16,517 results · Clear filters · Feed
-
Medium 6.9
Sulu: JCR-SQL2 injection via `categories` query parameter (unauthenticated)
Sulu is an open-source PHP content management system based on the Symfony framework. Prior to 2.6.25 and 3.0.8, the affected Sulu 2.6 and 3.0 release lines have a Smart Content QueryBuilder in src/Sulu/Component/Content/SmartContent/QueryBuilder.php that conc…
-
Medium 6.5
JLine: ReDoS in Nano Editor Regex Search Mode
JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in nano editor's regex search mode passes a user-controlled search term from doSearch(String text) in builtins/src/main/java/org/jline/builtins/Nano.java t…
-
Medium 6.4
9Router: Kiro region injection allows authenticated SSRF with Authorization header forwarding
9Router is an AI router & token saver. Prior to 0.5.6, the Kiro API-key validation endpoint POST /api/oauth/kiro/api-key builds an upstream URL using a user-controlled region value, allowing an authenticated attacker to supply a crafted region such as kiro-ca…
-
Medium 5.5
JLine: ReDoS via `HISTORY_IGNORE` Configuration Variable
JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, DefaultHistory.matchPatterns(String patterns, String line) in reader/src/main/java/org/jline/reader/impl/history/DefaultHistory.java converts the HISTORY_IGNORE configurat…
-
Medium 4.6
Diba carousel slider - Moderately critical - Cross Site Scripting (XSS) - SA-CONTRIB-2026-191
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Diba carousel slider allows Stored XSS. This issue affects Diba carousel slider versions: from 0.0.0 to 3.0.2.
-
Medium 6.5
Smart Content - Moderately critical - Access bypass - SA-CONTRIB-2026-190
Missing Authorization vulnerability in Drupal Smart Content allows Forceful Browsing. This issue affects Smart Content versions: from 0.0.0 to 3.2.1.
-
Medium 6.5
CSS Usage Analyzer - Moderately critical - Improper access control - SA-CONTRIB-2026-189
Missing Authorization vulnerability in Drupal CSS Usage Analyzer allows Forceful Browsing. This issue affects CSS Usage Analyzer versions: from 1.0.0 to 1.0.2.
-
Medium 5.3
Combined image style - Moderately critical - Improper access control - SA-CONTRIB-2026-188
Allocation of Resources Without Limits or Throttling vulnerability in Drupal Combined image style allows Excessive Allocation. This issue affects Combined image style versions: from 0.0.0 to 1.0.7.
-
Medium 4.3
Webform REST - Less critical - Access bypass - SA-CONTRIB-2026-186
Missing Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. This issue affects Webform REST versions: from 0.0.0 to 4.2.1.
-
Medium 4.3
Editoria11y Accessibility Checker - Moderately critical - Access bypass - SA-CONTRIB-2026-185
Privilege Defined With Unsafe Actions vulnerability in Drupal Editoria11y Accessibility Checker allows Privilege Escalation. This issue affects Editoria11y Accessibility Checker versions: from 0.0.0 to 2.2.23, from 3.0.0 to 3.0.9.
-
Medium 5.4
Tawk.to - Live chat application - Critical - Cross Site Request Forgery - SA-CONTRIB-2026-184
Cross-Site Request Forgery (CSRF) vulnerability in Drupal Tawk.to - Live chat application allows Cross Site Request Forgery. This issue affects Tawk.to - Live chat application versions: from 0.0.0 to 3.0.4.
-
Medium 6.5
REST & JSON API Authentication for Drupal - Moderately critical - Access bypass - SA-CONTRIB-2026-182
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal REST & JSON API Authentication for Drupal allows Authentication Bypass. This issue affects REST & JSON API Authentication for Drupal versions: from 0.0.0 to 3.2.0.
-
Medium 4.3
Commerce Decoupled Checkout - Moderately critical - Access bypass - SA-CONTRIB-2026-179
Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Commerce Decoupled Checkout allows Object Injection. This issue affects Commerce Decoupled Checkout versions: from 1.0.0 to 1.8.0.
-
Medium 4.2
Project Browser - Critical - Cross-site request forgery - SA-CONTRIB-2026-178
Cross-Site Request Forgery (CSRF) vulnerability in Drupal Project Browser allows Cross Site Request Forgery. This issue affects Project Browser versions: from 0.0.0 to 2.0.3, from 2.1.0 to 2.1.5.
-
Medium 6.4
Cloud - Critical - Remote code execution - SA-CONTRIB-2026-177
Improper Neutralization of Special Elements used in an OS Command ("OS Command Injection") vulnerability in Drupal Cloud allows OS Command Injection. This issue affects Cloud versions: from 0.0.0 to 7.0.1.
-
Medium 4.8
Cloud - Critical - Remote code execution - SA-CONTRIB-2026-176
Improper Certificate Validation vulnerability in Drupal Cloud allows Adversary in the Middle (AiTM). This issue affects Cloud versions: from 0.0.0 to 7.0.1.
