Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,614 results · page 5 of 33
Sep 2, 2026Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Entity Browser allows Stored XSS.CVE-2026-18986 · Websites & servers · reported by mlhess@drupal.orgMedium 4.8
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Entity Browser allows Stored XSS. This issue affects Entity Browser versions: from 0.0.0 to 2.16.0.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 2, 2026Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Disable Login Page allows Functionality Bypass.CVE-2026-16647 · Websites & servers · reported by mlhess@drupal.orgMedium 4.1
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Disable Login Page allows Functionality Bypass. This issue affects Disable Login Page versions: from 0.0.0 to 1.1.4.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2026Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Stored XSS.CVE-2026-55805 · Websites & servers · reported by mlhess@drupal.orgMedium 5.4
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Stored XSS. This issue affects Drupal core versions: from 0.0.0 to 10.6.13, from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, from 0.0.0 to 11.0.*, from 0.0.0 to 11.1.*, from 0.0.0 to 11.2.*.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2026Incorrect Authorization vulnerability in Drupal Edit in-place field allows Forceful Browsing.CVE-2026-18985 · Websites & servers · reported by mlhess@drupal.orgHigh 8.1
Incorrect Authorization vulnerability in Drupal Edit in-place field allows Forceful Browsing. This issue affects Edit in-place field versions: from 0.0.0 to 2.1.1.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2026Vulnerability in Drupal Powerful Surveys.CVE-2026-18261 · Websites & servers · reported by mlhess@drupal.orgMedium 5.7
Vulnerability in Drupal Powerful Surveys. This issue affects Powerful Surveys versions: *.*.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2026Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Disable Login Page allows Brute Force.CVE-2026-18260 · Websites & servers · reported by mlhess@drupal.orgMedium 5.7
Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Disable Login Page allows Brute Force. This issue affects Disable Login Page versions: from 0.0.0 to 1.1.4.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2026Observable Timing Discrepancy vulnerability in Drupal Token Content Access allows Brute Force.CVE-2026-18259 · Websites & servers · reported by mlhess@drupal.orgHigh 7.5
Observable Timing Discrepancy vulnerability in Drupal Token Content Access allows Brute Force. This issue affects Token Content Access versions: from 0.0.0 to 3.1.2.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2026Vulnerability in Drupal PanKM.CVE-2026-16646 · Websites & servers · reported by mlhess@drupal.orgMedium 5.7
Vulnerability in Drupal PanKM. This issue affects PanKM versions: *.*.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2026Missing Authorization vulnerability in Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery allows Forceful Browsing.CVE-2026-16645 · Websites & servers · reported by mlhess@drupal.orgCritical 9.1
Missing Authorization vulnerability in Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery allows Forceful Browsing. This issue affects PhotoSwipe - Responsive JavaScript Modal Image Gallery versions: from 0.0.0 to 3.2.0.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2026Incorrect Authorization vulnerability in Drupal Webform REST allows Forceful Browsing.CVE-2026-16644 · Websites & servers · reported by mlhess@drupal.orgCritical 9.1
Incorrect Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. This issue affects Webform REST versions: from 0.0.0 to 4.1.0.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2026Vulnerability in Drupal Lunr exposed filters.CVE-2026-16643 · Websites & servers · reported by mlhess@drupal.orgMedium 5.7
Vulnerability in Drupal Lunr exposed filters. This issue affects Lunr exposed filters versions: *.*.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2026Vulnerability in Drupal Email Login OTP.CVE-2026-16642 · Websites & servers · reported by mlhess@drupal.orgMedium 5.7
Vulnerability in Drupal Email Login OTP. This issue affects Email Login OTP versions: *.*.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2026Vulnerability in Drupal Commerce Elavon.CVE-2026-16641 · Websites & servers · reported by mlhess@drupal.orgCritical 9.8
Vulnerability in Drupal Commerce Elavon. This issue affects Commerce Elavon versions: *.*.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2026Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Search API Autocomplete allows Reflected XSS.CVE-2026-16640 · Websites & servers · reported by mlhess@drupal.orgMedium 6.1
