Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
34,857 results · page 1 of 698
Nov 1, 2026Kali Forms — Contact Form & Drag-and-Drop Builder: Does not perform a capability check on its test-email handlerCVE-2026-107343 · WordPress plugins & themes · reported by WPScan
The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.30 does not perform a capability check on its test-email handler, relying only on a nonce that is available to any logged-in user, so a low-privileged user such as a Subscriber can make the site send email to an arbitrary recipient with a spoofed sender address.
- Product
- Kali Forms — Contact Form & Drag-and-Drop Builder
- Fixed in
- 2.4.30
- What to do
- Update Kali Forms — Contact Form & Drag-and-Drop Builder to 2.4.30 or newer.
Nov 1, 2026Kali Forms — Contact Form & Drag-and-Drop Builder: Does not perform a capability checkCVE-2026-107342 · WordPress plugins & themes · reported by WPScan
The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.30 does not perform a capability check when its test-email handler resolves and returns a user's email address, relying only on a nonce that is available to any logged-in user, allowing authenticated users with minimal privileges (Subscriber and above) to disclose the email address of any registered user, including administrators.
- Product
- Kali Forms — Contact Form & Drag-and-Drop Builder
- Fixed in
- 2.4.30
- What to do
- Update Kali Forms — Contact Form & Drag-and-Drop Builder to 2.4.30 or newer.
Oct 31, 2026Jpom 2.10.0 through 2.11.12 contains an authentication bypass vulnerability that allows unauthenticated attackers to gain super-administrator access by injectinCVE-2026-120201 · Other software · dromara · reported by VulnCheckCritical 9.3
Jpom 2.10.0 through 2.11.12 contains an authentication bypass vulnerability that allows unauthenticated attackers to gain super-administrator access by injecting query conditions into the JPOM-USER-TOKEN header. Attackers can send a value like 'is not null', which Hutool's Condition parser treats as an operator, then execute commands through Jpom's script features.
- Product
- Jpom
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 31, 2026Shipping Zones by Drawing for WooCommerce: Stored Cross-Site ScriptingCVE-2026-119065 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Shipping Zones by Drawing for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'szbd-picked' checkout parameter in versions up to, and including, 3.3.0 The szbd_checkout_field_update_order_meta() handler stores stripslashes(sanitize_text_field($_POST['szbd-picked'])) in order meta without validating the JSON structure or restricting dangerous characters, and the szbd_show_checkout_field_admin_order_meta() handler later concatenates the decoded lat and lng values directly into a double-quoted href attribute without esc_url() or esc_attr(). This makes it possible for unauthenticated attackers, by submitting an ordinary guest-checkout order with a crafted szbd-picked JSON payload, to inject arbitrary attributes (such as onmouseover) onto the Google Maps link in the WooCommerce admin order view that will execute whenever an administrator accesses an injected order.
- Product
- Shipping Zones by Drawing for WooCommerce
- Affected
- up to 3.3.0
- What to do
- Affects up to 3.3.0. Update Shipping Zones by Drawing for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 31, 2026PDF Invoice for WooCommerce + Drag and Drop Template Builder: PHP Object InjectionCVE-2026-109220 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The PDF Invoice for WooCommerce + Drag and Drop Template Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 7.1.1 via the 'customer_note' parameter parameter. This is due to insufficient sanitization of the customer_note checkout field, which is inlined verbatim into invoice HTML, entity-decoded back into a live tag by simplehtmldom, reassembled into raw bytes by mPDF, and passed to unserialize() in _getObjAttr without validation. This makes it possible for unauthenticated attackers to execute code on the server. An unauthenticated attacker can trigger the vulnerable code path on a default install by placing an anonymous WooCommerce checkout via the public Store API (POST /wc/store/v1/checkout) using a Direct Bank Transfer or cheque payment method, which automatically transitions the order to 'on-hold' status and fires the plugin's invoice-generation hook.
