Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-107268 | medium | 4.3 | No | Insertion of Sensitive Information Into Sent Data vulnerability in Drupal Two Factor Authentication - TFA / Passwordless Login allows Forcef... | 2026-10-30 |
| CVE-2026-107267 | medium | 5.3 | No | Missing Authorization vulnerability in Drupal DKAN allows Forceful Browsing. This issue affects DKAN versions: from 0.0.0 to 4.0.4, from 4.1... | 2026-10-30 |
| CVE-2026-107265 | medium | 5.4 | No | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Leaflet allows Stored XSS. This... | 2026-10-30 |
| CVE-2026-107264 | medium | 5.4 | No | Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Inline Formatter Field allows Code Injection.... | 2026-10-30 |
| CVE-2026-107263 | medium | 5.4 | No | Incorrect Authorization vulnerability in Drupal Gutenberg allows Forceful Browsing. This issue affects Gutenberg versions: from 0.0.0 to 2.1... | 2026-10-30 |
| CVE-2026-107261 | medium | 4.2 | No | Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Authenticator Login Plus (2FA) allows Authentication Bypass... | 2026-10-30 |
| CVE-2026-107259 | medium | 5.4 | No | Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Linked Field allows Code Injection. This issue... | 2026-10-30 |
| CVE-2026-107258 | medium | 5.4 | No | Incorrect Authorization vulnerability in Drupal Inline Entity Form Dialog allows Forceful Browsing. This issue affects Inline Entity Form Di... | 2026-10-30 |
| CVE-2026-107257 | medium | 6.5 | No | Incorrect Authorization vulnerability in Drupal Actstream allows Forceful Browsing. This issue affects Actstream versions: from 0.0.0 to 2.0... | 2026-10-30 |
| CVE-2026-107254 | medium | 4.8 | No | Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Authenticator Login Plus (2FA) allows Authentication Bypass... | 2026-10-30 |
| CVE-2026-107253 | medium | 5.9 | No | Vulnerability in Drupal Orphans Media. This issue affects Orphans Media versions: *.*. | 2026-10-30 |
| CVE-2026-107252 | medium | 5.4 | No | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal MathJax: LaTeX for Drupal allow... | 2026-10-30 |
| CVE-2026-107251 | medium | 6.5 | No | Incorrect Authorization vulnerability in Drupal Entity Reference Manager (Merge entities) allows Forceful Browsing. This issue affects Entit... | 2026-10-30 |
| CVE-2026-107250 | medium | 5.9 | No | Vulnerability in Drupal ECA Helper. This issue affects ECA Helper versions: *.*. | 2026-10-30 |
| CVE-2026-107249 | critical | 9.8 | No | Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Block AJAX allows Object Injection. T... | 2026-10-30 |
| CVE-2026-106763 | high | 7.5 | No | An issue in @justice8096/sagemath-mcp-server 1.0.1 allows a remote attacker to execute arbitrary code via the escapeShellString and sanitize... | 2026-10-30 |
| CVE-2026-103299 | medium | 5.3 | No | The Payment Gateway WordPress plugin through 2.2.0 does not ensure a shared secret is configured before using it to authenticate the bank's... | 2026-10-30 |
| CVE-2026-100517 | high | 7.5 | No | Authorization Bypass Through User-Controlled Key vulnerability in VillaTheme Photo Reviews for WooCommerce woo-photo-reviews allows Exploiti... | 2026-10-30 |
| CVE-2026-61806 | not reported | — | No | Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to version 2.54.2, unpublished... | 2026-10-30 |
| CVE-2026-61803 | not reported | — | No | Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to version 2.52.1, the `course/... | 2026-10-30 |