Search vulnerabilities

Expected end of text, found ':' (at char 25), (line:1, col:26)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,758

CVE-2026-101405

Unauthenticated Access to Marketing Data in Oracle Siebel Apps

Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Marketing). Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Siebel Apps - Marketing. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Siebel Apps - Marketing accessible data as well as unauthorized read access to a subset of Siebel Apps - Marketing accessible data. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Oracle
Products
Siebel Apps - Marketing Siebel Crm
CVE-2025-4945

Libsoup: integer overflow in cookie expiration date handling in libsoup

A flaw was found in the cookie parsing logic of the libsoup HTTP library, used in GNOME applications and other software. The vulnerability arises when processing the expiration date of cookies, where a specially crafted value can trigger an integer overflow. This may result in undefined behavior, allowing an attacker to bypass cookie expiration logic, causing persistent or unintended cookie behavior. The issue stems from improper validation of large integer inputs during date arithmetic operations within the cookie parsing routines.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Rhel Aus Rhel E4s and 4 more
CVE-2026-118584

Field Permissions - Moderately critical - Access bypass - SA-CONTRIB-2026-289

Incorrect Authorization vulnerability in Drupal Field Permissions allows Forceful Browsing. This issue affects Field Permissions versions: from 0.0.0 to 1.6.0.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Field Permissions
CVE-2026-118582

CAPTCHA - Moderately critical - Session Replay (CAPTCHA bypass) - SA-CONTRIB-2026-281

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal CAPTCHA allows Functionality Bypass. This issue affects CAPTCHA versions: from 0.0.0 to 1.18.0, from 2.0.0 to 2.0.11.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Captcha
CVE-2026-118564

PayUmoney for Drupal Commerce - Critical - Unsupported - SA-CONTRIB-2026-277

Vulnerability in Drupal PayUmoney for Drupal Commerce. This issue affects PayUmoney for Drupal Commerce versions: *.*.

CVSS 3.1 · 6.6 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Payumoney For Drupal Commerce
CVE-2026-118562

Single Content Sync - Critical - Remote code execution - SA-CONTRIB-2026-275

Deserialization of Untrusted Data vulnerability in Drupal Single Content Sync allows Object Injection. This issue affects Single Content Sync versions: from 0.0.0 to 1.4.19.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Single Content Sync
CVE-2026-118561

Single Content Sync - Critical - External control of file name or path - SA-CONTRIB-2026-274

External Control of File Name or Path vulnerability in Drupal Single Content Sync allows Path Traversal. This issue affects Single Content Sync versions: from 0.0.0 to 1.4.19.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Single Content Sync
CVE-2026-118568

Content Sync (content-sync.io) - Moderately critical - Information disclosure - SA-CONTRIB-2026-291

Insecure Storage of Sensitive Information vulnerability in Drupal Content Sync (content-sync.io) allows Retrieve Embedded Sensitive Data. This issue affects Content Sync (content-sync.io) versions: from 0.0.0 to 3.2.2.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Content Sync (content-sync.io)
CVE-2026-118573

OAuth2 Token Manager - Critical - Access bypass - SA-CONTRIB-2026-290

Missing Authorization vulnerability in Drupal OAuth2 Token Manager allows Forceful Browsing. This issue affects OAuth2 Token Manager versions: from 0.0.0 to 1.2.0.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Oauth2 Token Manager
CVE-2026-118583

Field Permissions - Moderately critical - Access bypass - SA-CONTRIB-2026-288

Incorrect Authorization vulnerability in Drupal Field Permissions allows Forceful Browsing. This issue affects Field Permissions versions: from 0.0.0 to 1.6.0.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Field Permissions
CVE-2026-118576

Stage File Proxy - Critical - Cross-site scripting - SA-CONTRIB-2026-286

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Stage File Proxy allows Cross-Site Scripting (XSS). This issue affects Stage File Proxy versions: from 0.0.0 to 3.1.7, from 4.0.0 to 4.0.1.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Stage File Proxy
CVE-2026-118574

S3 File System - Moderately critical - Access bypass - SA-CONTRIB-2026-279

Incorrect Permission Assignment for Critical Resource vulnerability in Drupal S3 File System allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects S3 File System versions: from 0.0.0 to 3.12.0.

CVSS 3.1 · 5.6 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
S3 File System
CVE-2026-118570

Fasttoggle - Moderately critical - Cross-Site Request Forgery - SA-CONTRIB-2026-283

Cross-Site Request Forgery (CSRF) vulnerability in Drupal Fasttoggle allows Cross Site Request Forgery. This issue affects Fasttoggle versions: from 0.0.0 to 4.1.1.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Fasttoggle
CVE-2026-118569

Fasttoggle - Moderately critical - Access bypass - SA-CONTRIB-2026-282

Incorrect Authorization vulnerability in Drupal Fasttoggle allows Forceful Browsing. This issue affects Fasttoggle versions: from 0.0.0 to 4.1.1.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Fasttoggle
CVE-2026-118550

AI (Artificial Intelligence) - Moderately critical - Access bypass - SA-CONTRIB-2026-270

Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal AI (Artificial Intelligence) allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Artificial Intelligence
CVE-2026-118559

Commerce Stripe - Moderately critical - Improper verification of cryptographic signature - SA-CONTRIB-2026-264

Improper Verification of Cryptographic Signature vulnerability in Drupal Commerce Stripe allows Signature Spoof. This issue affects Commerce Stripe versions: from 0.0.0 to 1.4, from 2.0.0 to 2.2.3.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Commerce Stripe
CVE-2026-118544

Commerce Core - Moderately critical - Information disclosure - SA-CONTRIB-2026-259

Exposure of Sensitive Information Through Data Queries vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Commerce Core
CVE-2026-118541

Commerce Core - Less critical - Access bypass - SA-CONTRIB-2026-256

Incorrect Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Commerce Core
CVE-2026-118540

Commerce Core - Moderately critical - Information disclosure - SA-CONTRIB-2026-255

Incorrect Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41, from 3.0.0 to 3.2.0.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Commerce Core
CVE-2026-114571

Rabbit Hole - Moderately critical - Access Bypass - SA-CONTRIB-2026-252

Incorrect Authorization vulnerability in Drupal Rabbit Hole allows Forceful Browsing. This issue affects Rabbit Hole versions: from 0.0.0 to 1.3.0.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Rabbit Hole