Tagged “cve.org”
CVEs tagged cve.org, newest first.
47129 CVEsRSS
CVE-2026-118541Medium· 4.3Commerce Core - Less critical - Access bypass - SA-CONTRIB-2026-256
Incorrect Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13.
CVE-2026-118544Low· 3.7Commerce Core - Moderately critical - Information disclosure - SA-CONTRIB-2026-259
Exposure of Sensitive Information Through Data Queries vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13.
CVE-2026-118543Medium· 5.3Commerce Core - Moderately critical - Cross-site request forgery - SA-CONTRIB-2026-258
Cross-Site Request Forgery (CSRF) vulnerability in Drupal Commerce Core allows Cross Site Request Forgery. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13.
CVE-2026-118556Medium· 6.5Commerce Shipping - Moderately critical - Access bypass - SA-CONTRIB-2026-261
Incorrect Authorization vulnerability in Drupal Commerce Shipping allows Forceful Browsing. This issue affects Commerce Shipping versions: from 0.0.0 to 2.16.0, from 3.0.0 to 3.0.6.
CVE-2026-118555Medium· 6.3Commerce License - Moderately critical - Access bypass - SA-CONTRIB-2026-260
Incorrect Authorization vulnerability in Drupal Commerce License allows Forceful Browsing. This issue affects Commerce License versions: from 0.0.0 to 3.1.1.
CVE-2026-118560Medium· 5.1Commerce Stripe - Moderately critical - Cross site scripting - SA-CONTRIB-2026-265
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Commerce Stripe allows Cross-Site Scripting (XSS). This issue affects Commerce Stripe versions: from 2.0.0 to 2.2.3.
CVE-2026-118559Medium· 5.3Commerce Stripe - Moderately critical - Improper verification of cryptographic signature - SA-CONTRIB-2026-264
Improper Verification of Cryptographic Signature vulnerability in Drupal Commerce Stripe allows Signature Spoof. This issue affects Commerce Stripe versions: from 0.0.0 to 1.4, from 2.0.0 to 2.2.3.
CVE-2026-118557Low· 2.7Commerce Shipping - Less critical - Access bypass - SA-CONTRIB-2026-262
Incorrect Authorization vulnerability in Drupal Commerce Shipping allows Forceful Browsing. This issue affects Commerce Shipping versions: from 0.0.0 to 2.16.0, from 3.0.0 to 3.0.6.
CVE-2026-118558High· 7.3Commerce Stripe - Critical - Cross-site request forgery - SA-CONTRIB-2026-263
Cross-Site Request Forgery (CSRF) vulnerability in Drupal Commerce Stripe allows Cross Site Request Forgery. This issue affects Commerce Stripe versions: from 2.0.0 to 2.2.3.
CVE-2026-118545Medium· 6.5AI (Artificial Intelligence) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-266
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Cross-Site Scripting (XSS). This issue affects AI (Artificial Intelligence) versions: from 0…
CVE-2026-118550Medium· 5.9AI (Artificial Intelligence) - Moderately critical - Access bypass - SA-CONTRIB-2026-270
Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal AI (Artificial Intelligence) allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects AI (Artificial Intelligence) versi…
CVE-2026-118549High· 7.1AI (Artificial Intelligence) - Critical - Cross-site scripting - SA-CONTRIB-2026-269
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Cross-Site Scripting (XSS). This issue affects AI (Artificial Intelligence) versions: from 0…
CVE-2026-118561High· 7.2Single Content Sync - Critical - External control of file name or path - SA-CONTRIB-2026-274
External Control of File Name or Path vulnerability in Drupal Single Content Sync allows Path Traversal. This issue affects Single Content Sync versions: from 0.0.0 to 1.4.19.
CVE-2026-118548Low· 3.7AI (Artificial Intelligence) - Moderately critical - Information disclosure - SA-CONTRIB-2026-268
Incorrect Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Resource Injection. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2.
