Search
CVE Explorer
Search the full tracked CVE corpus across every vendor — by keyword, vendor, severity, CVSS band and publication date. Server-rendered; each filtered view has its own URL.
01
Filters
Submit to refine — state is held in the URL.
02
Results
83,150 matching · page 50/1663Each CVE id links to its NVD record.
| CVE | Severity | CVSS | Summary | Published |
|---|---|---|---|---|
| CVE-2026-114535(opens NVD record) | Unscored | — | Missing Authorization vulnerability in Drupal Swiper formatter allows Forceful Browsing. This issue affects Swiper formatter versions: from 0.0.0 to 2.1.2, from 3.0.1 to 3.1.0. | Oct 30, 2026 |
| CVE-2026-114534(opens NVD record) | Unscored | — | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Block Attributes allows Stored XSS. This issue affects Block Attributes versions: from 0.0.0 to 2.1.0. | Oct 30, 2026 |
| CVE-2026-114533(opens NVD record) | Unscored | — | Missing Authorization vulnerability in Drupal Ágora Transparency Theme allows Forceful Browsing. This issue affects Ágora Transparency Theme versions: from 0.0.0 to 1.2.3. | Oct 30, 2026 |
| CVE-2026-114532(opens NVD record) | Unscored | — | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal UI Icons allows Cross-Site Scripting (XSS). This issue affects UI Icons versions: from 0.0.0 to 1.1.3, from 2.0.0 to 2.0.2. | Oct 30, 2026 |
| CVE-2026-114531(opens NVD record) | Unscored | — | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Swiper formatter allows Stored XSS. This issue affects Swiper formatter versions: from 0.0.0 to 2.1.2, from 3.0.1 to 3.1.0. | Oct 30, 2026 |
| CVE-2026-114530(opens NVD record) | Unscored | — | Incorrect Authorization vulnerability in Drupal Dopup allows Forceful Browsing. This issue affects Dopup versions: from 0.0.0 to 1.0.7. | Oct 30, 2026 |
| CVE-2026-114529(opens NVD record) | Unscored | — | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal CSV Field allows Stored XSS. This issue affects CSV Field versions: from 0.0.0 to 2.0.10, from 3.0.0 to 3.0.7. | Oct 30, 2026 |
| CVE-2026-114528(opens NVD record) | Unscored | — | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Zero Point allows Stored XSS. This issue affects Zero Point versions: from 0.0.0 to 1.30.0, from 2.0.0 to 2.0.1. | Oct 30, 2026 |
| CVE-2026-114527(opens NVD record) | Unscored | — | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal UI Icons allows Cross-Site Scripting (XSS). This issue affects UI Icons versions: from 0.0.0 to 1.1.3, from 2.0.0 to 2.0.2. | Oct 30, 2026 |
| CVE-2026-114526(opens NVD record) | Unscored | — | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Black Hole allows Stored XSS. This issue affects Black Hole versions: from 0.0.0 to 1.26.0, from 2.0.0 to 2.0.1. | Oct 30, 2026 |
| CVE-2026-114525(opens NVD record) | Unscored | — | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal ABC allows Stored XSS. This issue affects ABC versions: from 0.0.0 to 1.25.0, from 2.0.0 to 2.0.1. | Oct 30, 2026 |
| CVE-2026-114524(opens NVD record) | Unscored | — | Privilege Defined With Unsafe Actions vulnerability in Drupal Custom Formatters allows Privilege Escalation. This issue affects Custom Formatters versions: from 0.0.0 to 4.2.1. | Oct 30, 2026 |
| CVE-2026-114523(opens NVD record) | Unscored | — | Improper Neutralization of Special Elements used in an OS Command ("OS Command Injection") vulnerability in Drupal Ffmpeg Image Toolkit allows OS Command Injection. This issue affects Ffmpeg Image Toolkit versions: from 0.0.0 to 1.0.3. | Oct 30, 2026 |
| CVE-2026-110738(opens NVD record) | Unscored | — | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Gin Admin Theme allows Cross-Site Scripting (XSS). This issue affects Gin Admin Theme versions: from 0.0.0 to 4.1.4, from 5.0.0 to 5.0.16. | Oct 30, 2026 |
| CVE-2026-108515(opens NVD record) | Unscored | — | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Drupal core versions: from 8.9.0 to 10.6.19, from 11.0.0 to 11.3.19, from 11.4.0 to 11.4.10, from 12.0.0-alpha1 to 12.0.0-beta2. | Oct 30, 2026 |
| CVE-2026-108514(opens NVD record) | Unscored | — | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Drupal core versions: from 10.3.0 to 10.6.19, from 11.0.0 to 11.3.19, from 11.4.0 to 11.4.10, from 12.0.0-alpha1 to 12.0.0-beta2. | Oct 30, 2026 |
| CVE-2026-108099(opens NVD record) | Unscored | — | Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Drupal Entity List allows Reflection Injection. This issue affects Entity List versions: from 0.0.0 to 3.0.10. | Oct 30, 2026 |