- Product
- PDF Invoice for WooCommerce + Drag and Drop Template Builder
- Affected
- up to 7.1.1
- What to do
- Affects up to 7.1.1. Update PDF Invoice for WooCommerce + Drag and Drop Template Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recorddownloads.wordpress.orgplugins.trac.wordpress.org
Oct 30, 2026The File Force Download module for Drupal 7 implements hook_file_download() to add a Content-Disposition header when a file URL carries the download query paramCVE-2026-110176 · Websites & servers · Drupal · reported by mlhess@drupal.orgHigh 8.7
The File Force Download module for Drupal 7 implements hook_file_download() to add a Content-Disposition header when a file URL carries the download query parameter. In Drupal 7, returning a non-empty header array from that hook is itself a grant of access to the file. In versions 7.1.0 through 7.1.2, the module only delegated to other modules' hook_file_download() implementations when the file was in the private scheme. For every other scheme it returned its headers without any check. An unauthenticated visitor who appended download=1 to the URL of a file in the temporary:// scheme, or in a stream wrapper supplied by another module, could retrieve the file, overriding the access checks that would otherwise have applied. Files in the public and private schemes are not affected.
- Product
- File Force Download
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordd7es.tag1.comherodevs.com
Oct 30, 2026Improper Authorization vulnerability in Drupal Field Collection for Drupal 7 allows a user with the "edit field collections" permission to bypass access controlCVE-2026-77152 · Websites & servers · Drupal · reported by mlhess@drupal.orgMedium 5.3
Improper Authorization vulnerability in Drupal Field Collection for Drupal 7 allows a user with the "edit field collections" permission to bypass access control on the parent (host) entity. The access check for field collection items (field_collection_item_access()) granted edit and delete access to any user holding the "edit field collections" permission without verifying the user's access to the host entity. As a result, a user with "edit field collections" but without edit/update access to the host entity (for example a node they cannot edit) could edit or delete field collection items attached to that entity, bypassing the intended entity/node access restrictions. The fix requires access to the parent entity in addition to the field collection permission. This issue affects Field Collection for Drupal 7: version 7.x-1.0 up to and including 7.x-1.2.
- Product
- Field Collection for Drupal 7
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordd7es.tag1.comherodevs.com
Oct 30, 2026Dream Displays provides in-game screens for streaming videos in Minecraft.CVE-2026-62968 · Other software · arsmotorin · reported by GitHubHigh 8.7
Dream Displays provides in-game screens for streaming videos in Minecraft. From 1.5.0 until 1.8.2, user-controlled input can influence arguments passed to `yt-dlp` under specific conditions. Unintended command-line options may be interpreted by `yt-dlp`, potentially altering its behavior. This issue is fixed in version 1.8.2.
- Product
- dreamdisplays
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026Maxthon Browser for Android before 7.5.8.103 contains an address bar spoofing vulnerability that allows remote attackers to misrepresent a page's origin by explCVE-2026-119730 · Other software · Maxthon Technology Limited · reported by VulnCheckMedium 5.1
Maxthon Browser for Android before 7.5.8.103 contains an address bar spoofing vulnerability that allows remote attackers to misrepresent a page's origin by exploiting the lack of a persistent fullscreen notification or trusted origin indicator when the Fullscreen API is invoked. Attackers can craft a malicious web page that renders a counterfeit address bar showing a trusted domain while displaying attacker-controlled content, tricking users who perform a single tap to enter fullscreen into disclosing credentials via phishing.
- Product
- Maxthon Browser for Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmaxthon.comvulncheck.com
Oct 30, 2026draw.io Desktop is the official Electron build of draw.io.CVE-2026-119333 · Other software · jgraph · reported by GitHubHigh 7.8
draw.io Desktop is the official Electron build of draw.io. Prior to 31.5.2, the Windows application launched powershell and attrib by bare executable name from src/main/electron.js. When draw.io Desktop was not already running, opening a diagram from File Explorer made the diagram directory the current working directory, allowing a colocated attacker-controlled powershell.bat or attrib.exe to be resolved before the intended system executable. A victim who extracted an attacker-supplied archive and cold-opened its legitimate .drawio file could therefore execute attacker-controlled code when Local Fonts were enabled or when draft or backup attributes were updated. This issue is fixed in version 31.5.2.