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Search API Autocomplete allows Reflected XSS. This issue affects Search API Autocomplete versions: from 0.0.0 to 1.12.0.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2026Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Internationalization Single Sign-On allows Authentication Bypass.CVE-2026-16639 · Websites & servers · reported by mlhess@drupal.orgCritical 9.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Internationalization Single Sign-On allows Authentication Bypass. This issue affects Internationalization Single Sign-On versions: from 0.0.0 to 1.8.0.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2026Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Media Folders allows Stored XSS.CVE-2026-16638 · Websites & servers · reported by mlhess@drupal.orgMedium 6.1
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Media Folders allows Stored XSS. This issue affects Media Folders versions: from 0.0.0 to 1.0.8.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2026Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS).CVE-2026-15917 · Websites & servers · reported by mlhess@drupal.orgMedium 4.7
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Drupal core versions: from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, from 0.0.0 to 11.2.*.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2026Missing Authorization vulnerability in Drupal Drupal core allows Forceful Browsing.CVE-2026-15916 · Websites & servers · reported by mlhess@drupal.orgMedium 4.2
Missing Authorization vulnerability in Drupal Drupal core allows Forceful Browsing. This issue affects Drupal core versions: from 0.0.0 to 10.6.13, from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, from 0.0.0 to 11.0.*, from 0.0.0 to 11.1.*, from 0.0.0 to 11.2.*.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2026Vulnerability in Drupal Development Environment.CVE-2026-15088 · Websites & servers · reported by mlhess@drupal.orgMedium 5.7
Vulnerability in Drupal Development Environment. This issue affects Development Environment versions: *.*.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2026Vulnerability in Drupal Commerce guest registration.CVE-2026-15089 · Websites & servers · reported by mlhess@drupal.orgCritical 9.1
Vulnerability in Drupal Commerce guest registration. This issue affects Commerce guest registration versions: *.*.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2026vulnerability in Drupal Clean RESTful allows .CVE-2026-15087 · Websites & servers · reported by mlhess@drupal.orgMedium 5.9
vulnerability in Drupal Clean RESTful allows . This issue affects Clean RESTful versions: *.*.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2026vulnerability in Drupal Raw Formatter [Meta Tag Formatter] allows .CVE-2026-15086 · Websites & servers · reported by mlhess@drupal.orgMedium 5.9
vulnerability in Drupal Raw Formatter [Meta Tag Formatter] allows . This issue affects Raw Formatter [Meta Tag Formatter] versions: *.*.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2026vulnerability in Drupal Brute force attack protection allows .CVE-2026-11915 · Websites & servers · reported by mlhess@drupal.orgMedium 5.9
vulnerability in Drupal Brute force attack protection allows . This issue affects Brute force attack protection versions: *.*.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2026vulnerability in Drupal Composer allows .CVE-2026-11914 · Websites & servers · reported by mlhess@drupal.orgMedium 5.9
vulnerability in Drupal Composer allows . This issue affects Composer versions: *.*.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2026vulnerability in Drupal Mother May I allows .CVE-2026-11913 · Websites & servers · reported by mlhess@drupal.orgCritical 9.8
vulnerability in Drupal Mother May I allows . This issue affects Mother May I versions: *.*.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2026Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Colorbox allows Cross-Site Scripting (XSS).CVE-2026-58591 · Websites & servers · reported by mlhess@drupal.orgMedium 5.4
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Colorbox allows Cross-Site Scripting (XSS). This issue affects Colorbox versions: from 0.0.0 to 2.1.5, from 0.0.0 to 2.2.0.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2026Missing Authorization vulnerability in Drupal FlowDrop allows Forceful Browsing.CVE-2026-58590 · Websites & servers · reported by mlhess@drupal.orgMedium 5.4
Missing Authorization vulnerability in Drupal FlowDrop allows Forceful Browsing. This issue affects FlowDrop versions: from 0.0.0 to 1.6.0.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2026Missing Authorization vulnerability in Drupal FlowDrop allows Forceful Browsing.CVE-2026-58589 · Websites & servers · reported by mlhess@drupal.orgMedium 5.4
