CVE-2026-93579

Io.netty/netty-codec-http2: netty: http/2 header field values are not validated by default (cr/lf/nul passthrough)

A flaw was found in Netty's HTTP/2 stack. This vulnerability allows a remote attacker to inject prohibited characters, such as NUL, Line Feed, and Carriage Return, into HTTP/2 header field values due to insufficient validation. When these values cross an HTTP/2 to HTTP/1.1 translation boundary, they can be exploited for request smuggling, header injection, or response splitting. This could lead to unauthorized access, data manipulation, or other security bypasses.

CVSS 3.1 · 6.5 Medium EPSS 1.1% KEV · Not listed

Vendors

Io.netty Redhat

Products

Netty-codec-http2 Amq Broker Apicurio Registry and 20 more

CVE-2026-18217

Keycloak-services: keycloak-services: saml http-redirect binding response preserves query string leading to parameter pollution

A flaw was found in the SAML protocol implementation of Keycloak, an open-source identity and access management solution. The issue occurs when Keycloak handles SAML authentication requests using the HTTP-Redirect binding. If a client is configured with a wildcard redirect URL, an attacker can craft a request that includes malicious parameters. When a user authenticates, Keycloak appends its legitimate response to the attacker's parameters. This can cause some service providers to process the attacker's data instead of the real login information, potentially leading to a user being logged into the wrong account.

CVSS 3.1 · 3.4 Low EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Build Keycloak Build Of Keycloak Data Grid and 5 more

CVE-2026-93492

Io.netty/netty-codec-http2: netty: http/2 hpackencoder dos with large table size

A flaw was found in Netty's HTTP/2 HpackEncoder. A remote attacker can exploit this by sending HTTP/2 SETTINGS frames with a very large MAX_HEADER_TABLE_SIZE. This causes the HpackEncoder to store an excessive number of unique headers, leading to increased CPU usage and memory consumption, ultimately resulting in a Denial of Service (DoS).

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Io.netty Redhat

Products

Netty-codec-http2 Amq Broker Amq Broker 7 and 21 more

CVE-2026-28597

UriGrantsManagerService Permission Bypass Leading to Local Privilege Escalation

In writeGrantedUriPermissions of UriGrantsManagerService.java, there is a possible permission bypass due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Google

Products

Android

CVE-2026-114553

Frontend Editing - Less critical - Access bypass - SA-CONTRIB-2026-241

Incorrect Authorization vulnerability in Drupal Frontend Editing allows Forceful Browsing. This issue affects Frontend Editing versions: from 0.0.0 to 1.9.3.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Frontend Editing

CVE-2026-107260

Sector Distribution - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-229

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Sector Distribution allows Stored XSS. This issue affects Sector Distribution versions: from 0.0.0 to 10.3.3, from 10.4.0 to 10.4.2.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Sector Distribution

CVE-2026-114531

Swiper formatter - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-228

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Swiper formatter allows Stored XSS. This issue affects Swiper formatter versions: from 0.0.0 to 2.1.2, from 3.0.1 to 3.1.0.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Swiper Formatter

CVE-2026-114530

Dopup - Critical - Information disclosure - SA-CONTRIB-2026-227

Incorrect Authorization vulnerability in Drupal Dopup allows Forceful Browsing. This issue affects Dopup versions: from 0.0.0 to 1.0.7.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Dopup

CVE-2026-114529

CSV Field - Moderately critical - Cross site Scripting - SA-CONTRIB-2026-226

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal CSV Field allows Stored XSS. This issue affects CSV Field versions: from 0.0.0 to 2.0.10, from 3.0.0 to 3.0.7.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Csv Field

CVE-2026-114524

Custom Formatters - Critical - Remote code execution - SA-CONTRIB-2026-225

Privilege Defined With Unsafe Actions vulnerability in Drupal Custom Formatters allows Privilege Escalation. This issue affects Custom Formatters versions: from 0.0.0 to 4.2.1.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Custom Formatters

CVE-2026-114525

ABC - Critical - Cross-site scripting - SA-CONTRIB-2026-224

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal ABC allows Stored XSS. This issue affects ABC versions: from 0.0.0 to 1.25.0, from 2.0.0 to 2.0.1.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Abc

CVE-2026-114526

Black Hole - Critical - Cross-site scripting - SA-CONTRIB-2026-223

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Black Hole allows Stored XSS. This issue affects Black Hole versions: from 0.0.0 to 1.26.0, from 2.0.0 to 2.0.1.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Black Hole

CVE-2026-114528

Zero Point - Critical - Cross-site scripting - SA-CONTRIB-2026-222

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Zero Point allows Stored XSS. This issue affects Zero Point versions: from 0.0.0 to 1.30.0, from 2.0.0 to 2.0.1.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Zero Point

CVE-2026-114527

UI Icons - Critical - Cross site scripting - SA-CONTRIB-2026-221

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal UI Icons allows Cross-Site Scripting (XSS). This issue affects UI Icons versions: from 0.0.0 to 1.1.3, from 2.0.0 to 2.0.2.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Ui Icons

CVE-2026-114523

Ffmpeg Image Toolkit - Highly critical - Remote Code Execution - SA-CONTRIB-2026-220

Improper Neutralization of Special Elements used in an OS Command ("OS Command Injection") vulnerability in Drupal Ffmpeg Image Toolkit allows OS Command Injection. This issue affects Ffmpeg Image Toolkit versions: from 0.0.0 to 1.0.3.

CVSS 3.1 · 9.8 Critical EPSS 1.0% KEV · Not listed

Vendors

Drupal

Products

Ffmpeg Image Toolkit

CVE-2026-108099

Entity List - Critical - Remote code execution - SA-CONTRIB-2026-218

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Drupal Entity List allows Reflection Injection. This issue affects Entity List versions: from 0.0.0 to 3.0.10.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Entity List

CVE-2026-108514

Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-016

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Drupal core versions: from 10.3.0 to 10.6.19, from 11.0.0 to 11.3.19, from 11.4.0 to 11.4.10, from 12.0.0-alpha1 to 12.0.0-beta2.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Drupal Core

CVE-2026-108515

Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-015

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Drupal core versions: from 8.9.0 to 10.6.19, from 11.0.0 to 11.3.19, from 11.4.0 to 11.4.10, from 12.0.0-alpha1 to 12.0.0-beta2.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Drupal Core

CVE-2026-108097

Drupal core - Critical - Remote code execution - SA-CORE-2026-014

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Drupal Drupal core allows Reflection Injection. This issue affects Drupal core versions: from 8.9.0 to 10.6.19, from 11.0.0 to 11.3.19, from 11.4.0 to 11.4.10, from 12.0.0-alpha1 to 12.0.0-beta2.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Drupal Core

CVE-2026-107255

Restrict route by IP - Critical - Access bypass - SA-CONTRIB-2026-216

Incorrect Authorization vulnerability in Drupal Restrict route by IP allows Forceful Browsing. This issue affects Restrict route by IP versions: from 0.0.0 to 1.3.1, from 2.0.0 to 2.0.1.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Restrict Route By Ip