- Product
- drawio-desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026Hydra is a layer-two scalability solution for Cardano.CVE-2026-62162 · Other software · cardano-scaling · reported by GitHubHigh 8.2
Hydra is a layer-two scalability solution for Cardano. Prior to 2.1.0, the `Claim` branch in `hydra-plutus/validators/deposit.ak` checks only that `datum.head_id` matches the attacker-controlled `redeemer.currencySymbol` and that the transaction is valid before the deposit deadline. It neither requires spending the Head state-token UTxO in the same transaction nor constrains outputs. After a deposit made through `POST /commit` is confirmed, any third party able to build a Cardano transaction can observe and consume the pending deposit UTxO before its deadline and redirect the assets to an arbitrary address. A standalone deposit spend invokes no Head validator, bypassing its safety checks; historical head-ID binding and the Aiken rewrite retained this missing invariant. The default deadline is three times depositPeriod, so the described attack applies to pending deposits before that deadline. This issue is fixed in version 2.1.0.
- Product
- hydra
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026LM Studio before 0.4.22+1 contains a path traversal vulnerability in the model downloader's resolveDownloadRequest that allows attackers to write files outside CVE-2026-119979 · Other software · Element Labs · reported by VulnCheckHigh 8.7
LM Studio before 0.4.22+1 contains a path traversal vulnerability in the model downloader's resolveDownloadRequest that allows attackers to write files outside the models directory using backslash-separated traversal filenames. Attackers can trick users into downloading a crafted model repository that plants a plugin manifest.json, install-state.json and mcp-bridge-config.json, running an attacker-supplied Python payload on every launch.
- Product
- LM Studio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlmstudio.aivulncheck.com
Oct 30, 2026SecureDrop is an open-source whistleblower submission system that media organizations can use to securely accept documents from, and communicate with anonymous CVE-2026-50000 · Other software · freedomofpress · reported by GitHubMedium 5
SecureDrop is an open-source whistleblower submission system that media organizations can use to securely accept documents from, and communicate with anonymous sources. From 2.5.0 until 2.16.0, the `Journalist Interface` can accept an `API session` token against the `web UI` because its `SessionInterface` keeps a mutable session key prefix that changes with each request and persists across requests. API and web sessions were separated in `Redis` starting in version 2.5.0, but prefix corruption confuses those session namespaces. An attacker who already has access to the secret `Journalist Interface` onion address, the required authentication access and a recent nonexpired `API session` token can reuse that token against the `web UI` until its natural expiry, at most eight hours. The corrupted prefix can also prevent logout from deleting the correct `Redis` session, although normal expiry still applies. A compromised journalist can access encrypted submissions and perform broad actions on source submissions, but this issue does not expose plaintext submissions or affect the running system's availability. This issue is fixed in version 2.16.0.
- Product
- securedrop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026Scribus before 1.6.7 contains an out-of-bounds write vulnerability in the importdrw Micrografx Draw plugin that uses an unvalidated y offset to select image scaCVE-2026-104065 · Other software · Scribus · reported by VulnCheckHigh 8.5
Scribus before 1.6.7 contains an out-of-bounds write vulnerability in the importdrw Micrografx Draw plugin that uses an unvalidated y offset to select image scanlines. Attackers can craft a DRW file that, when imported by a user, writes decoded bitmap data outside the heap image buffer, causing crashes or code execution.
- Product
- Scribus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026RuoYi-Vue-Plus through 6.0.0 contains an authorization bypass vulnerability in SysUserServiceImpl.selectUserListByDept that allows authenticated users to read uCVE-2026-119647 · Other software · dromara · reported by VulnCheckMedium 5.3
RuoYi-Vue-Plus through 6.0.0 contains an authorization bypass vulnerability in SysUserServiceImpl.selectUserListByDept that allows authenticated users to read users of other departments. Users holding system:user:list under a department-restricted role can request GET /system/user/list/dept/{deptId} with any department id to obtain usernames, nicknames, account status, last login IP and time, and remarks.