Missing Authorization vulnerability in Drupal FlowDrop allows Forceful Browsing. This issue affects FlowDrop versions: from 0.0.0 to 1.6.0.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2026Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal Canvas allows Cross-Site Scripting (XSS).CVE-2026-58588 · Websites & servers · reported by mlhess@drupal.orgMedium 6.1
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal Canvas allows Cross-Site Scripting (XSS). This issue affects Drupal Canvas versions: from 0.0.0 to 1.4.2, from 1.5.0 to 1.5.2, from 1.6.0 to 1.6.1, from 1.7.0 to 1.7.1.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2026Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal Canvas allows Cross-Site Scripting (XSS).CVE-2026-58587 · Websites & servers · reported by mlhess@drupal.orgMedium 6.1
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal Canvas allows Cross-Site Scripting (XSS). This issue affects Drupal Canvas versions: from 0.0.0 to 1.4.2, from 1.5.0 to 1.5.2, from 1.6.0 to 1.6.1, from 1.7.0 to 1.7.1.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2026Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Plotly.js Graphing allows Object Injection.CVE-2026-55810 · Websites & servers · reported by mlhess@drupal.orgHigh 8.1
Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Plotly.js Graphing allows Object Injection. This issue affects Plotly.js Graphing versions: from 0.0.0 to 3.0.2.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2026Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Flag attendance field allows Object Injection.CVE-2026-55809 · Websites & servers · reported by mlhess@drupal.orgHigh 8.1
Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Flag attendance field allows Object Injection. This issue affects Flag attendance field versions: from 0.0.0 to 1.2.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2026Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS).CVE-2026-55808 · Websites & servers · reported by mlhess@drupal.orgMedium 5.4
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Drupal core versions: from 0.0.0 to 10.5.12, from 10.6.0 to 10.6.11, from 11.2.0 to 11.2.14, from 11.3.0 to 11.3.12, from 0.0.0 to 11.0.*, from 0.0.0 to 11.1.*.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2026Server-Side Request Forgery (SSRF) vulnerability in Drupal Drupal core allows Server Side Request Forgery.CVE-2026-55807 · Websites & servers · reported by mlhess@drupal.orgLow 3.1
Server-Side Request Forgery (SSRF) vulnerability in Drupal Drupal core allows Server Side Request Forgery. This issue affects Drupal core versions: from 0.0.0 to 10.5.12, from 10.6.0 to 10.6.11, from 11.2.0 to 11.2.14, from 11.3.0 to 11.3.12, from 0.0.0 to 11.0.*, from 0.0.0 to 11.1.*.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2026URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal Drupal core allows Content Spoofing.CVE-2026-55806 · Websites & servers · reported by mlhess@drupal.orgMedium 5.9
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal Drupal core allows Content Spoofing. This issue affects Drupal core versions: from 0.0.0 to 10.5.12, from 10.6.0 to 10.6.11, from 11.2.0 to 11.2.14, from 11.3.0 to 11.3.12, from 0.0.0 to 11.0.*, from 0.0.0 to 11.1.*.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2026Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection.CVE-2026-55804 · Websites & servers · reported by mlhess@drupal.orgMedium 5.9
Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection. This issue affects Drupal core versions: from 0.0.0 to 10.5.12, from 10.6.0 to 10.6.11, from 11.2.0 to 11.2.14, from 11.3.0 to 11.3.12, from 0.0.0 to 11.0.*, from 0.0.0 to 11.1.*.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2026Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection.CVE-2026-55803 · Websites & servers · reported by mlhess@drupal.orgMedium 5.9
Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection. This issue affects Drupal core versions: from 0.0.0 to 10.5.12, from 10.6.0 to 10.6.11, from 11.2.0 to 11.2.14, from 11.3.0 to 11.3.12, from 0.0.0 to 11.0.*, from 0.0.0 to 11.1.*.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2026Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI SEO/GEO Analyzer allows Stored XSS.CVE-2026-15085 · Websites & servers · reported by mlhess@drupal.orgMedium 5.4
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI SEO/GEO Analyzer allows Stored XSS. This issue affects AI SEO/GEO Analyzer versions: from 0.0.0 to 1.1.3.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2026Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal UI Patterns (SDC in Drupal UI) allows Stored XSS.CVE-2026-15084 · Websites & servers · reported by mlhess@drupal.orgMedium 5.4