-
Medium 5.3
Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-174
Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
-
Medium 4.3
Webform - Less critical - Access bypass - SA-CONTRIB-2026-173
Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
-
Medium 4.6
Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-172
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
-
Medium 5.3
Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-171
Improper Control of Interaction Frequency vulnerability in Drupal Webform allows Functionality Misuse. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
-
Medium 5.3
Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-169
Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
-
Medium 5.4
Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-167
Insufficient Granularity of Access Control vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
-
Medium 5.4
Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-166
Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
-
Medium 5.4
Webform - Moderately critical - Access bypass, Server-side request forgery - SA-CONTRIB-2026-164
Incorrect Authorization vulnerability in Drupal Webform allows Server Side Request Forgery. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
-
Medium 4.6
Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-163
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
-
Medium 4.6
Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-162
Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
-
Medium 4.2
Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-160
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Cross-Site Scripting (XSS). This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
-
Medium 4.6
Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-159
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Cross-Site Scripting (XSS). This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
-
Medium 4.6
Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-158
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Cross-Site Scripting (XSS). This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
-
Medium 4.6
Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-155
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Cross-Site Scripting (XSS). This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
-
Medium 5.3CVE-2026-73858 Public exploit
Solspace Freeform: Limited Twig template injection via submitted field values
Solspace Freeform plugin for Craft CMS 5.x is a super flexible form-building tool. From 5.0.0 through 5.10.13, submitted values from public Freeform forms can be evaluated by the isolated Twig renderer when rendered into HTML attributes. An unauthenticated at…
-
Medium 5.4
WPGraphQL: Contributor can publish and modify posts without the required capabilities via updatePost
WPGraphQL provides a GraphQL API for WordPress sites. Prior to 2.22.2, the updatePost mutation in src/Mutation/PostObjectUpdate.php checks only the collection-level edit_posts capability and the post author, but does not enforce the object-level edit_post cap…
-
Medium 6.4
REDAXO: Missing CSRF Protection on Package Update Action Allows Forced Addon Updates
REDAXO is a PHP-based content management system. Prior to 5.21.2, rex_api_install_package_update in redaxo/src/addons/install/lib/api/api_package_update.php inherits the false default from rex_api_function::requiresCsrfProtection() instead of requiring a CSRF…
-
Medium 4.8
REDAXO: Stored XSS in Mediapool Sync Page via Unescaped Filesystem Filenames
REDAXO is a PHP-based content management system. Prior to 5.21.2, redaxo/src/addons/mediapool/pages/sync.php inserts filenames held in $diffFiles from the media filesystem into the Mediapool Sync page without rex_escape(). An attacker who can place an unregis…
-
Medium 4.8
REDAXO: Stored XSS via Unescaped Media Manager Type Name in `mediaIsInUse()`
REDAXO is a PHP-based content management system. Prior to 5.21.2, the mediaIsInUse() handler in redaxo/src/addons/media_manager/lib/media_manager.php inserts a Media Manager type name into raw backend warning HTML without escaping it when invoked through MEDI…
-
Medium 6.9
Zapros has an Unbounded Content-Encoding decompression chain that allows denial of service
Zapros, a Python HTTP client, prior to version 0.14.0 is vulnerable to denial of service when an application requests content from an untrusted server, or follows a redirect to one, because a malicious response containing an excessive number of chained `Conte…
-
Medium 5.4
Home Assistant: mDNS Server-Side Request Forgery
Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.2.3, the IPP integration automatically processed unauthenticated _ipp._tcp.local mDNS announcements in homeassistant/components/ipp/config_flow.py, wher…
-
Medium 6.3
Traefik: BasicAuth singleflight coalescing reintroduces an unauthenticated username-enumeration timing oracle
Traefik is an open source HTTP reverse proxy and load balancer. From 3.6.11 until 3.7.13, checkPassword in pkg/middlewares/auth/basic_auth.go constructs the BasicAuth singleflight key from the submitted password and stored secret. Concurrent requests for abse…
-
Medium 4.3
Hatchet DurableTask WorkerStatus gRPC resolves caller-supplied durable-task UUIDs via ListSatisfiedEntries with no tenant_id filter
Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.106.1, the WorkerStatus gRPC polling path in pkg/repository/durable_events.go passes caller-supplied durable task, node, and branch identifiers to …
-
Medium 6.5
Cloudreve: SSRF guard bypass: checkIP does not decode IPv6-transition wrappers (NAT64, IPv4-compatible, 6to4) reaching internal and cloud-metadata addresses
Cloudreve is a self-hosted file management and sharing system. Prior to 4.18.0, the ValidateExternalURL server-side request forgery guard in pkg/request/ssrf.go passes resolved addresses to checkIP without decoding NAT64, IPv4-compatible, and 6to4 IPv4-in-IPv…