Updated 39 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

584new WordPress flaws this week

391,288entries in the database

23,309 results · page 2 of 467

Oct 30, 2026Traefik from 3.2.0 before 3.7.15 contains a data race in the experimental FastProxy that allows unauthenticated attackers to crash the process by abusing HTTP/1CVE-2026-119574 · Other software · traefik · reported by VulnCheckHigh 8.2
Traefik from 3.2.0 before 3.7.15 contains a data race in the experimental FastProxy that allows unauthenticated attackers to crash the process by abusing HTTP/1 protocol upgrades. Attackers can repeatedly open and abort upgraded connections such as WebSocket, corrupting the unsynchronized shared bufio.Reader and triggering an unrecovered panic that terminates Traefik.
Product
traefik
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com vulncheck.com
Oct 30, 2026Dell OpenManage Enterprise, versions prior to 4.8.0, contains a Missing Authentication for Critical Function vulnerability.CVE-2026-111500 · Other software · Dell · reported by security_alert@emc.comMedium 5.4
Dell OpenManage Enterprise, versions prior to 4.8.0, contains a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Server-side request forgery.
Product
OpenManage Enterprise
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record dell.com
Oct 30, 2026Moodle 4.2.0 through 4.5.15, 5.0.0 through 5.0.11, 5.1.0 through 5.1.8, 5.2.0 through 5.2.4, and 5.3.0 contain a missing capability check in the core_grades_getCVE-2026-119556 · Other software · Moodle Project · reported by VulnCheckMedium 5.3
Moodle 4.2.0 through 4.5.15, 5.0.0 through 5.0.11, 5.1.0 through 5.1.8, 5.2.0 through 5.2.4, and 5.3.0 contain a missing capability check in the core_grades_get_gradeitems web service that allows enrolled students to view hidden grade items. Authenticated course users can call the AJAX or mobile web service to list hidden grade item ids, names, and categories that the gradebook conceals from them.
Product
moodle
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record abraxaslabs.tech github.com
Oct 30, 2026phpMyAdmin through 5.2.3 contains a missing re-authentication vulnerability that allows authenticated attackers to remove two-factor authentication by posting tCVE-2026-119429 · Websites & servers · phpMyAdmin · reported by VulnCheckMedium 5.3
phpMyAdmin through 5.2.3 contains a missing re-authentication vulnerability that allows authenticated attackers to remove two-factor authentication by posting the 2fa key to /config/set. Attackers holding a hijacked session can submit key=2fa with a null JSON value to SetConfigController, stripping 2FA so later logins require only the MySQL password.
Product
phpMyAdmin
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record abraxaslabs.tech github.com
Oct 30, 2026phpMyAdmin through 5.2.3 contains a cross-site request forgery vulnerability that allows remote attackers to execute arbitrary SQL by bypassing CSRF token checkCVE-2026-119426 · Websites & servers · phpMyAdmin · reported by VulnCheckHigh 7.7
phpMyAdmin through 5.2.3 contains a cross-site request forgery vulnerability that allows remote attackers to execute arbitrary SQL by bypassing CSRF token checks on non-AJAX POST requests. Attackers can lure authenticated victims into submitting cross-site POSTs carrying sql_query to /sql or /database/sql, running SQL with the victim's database privileges under http or config authentication.
Product
phpMyAdmin
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record abraxaslabs.tech github.com
Oct 30, 2026Juspay Hyperswitch through 1.128.0 (and builds before 2026.10.19.0) contains a missing authorization vulnerability that allows unauthenticated attackers to confCVE-2026-119421 · Other software · juspay · reported by VulnCheckHigh 8.2
Juspay Hyperswitch through 1.128.0 (and builds before 2026.10.19.0) contains a missing authorization vulnerability that allows unauthenticated attackers to confirm payouts with any client_secret via POST /payouts/{payout_id}/confirm. Attackers holding the merchant's publishable key and a payout_id can confirm payouts and overwrite amount, currency, connector, and routing fields to trigger unauthorized merchant payouts.
