CVE-2026-87940

Key auth - Moderately critical - Access bypass - SA-CONTRIB-2026-138

Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Key auth allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Key auth versions: from 0.0.0 to 2.2.4.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Key Auth

CVE-2026-87939

Feed Block - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-137

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Feed Block allows Stored XSS. This issue affects Feed Block versions: from 0.0.0 to 2.0.2, from 3.0.0 to 3.0.2.

CVSS 3.1 · 4.2 Medium EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Feed Block

CVE-2026-87937

Central Authentication System (CAS) Server - Moderately critical - Open redirect - SA-CONTRIB-2026-135

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal Central Authentication System (CAS) Server allows Fake the Source of Data. This issue affects Central Authentication System (CAS) Server versions: from 0.0.0 to 2.0.4, from 2.1.0 to 2.1.3.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Central Authentication System (cas) Server

CVE-2026-87936

amazee.ai Private AI Provider - Critical - SQL injection - SA-CONTRIB-2026-134

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal amazee.ai Private AI Provider allows SQL Injection. This issue affects amazee.ai Private AI Provider versions: from 0.0.0 to 1.3.7, from 1.4.0 to 1.4.3.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Amazee.ai Private Ai Provider

CVE-2026-84921

Webform Submissions Delete - Moderately critical - Access bypass - SA-CONTRIB-2026-133

Missing Authorization vulnerability in Drupal Webform Submissions Delete allows Forceful Browsing. This issue affects Webform Submissions Delete versions: from 0.0.0 to 1.2.0.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Webform Submissions Delete

CVE-2026-84919

PhotoSwipe - Responsive JavaScript Modal Image Gallery - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-131

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery allows Stored XSS. This issue affects PhotoSwipe - Responsive JavaScript Modal Image Gallery versions: from 0.0.0 to 5.0.9.

CVSS 3.1 · 4.6 Medium EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Photoswipe - Responsive Javascript Modal Image Gallery

CVE-2026-84918

Monobank payment API - Moderately critical - Access bypass - SA-CONTRIB-2026-130

Improper Verification of Cryptographic Signature vulnerability in Drupal Monobank payment API allows Signature Spoof. This issue affects Monobank payment API versions: from 0.0.0 to 1.0.3.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Monobank Payment Api

CVE-2026-84917

Jsonapi Role Access - Critical - Access bypass - SA-CONTRIB-2026-127

Incorrect Authorization vulnerability in Drupal Jsonapi Role Access allows Forceful Browsing. This issue affects Jsonapi Role Access versions: from 0.0.0 to 2.0.2.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Jsonapi Role Access

CVE-2026-84916

Islandora - Moderately critical - Access bypass - SA-CONTRIB-2026-126

Missing Authorization vulnerability in Drupal Islandora allows Forceful Browsing. This issue affects Islandora versions: from 0.0.0 to 2.19.0.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Islandora

CVE-2026-81163

Media Library Importer - Moderately critical - Access bypass - SA-CONTRIB-2026-129

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Drupal Media Library Importer allows Path Traversal. This issue affects Media Library Importer versions: from 0.0.0 to 2.1.6.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Media Library Importer

CVE-2026-16648

Mailer Plus Log - Moderately critical - Access bypass - SA-CONTRIB-2026-128

Insertion of Sensitive Information into Log File vulnerability in Drupal Mailer Plus Log allows Remote Services with Stolen Credentials. This issue affects Mailer Plus Log versions: from 0.0.0 to 1.2.7.

CVSS 3.1 · 3.8 Low EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Mailer Plus Log

CVE-2026-114082

Trigger.dev before 4.6.2 Overly Broad Realtime Session Stream Credentials

Trigger.dev before 4.6.2 contains an authorization vulnerability that allows public-token holders with session write access to obtain environment-wide S2 stream credentials via session input initialization. Attackers can use the credential directly against the storage API to append, create, or trim other session and run streams, forging output or permanently deleting records.

