.5 medium | 0.00% | dopry, geolocation_field | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Geolocation Field allows SQL Injection. This issue affects Geolocation Field versions: from 0.0.0 to 3.15.0. | Sun 25 Oct |
| CVE-2026-87937 | 6.5 medium | 0.00% | no CPE yet | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal Central Authentication System (CAS) Server allows Fake the Source of Data. This issue affects Central Authentication System (CAS) Server versions: from 0.0.0 to 2.0.4, from 2.1.0 to 2.1.3. | 22 Oct |
| CVE-2026-87936 | 6.5 medium | 0.00% | no CPE yet | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal amazee.ai Private AI Provider allows SQL Injection. This issue affects amazee.ai Private AI Provider versions: from 0.0.0 to 1.3.7, from 1.4.0 to 1.4.3. | 22 Oct |
| CVE-2026-84917 | 6.5 medium | 0.00% | no CPE yet | Incorrect Authorization vulnerability in Drupal Jsonapi Role Access allows Forceful Browsing. This issue affects Jsonapi Role Access versions: from 0.0.0 to 2.0.2. | 22 Oct |
| CVE-2026-84923 | 6.5 medium | 0.00% | no CPE yet | Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Email Verification / SMS Verification / OTP Verification allows Authentication Bypass. This issue affects Email Verification / SMS Verification / OTP Verification versions: from 0.0.0 to 2.4.0. | 22 Oct |
| CVE-2026-96386 | 6.5 medium | 0.00% | no CPE yet | Missing Authorization vulnerability in Drupal Smart Content allows Forceful Browsing. This issue affects Smart Content versions: from 0.0.0 to 3.2.1. | 22 Oct |
| CVE-2026-96380 | 6.5 medium | 0.00% | no CPE yet | Missing Authorization vulnerability in Drupal CSS Usage Analyzer allows Forceful Browsing. This issue affects CSS Usage Analyzer versions: from 1.0.0 to 1.0.2. | 22 Oct |
| CVE-2026-96385 | 6.5 medium | 0.00% | no CPE yet | Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal REST & JSON API Authentication for Drupal allows Authentication Bypass. This issue affects REST & JSON API Authentication for Drupal versions: from 0.0.0 to 3.2.0. | 22 Oct |
| CVE-2026-87943 | 6.5 medium | 0.00% | no CPE yet | Missing Authorization vulnerability in Drupal SAML SSO - Service Provider allows Forceful Browsing. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0. | 22 Oct |
| CVE-2025-9549 | 6.5 medium | 0.00% | facets_project, facets | Missing Authorization vulnerability in Drupal Facets allows Forceful Browsing.This issue affects Facets: from 0.0.0 before 2.0.10, from 3.0.0 before 3.0.1. | 8 Oct |
| CVE-2025-9551 | 6.5 medium | 0.00% | protected_pages_project, protected_pages | Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Protected Pages allows Brute Force.This issue affects Protected Pages: from 0.0.0 before 1.8.0, from 7.X-1.0 before 7.X-2.5. | 8 Oct |
| CVE-2025-10928 | 6.3 medium | 0.00% | access_code_project, access_code | Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Access code allows Brute Force.This issue affects Access code: from 0.0.0 before 2.0.5. | 8 Oct |
| CVE-2026-10770 | 6.1 medium | 0.00% | cleantalk, anti-spam | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Anti-Spam by CleanTalk allows Reflected XSS. This issue affects Anti-Spam by CleanTalk versions: from 0.0.0 to 9.7.1. | Sun 25 Oct |
| CVE-2026-13231 | 6.1 medium | 0.00% | anuaralfetahe, advanced_content_feedback | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Advanced Content Feedback (aka admin_feedback) allows Stored XSS. This issue affects Advanced Content Feedback (aka admin_feedback) versions: from 0.0.0 to 2.8.0. | Sun 25 Oct |