Product
hyperswitch
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record abraxaslabs.tech github.com
Oct 30, 2026SQLite before 3.54.0 contains an authorization bypass vulnerability in lookupName() that invokes the authorizer only for the first joined table's USING column.CVE-2026-119377 · Other software · SQLite · reported by VulnCheckLow 2
SQLite before 3.54.0 contains an authorization bypass vulnerability in lookupName() that invokes the authorizer only for the first joined table's USING column. Attackers able to submit SQL can query a shared USING column in a RIGHT or FULL JOIN to read columns denied via sqlite3_set_authorizer() SQLITE_READ restrictions.
Product
SQLite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record abraxaslabs.tech github.com
Oct 30, 2026AI Engine – The Chatbot, AI Framework & MCP for: Missing AuthorizationCVE-2026-110732 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.8.6 This is due to the MCP module's OAuth 2.1 Dynamic Client Registration endpoint (/wp-json/mcp/v1/oauth/register) being registered with a permission_callback of __return_true, allowing an unauthenticated user to register an active OAuth client with an attacker-controlled redirect URI. This makes it possible for unauthenticated attackers to obtain an administrator-bound MCP access token, and thereby full administrator-level control through the MCP tools (including user creation and option updates), once an administrator approves the attacker's client on the OAuth consent screen. The consent page is additionally served without X-Frame-Options or Content-Security-Policy frame-ancestors, so that approval can be obtained via clickjacking.
Product
AI Engine – The Chatbot, AI Framework & MCP for
Affected
up to 3.8.6
What to do
Affects up to 3.8.6. Update AI Engine – The Chatbot, AI Framework & MCP for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 30, 2026WP Visitor Statistics (Real Time Traffic): Does not sanitize and escape a parameter before using it in a SQL statementCVE-2026-117572 · WordPress plugins & themes · reported by WPScanMedium 4.1
The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 8.8 does not sanitize and escape a parameter before using it in a SQL statement, allowing high-privilege users such as administrators to perform SQL injection attacks.
Product
WP Visitor Statistics (Real Time Traffic)
Fixed in
8.8
What to do
Update WP Visitor Statistics (Real Time Traffic) to 8.8 or newer.
Full record and what to do →NVD record wpscan.com
Oct 30, 2026Missing Authorization vulnerability in Drupal Xray Audit allows Forceful Browsing.CVE-2026-96389 · Websites & servers · Drupal · reported by mlhess@drupal.orgMedium 6.5
Missing Authorization vulnerability in Drupal Xray Audit allows Forceful Browsing. This issue affects Xray Audit versions: from 0.0.0 to 1.6.3, from 2.0.0 to 2.0.4, from 3.0.0 to 3.1.1.
Product
Xray Audit
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record drupal.org
Oct 30, 2026Incorrect Authorization vulnerability in Drupal Field Permissions allows Forceful Browsing.CVE-2026-118584 · Websites & servers · Drupal · reported by mlhess@drupal.org
Incorrect Authorization vulnerability in Drupal Field Permissions allows Forceful Browsing. This issue affects Field Permissions versions: from 0.0.0 to 1.6.0.
Product
Field Permissions
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record drupal.org
Oct 30, 2026Incorrect Authorization vulnerability in Drupal Field Permissions allows Forceful Browsing.CVE-2026-118583 · Websites & servers · Drupal · reported by mlhess@drupal.org
Incorrect Authorization vulnerability in Drupal Field Permissions allows Forceful Browsing. This issue affects Field Permissions versions: from 0.0.0 to 1.6.0.
Product
Field Permissions
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record drupal.org
Oct 30, 2026Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal CAPTCHA allows Functionality Bypass.CVE-2026-118582 · Websites & servers · Drupal · reported by mlhess@drupal.org
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal CAPTCHA allows Functionality Bypass. This issue affects CAPTCHA versions: from 0.0.0 to 1.18.0, from 2.0.0 to 2.0.11.
