Skip to content
OpenAdvisories

Archive

10 July 2026

Vulnerabilities first published on this day (UTC), newest first.

← June 2026 2026 / July /10 August 2026 →
  1. 1377
  2. 2278
  3. 3181
  4. 472
  5. 588
  6. 6199
  7. 7184
  8. 8365
  9. 9281
  10. 10354
  11. 1180
  12. 1263
  13. 13346
  14. 141016
  15. 15280
  16. 16248
  17. 17294
  18. 1881
  19. 19464
  20. 20266
  21. 211479
  22. 22201
  23. 23376
  24. 24208
  25. 25285
  26. 2616
  27. 27443
  28. 28250
  29. 29279
  30. 30662
  31. 31192
All Critical High Medium Low Exploited only Public exploit

354 results · Feed

  • Critical 9.9
    CVE-2026-14480

    OpenPLC v3 External Control of File Name or Path

    OpenPLC Runtime v3 contains an authenticated arbitrary file write vulnerability in the legacy web UI program‑upload workflow. The application stores an attacker‑supplied filename (prog_file) directly into the Programs.File database field and later uses this v…

    OpenPLC OpenPLC
  • High 7.5
    CVE-2026-44383

    Hydro-Québec Le Circuit Electrique charging station backend Insufficient Session Expiration

    Multiple connections to the backend using the same charging station ID are allowed, which could allow an attacker to deploy multiple instances of malicious OCPP clients to overwhelm the backend.

    Hydro-Québec Le Circuit Electrique charging station backend
  • High 7.5
    CVE-2026-42952

    Hydro-Québec Le Circuit Electrique charging station backend Improper Restriction of Excessive Authentication Attempts

    Previously, there was no throttling on repeated authentication attempts to the charging station backend, which could allow an attacker to execute a denial-of-service attack.

    Hydro-Québec Le Circuit Electrique charging station backend
  • Critical 9.8
    CVE-2026-20744

    Hydro-Québec Le Circuit Electrique charging station backend Improper Access Control

    The charging station websocket endpoint accepts connections without proper authentication, which could lead to privilege escalation.

    Hydro-Québec Le Circuit Electrique charging station backend
  • Critical 9.8
    CVE-2026-11913

    Mother May I - Critical - Unsupported - SA-CONTRIB-2026-045

    vulnerability in Drupal Mother May I allows . This issue affects Mother May I versions: *.*.

    Drupal Mother May I drupal/mothermayi Packagist
  • Medium 5.9
    CVE-2026-11914

    Composer - Critical - Unsupported - SA-CONTRIB-2026-046

    vulnerability in Drupal Composer allows . This issue affects Composer versions: *.*.

    Drupal Composer drupal/composer Packagist
  • Medium 5.9
    CVE-2026-11915

    Brute force attack protection - Critical - Unsupported - SA-CONTRIB-2026-047

    vulnerability in Drupal Brute force attack protection allows . This issue affects Brute force attack protection versions: *.*.

    Drupal Brute force attack protection drupal/bfap_sb Packagist
  • Medium 5.9
    CVE-2026-15087

    Clean RESTful - Critical - Unsupported - SA-CONTRIB-2026-078

    vulnerability in Drupal Clean RESTful allows . This issue affects Clean RESTful versions: *.*.

    Drupal Clean RESTful drupal/clean_node_api Packagist
  • Medium 5.9
    CVE-2026-15086

    Raw Formatter [Meta Tag Formatter] - Critical - Unsupported - SA-CONTRIB-2026-077

    vulnerability in Drupal Raw Formatter [Meta Tag Formatter] allows . This issue affects Raw Formatter [Meta Tag Formatter] versions: *.*.

    Drupal Raw Formatter [Meta Tag Formatter] drupal/raw_formatter Packagist
  • Critical 9.1
    CVE-2026-15089

    Commerce guest registration - Critical - Unsupported - SA-CONTRIB-2026-079

    Vulnerability in Drupal Commerce guest registration. This issue affects Commerce guest registration versions: *.*.

