Skip to content
OpenAdvisories

Source

OSV.dev (GitHub Advisories, PyPA, Go, RustSec…)

Source: https://osv.dev/

All Critical High Medium Low Exploited only Public exploit

38,591 results · Feed

  • Low 2.9
    CVE-2026-55458

    Caddy: RFC 7230 §6.1 compliance issue / Hop-by-hop headers that leak through

    Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.5, the reverse proxy's finalizeResponse method in modules/caddyhttp/reverseproxy/reverseproxy.go handles an upstream 101 Switching Protocols response before running removeConnectio…

    caddyserver caddy github.com/caddyserver/caddy/v2 caddy Debian Ubuntu Go
  • Medium 5.9
    CVE-2026-118571

    Media Alias Display - Moderately critical - Information disclosure - SA-CONTRIB-2026-292

    Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Media Alias Display allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Media Alias Display versions: from 0.0.0 to 2.1.3, from 3.0.0 to …

    Drupal Media Alias Display drupal/media_alias_display Packagist
  • Low 3.3
    CVE-2026-118568

    Content Sync (content-sync.io) - Moderately critical - Information disclosure - SA-CONTRIB-2026-291

    Insecure Storage of Sensitive Information vulnerability in Drupal Content Sync (content-sync.io) allows Retrieve Embedded Sensitive Data. This issue affects Content Sync (content-sync.io) versions: from 0.0.0 to 3.2.2.

    Drupal Content Sync (content-sync.io) drupal/cms_content_sync Packagist
  • Medium 4.8
    CVE-2026-118573

    OAuth2 Token Manager - Critical - Access bypass - SA-CONTRIB-2026-290

    Missing Authorization vulnerability in Drupal OAuth2 Token Manager allows Forceful Browsing. This issue affects OAuth2 Token Manager versions: from 0.0.0 to 1.2.0.

    Drupal OAuth2 Token Manager drupal/oauth2_token_manager Packagist
  • Medium 5.3
    CVE-2026-118584

    Field Permissions - Moderately critical - Access bypass - SA-CONTRIB-2026-289

    Incorrect Authorization vulnerability in Drupal Field Permissions allows Forceful Browsing. This issue affects Field Permissions versions: from 0.0.0 to 1.6.0.

    Drupal Field Permissions drupal/field_permissions Packagist
  • Medium 5.3
    CVE-2026-118583

    Field Permissions - Moderately critical - Access bypass - SA-CONTRIB-2026-288

    Incorrect Authorization vulnerability in Drupal Field Permissions allows Forceful Browsing. This issue affects Field Permissions versions: from 0.0.0 to 1.6.0.

    Drupal Field Permissions drupal/field_permissions Packagist
  • Medium 5.4
    CVE-2026-118554

    OpenID Connect Client - Moderately critical - Improper authentication - SA-CONTRIB-2026-287

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal OpenID Connect Client allows Authentication Bypass. This issue affects OpenID Connect Client versions: from 0.0.0 to 2.3.1.

    Drupal OpenID Connect Client drupal/oidc Packagist
  • Medium 6.5
    CVE-2026-118576

    Stage File Proxy - Critical - Cross-site scripting - SA-CONTRIB-2026-286

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Stage File Proxy allows Cross-Site Scripting (XSS). This issue affects Stage File Proxy versions: from 0.0.0 to 3.1.7, from 4.0.0 to 4.0.1.

    Drupal Stage File Proxy drupal/stage_file_proxy Packagist
  • Medium 6.1
    CVE-2026-118575

    Signature pad widget - Critical - Cross-site scripting - SA-CONTRIB-2026-285

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Signature pad widget allows Stored XSS. This issue affects Signature pad widget versions: from 0.0.0 to 1.15.0.

    Drupal Signature pad widget drupal/sign_widget Packagist
  • Medium 4.8
    CVE-2026-118572

    OAuth Login - OAuth OIDC SSO - Critical - Authentication bypass - SA-CONTRIB-2026-284

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal OAuth Login - OAuth OIDC SSO allows Authentication Bypass. This issue affects OAuth Login - OAuth OIDC SSO versions: from 0.0.0 to 3.1.1.

    Drupal OAuth Login - OAuth OIDC SSO drupal/oauth_login_oauth2 Packagist
  • Medium 4.7
    CVE-2026-118567

    Bulk Update User Roles - Moderately critical - Incorrect authorization - SA-CONTRIB-2026-280

    Incorrect Authorization vulnerability in Drupal Bulk Update User Roles allows Forceful Browsing. This issue affects Bulk Update User Roles versions: from 0.0.0 to 1.0.5.