- Product
- RuoYi-Vue-Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026ArcadeDB from 21.12.1 before 26.10.2 contains an authorization bypass vulnerability that allows users with only readRecord to replace the shared GraphQL schema CVE-2026-119576 · Other software · ArcadeData · reported by VulnCheckMedium 5.3
ArcadeDB from 21.12.1 before 26.10.2 contains an authorization bypass vulnerability that allows users with only readRecord to replace the shared GraphQL schema via the read-only query endpoint. Attackers can send a GraphQL type definition with a crafted @sql directive to /api/v1/query/{database}, altering query results returned to other users including administrators.
- Product
- arcadedb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 30, 2026Parse Server from 9.7.0 before 9.10.5-alpha.10 contains an authorization flaw that applies _Installation updates addressed by object ID to the installation nameCVE-2026-119571 · Other software · parse-community · reported by VulnCheckMedium 6.3
Parse Server from 9.7.0 before 9.10.5-alpha.10 contains an authorization flaw that applies _Installation updates addressed by object ID to the installation named in the X-Parse-Installation-Id header. When protectedFieldsTriggerExempt is enabled, attackers knowing another installation's object ID can make a beforeSave trigger process that installation's protected fields while writing elsewhere.
- Product
- parse-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 30, 2026OPNsense core before 26.7.8 contains a log injection vulnerability that allows unauthenticated attackers to plant victim IP addresses in the lockout_handler by CVE-2026-119423 · Other software · opnsense · reported by VulnCheckMedium 6.9
OPNsense core before 26.7.8 contains a log injection vulnerability that allows unauthenticated attackers to plant victim IP addresses in the lockout_handler by submitting crafted WebGUI login usernames. Attackers can submit usernames like 'Invalid user <victim-ip>' repeatedly to add the victim to the sshlockout table, blocking SSH and WebGUI access and killing its pf states.
- Product
- core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordabraxaslabs.techgithub.com
Oct 30, 2026A denial-of-service vulnerability exists in UAA's private_key_jwt client-authentication mechanism.CVE-2026-59396 · Other software · Cloud Foundry · reported by security@vmware.comMedium 6.9
A denial-of-service vulnerability exists in UAA's private_key_jwt client-authentication mechanism. When UAA retrieves a remote JWKS URI, it caches the response. Invalid authentication attempts can trigger full deserialization of this cached data. An attacker with prerequisites (write access to clients or a compromised endpoint) can send anonymous requests that force repeated parsing of large cached objects, causing excessive CPU usage and potential Java heap exhaustion via OutOfMemoryError, resulting in service unavailability.
- Product
- UAA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026Cloud Controller (CAPI) leaks sensitive data into audit logs in multiple instances: custom buildpack credentials are exposed in audit events for app manifest apCVE-2026-59388 · Other software · Cloud Foundry Foundation · reported by security@vmware.comMedium 6.5
Cloud Controller (CAPI) leaks sensitive data into audit logs in multiple instances: custom buildpack credentials are exposed in audit events for app manifest application, creation, and updates; syslog drain URL credentials are exposed in user-provided service instance audit events; and service binding parameters are leaked in app manifest and service binding audit events.
- Product
- CAPI (Cloud Foundry Controller)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026The Nginx routing configuration for Cloud Controller blocks unauthenticated access to /internal/v4/ and /internal/v5/ endpoints but omits an equivalent deny rulCVE-2026-59387 · Other software · Cloud Foundry · reported by security@vmware.comHigh 8.8
The Nginx routing configuration for Cloud Controller blocks unauthenticated access to /internal/v4/ and /internal/v5/ endpoints but omits an equivalent deny rule for /internal/v3/. As a result, the staging callback endpoints /internal/v3/staging/:guid/droplet_completed and /internal/v3/staging/:guid/build_completed are reachable from the public API listener without OAuth or mutual TLS. An attacker with a valid build or droplet GUID can submit a forged staging callback, transition a droplet to STAGED, and persist arbitrary process metadata and sidecar data with no associated package or actor. A SpaceAuditor can enumerate GUIDs without write permissions, making this an effective privilege escalation beyond the intended role boundary.