CVE-2026-118546Medium· 6.5AI (Artificial Intelligence) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-267
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Cross-Site Scripting (XSS). This issue affects AI (Artificial Intelligence) versions: from 0…
CVE-2026-118552Medium· 6.5AI (Artificial Intelligence) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-272
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Cross-Site Scripting (XSS). This issue affects AI (Artificial Intelligence) versions: from 0…
CVE-2026-118551Low· 3.1AI (Artificial Intelligence) - Less critical - Information Disclosure - SA-CONTRIB-2026-271
Insecure Storage of Sensitive Information vulnerability in Drupal AI (Artificial Intelligence) allows Retrieve Embedded Sensitive Data. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2.
CVE-2026-118563Medium· 6.6CacheFlush - Critical - Unsupported - SA-CONTRIB-2026-276
Vulnerability in Drupal CacheFlush. This issue affects CacheFlush versions: *.*.
CVE-2026-118553Medium· 5.5AI (Artificial Intelligence) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-273
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Stored XSS. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, …
CVE-2026-118565High· 7.2GroupEx PRO ( Daxko ) integration - Critical - Unsupported - SA-CONTRIB-2026-278
Vulnerability in Drupal GroupEx PRO ( Daxko ) integration. This issue affects GroupEx PRO ( Daxko ) integration versions: *.*.
CVE-2026-118564Medium· 6.6PayUmoney for Drupal Commerce - Critical - Unsupported - SA-CONTRIB-2026-277
Vulnerability in Drupal PayUmoney for Drupal Commerce. This issue affects PayUmoney for Drupal Commerce versions: *.*.
CVE-2026-118562High· 7.2Single Content Sync - Critical - Remote code execution - SA-CONTRIB-2026-275
Deserialization of Untrusted Data vulnerability in Drupal Single Content Sync allows Object Injection. This issue affects Single Content Sync versions: from 0.0.0 to 1.4.19.
CVE-2026-118582High· 7.3CAPTCHA - Moderately critical - Session Replay (CAPTCHA bypass) - SA-CONTRIB-2026-281
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal CAPTCHA allows Functionality Bypass. This issue affects CAPTCHA versions: from 0.0.0 to 1.18.0, from 2.0.0 to 2.0.11.
CVE-2026-118570Medium· 6.5PoCFasttoggle - Moderately critical - Cross-Site Request Forgery - SA-CONTRIB-2026-283
Cross-Site Request Forgery (CSRF) vulnerability in Drupal Fasttoggle allows Cross Site Request Forgery. This issue affects Fasttoggle versions: from 0.0.0 to 4.1.1.
CVE-2026-118574Medium· 5.6S3 File System - Moderately critical - Access bypass - SA-CONTRIB-2026-279
Incorrect Permission Assignment for Critical Resource vulnerability in Drupal S3 File System allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects S3 File System versions: from 0.0.0 to 3.12.0.
CVE-2026-118569Medium· 5.4PoCFasttoggle - Moderately critical - Access bypass - SA-CONTRIB-2026-282
Incorrect Authorization vulnerability in Drupal Fasttoggle allows Forceful Browsing. This issue affects Fasttoggle versions: from 0.0.0 to 4.1.1.
CVE-2026-118575Medium· 6.1Signature pad widget - Critical - Cross-site scripting - SA-CONTRIB-2026-285
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Signature pad widget allows Stored XSS. This issue affects Signature pad widget versions: from 0.0.0 to 1.15.0.
CVE-2026-118572Medium· 4.8OAuth Login - OAuth OIDC SSO - Critical - Authentication bypass - SA-CONTRIB-2026-284
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal OAuth Login - OAuth OIDC SSO allows Authentication Bypass. This issue affects OAuth Login - OAuth OIDC SSO versions: from 0.0.0 to 3.1.1.
CVE-2026-118576Medium· 6.5Stage File Proxy - Critical - Cross-site scripting - SA-CONTRIB-2026-286
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Stage File Proxy allows Cross-Site Scripting (XSS). This issue affects Stage File Proxy versions: from 0.0.0 to 3.1.7, from 4.0.…
CVE-2026-118573Medium· 4.8OAuth2 Token Manager - Critical - Access bypass - SA-CONTRIB-2026-290
Missing Authorization vulnerability in Drupal OAuth2 Token Manager allows Forceful Browsing. This issue affects OAuth2 Token Manager versions: from 0.0.0 to 1.2.0.