    Drupal Commerce guest registration drupal/commerce_guest_registration Packagist
  • High 7.5
    CVE-2026-55175

    Spinnaker: Improper yaml processing on kustomize bake operations

    Spinnaker is an open source, multi-cloud continuous delivery platform. Prior to versions 2026.1.1, 2026.0.3, 2025.4.4, and 2025.3.4 on their respective release lines, Kustomize bake operations allow unsafe YAML tag processing in rosco manifests. This can lead…

    spinnaker spinnaker io.spinnaker.rosco:rosco-manifests Maven
  • High 8.8
    CVE-2026-44795

    Spinnaker: Non-safe yaml deserialization allowing RCE when using specific types

    Spinnaker is an open source, multi-cloud continuous delivery platform. Prior to 2026.1.0, 2026.0.3, 2025.4.4, and 2025.3.3, unsafe YAML processing bypasses safe deserialization when using CloudFormation deployments or CloudFoundry baking. The use of a non-saf…

    spinnaker spinnaker io.spinnaker.orca:orca-core io.spinnaker.rosco:rosco-core Maven
  • Medium 5.4
    CVE-2026-55808

    Drupal core - Moderately critical - Improper validation - SA-CORE-2026-009

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Drupal core versions: from 0.0.0 to 10.5.12, from 10.6.0 to 10.6.11, from 11.2.0 to …

    Drupal Drupal core drupal/core Web / CMS Packagist
  • Low 3.1
    CVE-2026-55807

    Drupal core - Moderately critical - Server-side request forgery - SA-CORE-2026-008

    Server-Side Request Forgery (SSRF) vulnerability in Drupal Drupal core allows Server Side Request Forgery. This issue affects Drupal core versions: from 0.0.0 to 10.5.12, from 10.6.0 to 10.6.11, from 11.2.0 to 11.2.14, from 11.3.0 to 11.3.12, from 0.0.0 to 11…

    Drupal Drupal core drupal/core Web / CMS Packagist
  • Medium 5.9
    CVE-2026-55804

    Drupal core - Moderately critical - Gadget chain - SA-CORE-2026-006

    Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection. This issue affects Drupal core versions: from 0.0.0 to 10.5.12, from 10.6.0 to 10.6.11, from 11.2.0 to 11.2.14, from 11…

    Drupal Drupal core drupal/core Web / CMS Packagist
  • Medium 5.9
    CVE-2026-55806

    Drupal core - Less critical - Cache poisoning and open redirect - SA-CORE-2026-007

    URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal Drupal core allows Content Spoofing. This issue affects Drupal core versions: from 0.0.0 to 10.5.12, from 10.6.0 to 10.6.11, from 11.2.0 to 11.2.14, from 11.3.0 to 11.3.12, from 0.0.0…

    Drupal Drupal core drupal/core Web / CMS Packagist
  • Medium 5.9
    CVE-2026-55803

    Drupal core - Critical - PHP object injection - SA-CORE-2026-005

    Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection. This issue affects Drupal core versions: from 0.0.0 to 10.5.12, from 10.6.0 to 10.6.11, from 11.2.0 to 11.2.14, from 11…

    Drupal Drupal core drupal/core Web / CMS Packagist
  • Medium 5.4
    CVE-2026-15085

    AI SEO/GEO Analyzer - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-076

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI SEO/GEO Analyzer allows Stored XSS. This issue affects AI SEO/GEO Analyzer versions: from 0.0.0 to 1.1.3.

    Drupal AI SEO/GEO Analyzer drupal/ai_seo Packagist
  • Medium 5.4
    CVE-2026-15084

    UI Patterns (SDC in Drupal UI) - Moderately critical - Cross site scripting - SA-CONTRIB-2026-075

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal UI Patterns (SDC in Drupal UI) allows Stored XSS. This issue affects UI Patterns (SDC in Drupal UI) versions: from 2.0.0 to 2.0.17.