    Drupal Bulk Update User Roles drupal/bulk_update_user_roles Packagist
  • Medium 5.6
    CVE-2026-118574

    S3 File System - Moderately critical - Access bypass - SA-CONTRIB-2026-279

    Incorrect Permission Assignment for Critical Resource vulnerability in Drupal S3 File System allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects S3 File System versions: from 0.0.0 to 3.12.0.

    Drupal S3 File System drupal/s3fs Packagist
  • Medium 6.5
    CVE-2026-118570 Public exploit

    Fasttoggle - Moderately critical - Cross-Site Request Forgery - SA-CONTRIB-2026-283

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal Fasttoggle allows Cross Site Request Forgery. This issue affects Fasttoggle versions: from 0.0.0 to 4.1.1.

    Drupal Fasttoggle drupal/fasttoggle Packagist
  • Medium 5.4
    CVE-2026-118569 Public exploit

    Fasttoggle - Moderately critical - Access bypass - SA-CONTRIB-2026-282

    Incorrect Authorization vulnerability in Drupal Fasttoggle allows Forceful Browsing. This issue affects Fasttoggle versions: from 0.0.0 to 4.1.1.

    Drupal Fasttoggle drupal/fasttoggle Packagist
  • High 7.3
    CVE-2026-118582

    CAPTCHA - Moderately critical - Session Replay (CAPTCHA bypass) - SA-CONTRIB-2026-281

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal CAPTCHA allows Functionality Bypass. This issue affects CAPTCHA versions: from 0.0.0 to 1.18.0, from 2.0.0 to 2.0.11.

    Drupal CAPTCHA drupal/captcha Packagist
  • Medium 6.6
    CVE-2026-118564

    PayUmoney for Drupal Commerce - Critical - Unsupported - SA-CONTRIB-2026-277

    Vulnerability in Drupal PayUmoney for Drupal Commerce. This issue affects PayUmoney for Drupal Commerce versions: *.*.

    Drupal PayUmoney for Drupal Commerce drupal/commerce_payumoney Web / CMS Packagist
  • Medium 6.6
    CVE-2026-118563

    CacheFlush - Critical - Unsupported - SA-CONTRIB-2026-276

    Vulnerability in Drupal CacheFlush. This issue affects CacheFlush versions: *.*.

    Drupal CacheFlush drupal/cacheflush Packagist
  • High 7.2
    CVE-2026-118562

    Single Content Sync - Critical - Remote code execution - SA-CONTRIB-2026-275

    Deserialization of Untrusted Data vulnerability in Drupal Single Content Sync allows Object Injection. This issue affects Single Content Sync versions: from 0.0.0 to 1.4.19.

    Drupal Single Content Sync drupal/single_content_sync Packagist
  • High 7.2
    CVE-2026-118561

    Single Content Sync - Critical - External control of file name or path - SA-CONTRIB-2026-274

    External Control of File Name or Path vulnerability in Drupal Single Content Sync allows Path Traversal. This issue affects Single Content Sync versions: from 0.0.0 to 1.4.19.

    Drupal Single Content Sync drupal/single_content_sync Packagist
  • Medium 5.5
    CVE-2026-118553

    AI (Artificial Intelligence) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-273

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Stored XSS. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2.

    Drupal AI (Artificial Intelligence) drupal/ai Packagist
  • Medium 6.5
    CVE-2026-118552

    AI (Artificial Intelligence) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-272

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Cross-Site Scripting (XSS). This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1…

    Drupal AI (Artificial Intelligence) drupal/ai Packagist
  • Low 3.1
    CVE-2026-118551

    AI (Artificial Intelligence) - Less critical - Information Disclosure - SA-CONTRIB-2026-271

    Insecure Storage of Sensitive Information vulnerability in Drupal AI (Artificial Intelligence) allows Retrieve Embedded Sensitive Data. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2.

    Drupal AI (Artificial Intelligence) drupal/ai Packagist
  • Medium 5.9
    CVE-2026-118550

    AI (Artificial Intelligence) - Moderately critical - Access bypass - SA-CONTRIB-2026-270

    Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal AI (Artificial Intelligence) allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4…

    Drupal AI (Artificial Intelligence) drupal/ai Packagist
  • High 7.1
    CVE-2026-118549

    AI (Artificial Intelligence) - Critical - Cross-site scripting - SA-CONTRIB-2026-269

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Cross-Site Scripting (XSS). This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1…

    Drupal AI (Artificial Intelligence) drupal/ai Packagist
  • Low 3.7
    CVE-2026-118548

    AI (Artificial Intelligence) - Moderately critical - Information disclosure - SA-CONTRIB-2026-268

    Incorrect Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Resource Injection. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2.

