Skip to content
OpenAdvisories

Latest vulnerabilities

Every new CVE with its exploitation status, public exploits and fixes — from more than 20 public sources, updated hourly.

Tracked
409,112
Last 24h
508
Critical, 7 days
343
Known exploited
1,779
All Critical High Medium Low Exploited only Public exploit

107,931 results · Clear filters · Feed

  • Medium 5.4
    CVE-2026-114544

    Media Bulk Upload - Moderately critical - Access bypass - SA-CONTRIB-2026-243

    Incorrect Authorization vulnerability in Drupal Media Bulk Upload allows Forceful Browsing. This issue affects Media Bulk Upload versions: from 0.0.0 to 3.0.6.

    Drupal Media Bulk Upload drupal/media_bulk_upload Packagist
  • Medium 5.4
    CVE-2026-114545

    Fullcalendar View - Moderately critical - Access bypass - SA-CONTRIB-2026-244

    Incorrect Authorization vulnerability in Drupal Fullcalendar View allows Forceful Browsing. This issue affects Fullcalendar View versions: from 0.0.0 to 5.2.6.

    Drupal Fullcalendar View drupal/fullcalendar_view Packagist
  • Medium 5.3
    CVE-2026-107256

    Shield - Moderately critical - Access bypass - SA-CONTRIB-2026-248

    Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Shield allows Brute Force. This issue affects Shield versions: from 0.0.0 to 1.9.0.

    Drupal Shield drupal/shield Packagist
  • Medium 5.4
    CVE-2026-114572

    Domain Login Restrict - Moderately critical - Access bypass - SA-CONTRIB-2026-249

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Domain Login Restrict allows Authentication Bypass. This issue affects Domain Login Restrict versions: from 0.0.0 to 1.5.0.

    Drupal Domain Login Restrict drupal/domain_login_restrict Packagist
  • Medium 4.3
    CVE-2026-114554

    AI File to Text - Moderately critical - Access bypass - SA-CONTRIB-2026-251

    Incorrect Authorization vulnerability in Drupal AI File to Text allows Forceful Browsing. This issue affects AI File to Text versions: from 0.0.0 to 1.0.1.

    Drupal AI File to Text drupal/ai_file_to_text Packagist
  • Medium 6.5
    CVE-2026-114571

    Rabbit Hole - Moderately critical - Access Bypass - SA-CONTRIB-2026-252

    Incorrect Authorization vulnerability in Drupal Rabbit Hole allows Forceful Browsing. This issue affects Rabbit Hole versions: from 0.0.0 to 1.3.0.

    Drupal Rabbit Hole drupal/rabbit_hole Packagist
  • Medium 6.5
    CVE-2026-118539

    Commerce Core - Highly critical - Access bypass - SA-CONTRIB-2026-254

    Missing Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41, from 3.0.0 to 3.3.13.

    Drupal Commerce Core drupal/commerce Packagist
  • Medium 5.3
    CVE-2026-118540

    Commerce Core - Moderately critical - Information disclosure - SA-CONTRIB-2026-255

    Incorrect Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41, from 3.0.0 to 3.2.0.

    Drupal Commerce Core drupal/commerce Packagist
  • Medium 4.3
    CVE-2026-118541

    Commerce Core - Less critical - Access bypass - SA-CONTRIB-2026-256

    Incorrect Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13.

    Drupal Commerce Core drupal/commerce Packagist
  • Medium 5.3
    CVE-2026-118543

    Commerce Core - Moderately critical - Cross-site request forgery - SA-CONTRIB-2026-258

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal Commerce Core allows Cross Site Request Forgery. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13.

    Drupal Commerce Core drupal/commerce Packagist
  • Medium 6.3
    CVE-2026-118555

    Commerce License - Moderately critical - Access bypass - SA-CONTRIB-2026-260

    Incorrect Authorization vulnerability in Drupal Commerce License allows Forceful Browsing. This issue affects Commerce License versions: from 0.0.0 to 3.1.1.

    Drupal Commerce License drupal/commerce_license Packagist
  • Medium 6.5
    CVE-2026-118556

    Commerce Shipping - Moderately critical - Access bypass - SA-CONTRIB-2026-261

    Incorrect Authorization vulnerability in Drupal Commerce Shipping allows Forceful Browsing. This issue affects Commerce Shipping versions: from 0.0.0 to 2.16.0, from 3.0.0 to 3.0.6.

    Drupal Commerce Shipping drupal/commerce_shipping Packagist
  • Medium 5.3
    CVE-2026-118559

    Commerce Stripe - Moderately critical - Improper verification of cryptographic signature - SA-CONTRIB-2026-264

    Improper Verification of Cryptographic Signature vulnerability in Drupal Commerce Stripe allows Signature Spoof. This issue affects Commerce Stripe versions: from 0.0.0 to 1.4, from 2.0.0 to 2.2.3.