| CVE-2026-13234 | 6.1 medium | 0.00% | artificial_intelligence_project, artificial_intelligence | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Cross-Site Scripting (XSS). This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.2.17, from 1.3.0 to 1.3.8, from 1.4.0 to 1.4.3. | Sun 25 Oct |
| CVE-2026-58587 | 6.1 medium | 0.00% | drupal_canvas_project, drupal_canvas | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal Canvas allows Cross-Site Scripting (XSS). This issue affects Drupal Canvas versions: from 0.0.0 to 1.4.2, from 1.5.0 to 1.5.2, from 1.6.0 to 1.6.1, from 1.7.0 to 1.7.1. | Sun 25 Oct |
| CVE-2026-58588 | 6.1 medium | 0.00% | drupal_canvas_project, drupal_canvas | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal Canvas allows Cross-Site Scripting (XSS). This issue affects Drupal Canvas versions: from 0.0.0 to 1.4.2, from 1.5.0 to 1.5.2, from 1.6.0 to 1.6.1, from 1.7.0 to 1.7.1. | Sun 25 Oct |
| CVE-2025-9550 | 6.1 medium | 0.00% | facets_project, facets | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Facets allows Cross-Site Scripting (XSS).This issue affects Facets: from 0.0.0 before 2.0.10, from 3.0.0 before 3.0.1. | 8 Oct |
| CVE-2025-10926 | 6.1 medium | 0.00% | json_field_project, json_field | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal JSON Field allows Cross-Site Scripting (XSS).This issue affects JSON Field: from 0.0.0 before 1.5. | 8 Oct |
| CVE-2025-10927 | 6.1 medium | 0.00% | plausible_tracking_project, plausible_tracking | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Plausible tracking allows Cross-Site Scripting (XSS).This issue affects Plausible tracking: from 0.0.0 before 1.0.2. | 8 Oct |
| CVE-2025-12083 | 6.1 medium | 0.00% | salsa.digital, civictheme_design_system | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal CivicTheme Design System allows Cross-Site Scripting (XSS).This issue affects CivicTheme Design System: from 0.0.0 before 1.12.0. | 8 Oct |
| CVE-2026-55803 | 5.9 medium | 0.00% | drupal | Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection. This issue affects Drupal core versions: from 0.0.0 to 10.5.12, from 10.6.0 to 10.6.11, from 11.2.0 to 11.2.14, from 11.3.0 to 11.3.12, from 0.0.0 to 11.0.*, from 0.0.0 to 11.1.*. | Sun 25 Oct |
| CVE-2026-55804 | 5.9 medium | 0.00% | drupal | Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection. This issue affects Drupal core versions: from 0.0.0 to 10.5.12, from 10.6.0 to 10.6.11, from 11.2.0 to 11.2.14, from 11.3.0 to 11.3.12, from 0.0.0 to 11.0.*, from 0.0.0 to 11.1.*. | Sun 25 Oct |
| CVE-2026-55806 | 5.9 medium | 0.00% | drupal | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal Drupal core allows Content Spoofing. This issue affects Drupal core versions: from 0.0.0 to 10.5.12, from 10.6.0 to 10.6.11, from 11.2.0 to 11.2.14, from 11.3.0 to 11.3.12, from 0.0.0 to 11.0.*, from 0.0.0 to 11.1.*. | Sun 25 Oct |
| CVE-2026-11914 | 5.9 medium | 0.00% | no CPE yet | vulnerability in Drupal Composer allows . This issue affects Composer versions: *.*. | Sun 25 Oct |
| CVE-2026-11915 | 5.9 medium | 0.00% | no CPE yet | vulnerability in Drupal Brute force attack protection allows . This issue affects Brute force attack protection versions: *.*. | Sun 25 Oct |
| CVE-2026-15086 | 5.9 medium | 0.00% | no CPE yet | vulnerability in Drupal Raw Formatter [Meta Tag Formatter] allows . This issue affects Raw Formatter [Meta Tag Formatter] versions: *.*. | Sun 25 Oct |
50 of 247 · Next
Download these 247 as CSV · subscribe to this list.
EPSS scores: 2026-10-29. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.