Search

Expected end of text, found ':' (at char 26), (line:1, col:27)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (417679 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-107307 1 Drupal 1 Smartlinker Ai 2026-10-30 4.3 Medium
Incorrect Authorization vulnerability in Drupal SmartLinker AI allows Forceful Browsing. This issue affects SmartLinker AI versions: from 0.0.0 to 1.0.3.
CVE-2026-107267 1 Drupal 1 Dkan 2026-10-30 5.3 Medium
Missing Authorization vulnerability in Drupal DKAN allows Forceful Browsing. This issue affects DKAN versions: from 0.0.0 to 4.0.4, from 4.1.0 to 4.1.5.
CVE-2026-107268 1 Drupal 1 Two Factor Authentication - Tfa / Passwordless Login 2026-10-30 4.3 Medium
Insertion of Sensitive Information Into Sent Data vulnerability in Drupal Two Factor Authentication - TFA / Passwordless Login allows Forceful Browsing. This issue affects Two Factor Authentication - TFA / Passwordless Login versions: from 0.0.0 to 5.4.1, from 5.5.0 to 5.5.2.
CVE-2026-96389 1 Drupal 1 Xray Audit 2026-10-30 6.5 Medium
Missing Authorization vulnerability in Drupal Xray Audit allows Forceful Browsing. This issue affects Xray Audit versions: from 0.0.0 to 1.6.3, from 2.0.0 to 2.0.4, from 3.0.0 to 3.1.1.
CVE-2026-107266 1 Drupal 1 Views Share 2026-10-30 N/A
Missing Authorization vulnerability in Drupal Views Share allows Forceful Browsing. This issue affects Views Share versions: from 0.0.0 to 2.0.1.
CVE-2026-107265 1 Drupal 1 Leaflet 2026-10-30 5.4 Medium
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Leaflet allows Stored XSS. This issue affects Leaflet versions: from 0.0.0 to 10.4.13.
CVE-2026-107264 1 Drupal 1 Inline Formatter Field 2026-10-30 5.4 Medium
Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Inline Formatter Field allows Code Injection. This issue affects Inline Formatter Field versions: from 0.0.0 to 4.2.0.
CVE-2026-107263 1 Drupal 1 Gutenberg 2026-10-30 5.4 Medium
Incorrect Authorization vulnerability in Drupal Gutenberg allows Forceful Browsing. This issue affects Gutenberg versions: from 0.0.0 to 2.15.0, from 3.0.0 to 3.0.7.
CVE-2026-107261 1 Drupal 1 Authenticator Login Plus (2fa) 2026-10-30 4.2 Medium
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Authenticator Login Plus (2FA) allows Authentication Bypass. This issue affects Authenticator Login Plus (2FA) versions: from 0.0.0 to 1.0.1.
CVE-2026-107259 1 Drupal 1 Linked Field 2026-10-30 5.4 Medium
Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Linked Field allows Code Injection. This issue affects Linked Field versions: from 0.0.0 to 1.8.0.
CVE-2026-107258 1 Drupal 1 Inline Entity Form Dialog 2026-10-30 5.4 Medium
Incorrect Authorization vulnerability in Drupal Inline Entity Form Dialog allows Forceful Browsing. This issue affects Inline Entity Form Dialog versions: from 0.0.0 to 1.0.6.
CVE-2026-107257 1 Drupal 1 Actstream 2026-10-30 6.5 Medium
Incorrect Authorization vulnerability in Drupal Actstream allows Forceful Browsing. This issue affects Actstream versions: from 0.0.0 to 2.0.1, from 2.1.0 to 2.1.1.
CVE-2026-107254 1 Drupal 1 Authenticator Login Plus (2fa) 2026-10-30 4.8 Medium
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Authenticator Login Plus (2FA) allows Authentication Bypass. This issue affects Authenticator Login Plus (2FA) versions: from 0.0.0 to 1.0.1.
CVE-2026-107253 1 Drupal 1 Orphans Media 2026-10-30 5.9 Medium
Vulnerability in Drupal Orphans Media. This issue affects Orphans Media versions: *.*.
CVE-2026-107252 1 Drupal 1 Mathjax: Latex For Drupal 2026-10-30 5.4 Medium
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal MathJax: LaTeX for Drupal allows Cross-Site Scripting (XSS). This issue affects MathJax: LaTeX for Drupal versions: from 0.0.0 to 4.1.2.
CVE-2026-107251 1 Drupal 1 Entity Reference Manager (merge Entities) 2026-10-30 6.5 Medium
Incorrect Authorization vulnerability in Drupal Entity Reference Manager (Merge entities) allows Forceful Browsing. This issue affects Entity Reference Manager (Merge entities) versions: from 0.0.0 to 1.0.3.
CVE-2026-107250 1 Drupal 1 Eca Helper 2026-10-30 5.9 Medium
Vulnerability in Drupal ECA Helper. This issue affects ECA Helper versions: *.*.
CVE-2026-107249 1 Drupal 1 Block Ajax 2026-10-30 9.8 Critical
Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Block AJAX allows Object Injection. This issue affects Block AJAX versions: from 0.0.0 to 3.0.2.
CVE-2026-103039 2 Gravityforms, Wordpress-extensions 2 Gravity Forms, Gravity Forms 2026-10-30 9.8 Critical
The Gravity Forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.1.2 via a Post Custom Field whose input type is List. This is due to GFFormsModel::create_post() passing the submitted value to WordPress' unrestricted global maybe_unserialize() rather than the plugin's own hardened GFCommon::maybe_unserialize(), which was added in 3.1.1 and passes allowed_classes => false precisely to prevent object instantiation. Where the field has a content template enabled, the submitted row reaches that call verbatim. This makes it possible for unauthenticated attackers to inject a PHP object into post meta. No PHP Object Injection gadget chain is present in the plugin itself; however, if a gadget chain is present via an additional plugin or theme, it could allow the attacker to perform actions such as remote code execution. Where the custom field is mapped to the protected _wp_page_template meta key, WordPress itself supplies the chain: validate_file() accepts non-scalars, WP_Theme::__toString() then resolves an attacker-controlled path, and on hosts with a readable PEAR install and register_argc_argv enabled this yields remote code execution.
CVE-2026-85268 1 Google Cloud 1 Identity Platform And Firebase Authentication 2026-10-30 N/A
A Cross-Site Scripting (XSS) (CWE-79) vulnerability in the auth/handler in Google Cloud Identity Platform and Firebase Authentication versions prior to 2026-08-14 on iOS allows an unauthenticated remote attacker to execute arbitrary JavaScript using a malicious iOS bundle ID.