Search vulnerabilities

Expected end of text, found ':' (at char 6), (line:1, col:7)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,467

CVE-2026-107308

Country - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-211

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Country allows Cross-Site Scripting (XSS). This issue affects Country versions: from 0.0.0 to 2.1.3, from 2.2.0 to 2.2.1.

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Country
CVE-2026-107306

Menu Link Attributes - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-209

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Menu Link Attributes allows Stored XSS. This issue affects Menu Link Attributes versions: from 0.0.0 to 1.8.0.

CVSS 3.1 · 3.8 Low EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Menu Link Attributes
CVE-2026-3322

Privilege escalation via request replaying in Lobster_pro

Due to improper permission checks in Lobster_pro, attackers are able to interact with endpoints that should require administrative privileges. This issue affects Lobster_pro version 4.12.12-LTS and potentially other versions prior to 25.1.3.

CVSS 4.0 · 5.6 Medium EPSS < 1% KEV · Not listed
Vendors
Lobster Gmbh
Products
Lobster Pro
CVE-2026-112345

TTLock Android App < 9.8.260718 Hardcoded BLE Pairing Key Exposure

TTLock Android application before v9.8.260718 and associated smart-lock firmware contain a hardcoded static AES key vulnerability that allows an attacker within Bluetooth range to decrypt the per-pairing session key transmitted during BLE pairing. Attackers can observe the pairing exchange, recover the persistent session key using the embedded defaultKey, and forge authenticated BLE requests to unlock the device, add fingerprints or access codes, and perform administrative actions without authentication or user interaction.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Sciener Ttlock
Products
Ttlock App Ttlock
CVE-2026-62047

WordPress Event Tickets plugin <= 5.30.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through 5.30.2.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Liquid Web / Stellarwp Wordpress-extensions
Products
Event Tickets Event Tickets
CVE-2026-114572

Domain Login Restrict - Moderately critical - Access bypass - SA-CONTRIB-2026-249

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Domain Login Restrict allows Authentication Bypass. This issue affects Domain Login Restrict versions: from 0.0.0 to 1.5.0.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Domain Login Restrict
CVE-2026-107311

Permissions by Term - Moderately critical - Information disclosure - SA-CONTRIB-2026-214

Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal Permissions by Term allows Forceful Browsing. This issue affects Permissions by Term versions: from 0.0.0 to 3.1.41.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Permissions By Term
CVE-2026-107310

Freelinking - Moderately critical - Information Disclosure - SA-CONTRIB-2026-213

Server-Side Request Forgery (SSRF) vulnerability in Drupal Freelinking allows Server Side Request Forgery. This issue affects Freelinking versions: from 0.0.0 to 4.0.3.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Freelinking
CVE-2026-107309

Easy Breadcrumb - Moderately critical - Information disclosure - SA-CONTRIB-2026-212

Missing Authorization vulnerability in Drupal Easy Breadcrumb allows Forceful Browsing. This issue affects Easy Breadcrumb versions: from 0.0.0 to 2.0.11.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Easy Breadcrumb
CVE-2026-107307

SmartLinker AI - Moderately critical - Information disclosure - SA-CONTRIB-2026-210

Incorrect Authorization vulnerability in Drupal SmartLinker AI allows Forceful Browsing. This issue affects SmartLinker AI versions: from 0.0.0 to 1.0.3.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Smartlinker Ai
CVE-2026-107267

DKAN - Moderately critical - Access bypass - SA-CONTRIB-2026-208

Missing Authorization vulnerability in Drupal DKAN allows Forceful Browsing. This issue affects DKAN versions: from 0.0.0 to 4.0.4, from 4.1.0 to 4.1.5.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Dkan
CVE-2026-107268

Two Factor Authentication - TFA / Passwordless Login - Moderately critical - Information disclosure - SA-CONTRIB-2026-207

Insertion of Sensitive Information Into Sent Data vulnerability in Drupal Two Factor Authentication - TFA / Passwordless Login allows Forceful Browsing. This issue affects Two Factor Authentication - TFA / Passwordless Login versions: from 0.0.0 to 5.4.1, from 5.5.0 to 5.5.2.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Two Factor Authentication - Tfa / Passwordless Login
CVE-2026-96389

Xray Audit - Moderately critical - Access bypass - SA-CONTRIB-2026-206

Missing Authorization vulnerability in Drupal Xray Audit allows Forceful Browsing. This issue affects Xray Audit versions: from 0.0.0 to 1.6.3, from 2.0.0 to 2.0.4, from 3.0.0 to 3.1.1.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Xray Audit
CVE-2026-107265

Leaflet - Moderately critical - Cross site scripting - SA-CONTRIB-2026-204

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Leaflet allows Stored XSS. This issue affects Leaflet versions: from 0.0.0 to 10.4.13.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Leaflet
CVE-2026-107264

Inline Formatter Field - Moderately critical - Server-side template injection - SA-CONTRIB-2026-203

Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Inline Formatter Field allows Code Injection. This issue affects Inline Formatter Field versions: from 0.0.0 to 4.2.0.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Inline Formatter Field
CVE-2026-107263

Gutenberg - Moderately critical - Access bypass - SA-CONTRIB-2026-202

Incorrect Authorization vulnerability in Drupal Gutenberg allows Forceful Browsing. This issue affects Gutenberg versions: from 0.0.0 to 2.15.0, from 3.0.0 to 3.0.7.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Gutenberg
CVE-2026-107261

Authenticator Login Plus (2FA) - Moderately critical - Improper authentication - SA-CONTRIB-2026-201

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Authenticator Login Plus (2FA) allows Authentication Bypass. This issue affects Authenticator Login Plus (2FA) versions: from 0.0.0 to 1.0.1.

CVSS 3.1 · 4.2 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Authenticator Login Plus (2fa)
CVE-2026-107259

Linked Field - Moderately critical - Server-side template injection - SA-CONTRIB-2026-200

Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Linked Field allows Code Injection. This issue affects Linked Field versions: from 0.0.0 to 1.8.0.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Linked Field
CVE-2026-107258

Inline Entity Form Dialog - Moderately critical - Access bypass - SA-CONTRIB-2026-199

Incorrect Authorization vulnerability in Drupal Inline Entity Form Dialog allows Forceful Browsing. This issue affects Inline Entity Form Dialog versions: from 0.0.0 to 1.0.6.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Inline Entity Form Dialog
CVE-2026-107257

Actstream - Critical - Access bypass - SA-CONTRIB-2026-198

Incorrect Authorization vulnerability in Drupal Actstream allows Forceful Browsing. This issue affects Actstream versions: from 0.0.0 to 2.0.1, from 2.1.0 to 2.1.1.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal
Products
Actstream