    Drupal Commerce Stripe drupal/commerce_stripe Packagist
  • Medium 5.1
    CVE-2026-118560

    Commerce Stripe - Moderately critical - Cross site scripting - SA-CONTRIB-2026-265

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Commerce Stripe allows Cross-Site Scripting (XSS). This issue affects Commerce Stripe versions: from 2.0.0 to 2.2.3.

    Drupal Commerce Stripe drupal/commerce_stripe Packagist
  • Medium 6.5
    CVE-2026-118545

    AI (Artificial Intelligence) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-266

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Cross-Site Scripting (XSS). This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1…

    Drupal AI (Artificial Intelligence) drupal/ai Packagist
  • Medium 6.5
    CVE-2026-118546

    AI (Artificial Intelligence) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-267

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Cross-Site Scripting (XSS). This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1…

    Drupal AI (Artificial Intelligence) drupal/ai Packagist
  • Medium 5.9
    CVE-2026-118550

    AI (Artificial Intelligence) - Moderately critical - Access bypass - SA-CONTRIB-2026-270

    Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal AI (Artificial Intelligence) allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4…

    Drupal AI (Artificial Intelligence) drupal/ai Packagist
  • Medium 6.5
    CVE-2026-118552

    AI (Artificial Intelligence) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-272

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Cross-Site Scripting (XSS). This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1…

    Drupal AI (Artificial Intelligence) drupal/ai Packagist
  • Medium 5.5
    CVE-2026-118553

    AI (Artificial Intelligence) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-273

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Stored XSS. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2.

    Drupal AI (Artificial Intelligence) drupal/ai Packagist
  • Medium 6.6
    CVE-2026-118563

    CacheFlush - Critical - Unsupported - SA-CONTRIB-2026-276

    Vulnerability in Drupal CacheFlush. This issue affects CacheFlush versions: *.*.

    Drupal CacheFlush drupal/cacheflush Packagist
  • Medium 6.6
    CVE-2026-118564

    PayUmoney for Drupal Commerce - Critical - Unsupported - SA-CONTRIB-2026-277

    Vulnerability in Drupal PayUmoney for Drupal Commerce. This issue affects PayUmoney for Drupal Commerce versions: *.*.

    Drupal PayUmoney for Drupal Commerce drupal/commerce_payumoney Web / CMS Packagist
  • Medium 5.4
    CVE-2026-118569 Public exploit

    Fasttoggle - Moderately critical - Access bypass - SA-CONTRIB-2026-282

    Incorrect Authorization vulnerability in Drupal Fasttoggle allows Forceful Browsing. This issue affects Fasttoggle versions: from 0.0.0 to 4.1.1.

    Drupal Fasttoggle drupal/fasttoggle Packagist
  • Medium 6.5
    CVE-2026-118570 Public exploit

    Fasttoggle - Moderately critical - Cross-Site Request Forgery - SA-CONTRIB-2026-283

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal Fasttoggle allows Cross Site Request Forgery. This issue affects Fasttoggle versions: from 0.0.0 to 4.1.1.

    Drupal Fasttoggle drupal/fasttoggle Packagist
  • Medium 5.6
    CVE-2026-118574

    S3 File System - Moderately critical - Access bypass - SA-CONTRIB-2026-279

    Incorrect Permission Assignment for Critical Resource vulnerability in Drupal S3 File System allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects S3 File System versions: from 0.0.0 to 3.12.0.

    Drupal S3 File System drupal/s3fs Packagist
  • Medium 4.7
    CVE-2026-118567

    Bulk Update User Roles - Moderately critical - Incorrect authorization - SA-CONTRIB-2026-280

    Incorrect Authorization vulnerability in Drupal Bulk Update User Roles allows Forceful Browsing. This issue affects Bulk Update User Roles versions: from 0.0.0 to 1.0.5.

    Drupal Bulk Update User Roles drupal/bulk_update_user_roles Packagist
  • Medium 4.8
    CVE-2026-118572

    OAuth Login - OAuth OIDC SSO - Critical - Authentication bypass - SA-CONTRIB-2026-284

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal OAuth Login - OAuth OIDC SSO allows Authentication Bypass. This issue affects OAuth Login - OAuth OIDC SSO versions: from 0.0.0 to 3.1.1.

    Drupal OAuth Login - OAuth OIDC SSO drupal/oauth_login_oauth2 Packagist
  • Medium 6.1
    CVE-2026-118575

    Signature pad widget - Critical - Cross-site scripting - SA-CONTRIB-2026-285

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Signature pad widget allows Stored XSS. This issue affects Signature pad widget versions: from 0.0.0 to 1.15.0.