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal UI Patterns (SDC in Drupal UI) allows Stored XSS. This issue affects UI Patterns (SDC in Drupal UI) versions: from 2.0.0 to 2.0.17.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2026Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal ECA: Event - Condition - Action allows Object Injection.CVE-2026-15083 · Websites & servers · reported by mlhess@drupal.orgMedium 4.2
Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal ECA: Event - Condition - Action allows Object Injection. This issue affects ECA: Event - Condition - Action versions: from 0.0.0 to 2.1.20, from 3.0.0 to 3.0.12, from 3.1.0 to 3.1.4.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2026Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Siteimprove Analytics allows Cross-Site Scripting (CVE-2026-15082 · Websites & servers · reported by mlhess@drupal.orgMedium 5.4
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Siteimprove Analytics allows Cross-Site Scripting (XSS). This issue affects Siteimprove Analytics versions: from 0.0.0 to 2.0.1.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2026Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Location Selector allows SQL Injection.CVE-2026-15081 · Websites & servers · reported by mlhess@drupal.orgHigh 7.4
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Location Selector allows SQL Injection. This issue affects Location Selector versions: from 0.0.0 to 1.3.0.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2026Cross-Site Request Forgery (CSRF) vulnerability in Drupal Ray Enterprise Translation allows Cross Site Request Forgery.CVE-2026-15080 · Websites & servers · reported by mlhess@drupal.orgMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Drupal Ray Enterprise Translation allows Cross Site Request Forgery. This issue affects Ray Enterprise Translation versions: from 0.0.0 to 4.0.4, from 4.1.0 to 4.1.4, from 11.0.0 to 11.0.4.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2026Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Login Disable allows Brute Force.CVE-2026-15079 · Websites & servers · reported by mlhess@drupal.orgMedium 5.4
Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Login Disable allows Brute Force. This issue affects Login Disable versions: from 0.0.0 to 2.1.4.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2026Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Tealium iQ Tag Management allows Object Injection.CVE-2026-13244 · Websites & servers · reported by mlhess@drupal.orgHigh 8.1
Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Tealium iQ Tag Management allows Object Injection. This issue affects Tealium iQ Tag Management versions: from 0.0.0 to 2.4.0.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2026Cross-Site Request Forgery (CSRF) vulnerability in Drupal Salesforce Suite allows Cross Site Request Forgery.CVE-2026-13243 · Websites & servers · reported by mlhess@drupal.orgMedium 4.8
Cross-Site Request Forgery (CSRF) vulnerability in Drupal Salesforce Suite allows Cross Site Request Forgery. This issue affects Salesforce Suite versions: from 0.0.0 to 5.1.3.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2026Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Geolocation Field allows SQL Injection.CVE-2026-13242 · Websites & servers · reported by mlhess@drupal.orgMedium 6.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Geolocation Field allows SQL Injection. This issue affects Geolocation Field versions: from 0.0.0 to 3.15.0.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2026Missing Authorization vulnerability in Drupal Paragraphs allows Forceful Browsing.CVE-2026-13241 · Websites & servers · reported by mlhess@drupal.orgMedium 6.5
Missing Authorization vulnerability in Drupal Paragraphs allows Forceful Browsing. This issue affects Paragraphs versions: from 0.0.0 to 1.21.0.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2026Missing Authorization vulnerability in Drupal Paragraphs allows Forceful Browsing.CVE-2026-13240 · Websites & servers · reported by mlhess@drupal.orgMedium 6.5
Missing Authorization vulnerability in Drupal Paragraphs allows Forceful Browsing. This issue affects Paragraphs versions: from 0.0.0 to 1.21.0.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2026Missing Authorization vulnerability in Drupal WissKI allows Forceful Browsing.CVE-2026-13239 · Websites & servers · reported by mlhess@drupal.orgMedium 6.5
Missing Authorization vulnerability in Drupal WissKI allows Forceful Browsing. This issue affects WissKI versions: from 0.0.0 to 4.2.0.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.