Product
CAPTCHA
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record drupal.org
Oct 30, 2026Missing Authorization vulnerability in Drupal OAuth2 Token Manager allows Forceful Browsing.CVE-2026-118573 · Websites & servers · Drupal · reported by mlhess@drupal.org
Missing Authorization vulnerability in Drupal OAuth2 Token Manager allows Forceful Browsing. This issue affects OAuth2 Token Manager versions: from 0.0.0 to 1.2.0.
Product
OAuth2 Token Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record drupal.org
Oct 30, 2026Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal OAuth Login - OAuth OIDC SSO allows Authentication Bypass.CVE-2026-118572 · Websites & servers · Drupal · reported by mlhess@drupal.org
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal OAuth Login - OAuth OIDC SSO allows Authentication Bypass. This issue affects OAuth Login - OAuth OIDC SSO versions: from 0.0.0 to 3.1.1.
Product
OAuth Login - OAuth OIDC SSO
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record drupal.org
Oct 30, 2026Incorrect Authorization vulnerability in Drupal Fasttoggle allows Forceful Browsing.CVE-2026-118569 · Websites & servers · Drupal · reported by mlhess@drupal.org
Incorrect Authorization vulnerability in Drupal Fasttoggle allows Forceful Browsing. This issue affects Fasttoggle versions: from 0.0.0 to 4.1.1.
Product
Fasttoggle
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record drupal.org
Oct 30, 2026Incorrect Authorization vulnerability in Drupal Bulk Update User Roles allows Forceful Browsing.CVE-2026-118567 · Websites & servers · Drupal · reported by mlhess@drupal.org
Incorrect Authorization vulnerability in Drupal Bulk Update User Roles allows Forceful Browsing. This issue affects Bulk Update User Roles versions: from 0.0.0 to 1.0.5.
Product
Bulk Update User Roles
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record drupal.org
Oct 30, 2026Deserialization of Untrusted Data vulnerability in Drupal Single Content Sync allows Object Injection.CVE-2026-118562 · Websites & servers · Drupal · reported by mlhess@drupal.org
Deserialization of Untrusted Data vulnerability in Drupal Single Content Sync allows Object Injection. This issue affects Single Content Sync versions: from 0.0.0 to 1.4.19.
Product
Single Content Sync
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record drupal.org
Oct 30, 2026External Control of File Name or Path vulnerability in Drupal Single Content Sync allows Path Traversal.CVE-2026-118561 · Websites & servers · Drupal · reported by mlhess@drupal.org
External Control of File Name or Path vulnerability in Drupal Single Content Sync allows Path Traversal. This issue affects Single Content Sync versions: from 0.0.0 to 1.4.19.
Product
Single Content Sync
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record drupal.org
Oct 30, 2026Incorrect Authorization vulnerability in Drupal Commerce Shipping allows Forceful Browsing.CVE-2026-118557 · Websites & servers · Drupal · reported by mlhess@drupal.org
Incorrect Authorization vulnerability in Drupal Commerce Shipping allows Forceful Browsing. This issue affects Commerce Shipping versions: from 0.0.0 to 2.16.0, from 3.0.0 to 3.0.6.
Product
Commerce Shipping
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record drupal.org
Oct 30, 2026Incorrect Authorization vulnerability in Drupal Commerce Shipping allows Forceful Browsing.CVE-2026-118556 · Websites & servers · Drupal · reported by mlhess@drupal.org
Incorrect Authorization vulnerability in Drupal Commerce Shipping allows Forceful Browsing. This issue affects Commerce Shipping versions: from 0.0.0 to 2.16.0, from 3.0.0 to 3.0.6.