- Product
- CAPI (Cloud Controller API)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026A SpaceSupporter could improperly modify an application's start command and buildpack—actions requiring SpaceDeveloper privileges.CVE-2026-59386 · Other software · Cloud Foundry · reported by security@vmware.comMedium 6.5
A SpaceSupporter could improperly modify an application's start command and buildpack—actions requiring SpaceDeveloper privileges. This privilege escalation enables unauthorized retrieval of service credentials through malicious start commands or custom buildpacks.
- Product
- Cloud Foundry Controller (CAPI)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026A user with SpaceDeveloper privileges could modify the URL of a space-scoped broker without altering its credentials, enabling extraction of existing broker creCVE-2026-59385 · Other software · Cloud Foundry · reported by security@vmware.comLow 2.7
A user with SpaceDeveloper privileges could modify the URL of a space-scoped broker without altering its credentials, enabling extraction of existing broker credentials by redirecting them to a broker under their control. The CF API does not permit direct reading of broker credentials, making this an indirect extraction method.
- Product
- CAPI (Cloud Foundry Controller)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026Missing Authorization vulnerability in Drupal Xray Audit allows Forceful Browsing.CVE-2026-96389 · Websites & servers · Drupal · reported by mlhess@drupal.orgMedium 6.5
Missing Authorization vulnerability in Drupal Xray Audit allows Forceful Browsing. This issue affects Xray Audit versions: from 0.0.0 to 1.6.3, from 2.0.0 to 2.0.4, from 3.0.0 to 3.1.1.
- Product
- Xray Audit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026Incorrect Authorization vulnerability in Drupal Field Permissions allows Forceful Browsing.CVE-2026-118584 · Websites & servers · Drupal · reported by mlhess@drupal.org
Incorrect Authorization vulnerability in Drupal Field Permissions allows Forceful Browsing. This issue affects Field Permissions versions: from 0.0.0 to 1.6.0.
- Product
- Field Permissions
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026Incorrect Authorization vulnerability in Drupal Field Permissions allows Forceful Browsing.CVE-2026-118583 · Websites & servers · Drupal · reported by mlhess@drupal.org
Incorrect Authorization vulnerability in Drupal Field Permissions allows Forceful Browsing. This issue affects Field Permissions versions: from 0.0.0 to 1.6.0.
- Product
- Field Permissions
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal CAPTCHA allows Functionality Bypass.CVE-2026-118582 · Websites & servers · Drupal · reported by mlhess@drupal.org
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal CAPTCHA allows Functionality Bypass. This issue affects CAPTCHA versions: from 0.0.0 to 1.18.0, from 2.0.0 to 2.0.11.
- Product
- CAPTCHA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Stage File Proxy allows Cross-Site Scripting (XSS).CVE-2026-118576 · Websites & servers · Drupal · reported by mlhess@drupal.org
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Stage File Proxy allows Cross-Site Scripting (XSS). This issue affects Stage File Proxy versions: from 0.0.0 to 3.1.7, from 4.0.0 to 4.0.1.
- Product
- Stage File Proxy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Signature pad widget allows Stored XSS.CVE-2026-118575 · Websites & servers · Drupal · reported by mlhess@drupal.org
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Signature pad widget allows Stored XSS. This issue affects Signature pad widget versions: from 0.0.0 to 1.15.0.
- Product
- Signature pad widget
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026Incorrect Permission Assignment for Critical Resource vulnerability in Drupal S3 File System allows Exploiting Incorrectly Configured Access Control Security LeCVE-2026-118574 · Websites & servers · Drupal · reported by mlhess@drupal.org
Incorrect Permission Assignment for Critical Resource vulnerability in Drupal S3 File System allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects S3 File System versions: from 0.0.0 to 3.12.0.
