Browse All CVEs
10,557 vulnerabilities matching filters.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-87950 |
medium | 5.3 | 0.0029 | 2026-10-29 | Use of Hard-coded Credentials vulnerability in Drupal SAML SSO - Service Provider allows | |
CVE-2026-87954 |
medium | 4.3 | 0.0026 | 2026-10-29 | Missing Authorization vulnerability in Drupal Taxonomy Term Glossary allows Forceful Brows | |
CVE-2026-87955 |
medium | 4.3 | 0.0024 | 2026-10-29 | Missing Authorization vulnerability in Drupal Ultimate Table Field allows Forceful Browsin | |
CVE-2026-96356 |
medium | 5.3 | 0.0041 | 2026-10-29 | Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This iss | |
CVE-2026-96357 |
medium | 4.6 | 0.0022 | 2026-10-29 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulne | |
CVE-2026-96358 |
medium | 4.6 | 0.0022 | 2026-10-29 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulne | |
CVE-2026-96359 |
medium | 4.6 | 0.0022 | 2026-10-29 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulne | |
CVE-2026-96361 |
medium | 4.6 | 0.0022 | 2026-10-29 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulne | |
CVE-2026-96362 |
medium | 4.2 | 0.0020 | 2026-10-29 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulne | |
CVE-2026-96364 |
medium | 5.3 | 0.0029 | 2026-10-29 | Improper Control of Interaction Frequency vulnerability in Drupal Webform allows Functiona | |
CVE-2026-96366 |
medium | 5.3 | 0.0040 | 2026-10-29 | Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This iss | |
CVE-2026-96367 |
medium | 4.6 | 0.0026 | 2026-10-29 | Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS. T | |
CVE-2026-96368 |
medium | 4.6 | 0.0017 | 2026-10-29 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulne | |
CVE-2026-96370 |
medium | 5.4 | 0.0024 | 2026-10-29 | Incorrect Authorization vulnerability in Drupal Webform allows Server Side Request Forgery | |
CVE-2026-96371 |
medium | 5.4 | 0.0024 | 2026-10-29 | Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS. T | |
CVE-2026-96372 |
medium | 5.4 | 0.0024 | 2026-10-29 | Insufficient Granularity of Access Control vulnerability in Drupal Webform allows Forceful | |
CVE-2026-96374 |
medium | 4.2 | 0.0010 | 2026-10-29 | Cross-Site Request Forgery (CSRF) vulnerability in Drupal Project Browser allows Cross Sit | |
CVE-2026-96375 |
medium | 4.8 | 0.0012 | 2026-10-29 | Improper Certificate Validation vulnerability in Drupal Cloud allows Adversary in the Midd | |
CVE-2026-96376 |
medium | 6.4 | 0.0058 | 2026-10-29 | Improper Neutralization of Special Elements used in an OS Command ("OS Command Injection") | |
CVE-2026-96377 |
medium | 5.3 | 0.0034 | 2026-10-29 | Allocation of Resources Without Limits or Throttling vulnerability in Drupal Combined imag | |
CVE-2026-96378 |
medium | 4.3 | 0.0023 | 2026-10-29 | Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerabili | |
CVE-2026-96380 |
medium | 6.5 | 0.0022 | 2026-10-29 | Missing Authorization vulnerability in Drupal CSS Usage Analyzer allows Forceful Browsing. | |
CVE-2026-96382 |
medium | 4.6 | 0.0017 | 2026-10-29 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulne | |
CVE-2026-96385 |
medium | 6.5 | 0.0028 | 2026-10-29 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal REST & JS | |
CVE-2026-96386 |
medium | 6.5 | 0.0022 | 2026-10-29 | Missing Authorization vulnerability in Drupal Smart Content allows Forceful Browsing. This | |
CVE-2026-96388 |