    Drupal AI (Artificial Intelligence) drupal/ai Packagist
  • Medium 6.5
    CVE-2026-118546

    AI (Artificial Intelligence) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-267

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Cross-Site Scripting (XSS). This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1…

    Drupal AI (Artificial Intelligence) drupal/ai Packagist
  • Medium 6.5
    CVE-2026-118545

    AI (Artificial Intelligence) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-266

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Cross-Site Scripting (XSS). This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1…

    Drupal AI (Artificial Intelligence) drupal/ai Packagist
  • Medium 5.1
    CVE-2026-118560

    Commerce Stripe - Moderately critical - Cross site scripting - SA-CONTRIB-2026-265

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Commerce Stripe allows Cross-Site Scripting (XSS). This issue affects Commerce Stripe versions: from 2.0.0 to 2.2.3.

    Drupal Commerce Stripe drupal/commerce_stripe Packagist
  • Medium 5.3
    CVE-2026-118559

    Commerce Stripe - Moderately critical - Improper verification of cryptographic signature - SA-CONTRIB-2026-264

    Improper Verification of Cryptographic Signature vulnerability in Drupal Commerce Stripe allows Signature Spoof. This issue affects Commerce Stripe versions: from 0.0.0 to 1.4, from 2.0.0 to 2.2.3.

    Drupal Commerce Stripe drupal/commerce_stripe Packagist
  • High 7.3
    CVE-2026-118558

    Commerce Stripe - Critical - Cross-site request forgery - SA-CONTRIB-2026-263

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal Commerce Stripe allows Cross Site Request Forgery. This issue affects Commerce Stripe versions: from 2.0.0 to 2.2.3.

    Drupal Commerce Stripe drupal/commerce_stripe Packagist
  • Low 2.7
    CVE-2026-118557

    Commerce Shipping - Less critical - Access bypass - SA-CONTRIB-2026-262

    Incorrect Authorization vulnerability in Drupal Commerce Shipping allows Forceful Browsing. This issue affects Commerce Shipping versions: from 0.0.0 to 2.16.0, from 3.0.0 to 3.0.6.

    Drupal Commerce Shipping drupal/commerce_shipping Packagist
  • Medium 6.5
    CVE-2026-118556

    Commerce Shipping - Moderately critical - Access bypass - SA-CONTRIB-2026-261

    Incorrect Authorization vulnerability in Drupal Commerce Shipping allows Forceful Browsing. This issue affects Commerce Shipping versions: from 0.0.0 to 2.16.0, from 3.0.0 to 3.0.6.

    Drupal Commerce Shipping drupal/commerce_shipping Packagist
  • Medium 6.3
    CVE-2026-118555

    Commerce License - Moderately critical - Access bypass - SA-CONTRIB-2026-260

    Incorrect Authorization vulnerability in Drupal Commerce License allows Forceful Browsing. This issue affects Commerce License versions: from 0.0.0 to 3.1.1.

    Drupal Commerce License drupal/commerce_license Packagist
  • Low 3.7
    CVE-2026-118544

    Commerce Core - Moderately critical - Information disclosure - SA-CONTRIB-2026-259

    Exposure of Sensitive Information Through Data Queries vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13.

    Drupal Commerce Core drupal/commerce Packagist
  • Medium 5.3
    CVE-2026-118543

    Commerce Core - Moderately critical - Cross-site request forgery - SA-CONTRIB-2026-258

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal Commerce Core allows Cross Site Request Forgery. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13.

    Drupal Commerce Core drupal/commerce Packagist
  • Low 2.7
    CVE-2026-118542

    Commerce Core - Moderately critical - Access bypass - SA-CONTRIB-2026-257

    Incorrect Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13.

    Drupal Commerce Core drupal/commerce Packagist
  • Medium 4.3
    CVE-2026-118541

    Commerce Core - Less critical - Access bypass - SA-CONTRIB-2026-256

    Incorrect Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13.

    Drupal Commerce Core drupal/commerce Packagist
  • Medium 5.3
    CVE-2026-118540

    Commerce Core - Moderately critical - Information disclosure - SA-CONTRIB-2026-255

    Incorrect Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41, from 3.0.0 to 3.2.0.

    Drupal Commerce Core drupal/commerce Packagist
  • Medium 6.5
    CVE-2026-118539 Scanner template

    Commerce Core - Highly critical - Access bypass - SA-CONTRIB-2026-254

    Missing Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41, from 3.0.0 to 3.3.13.

    Drupal Commerce Core drupal/commerce Packagist
  • High 8.7
    CVE-2026-116078

    HTTP/2 request bodies made of 1-byte DATA frames amplify memory use in Bandit

    Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 request body reader of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via a request body sent as many 1-byte DATA frames. do_read_data/5 in lib…

    mtrudel bandit bandit bandit Ubuntu Hex