- Product
- S3 File System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026Missing Authorization vulnerability in Drupal OAuth2 Token Manager allows Forceful Browsing.CVE-2026-118573 · Websites & servers · Drupal · reported by mlhess@drupal.org
Missing Authorization vulnerability in Drupal OAuth2 Token Manager allows Forceful Browsing. This issue affects OAuth2 Token Manager versions: from 0.0.0 to 1.2.0.
- Product
- OAuth2 Token Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal OAuth Login - OAuth OIDC SSO allows Authentication Bypass.CVE-2026-118572 · Websites & servers · Drupal · reported by mlhess@drupal.org
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal OAuth Login - OAuth OIDC SSO allows Authentication Bypass. This issue affects OAuth Login - OAuth OIDC SSO versions: from 0.0.0 to 3.1.1.
- Product
- OAuth Login - OAuth OIDC SSO
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Media Alias Display allows Exploiting Incorrectly Configured Access Control SeCVE-2026-118571 · Websites & servers · Drupal · reported by mlhess@drupal.org
Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Media Alias Display allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Media Alias Display versions: from 0.0.0 to 2.1.3, from 3.0.0 to 3.0.3.
- Product
- Media Alias Display
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026Cross-Site Request Forgery (CSRF) vulnerability in Drupal Fasttoggle allows Cross Site Request Forgery.CVE-2026-118570 · Websites & servers · Drupal · reported by mlhess@drupal.org
Cross-Site Request Forgery (CSRF) vulnerability in Drupal Fasttoggle allows Cross Site Request Forgery. This issue affects Fasttoggle versions: from 0.0.0 to 4.1.1.
- Product
- Fasttoggle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026Incorrect Authorization vulnerability in Drupal Fasttoggle allows Forceful Browsing.CVE-2026-118569 · Websites & servers · Drupal · reported by mlhess@drupal.org
Incorrect Authorization vulnerability in Drupal Fasttoggle allows Forceful Browsing. This issue affects Fasttoggle versions: from 0.0.0 to 4.1.1.
- Product
- Fasttoggle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026Insecure Storage of Sensitive Information vulnerability in Drupal Content Sync (content-sync.io) allows Retrieve Embedded Sensitive Data.CVE-2026-118568 · Websites & servers · Drupal · reported by mlhess@drupal.org
Insecure Storage of Sensitive Information vulnerability in Drupal Content Sync (content-sync.io) allows Retrieve Embedded Sensitive Data. This issue affects Content Sync (content-sync.io) versions: from 0.0.0 to 3.2.2.
- Product
- Content Sync (content-sync.io)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026Incorrect Authorization vulnerability in Drupal Bulk Update User Roles allows Forceful Browsing.CVE-2026-118567 · Websites & servers · Drupal · reported by mlhess@drupal.org
Incorrect Authorization vulnerability in Drupal Bulk Update User Roles allows Forceful Browsing. This issue affects Bulk Update User Roles versions: from 0.0.0 to 1.0.5.
- Product
- Bulk Update User Roles
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026Vulnerability in Drupal GroupEx PRO ( Daxko ) integration.CVE-2026-118565 · Websites & servers · Drupal · reported by mlhess@drupal.org
Vulnerability in Drupal GroupEx PRO ( Daxko ) integration. This issue affects GroupEx PRO ( Daxko ) integration versions: *.*.
- Product
- GroupEx PRO ( Daxko ) integration
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026Vulnerability in Drupal PayUmoney for Drupal Commerce.CVE-2026-118564 · Websites & servers · Drupal · reported by mlhess@drupal.org
Vulnerability in Drupal PayUmoney for Drupal Commerce. This issue affects PayUmoney for Drupal Commerce versions: *.*.
- Product
- PayUmoney for Drupal Commerce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026Vulnerability in Drupal CacheFlush.CVE-2026-118563 · Websites & servers · Drupal · reported by mlhess@drupal.org
Vulnerability in Drupal CacheFlush. This issue affects CacheFlush versions: *.*.