    Drupal UI Patterns (SDC in Drupal UI) drupal/ui_patterns Web / CMS Packagist
  • Medium 4.2
    CVE-2026-15083

    ECA: Event - Condition - Action - Less critical - Information disclosure - SA-CONTRIB-2026-074

    Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal ECA: Event - Condition - Action allows Object Injection. This issue affects ECA: Event - Condition - Action versions: from 0.0.0 to 2.1.20, from 3.0.0 to 3.…

    Drupal ECA: Event - Condition - Action drupal/eca Packagist
  • Medium 5.4
    CVE-2026-15082

    Siteimprove Analytics - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-073

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Siteimprove Analytics allows Cross-Site Scripting (XSS). This issue affects Siteimprove Analytics versions: from 0.0.0 to 2.0.1.

    Drupal Siteimprove Analytics drupal/siteimprove_analytics Packagist
  • High 7.4
    CVE-2026-15081

    Location Selector - Critical - SQL Injection - SA-CONTRIB-2026-072

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Location Selector allows SQL Injection. This issue affects Location Selector versions: from 0.0.0 to 1.3.0.

    Drupal Location Selector drupal/location_selector Packagist
  • Medium 4.3
    CVE-2026-15080

    Ray Enterprise Translation - Moderately critical - Cross site request forgery - SA-CONTRIB-2026-071

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal Ray Enterprise Translation allows Cross Site Request Forgery. This issue affects Ray Enterprise Translation versions: from 0.0.0 to 4.0.4, from 4.1.0 to 4.1.4, from 11.0.0 to 11.0.4.

    Drupal Ray Enterprise Translation drupal/lingotek Packagist
  • Medium 5.4
    CVE-2026-15079

    Login Disable - Moderately critical - Access bypass - SA-CONTRIB-2026-070

    Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Login Disable allows Brute Force. This issue affects Login Disable versions: from 0.0.0 to 2.1.4.

    Drupal Login Disable drupal/login_disable Packagist
  • Medium 5.4
    CVE-2026-58591

    Colorbox - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-069

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Colorbox allows Cross-Site Scripting (XSS). This issue affects Colorbox versions: from 0.0.0 to 2.1.5, from 0.0.0 to 2.2.0.

    Drupal Colorbox drupal/colorbox Packagist
  • Medium 5.4
    CVE-2026-58590

    FlowDrop - Moderately critical - Access bypass - SA-CONTRIB-2026-068

    Missing Authorization vulnerability in Drupal FlowDrop allows Forceful Browsing. This issue affects FlowDrop versions: from 0.0.0 to 1.6.0.

    Drupal FlowDrop drupal/flowdrop Packagist
  • Medium 5.4
    CVE-2026-58589

    FlowDrop - Moderately critical - Access bypass - SA-CONTRIB-2026-067

    Missing Authorization vulnerability in Drupal FlowDrop allows Forceful Browsing. This issue affects FlowDrop versions: from 0.0.0 to 1.6.0.

    Drupal FlowDrop drupal/flowdrop Packagist
  • Medium 6.1
    CVE-2026-58587

    Drupal Canvas - Moderately critical - Improper validation - SA-CONTRIB-2026-065

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal Canvas allows Cross-Site Scripting (XSS). This issue affects Drupal Canvas versions: from 0.0.0 to 1.4.2, from 1.5.0 to 1.5.2, from 1.6.0 to 1.…

    Drupal Drupal Canvas drupal/canvas Web / CMS Packagist
  • Medium 6.1
    CVE-2026-58588

    Drupal Canvas - Moderately critical - Improper validation - SA-CONTRIB-2026-066

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal Canvas allows Cross-Site Scripting (XSS). This issue affects Drupal Canvas versions: from 0.0.0 to 1.4.2, from 1.5.0 to 1.5.2, from 1.6.0 to 1.…

    Drupal Drupal Canvas drupal/canvas Web / CMS Packagist
  • High 8.1
    CVE-2026-13244

    Tealium iQ Tag Management - Critical - PHP object injection - SA-CONTRIB-2026-064

    Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Tealium iQ Tag Management allows Object Injection. This issue affects Tealium iQ Tag Management versions: from 0.0.0 to 2.4.0.