medium | 5.4 | 0.0012 | 2026-10-29 | Cross-Site Request Forgery (CSRF) vulnerability in Drupal Tawk.to - Live chat application | |
CVE-2026-96390 |
medium | 4.3 | 0.0021 | 2026-10-29 | Privilege Defined With Unsafe Actions vulnerability in Drupal Editoria11y Accessibility Ch | |
CVE-2026-96391 |
medium | 4.3 | 0.0030 | 2026-10-29 | Missing Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. This | |
CVE-2026-96398 |
medium | 4.3 | 0.0032 | 2026-10-29 | Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This iss | |
CVE-2026-114729 |
medium | 5.3 | 0.0038 | 2026-10-29 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blo | |
CVE-2026-114731 |
medium | 5.3 | 0.0043 | 2026-10-29 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an uncontrolled reso | |
CVE-2026-114732 |
medium | 6.8 | 0.0036 | 2026-10-29 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an improper authenti | |
CVE-2026-114221 |
medium | 5.9 | 0.0033 | 2026-10-29 | NT OneAPP developed by NewType Infortech has a Credential Disclosure vulnerability. Unauth | |
CVE-2026-114222 |
medium | 6.9 | 0.0014 | 2026-10-29 | NT OneAPP developed by NewType Infortech has an Authentication Bypass vulnerability. Unaut | |
CVE-2026-114223 |
medium | 6.7 | 0.0008 | 2026-10-29 | NT OneAPP developed by NewType Infortech has an Exposure of Sensitive Information vulnerab | |
CVE-2026-100142 |
medium | 5.3 | 0.0030 | 2026-10-29 | The FluentCart A New Era of eCommerce WordPress plugin before 2.2.0 does not verify that | |
CVE-2026-103234 |
medium | 4.8 | 0.0022 | 2026-10-29 | The WP Ultimate Review WordPress plugin before 2.4.5 does not neutralise shortcodes in all | |
CVE-2026-110010 |
medium | 4.8 | 0.0021 | 2026-10-29 | The MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.12.3 does not perfo | |
CVE-2026-111971 |
medium | 6.8 | 0.0031 | 2026-10-29 | The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.5.8 does not sani | |
CVE-2026-111972 |
medium | 4.9 | 0.0025 | 2026-10-29 | The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.5.8 does not veri | |
CVE-2026-114570 |
medium | 4.9 | 0.0022 | 2026-10-29 | WordPress Core is vulnerable to Stored Cross-Site Scripting via Quick Edit in all versions | |
CVE-2026-78392 |
medium | 6.8 | 0.0034 | 2026-10-29 | The Link Library WordPress plugin before 7.9.6 does not sanitise and escape a link field b | |
CVE-2026-103634 |
medium | 5.3 | 0.0049 | 2026-10-29 | Out-of-bounds read and write in the Count-Min sketch deserialization of Apache DataSketche | |
CVE-2026-111847 |
medium | 5.4 | 0.0019 | 2026-10-29 | Missing Authorization vulnerability in Kings Plugins MarketKing marketking-multivendor-mar | |
CVE-2026-112826 |
medium | 5.3 | 0.0028 | 2026-10-29 | Missing Authorization vulnerability in eLightUp Falcon – WordPress Optimizations & Tweaks | |
CVE-2026-112843 |
medium | 4.3 | 0.0020 | 2026-10-29 | Missing Authorization vulnerability in WP Chill Strong Testimonials strong-testimonials al | |
CVE-2026-112867 |
medium | 6.5 | 0.0017 | 2026-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulne | |
CVE-2026-114175 |
medium | 5.4 | 0.0026 | 2026-10-29 | Missing Authorization vulnerability in DigitalME eRoom eroom-zoom-meetings-webinar allows | |
CVE-2026-114180 |
medium | 5.3 | 0.0025 | 2026-10-29 | Missing Authorization vulnerability in Wpmet Metform metform allows Exploiting Incorrectly | |
CVE-2026-114182 |
medium | 4.3 | 0.0022 | 2026-10-29 | Missing Authorization vulnerability in IdeaBox Creations PowerPack Addons for Elementor po |