- Product
- CacheFlush
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026Deserialization of Untrusted Data vulnerability in Drupal Single Content Sync allows Object Injection.CVE-2026-118562 · Websites & servers · Drupal · reported by mlhess@drupal.org
Deserialization of Untrusted Data vulnerability in Drupal Single Content Sync allows Object Injection. This issue affects Single Content Sync versions: from 0.0.0 to 1.4.19.
- Product
- Single Content Sync
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026External Control of File Name or Path vulnerability in Drupal Single Content Sync allows Path Traversal.CVE-2026-118561 · Websites & servers · Drupal · reported by mlhess@drupal.org
External Control of File Name or Path vulnerability in Drupal Single Content Sync allows Path Traversal. This issue affects Single Content Sync versions: from 0.0.0 to 1.4.19.
- Product
- Single Content Sync
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Commerce Stripe allows Cross-Site Scripting (XSS).CVE-2026-118560 · Websites & servers · Drupal · reported by mlhess@drupal.org
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Commerce Stripe allows Cross-Site Scripting (XSS). This issue affects Commerce Stripe versions: from 2.0.0 to 2.2.3.
- Product
- Commerce Stripe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026Improper Verification of Cryptographic Signature vulnerability in Drupal Commerce Stripe allows Signature Spoof.CVE-2026-118559 · Websites & servers · Drupal · reported by mlhess@drupal.org
Improper Verification of Cryptographic Signature vulnerability in Drupal Commerce Stripe allows Signature Spoof. This issue affects Commerce Stripe versions: from 0.0.0 to 1.4, from 2.0.0 to 2.2.3.
- Product
- Commerce Stripe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026Cross-Site Request Forgery (CSRF) vulnerability in Drupal Commerce Stripe allows Cross Site Request Forgery.CVE-2026-118558 · Websites & servers · Drupal · reported by mlhess@drupal.org
Cross-Site Request Forgery (CSRF) vulnerability in Drupal Commerce Stripe allows Cross Site Request Forgery. This issue affects Commerce Stripe versions: from 2.0.0 to 2.2.3.
- Product
- Commerce Stripe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026Incorrect Authorization vulnerability in Drupal Commerce Shipping allows Forceful Browsing.CVE-2026-118557 · Websites & servers · Drupal · reported by mlhess@drupal.org
Incorrect Authorization vulnerability in Drupal Commerce Shipping allows Forceful Browsing. This issue affects Commerce Shipping versions: from 0.0.0 to 2.16.0, from 3.0.0 to 3.0.6.
- Product
- Commerce Shipping
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026Incorrect Authorization vulnerability in Drupal Commerce Shipping allows Forceful Browsing.CVE-2026-118556 · Websites & servers · Drupal · reported by mlhess@drupal.org
Incorrect Authorization vulnerability in Drupal Commerce Shipping allows Forceful Browsing. This issue affects Commerce Shipping versions: from 0.0.0 to 2.16.0, from 3.0.0 to 3.0.6.
- Product
- Commerce Shipping
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026Incorrect Authorization vulnerability in Drupal Commerce License allows Forceful Browsing.CVE-2026-118555 · Websites & servers · Drupal · reported by mlhess@drupal.org
Incorrect Authorization vulnerability in Drupal Commerce License allows Forceful Browsing. This issue affects Commerce License versions: from 0.0.0 to 3.1.1.
- Product
- Commerce License
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal OpenID Connect Client allows Authentication Bypass.CVE-2026-118554 · Websites & servers · Drupal · reported by mlhess@drupal.org
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal OpenID Connect Client allows Authentication Bypass. This issue affects OpenID Connect Client versions: from 0.0.0 to 2.3.1.
- Product
- OpenID Connect Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2026Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Stored XSS.CVE-2026-118553 · Websites & servers · Drupal · reported by mlhess@drupal.org
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Stored XSS. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2.
- Product
- AI (Artificial Intelligence)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.