Product
Commerce Shipping
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record drupal.org
Oct 30, 2026Incorrect Authorization vulnerability in Drupal Commerce License allows Forceful Browsing.CVE-2026-118555 · Websites & servers · Drupal · reported by mlhess@drupal.org
Incorrect Authorization vulnerability in Drupal Commerce License allows Forceful Browsing. This issue affects Commerce License versions: from 0.0.0 to 3.1.1.
Product
Commerce License
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record drupal.org
Oct 30, 2026Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal OpenID Connect Client allows Authentication Bypass.CVE-2026-118554 · Websites & servers · Drupal · reported by mlhess@drupal.org
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal OpenID Connect Client allows Authentication Bypass. This issue affects OpenID Connect Client versions: from 0.0.0 to 2.3.1.
Product
OpenID Connect Client
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record drupal.org
Oct 30, 2026Exposure of Sensitive Information Through Data Queries vulnerability in Drupal Commerce Core allows Forceful Browsing.CVE-2026-118544 · Websites & servers · Drupal · reported by mlhess@drupal.org
Exposure of Sensitive Information Through Data Queries vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13.
Product
Commerce Core
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record drupal.org
Oct 30, 2026Incorrect Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing.CVE-2026-118542 · Websites & servers · Drupal · reported by mlhess@drupal.org
Incorrect Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13.
Product
Commerce Core
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record drupal.org
Oct 30, 2026Incorrect Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing.CVE-2026-118541 · Websites & servers · Drupal · reported by mlhess@drupal.org
Incorrect Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13.
Product
Commerce Core
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record drupal.org
Oct 30, 2026Incorrect Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing.CVE-2026-118540 · Websites & servers · Drupal · reported by mlhess@drupal.org
Incorrect Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41, from 3.0.0 to 3.2.0.
Product
Commerce Core
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record drupal.org
Oct 30, 2026Missing Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing.CVE-2026-118539 · Websites & servers · Drupal · reported by mlhess@drupal.orgMedium 6.5
Missing Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41, from 3.0.0 to 3.3.13.
Product
Commerce Core
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record drupal.org
Oct 30, 2026Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Domain Login Restrict allows Authentication Bypass.CVE-2026-114572 · Websites & servers · Drupal · reported by mlhess@drupal.orgMedium 5.4
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Domain Login Restrict allows Authentication Bypass. This issue affects Domain Login Restrict versions: from 0.0.0 to 1.5.0.
Product
Domain Login Restrict
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record drupal.org
Oct 30, 2026Incorrect Authorization vulnerability in Drupal Rabbit Hole allows Forceful Browsing.CVE-2026-114571 · Websites & servers · Drupal · reported by mlhess@drupal.org
Incorrect Authorization vulnerability in Drupal Rabbit Hole allows Forceful Browsing. This issue affects Rabbit Hole versions: from 0.0.0 to 1.3.0.
Product
Rabbit Hole
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record drupal.org
Oct 30, 2026Incorrect Authorization vulnerability in Drupal AI File to Text allows Forceful Browsing.CVE-2026-114554 · Websites & servers · Drupal · reported by mlhess@drupal.org
Incorrect Authorization vulnerability in Drupal AI File to Text allows Forceful Browsing. This issue affects AI File to Text versions: from 0.0.0 to 1.0.1.
Product
AI File to Text
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record drupal.org
Oct 30, 2026Incorrect Authorization vulnerability in Drupal Frontend Editing allows Forceful Browsing.CVE-2026-114553 · Websites & servers · Drupal · reported by mlhess@drupal.org
Incorrect Authorization vulnerability in Drupal Frontend Editing allows Forceful Browsing. This issue affects Frontend Editing versions: from 0.0.0 to 1.9.3.
Product
Frontend Editing
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record drupal.org
Oct 30, 2026Missing Authorization vulnerability in Drupal TinyPNG allows Forceful Browsing.CVE-2026-114547 · Websites & servers · Drupal · reported by mlhess@drupal.org
Missing Authorization vulnerability in Drupal TinyPNG allows Forceful Browsing. This issue affects TinyPNG versions: from 0.0.0 to 2.0.2.