    Drupal Tealium iQ Tag Management drupal/tealiumiq Packagist
  • Medium 4.8
    CVE-2026-13243

    Salesforce Suite - Moderately critical - Cross-site request forgery - SA-CONTRIB-2026-063

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal Salesforce Suite allows Cross Site Request Forgery. This issue affects Salesforce Suite versions: from 0.0.0 to 5.1.3.

    Drupal Salesforce Suite drupal/salesforce Packagist
  • Medium 6.5
    CVE-2026-13242

    Geolocation Field - Critical - SQL Injection - SA-CONTRIB-2026-062

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Geolocation Field allows SQL Injection. This issue affects Geolocation Field versions: from 0.0.0 to 3.15.0.

    Drupal Geolocation Field drupal/geolocation Packagist
  • Medium 6.5
    CVE-2026-13240

    Paragraphs - Less critical - Access bypass - SA-CONTRIB-2026-060

    Missing Authorization vulnerability in Drupal Paragraphs allows Forceful Browsing. This issue affects Paragraphs versions: from 0.0.0 to 1.21.0.

    Drupal Paragraphs drupal/paragraphs Packagist
  • Medium 6.5
    CVE-2026-13241

    Paragraphs - Moderately critical - Access bypass - SA-CONTRIB-2026-061

    Missing Authorization vulnerability in Drupal Paragraphs allows Forceful Browsing. This issue affects Paragraphs versions: from 0.0.0 to 1.21.0.

    Drupal Paragraphs drupal/paragraphs Packagist
  • Medium 6.5
    CVE-2026-13239

    WissKI - Critical - Access bypass - SA-CONTRIB-2026-059

    Missing Authorization vulnerability in Drupal WissKI allows Forceful Browsing. This issue affects WissKI versions: from 0.0.0 to 4.2.0.

    Drupal WissKI drupal/wisski Packagist
  • Medium 4.8
    CVE-2026-13238

    Commerce Realex / Global Payments - Moderately critical - Access Bypass - SA-CONTRIB-2026-058

    Incorrect Authorization vulnerability in Drupal Commerce Realex / Global Payments allows Forceful Browsing. This issue affects Commerce Realex / Global Payments versions: from 0.0.0 to 3.0.2.

    Drupal Commerce Realex / Global Payments drupal/commerce_realex Packagist
  • Medium 4.8
    CVE-2026-13237

    AI Agents - Moderately critical - Information disclosure, Access bypass - SA-CONTRIB-2026-057

    Incorrect Authorization vulnerability in Drupal AI Agents allows Forceful Browsing. This issue affects AI Agents versions: from 0.0.0 to 1.1.4, from 1.2.0 to 1.2.5, from 1.3.0 to 1.3.1.

    Drupal AI Agents drupal/ai_agents Packagist
  • Medium 4.2
    CVE-2026-13236

    AI Agents - Less critical - Access bypass - SA-CONTRIB-2026-056

    Missing Authorization vulnerability in Drupal AI Agents allows Forceful Browsing. This issue affects AI Agents versions: from 0.0.0 to 1.1.4, from 1.2.0 to 1.2.5, from 1.3.0 to 1.3.1.

    Drupal AI Agents drupal/ai_agents Packagist
  • Low 3.3
    CVE-2026-13235

    AI (Artificial Intelligence) - Moderately critical - Access bypass - SA-CONTRIB-2026-055

    Missing Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Forceful Browsing. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.2.17, from 1.3.0 to 1.3.8, from 1.4.0 to 1.4.3.

    Drupal AI (Artificial Intelligence) drupal/ai Packagist
  • Medium 6.1
    CVE-2026-13234

    AI (Artificial Intelligence) - Moderately critical - Information Disclosure / Cross-site Scripting - SA-CONTRIB-2026-054

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Cross-Site Scripting (XSS). This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.2.17, from 1…

    Drupal AI (Artificial Intelligence) drupal/ai Packagist