| CVE-2026-108097(opens NVD record) | Unscored | — | Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Drupal Drupal core allows Reflection Injection. This issue affects Drupal core versions: from 8.9.0 to 10.6.19, from 11.0.0 to 11.3.19, from 11.4.0 to 11.4.10, from 12.0.0-alpha1 to 12.0.0-beta2. | Oct 30, 2026 |
| CVE-2026-107312(opens NVD record) | Medium | 4.3 | Allocation of Resources Without Limits or Throttling vulnerability in Drupal Examples for Developers allows Excessive Allocation. This issue affects Examples for Developers versions: from 0.0.0 to 4.0.7. | Oct 30, 2026 |
| CVE-2026-107311(opens NVD record) | Low | 3.7 | Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal Permissions by Term allows Forceful Browsing. This issue affects Permissions by Term versions: from 0.0.0 to 3.1.41. | Oct 30, 2026 |
| CVE-2026-107310(opens NVD record) | Medium | 4.3 | Server-Side Request Forgery (SSRF) vulnerability in Drupal Freelinking allows Server Side Request Forgery. This issue affects Freelinking versions: from 0.0.0 to 4.0.3. | Oct 30, 2026 |
| CVE-2026-107309(opens NVD record) | Low | 3.7 | Missing Authorization vulnerability in Drupal Easy Breadcrumb allows Forceful Browsing. This issue affects Easy Breadcrumb versions: from 0.0.0 to 2.0.11. | Oct 30, 2026 |
| CVE-2026-107308(opens NVD record) | Low | 3.1 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Country allows Cross-Site Scripting (XSS). This issue affects Country versions: from 0.0.0 to 2.1.3, from 2.2.0 to 2.2.1. | Oct 30, 2026 |
| CVE-2026-107307(opens NVD record) | Medium | 4.3 | Incorrect Authorization vulnerability in Drupal SmartLinker AI allows Forceful Browsing. This issue affects SmartLinker AI versions: from 0.0.0 to 1.0.3. | Oct 30, 2026 |
| CVE-2026-107306(opens NVD record) | Low | 3.8 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Menu Link Attributes allows Stored XSS. This issue affects Menu Link Attributes versions: from 0.0.0 to 1.8.0. | Oct 30, 2026 |
| CVE-2026-107268(opens NVD record) | Medium | 4.3 | Insertion of Sensitive Information Into Sent Data vulnerability in Drupal Two Factor Authentication - TFA / Passwordless Login allows Forceful Browsing. This issue affects Two Factor Authentication - TFA / Passwordless Login versions: from 0.0.0 to 5.4.1, from 5.5.0 to 5.5.2. | Oct 30, 2026 |
| CVE-2026-107267(opens NVD record) | Medium | 5.3 | Missing Authorization vulnerability in Drupal DKAN allows Forceful Browsing. This issue affects DKAN versions: from 0.0.0 to 4.0.4, from 4.1.0 to 4.1.5. | Oct 30, 2026 |
| CVE-2026-107266(opens NVD record) | Unscored | — | Missing Authorization vulnerability in Drupal Views Share allows Forceful Browsing. This issue affects Views Share versions: from 0.0.0 to 2.0.1. | Oct 30, 2026 |
| CVE-2026-107265(opens NVD record) | Medium | 5.4 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Leaflet allows Stored XSS. This issue affects Leaflet versions: from 0.0.0 to 10.4.13. | Oct 30, 2026 |
| CVE-2026-107264(opens NVD record) | Medium | 5.4 | Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Inline Formatter Field allows Code Injection. This issue affects Inline Formatter Field versions: from 0.0.0 to 4.2.0. | Oct 30, 2026 |
| CVE-2026-107263(opens NVD record) | Medium | 5.4 | Incorrect Authorization vulnerability in Drupal Gutenberg allows Forceful Browsing. This issue affects Gutenberg versions: from 0.0.0 to 2.15.0, from 3.0.0 to 3.0.7. | Oct 30, 2026 |
| CVE-2026-107262(opens NVD record) | Medium | 5.3 | Cross-Site Request Forgery (CSRF) vulnerability in Drupal Advanced Filesystem allows Cross Site Request Forgery. This issue affects Advanced Filesystem versions: from 0.0.0 to 1.0.28. | Oct 30, 2026 |
| CVE-2026-107261(opens NVD record) | Medium | 4.2 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Authenticator Login Plus (2FA) allows Authentication Bypass. This issue affects Authenticator Login Plus (2FA) versions: from 0.0.0 to 1.0.1. | Oct 30, 2026 |
| CVE-2026-107260(opens NVD record) | Unscored | — | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Sector Distribution allows Stored XSS. This issue affects Sector Distribution versions: from 0.0.0 to 10.3.3, from 10.4.0 to 10.4.2. | Oct 30, 2026 |
| CVE-2026-107259(opens NVD record) | Medium | 5.4 | Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Linked Field allows Code Injection. This issue affects Linked Field versions: from 0.0.0 to 1.8.0. | Oct 30, 2026 |
| CVE-2026-107258(opens NVD record) | Medium | 5.4 | Incorrect Authorization vulnerability in Drupal Inline Entity Form Dialog allows Forceful Browsing. This issue affects Inline Entity Form Dialog versions: from 0.0.0 to 1.0.6. | Oct 30, 2026 |