Product
TinyPNG
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record drupal.org
Oct 30, 2026Incorrect Authorization vulnerability in Drupal Fullcalendar View allows Forceful Browsing.CVE-2026-114545 · Websites & servers · Drupal · reported by mlhess@drupal.org
Incorrect Authorization vulnerability in Drupal Fullcalendar View allows Forceful Browsing. This issue affects Fullcalendar View versions: from 0.0.0 to 5.2.6.
Product
Fullcalendar View
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record drupal.org
Oct 30, 2026Incorrect Authorization vulnerability in Drupal Media Bulk Upload allows Forceful Browsing.CVE-2026-114544 · Websites & servers · Drupal · reported by mlhess@drupal.org
Incorrect Authorization vulnerability in Drupal Media Bulk Upload allows Forceful Browsing. This issue affects Media Bulk Upload versions: from 0.0.0 to 3.0.6.
Product
Media Bulk Upload
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record drupal.org
Oct 30, 2026Incorrect Authorization vulnerability in Drupal Simple User Management allows Forceful Browsing.CVE-2026-114543 · Websites & servers · Drupal · reported by mlhess@drupal.org
Incorrect Authorization vulnerability in Drupal Simple User Management allows Forceful Browsing. This issue affects Simple User Management versions: from 0.0.0 to 1.11.0.
Product
Simple User Management
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record drupal.org
Oct 30, 2026Incorrect Authorization vulnerability in Drupal Domain allows Forceful Browsing.CVE-2026-114540 · Websites & servers · Drupal · reported by mlhess@drupal.org
Incorrect Authorization vulnerability in Drupal Domain allows Forceful Browsing. This issue affects Domain versions: from 3.0.0 to 3.0.2.
Product
Domain
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record drupal.org
Oct 30, 2026Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal DocCheck Basic allows Authentication Bypass.CVE-2026-114539 · Websites & servers · Drupal · reported by mlhess@drupal.org
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal DocCheck Basic allows Authentication Bypass. This issue affects DocCheck Basic versions: 7.x.
Product
DocCheck Basic
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record drupal.org
Oct 30, 2026Incorrect Authorization vulnerability in Drupal View Unpublished allows Forceful Browsing.CVE-2026-114537 · Websites & servers · Drupal · reported by mlhess@drupal.org
Incorrect Authorization vulnerability in Drupal View Unpublished allows Forceful Browsing. This issue affects View Unpublished versions: from 0.0.0 to 1.5.0.
Product
View Unpublished
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record drupal.org
Oct 30, 2026Missing Authorization vulnerability in Drupal Swiper formatter allows Forceful Browsing.CVE-2026-114535 · Websites & servers · Drupal · reported by mlhess@drupal.org
Missing Authorization vulnerability in Drupal Swiper formatter allows Forceful Browsing. This issue affects Swiper formatter versions: from 0.0.0 to 2.1.2, from 3.0.1 to 3.1.0.
Product
Swiper formatter
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record drupal.org
Oct 30, 2026Missing Authorization vulnerability in Drupal Ágora Transparency Theme allows Forceful Browsing.CVE-2026-114533 · Websites & servers · Drupal · reported by mlhess@drupal.org
Missing Authorization vulnerability in Drupal Ágora Transparency Theme allows Forceful Browsing. This issue affects Ágora Transparency Theme versions: from 0.0.0 to 1.2.3.
Product
Ágora Transparency Theme
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record drupal.org
Oct 30, 2026Incorrect Authorization vulnerability in Drupal Dopup allows Forceful Browsing.CVE-2026-114530 · Websites & servers · Drupal · reported by mlhess@drupal.org
Incorrect Authorization vulnerability in Drupal Dopup allows Forceful Browsing. This issue affects Dopup versions: from 0.0.0 to 1.0.7.