CVSS 4.0 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Triggerdotdev

Products

Trigger.dev

CVE-2026-114077

Trigger.dev before 4.5.6 Cross-Tenant Deployment Hijack via createDeploymentBackgroundWorkerV4

Trigger.dev before 4.5.6 contains an authorization bypass vulnerability in createDeploymentBackgroundWorkerV4 that resolves a WorkerDeployment by friendlyId alone, without environment, project, or organization scoping. Attackers holding only their own environment API key can POST to the deployment background-workers endpoint with a victim's deployment ID to re-point that in-progress deployment at a worker in the attacker's environment.

CVSS 4.0 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Triggerdotdev

Products

Trigger.dev

CVE-2026-114072

Trigger.dev before 4.5.12 CSRF via Slack OAuth Callback State

The Trigger.dev webapp before 4.5.12 contains a cross-site request forgery vulnerability in its organization-level Slack OAuth flow, which uses the organization ID as the OAuth state without binding it to the initiating session. Attackers who know a target organization ID can trick an authenticated member into opening an unredeemed /integrations/slack/callback URL, connecting an attacker-controlled Slack workspace that may receive the organization's operational alerts.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Triggerdotdev

Products

Trigger.dev

CVE-2026-114067

Trigger.dev 4.5.0 before 4.6.2 Improper Authorization via snapshot-url Session Route

Trigger.dev 4.5.0 before 4.6.2 contains an improper authorization vulnerability in the PUT snapshot-url session endpoint that allows public session token holders to obtain presigned S3 write URLs. End users can overwrite their own session's durable chat snapshot to forge the agent's conversation history, since the route lacks a secret-key-only check.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Triggerdotdev

Products

Trigger.dev

CVE-2026-114062

SvelteKit before 3.0.0 SSRF via Redirects in Server-Side Self-Fetch Fallbacks

SvelteKit before 3.0.0 contains a server-side request forgery vulnerability that allows remote attackers to reach internal services because self-fetch fallbacks follow HTTP redirects automatically. Attackers can manipulate the Host or forwarded headers to point fallback requests at their server, which redirects them to internal services.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Svelte

Products

Kit

CVE-2026-63829

net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink

In the Linux kernel, the following vulnerability has been resolved: net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink A tunnel changelink() operates on at most two netns, dev_net(dev) and the tunnel link netns t->net. They differ once the device is created in or moved to a netns other than the one the request runs in. The rtnl changelink path checks CAP_NET_ADMIN only against dev_net(dev), so a caller privileged there but not in t->net can rewrite a tunnel that lives in t->net. Add rtnl_dev_link_net_capable() next to rtnl_get_net_ns_capable() in net/core/rtnetlink.c. It requires CAP_NET_ADMIN in the link netns and is skipped when the link netns is dev_net(dev), where the rtnl path already checked it. The other patches in this series use the same helper. Gate ipgre_changelink() and erspan_changelink() with it, at the top of the op before any attribute is parsed, because the parsers update live tunnel fields first. ipgre_netlink_parms() sets t->collect_md before ip_tunnel_changelink() runs. Commit 8b484efd5cb4 ("ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate().") added the same check on the ioctl path. This adds it on RTM_NEWLINK.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Linux

Products

Linux Kernel

CVE-2026-101830

Unauthorized Access via Low‑Privileged HTTP Exploit in Oracle Project Contracts

Vulnerability in the Oracle Project Contracts product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Project Contracts. While the vulnerability is in Oracle Project Contracts, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Project Contracts accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed

Vendors

Oracle

Products

Project Contracts

CVE-2026-101828

Unauthorized Data Disclosure via HTTP in Oracle Mobile Application Server

Vulnerability in the Oracle Mobile Application Server product of Oracle E-Business Suite (component: MWA Terminal Server). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Mobile Application Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Mobile Application Server accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Oracle

Products

Mobile Application Server

CVE-2026-101821

Oracle Compensation Workbench Unauthorized Data Access Vulnerability

Vulnerability in the Oracle Compensation Workbench product of Oracle E-Business Suite (component: Total Compensation Statement). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Compensation Workbench. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Compensation Workbench, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Compensation Workbench accessible data as well as unauthorized read access to a subset of Oracle Compensation Workbench accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Oracle

Products

Compensation Workbench