    Drupal Signature pad widget drupal/sign_widget Packagist
  • Medium 6.5
    CVE-2026-118576

    Stage File Proxy - Critical - Cross-site scripting - SA-CONTRIB-2026-286

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Stage File Proxy allows Cross-Site Scripting (XSS). This issue affects Stage File Proxy versions: from 0.0.0 to 3.1.7, from 4.0.0 to 4.0.1.

    Drupal Stage File Proxy drupal/stage_file_proxy Packagist
  • Medium 5.4
    CVE-2026-118554

    OpenID Connect Client - Moderately critical - Improper authentication - SA-CONTRIB-2026-287

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal OpenID Connect Client allows Authentication Bypass. This issue affects OpenID Connect Client versions: from 0.0.0 to 2.3.1.

    Drupal OpenID Connect Client drupal/oidc Packagist
  • Medium 5.3
    CVE-2026-118583

    Field Permissions - Moderately critical - Access bypass - SA-CONTRIB-2026-288

    Incorrect Authorization vulnerability in Drupal Field Permissions allows Forceful Browsing. This issue affects Field Permissions versions: from 0.0.0 to 1.6.0.

    Drupal Field Permissions drupal/field_permissions Packagist
  • Medium 5.3
    CVE-2026-118584

    Field Permissions - Moderately critical - Access bypass - SA-CONTRIB-2026-289

    Incorrect Authorization vulnerability in Drupal Field Permissions allows Forceful Browsing. This issue affects Field Permissions versions: from 0.0.0 to 1.6.0.

    Drupal Field Permissions drupal/field_permissions Packagist
  • Medium 4.8
    CVE-2026-118573

    OAuth2 Token Manager - Critical - Access bypass - SA-CONTRIB-2026-290

    Missing Authorization vulnerability in Drupal OAuth2 Token Manager allows Forceful Browsing. This issue affects OAuth2 Token Manager versions: from 0.0.0 to 1.2.0.

    Drupal OAuth2 Token Manager drupal/oauth2_token_manager Packagist
  • Medium 5.9
    CVE-2026-118571

    Media Alias Display - Moderately critical - Information disclosure - SA-CONTRIB-2026-292

    Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Media Alias Display allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Media Alias Display versions: from 0.0.0 to 2.1.3, from 3.0.0 to …

    Drupal Media Alias Display drupal/media_alias_display Packagist
  • Medium 5.5
    CVE-2026-65587

    GPU DDK - OOB write in CalculateNPOTTwiddleSparsePageMap via TEXTURE_BASE_LEVEL change

    A web page that contains unusual WebGPU content loaded into the GPU GLES render process can trigger an OOB write in the GPU user-space driver, leading to memory corruption and possible browser/GPU process crash. The software writes data past the end of an int…

    Imagination Technologies Graphics DDK
  • Medium 6.5
    CVE-2026-91920

    Undertow: undertow: chunkreader message length permits chunk-size overflow

    A flaw was found in the ChunkReader component of the Undertow web server, which is used to handle chunked transfer encoding in HTTP requests. The issue occurs because a security check for the chunk size is performed before the value is shifted, allowing a spe…

    Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Single Sign-On 7 Linux Debian Ubuntu
  • Medium 5.8
    CVE-2026-110133

    Ghostscript: heap buffer overflow in ghostscript truetype outliner due to npointstotal integer underflow during retry rollback

    A flaw was found in Ghostscript. When processing a specially crafted TrueType font or document embedding one, an accounting error during font rendering can bypass buffer size checks, triggering a heap-based buffer overflow. A remote attacker could exploit thi…

    Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu
  • Medium 5.4
    CVE-2026-118959

    Keycloak-services: keycloak-services: required actions bypassed via kc_action parameter

    A flaw was found in the required action provider mechanism of Keycloak. The issue occurs when an authorization request includes the kc_action query parameter set to a mandatory action already assigned to the user, such as profile verification or terms and con…

    Red Hat Red Hat Single Sign-On 7 Red Hat Build of Keycloak
  • Medium 4.3
    CVE-2026-118947

    Keycloak-services: keycloak-services: authorization bypass via uma resource registration idor

    A flaw was found in the UMA resource registration endpoint of the keycloak-services component, which provides the core logic for Keycloak's authorization and identity services. The issue occurs when remote resource management is enabled, allowing an authentic…

    Red Hat Red Hat Single Sign-On 7 Red Hat Build of Keycloak
  • Medium 4.3
    CVE-2026-119272

    Incorrect authorization in FileSystem in Google Chrome prior to 156.0.8078.79 allowed a remote attacker leveraging soci…

    Google Chrome chromium Browsers Debian
  • Medium 4.3
    CVE-2026-76027

    Information loss in CacheStorage in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to obtain cross-orig…

    Google Chrome chromium Browsers Debian