Search
14,262 CVEs · Medium severity
CVEs (14,262, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 251–275 of 14,262 (capped at 500)
| CVE ID | Severity | Patch | CVSS | Published ↓ | Description |
|---|---|---|---|---|---|
| CVE-2026-87944 | MEDIUM | 4.8 | 2026-10-22 | Improper Certificate Validation vulnerability in Drupal SAML SSO - Service Provider allows Adversary in the Middle (AiTM). This issue affects SAML SSO - Service Provider … | |
| CVE-2026-87943 | MEDIUM | 6.5 | 2026-10-22 | Missing Authorization vulnerability in Drupal SAML SSO - Service Provider allows Forceful Browsing. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0. | |
| CVE-2026-87942 | MEDIUM | 4.6 | 2026-10-22 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal SafeDelete allows Stored XSS. This issue affects SafeDelete ver… | |
| CVE-2026-87940 | MEDIUM | 5.4 | 2026-10-22 | Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Key auth allows Exploiting Incorrectly Configured Access Control Security Levels. This iss… | |
| CVE-2026-87939 | MEDIUM | 4.2 | 2026-10-22 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Feed Block allows Stored XSS. This issue affects Feed Block ver… | |
| CVE-2026-87937 | MEDIUM | 6.5 | 2026-10-22 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal Central Authentication System (CAS) Server allows Fake the Source of Data. This issue affects Ce… | |
| CVE-2026-87936 | MEDIUM | 6.5 | 2026-10-22 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal amazee.ai Private AI Provider allows SQL Injection. This issue … | |
| CVE-2026-84924 | MEDIUM | 5.4 | 2026-10-22 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Email Verification / SMS Verification / OTP Verification allows… | |
| CVE-2026-84923 | MEDIUM | 6.5 | 2026-10-22 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Email Verification / SMS Verification / OTP Verification allows Authentication Bypass. This… | |
| CVE-2026-84921 | MEDIUM | 5.3 | 2026-10-22 | Missing Authorization vulnerability in Drupal Webform Submissions Delete allows Forceful Browsing. This issue affects Webform Submissions Delete versions: from 0.0.0 to 1.2.0. | |
| CVE-2026-84920 | MEDIUM | 5.3 | 2026-10-22 | Incorrect Authorization vulnerability in Drupal Unpublished Node Permissions allows Forceful Browsing. This issue affects Unpublished Node Permissions versions: from 0.0.0 … | |
| CVE-2026-84919 | MEDIUM | 4.6 | 2026-10-22 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery allows S… | |
| CVE-2026-84917 | MEDIUM | 6.5 | 2026-10-22 | Incorrect Authorization vulnerability in Drupal Jsonapi Role Access allows Forceful Browsing. This issue affects Jsonapi Role Access versions: from 0.0.0 to 2.0.2. | |
| CVE-2026-84915 | MEDIUM | 4.6 | 2026-10-22 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Component blocks allows Stored XSS. This issue affects Componen… | |
| CVE-2026-84914 | MEDIUM | 5.3 | 2026-10-22 | Missing Authorization vulnerability in Drupal Calculate Working Days allows Forceful Browsing. This issue affects Calculate Working Days versions: from 0.0.0 to 2.0.3. | |
| CVE-2026-84913 | MEDIUM | 4.6 | 2026-10-22 | Missing Authorization vulnerability in Drupal AI Translate allows Forceful Browsing. This issue affects AI Translate versions: from 0.0.0 to 1.3.2, from 1.4.0 to 1.4.1. | |
| CVE-2026-84912 | MEDIUM | 4.6 | 2026-10-22 | Missing Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Forceful Browsing. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to… | |
| CVE-2026-84910 | MEDIUM | 4.2 | 2026-10-22 | Missing Authorization vulnerability in Drupal Advanced Search allows Forceful Browsing. This issue affects Advanced Search versions: from 0.0.0 to 2.4.5. | |
| CVE-2026-81163 | MEDIUM | 5.4 | 2026-10-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Drupal Media Library Importer allows Path Traversal. This issue affects Medi… | |
| CVE-2026-114728 | MEDIUM | Patched | 5.3 | 2026-10-22 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass in the handling of FuncIRI attributes. rcube_washtml detected the CSS… |
| CVE-2026-114726 | MEDIUM | Patched | 5.8 | 2026-10-22 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability in the Bounce (resend) action. rcube_mime::decode_address_list()… |
| CVE-2026-114725 | MEDIUM | Patched | 5.0 | 2026-10-22 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability. rcmail_sendmail stripped newline characters only from the Subje… |
| CVE-2026-114722 | MEDIUM | Patched | 6.5 | 2026-10-22 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSS scoping bypass in HTML messages. rcube_utils::mod_css_styles() did not treat an at-rule prologue… |
| CVE-2026-114718 | MEDIUM | Patched | 4.7 | 2026-10-22 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a cross-site scripting vulnerability in the password plugin. Error text returned by a password driver … |
| CVE-2026-114717 | MEDIUM | Patched | 4.0 | 2026-10-22 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability when a message is forwarded as an attachment. The subject of the… |