Export limit exceeded: 413521 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (413521 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-87940 | 1 Drupal | 1 Key Auth | 2026-10-22 | 5.4 Medium |
| Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Key auth allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Key auth versions: from 0.0.0 to 2.2.4. | ||||
| CVE-2026-87939 | 1 Drupal | 1 Feed Block | 2026-10-22 | 4.2 Medium |
| Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Feed Block allows Stored XSS. This issue affects Feed Block versions: from 0.0.0 to 2.0.2, from 3.0.0 to 3.0.2. | ||||
| CVE-2026-87937 | 1 Drupal | 1 Central Authentication System (cas) Server | 2026-10-22 | 6.5 Medium |
| URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal Central Authentication System (CAS) Server allows Fake the Source of Data. This issue affects Central Authentication System (CAS) Server versions: from 0.0.0 to 2.0.4, from 2.1.0 to 2.1.3. | ||||
| CVE-2026-87936 | 1 Drupal | 1 Amazee.ai Private Ai Provider | 2026-10-22 | 6.5 Medium |
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal amazee.ai Private AI Provider allows SQL Injection. This issue affects amazee.ai Private AI Provider versions: from 0.0.0 to 1.3.7, from 1.4.0 to 1.4.3. | ||||
| CVE-2026-84924 | 1 Drupal | 1 Email Verification / Sms Verification / Otp Verification | 2026-10-22 | 5.4 Medium |
| Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Email Verification / SMS Verification / OTP Verification allows Reflected XSS. This issue affects Email Verification / SMS Verification / OTP Verification versions: from 0.0.0 to 2.4.0. | ||||
| CVE-2026-84921 | 1 Drupal | 1 Webform Submissions Delete | 2026-10-22 | 5.3 Medium |
| Missing Authorization vulnerability in Drupal Webform Submissions Delete allows Forceful Browsing. This issue affects Webform Submissions Delete versions: from 0.0.0 to 1.2.0. | ||||
| CVE-2026-84919 | 1 Drupal | 1 Photoswipe - Responsive Javascript Modal Image Gallery | 2026-10-22 | 4.6 Medium |
| Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery allows Stored XSS. This issue affects PhotoSwipe - Responsive JavaScript Modal Image Gallery versions: from 0.0.0 to 5.0.9. | ||||
| CVE-2026-84918 | 1 Drupal | 1 Monobank Payment Api | 2026-10-22 | 3.7 Low |
| Improper Verification of Cryptographic Signature vulnerability in Drupal Monobank payment API allows Signature Spoof. This issue affects Monobank payment API versions: from 0.0.0 to 1.0.3. | ||||
| CVE-2026-84917 | 1 Drupal | 1 Jsonapi Role Access | 2026-10-22 | 6.5 Medium |
| Incorrect Authorization vulnerability in Drupal Jsonapi Role Access allows Forceful Browsing. This issue affects Jsonapi Role Access versions: from 0.0.0 to 2.0.2. | ||||
| CVE-2026-84916 | 1 Drupal | 1 Islandora | 2026-10-22 | 3.7 Low |
| Missing Authorization vulnerability in Drupal Islandora allows Forceful Browsing. This issue affects Islandora versions: from 0.0.0 to 2.19.0. | ||||
| CVE-2026-81163 | 1 Drupal | 1 Media Library Importer | 2026-10-22 | 5.4 Medium |
| Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Drupal Media Library Importer allows Path Traversal. This issue affects Media Library Importer versions: from 0.0.0 to 2.1.6. | ||||
| CVE-2026-16648 | 1 Drupal | 1 Mailer Plus Log | 2026-10-22 | 3.8 Low |
| Insertion of Sensitive Information into Log File vulnerability in Drupal Mailer Plus Log allows Remote Services with Stolen Credentials. This issue affects Mailer Plus Log versions: from 0.0.0 to 1.2.7. | ||||
| CVE-2026-114077 | 1 Triggerdotdev | 1 Trigger.dev | 2026-10-22 | 7.1 High |
| Trigger.dev before 4.5.6 contains an authorization bypass vulnerability in createDeploymentBackgroundWorkerV4 that resolves a WorkerDeployment by friendlyId alone, without environment, project, or organization scoping. Attackers holding only their own environment API key can POST to the deployment background-workers endpoint with a victim's deployment ID to re-point that in-progress deployment at a worker in the attacker's environment. | ||||
| CVE-2026-114072 | 1 Triggerdotdev | 1 Trigger.dev | 2026-10-22 | 4.3 Medium |
| The Trigger.dev webapp before 4.5.12 contains a cross-site request forgery vulnerability in its organization-level Slack OAuth flow, which uses the organization ID as the OAuth state without binding it to the initiating session. Attackers who know a target organization ID can trick an authenticated member into opening an unredeemed /integrations/slack/callback URL, connecting an attacker-controlled Slack workspace that may receive the organization's operational alerts. | ||||
| CVE-2026-114067 | 1 Triggerdotdev | 1 Trigger.dev | 2026-10-22 | 6.5 Medium |
| Trigger.dev 4.5.0 before 4.6.2 contains an improper authorization vulnerability in the PUT snapshot-url session endpoint that allows public session token holders to obtain presigned S3 write URLs. End users can overwrite their own session's durable chat snapshot to forge the agent's conversation history, since the route lacks a secret-key-only check. | ||||
| CVE-2026-114062 | 1 Svelte | 1 Kit | 2026-10-22 | 5.3 Medium |
| SvelteKit before 3.0.0 contains a server-side request forgery vulnerability that allows remote attackers to reach internal services because self-fetch fallbacks follow HTTP redirects automatically. Attackers can manipulate the Host or forwarded headers to point fallback requests at their server, which redirects them to internal services. | ||||
| CVE-2026-101830 | 1 Oracle | 1 Project Contracts | 2026-10-22 | 7.7 High |
| Vulnerability in the Oracle Project Contracts product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Project Contracts. While the vulnerability is in Oracle Project Contracts, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Project Contracts accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N). | ||||
| CVE-2026-101828 | 1 Oracle | 1 Mobile Application Server | 2026-10-22 | 6.5 Medium |
| Vulnerability in the Oracle Mobile Application Server product of Oracle E-Business Suite (component: MWA Terminal Server). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Mobile Application Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Mobile Application Server accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). | ||||
| CVE-2026-101821 | 1 Oracle | 1 Compensation Workbench | 2026-10-22 | 5.4 Medium |
| Vulnerability in the Oracle Compensation Workbench product of Oracle E-Business Suite (component: Total Compensation Statement). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Compensation Workbench. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Compensation Workbench, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Compensation Workbench accessible data as well as unauthorized read access to a subset of Oracle Compensation Workbench accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N). | ||||
| CVE-2026-101819 | 1 Oracle | 1 General Ledger | 2026-10-22 | 6.5 Medium |
| Vulnerability in the Oracle General Ledger product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle General Ledger. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle General Ledger accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). | ||||