Product
Dopup
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record drupal.org
Oct 30, 2026Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal Permissions by Term allows Forceful Browsing.CVE-2026-107311 · Websites & servers · Drupal · reported by mlhess@drupal.orgLow 3.7
Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal Permissions by Term allows Forceful Browsing. This issue affects Permissions by Term versions: from 0.0.0 to 3.1.41.
Product
Permissions by Term
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record drupal.org
Oct 30, 2026Missing Authorization vulnerability in Drupal Easy Breadcrumb allows Forceful Browsing.CVE-2026-107309 · Websites & servers · Drupal · reported by mlhess@drupal.orgLow 3.7
Missing Authorization vulnerability in Drupal Easy Breadcrumb allows Forceful Browsing. This issue affects Easy Breadcrumb versions: from 0.0.0 to 2.0.11.
Product
Easy Breadcrumb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record drupal.org
Oct 30, 2026Incorrect Authorization vulnerability in Drupal SmartLinker AI allows Forceful Browsing.CVE-2026-107307 · Websites & servers · Drupal · reported by mlhess@drupal.orgMedium 4.3
Incorrect Authorization vulnerability in Drupal SmartLinker AI allows Forceful Browsing. This issue affects SmartLinker AI versions: from 0.0.0 to 1.0.3.
Product
SmartLinker AI
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record drupal.org
Oct 30, 2026Insertion of Sensitive Information Into Sent Data vulnerability in Drupal Two Factor Authentication - TFA / Passwordless Login allows Forceful Browsing.CVE-2026-107268 · Websites & servers · Drupal · reported by mlhess@drupal.orgMedium 4.3
Insertion of Sensitive Information Into Sent Data vulnerability in Drupal Two Factor Authentication - TFA / Passwordless Login allows Forceful Browsing. This issue affects Two Factor Authentication - TFA / Passwordless Login versions: from 0.0.0 to 5.4.1, from 5.5.0 to 5.5.2.
Product
Two Factor Authentication - TFA / Passwordless Login
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record drupal.org
Oct 30, 2026Missing Authorization vulnerability in Drupal DKAN allows Forceful Browsing.CVE-2026-107267 · Websites & servers · Drupal · reported by mlhess@drupal.orgMedium 5.3
Missing Authorization vulnerability in Drupal DKAN allows Forceful Browsing. This issue affects DKAN versions: from 0.0.0 to 4.0.4, from 4.1.0 to 4.1.5.
Product
DKAN
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record drupal.org
Oct 30, 2026Missing Authorization vulnerability in Drupal Views Share allows Forceful Browsing.CVE-2026-107266 · Websites & servers · Drupal · reported by mlhess@drupal.org
Missing Authorization vulnerability in Drupal Views Share allows Forceful Browsing. This issue affects Views Share versions: from 0.0.0 to 2.0.1.
Product
Views Share
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record drupal.org
Oct 30, 2026Incorrect Authorization vulnerability in Drupal Gutenberg allows Forceful Browsing.CVE-2026-107263 · Websites & servers · Drupal · reported by mlhess@drupal.orgMedium 5.4
Incorrect Authorization vulnerability in Drupal Gutenberg allows Forceful Browsing. This issue affects Gutenberg versions: from 0.0.0 to 2.15.0, from 3.0.0 to 3.0.7.
Product
Gutenberg
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record drupal.org
Oct 30, 2026Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Authenticator Login Plus (2FA) allows Authentication Bypass.CVE-2026-107261 · Websites & servers · Drupal · reported by mlhess@drupal.orgMedium 4.2
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Authenticator Login Plus (2FA) allows Authentication Bypass. This issue affects Authenticator Login Plus (2FA) versions: from 0.0.0 to 1.0.1.
Product
Authenticator Login Plus (2FA)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record drupal.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.