| CVE-2026-107257(opens NVD record) | Medium | 6.5 | Incorrect Authorization vulnerability in Drupal Actstream allows Forceful Browsing. This issue affects Actstream versions: from 0.0.0 to 2.0.1, from 2.1.0 to 2.1.1. | Oct 30, 2026 |
| CVE-2026-107256(opens NVD record) | Unscored | — | Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Shield allows Brute Force. This issue affects Shield versions: from 0.0.0 to 1.9.0. | Oct 30, 2026 |
| CVE-2026-107255(opens NVD record) | Unscored | — | Incorrect Authorization vulnerability in Drupal Restrict route by IP allows Forceful Browsing. This issue affects Restrict route by IP versions: from 0.0.0 to 1.3.1, from 2.0.0 to 2.0.1. | Oct 30, 2026 |
| CVE-2026-107254(opens NVD record) | Medium | 4.8 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Authenticator Login Plus (2FA) allows Authentication Bypass. This issue affects Authenticator Login Plus (2FA) versions: from 0.0.0 to 1.0.1. | Oct 30, 2026 |
| CVE-2026-107253(opens NVD record) | Medium | 5.9 | Vulnerability in Drupal Orphans Media. This issue affects Orphans Media versions: *.*. | Oct 30, 2026 |
| CVE-2026-107252(opens NVD record) | Medium | 5.4 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal MathJax: LaTeX for Drupal allows Cross-Site Scripting (XSS). This issue affects MathJax: LaTeX for Drupal versions: from 0.0.0 to 4.1.2. | Oct 30, 2026 |
| CVE-2026-107251(opens NVD record) | Medium | 6.5 | Incorrect Authorization vulnerability in Drupal Entity Reference Manager (Merge entities) allows Forceful Browsing. This issue affects Entity Reference Manager (Merge entities) versions: from 0.0.0 to 1.0.3. | Oct 30, 2026 |
| CVE-2026-107250(opens NVD record) | Medium | 5.9 | Vulnerability in Drupal ECA Helper. This issue affects ECA Helper versions: *.*. | Oct 30, 2026 |
| CVE-2026-107249(opens NVD record) | Critical | 9.8 | Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Block AJAX allows Object Injection. This issue affects Block AJAX versions: from 0.0.0 to 3.0.2. | Oct 30, 2026 |
| CVE-2026-91920(opens NVD record) | Medium | 6.5 | A flaw was found in the ChunkReader component of the Undertow web server, which is used to handle chunked transfer encoding in HTTP requests. The issue occurs because a security check for the chunk size is performed before the value is shifted, allowing a specifically crafted 15-digit chunk size to bypass the limit and overflow into internal state flags. This can cause the server to terminate a request body prematurely and interpret the remaining data as a separate, smuggled request. | Oct 30, 2026 |
| CVE-2026-74915(opens NVD record) | Unscored | — | A web page that contains unusual WebGPU content loaded into the GPU GLES render process can trigger a OOB read and/or write crash in the GPU GLES user-space shared library. On certain platforms, when the process executing graphics workload has system privileges this could enable further exploits on the device. | Oct 30, 2026 |
| CVE-2026-74912(opens NVD record) | Unscored | — | On GPU systems with the security vulnerability fix for CVE-2026-49746 applied, the mapping range of graphics buffers is limited which causes errors when the mapping outside of that range. Integer truncation caused when mapping GPU buffer pages in the buffer’s range 0GB - 4GB, produces error and limits the functionality of the kernel mode driver. | Oct 30, 2026 |
| CVE-2026-65587(opens NVD record) | Unscored | — | A web page that contains unusual WebGPU content loaded into the GPU GLES render process can trigger an OOB write in the GPU user-space driver, leading to memory corruption and possible browser/GPU process crash. The software writes data past the end of an intended memory offset. Writing outside the bounds of allocated memory can corrupt adjacent memory, crash the process, or cause undefined behaviour. | Oct 30, 2026 |
| CVE-2026-65586(opens NVD record) | Unscored | — | Software installed and run as a non-privileged user may conduct improper GPU system calls to free memory in still in use, replace with another allocation and cause arbitrary memory reads or writes to physical memory pages. A memory buffer managed by a CPU thread of control (driver) and accessed by a GPU thread of control (firmware) can be freed while in use. Software installed and run as a non-privileged user may replace that buffer with another and replace a shared resource (memory page address list) managed by the CPU thread of control (driver) leading to the GPU accessing memory not managed by the CPU thread of control (driver). | Oct 30, 2026 |