Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-87937 | medium | 6.5 | No | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal Central Authentication System (CAS) Server allows Fake the Sourc... | 2026-10-22 |
| CVE-2026-87936 | medium | 6.5 | No | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal amazee.ai Private AI Provider a... | 2026-10-22 |
| CVE-2026-84924 | medium | 5.4 | No | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Email Verification / SMS Verifi... | 2026-10-22 |
| CVE-2026-84923 | medium | 6.5 | No | Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Email Verification / SMS Verification / OTP Verification al... | 2026-10-22 |
| CVE-2026-84921 | medium | 5.3 | No | Missing Authorization vulnerability in Drupal Webform Submissions Delete allows Forceful Browsing. This issue affects Webform Submissions De... | 2026-10-22 |
| CVE-2026-84919 | medium | 4.6 | No | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal PhotoSwipe - Responsive JavaScr... | 2026-10-22 |
| CVE-2026-84918 | low | 3.7 | No | Improper Verification of Cryptographic Signature vulnerability in Drupal Monobank payment API allows Signature Spoof. This issue affects Mon... | 2026-10-22 |
| CVE-2026-84917 | medium | 6.5 | No | Incorrect Authorization vulnerability in Drupal Jsonapi Role Access allows Forceful Browsing. This issue affects Jsonapi Role Access version... | 2026-10-22 |
| CVE-2026-84916 | low | 3.7 | No | Missing Authorization vulnerability in Drupal Islandora allows Forceful Browsing. This issue affects Islandora versions: from 0.0.0 to 2.19.... | 2026-10-22 |
| CVE-2026-84915 | medium | 4.6 | No | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Component blocks allows Stored... | 2026-10-22 |
| CVE-2026-84914 | medium | 5.3 | No | Missing Authorization vulnerability in Drupal Calculate Working Days allows Forceful Browsing. This issue affects Calculate Working Days ver... | 2026-10-22 |
| CVE-2026-81163 | medium | 5.4 | No | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Drupal Media Library Importer allows Path Tr... | 2026-10-22 |
| CVE-2026-16648 | low | 3.8 | No | Insertion of Sensitive Information into Log File vulnerability in Drupal Mailer Plus Log allows Remote Services with Stolen Credentials. Thi... | 2026-10-22 |
| CVE-2026-114082 | high | 8.1 | No | Trigger.dev before 4.6.2 contains an authorization vulnerability that allows public-token holders with session write access to obtain enviro... | 2026-10-22 |
| CVE-2026-114077 | high | 7.1 | No | Trigger.dev before 4.5.6 contains an authorization bypass vulnerability in createDeploymentBackgroundWorkerV4 that resolves a WorkerDeployme... | 2026-10-22 |
| CVE-2026-114072 | medium | 4.3 | No | The Trigger.dev webapp before 4.5.12 contains a cross-site request forgery vulnerability in its organization-level Slack OAuth flow, which u... | 2026-10-22 |
| CVE-2026-114067 | medium | 6.5 | No | Trigger.dev 4.5.0 before 4.6.2 contains an improper authorization vulnerability in the PUT snapshot-url session endpoint that allows public... | 2026-10-22 |
| CVE-2026-114062 | medium | 5.3 | No | SvelteKit before 3.0.0 contains a server-side request forgery vulnerability that allows remote attackers to reach internal services because... | 2026-10-22 |
| CVE-2026-101830 | high | 7.7 | No | Vulnerability in the Oracle Project Contracts product of Oracle E-Business Suite (component: Internal Operations). Supported versions that a... | 2026-10-22 |
| CVE-2026-101828 | medium | 6.5 | No | Vulnerability in the Oracle Mobile Application Server product of Oracle E-Business Suite (component: MWA Terminal Server). Supported version... | 2026-10-22 |