Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (993 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2026-13241 2 Drupal, Md-systems 2 Paragraphs, Paragraphs 2026-07-13 6.5 Medium
Missing Authorization vulnerability in Drupal Paragraphs allows Forceful Browsing. This issue affects Paragraphs versions: from 0.0.0 to 1.21.0.
CVE-2026-13240 2 Drupal, Md-systems 2 Paragraphs, Paragraphs 2026-07-13 6.5 Medium
Missing Authorization vulnerability in Drupal Paragraphs allows Forceful Browsing. This issue affects Paragraphs versions: from 0.0.0 to 1.21.0.
CVE-2026-13239 2 Drupal, Wiss-ki 2 Wisski, Wisski 2026-07-13 6.5 Medium
Missing Authorization vulnerability in Drupal WissKI allows Forceful Browsing. This issue affects WissKI versions: from 0.0.0 to 4.2.0.
CVE-2026-13244 2 Dakku, Drupal 2 Tealium Iq Tag Management, Tealium Iq Tag Management 2026-07-13 8.1 High
Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Tealium iQ Tag Management allows Object Injection. This issue affects Tealium iQ Tag Management versions: from 0.0.0 to 2.4.0.
CVE-2026-13243 2 Drupal, Victorkane 2 Salesforce Suite, Salesforce Suite 2026-07-13 4.8 Medium
Cross-Site Request Forgery (CSRF) vulnerability in Drupal Salesforce Suite allows Cross Site Request Forgery. This issue affects Salesforce Suite versions: from 0.0.0 to 5.1.3.
CVE-2026-15080 2 Drupal, Lingotek 2 Ray Enterprise Translation, Ray Enterprise Translation 2026-07-13 4.3 Medium
Cross-Site Request Forgery (CSRF) vulnerability in Drupal Ray Enterprise Translation allows Cross Site Request Forgery. This issue affects Ray Enterprise Translation versions: from 0.0.0 to 4.0.4, from 4.1.0 to 4.1.4, from 11.0.0 to 11.0.4.
CVE-2026-15079 2 Budda, Drupal 2 Login Disable, Login Disable 2026-07-13 5.4 Medium
Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Login Disable allows Brute Force. This issue affects Login Disable versions: from 0.0.0 to 2.1.4.
CVE-2026-58590 2 Drupal, Flowdrop Project 2 Flowdrop, Flowdrop 2026-07-13 5.4 Medium
Missing Authorization vulnerability in Drupal FlowDrop allows Forceful Browsing. This issue affects FlowDrop versions: from 0.0.0 to 1.6.0.
CVE-2026-58589 2 Drupal, Flowdrop Project 2 Flowdrop, Flowdrop 2026-07-13 5.4 Medium
Missing Authorization vulnerability in Drupal FlowDrop allows Forceful Browsing. This issue affects FlowDrop versions: from 0.0.0 to 1.6.0.
CVE-2026-13231 2 Anuaralfetahe, Drupal 2 Advanced Content Feedback, Advanced Content Feedback (aka Admin Feedback) 2026-07-13 6.1 Medium
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Advanced Content Feedback (aka admin_feedback) allows Stored XSS. This issue affects Advanced Content Feedback (aka admin_feedback) versions: from 0.0.0 to 2.8.0.
CVE-2026-13234 2 Artificial Intelligence Project, Drupal 2 Artificial Intelligence, Artificial Intelligence 2026-07-13 6.1 Medium
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Cross-Site Scripting (XSS). This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.2.17, from 1.3.0 to 1.3.8, from 1.4.0 to 1.4.3.
CVE-2026-58587 2 Drupal, Drupal Canvas Project 2 Drupal Canvas, Drupal Canvas 2026-07-13 6.1 Medium
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal Canvas allows Cross-Site Scripting (XSS). This issue affects Drupal Canvas versions: from 0.0.0 to 1.4.2, from 1.5.0 to 1.5.2, from 1.6.0 to 1.6.1, from 1.7.0 to 1.7.1.
CVE-2026-13242 2 Dopry, Drupal 2 Geolocation Field, Geolocation Field 2026-07-13 6.5 Medium
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Geolocation Field allows SQL Injection. This issue affects Geolocation Field versions: from 0.0.0 to 3.15.0.
CVE-2026-9726 2 Alternativecommerce, Drupal 2 Alternativecommerce, Drupal Alternativecommerce (basket) 2026-07-13 9.8 Critical
Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal AlternativeCommerce (Basket) allows Object Injection. This issue affects Drupal AlternativeCommerce (Basket) versions: from 0.0.0 to 2.1.17.
CVE-2026-10768 2 Drupal, Localgovdrupal 2 Localgov Workflows, Localgov Workflows 2026-07-13 9.8 Critical
Missing Authorization vulnerability in Drupal LocalGov Workflows allows Forceful Browsing. This issue affects LocalGov Workflows versions: from 0.0.0 to 1.6.0.
CVE-2026-4929 2 Drupal, Simple Hierarchical Select Project 2 Simple Hierarchical Select (shs), Simple Hierarchical Select 2026-06-01 5.4 Medium
Simple Hierarchical Select (SHS) for Drupal 7 contains cross-site scripting risk due to improper output escaping of term-derived text. Confirmed affected paths include field formatter output (shs_field_formatter_view) and term-tree child-term data generation (shs_term_get_children). Malicious taxonomy term names can be rendered unsafely depending on output context. This affects versions from 7.x-1.0 through (and including) 7.x-1.10.
CVE-2026-4093 2 Drupal, Taxonomy Term Reference Tree Widget Project 2 Term Reference Tree, Taxonomy Term Reference Tree Widget 2026-06-01 5.4 Medium
In the Drupal 7 Term Reference Tree module, two stored XSS vectors exist in the widget/formatter rendering pipeline. Vector A (token display templates): When the Token module is enabled and token display templates are configured, attacker-controlled token output (e.g., term description) is rendered without proper sanitization. Any user who can edit the referenced taxonomy terms can inject HTML/JS that executes when the field is rendered. Vector B (term label rendering): Taxonomy term labels are not properly sanitized before being rendered in the widget, allowing a user with permission to create or edit taxonomy terms to inject scripts into the term name that execute when a form containing the widget is viewed. Exploit affects versions 7.x-1.x up to and including 7.x-1.11.
CVE-2026-5343 2 Drupal, Miniorange 2 Saml Sso - Service Provider, Saml Sso - Service Provider 2026-06-01 7.4 High
Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal SAML SSO - Service Provider allows Privilege Escalation. This issue affects SAML SSO - Service Provider: from 0.0.0 before 3.1.4.
CVE-2026-6816 2 Drupal, Tfa Basic Plugins Project 2 Tfa Basic Plugins, Tfa Basic Plugins 2026-06-01 3.8 Low
An access bypass vulnerability in Drupal TFA Basic Plugins allows users with the administer users permission to view or generate recovery codes for other users. This issue affects TFA Basic Plugins: from 7.x-1.0 through 7.x-1.2.
CVE-2026-8492 2 Drupal, Gtranslate 2 Translate Drupal With Gtranslate, Gtranslate 2026-05-27 2.7 Low
Modification of Assumed-Immutable Data (MAID) vulnerability in Drupal Translate Drupal with GTranslate allows Resource Location Spoofing. This issue affects Translate Drupal with GTranslate: from 0.0.0 before 3.0.5.