Export limit exceeded: 417674 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 417674 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (417674 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-62991 | 1 Shopperlabs | 1 Shopper | 2026-10-30 | 6.5 Medium |
| Shopper is a Headless e-commerce Admin Panel. Prior to 2.10.1, the customer detail route `/cpanel/customers/{user}/show` in `packages/admin/src/Livewire/Pages/Customers/Show.php` checks `read_customers` but looks up an arbitrary user ID without applying the `customers` role scope used by the listing. Authenticated staff holding `access_dashboard` and `read_customers` can change the user ID to retrieve administrator or staff profiles despite lacking `view_users`, which protects the separate team-management interface. The flaw exposes account profile data and permits user-ID enumeration through differing success, denial, and not-found responses. If the same role also holds `delete_customers`, `anonymizeAction()` operates on the unrestricted loaded user model and can enable destructive follow-up against non-customer accounts. This issue is fixed in version 2.10.1. | ||||
| CVE-2026-118573 | 1 Drupal | 1 Oauth2 Token Manager | 2026-10-30 | N/A |
| Missing Authorization vulnerability in Drupal OAuth2 Token Manager allows Forceful Browsing. This issue affects OAuth2 Token Manager versions: from 0.0.0 to 1.2.0. | ||||
| CVE-2026-118584 | 1 Drupal | 1 Field Permissions | 2026-10-30 | N/A |
| Incorrect Authorization vulnerability in Drupal Field Permissions allows Forceful Browsing. This issue affects Field Permissions versions: from 0.0.0 to 1.6.0. | ||||
| CVE-2026-118583 | 1 Drupal | 1 Field Permissions | 2026-10-30 | N/A |
| Incorrect Authorization vulnerability in Drupal Field Permissions allows Forceful Browsing. This issue affects Field Permissions versions: from 0.0.0 to 1.6.0. | ||||
| CVE-2026-118554 | 1 Drupal | 1 Openid Connect Client | 2026-10-30 | N/A |
| Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal OpenID Connect Client allows Authentication Bypass. This issue affects OpenID Connect Client versions: from 0.0.0 to 2.3.1. | ||||
| CVE-2026-118576 | 1 Drupal | 1 Stage File Proxy | 2026-10-30 | N/A |
| Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Stage File Proxy allows Cross-Site Scripting (XSS). This issue affects Stage File Proxy versions: from 0.0.0 to 3.1.7, from 4.0.0 to 4.0.1. | ||||
| CVE-2026-118575 | 1 Drupal | 1 Signature Pad Widget | 2026-10-30 | N/A |
| Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Signature pad widget allows Stored XSS. This issue affects Signature pad widget versions: from 0.0.0 to 1.15.0. | ||||
| CVE-2026-118572 | 1 Drupal | 1 Oauth Login - Oauth Oidc Sso | 2026-10-30 | N/A |
| Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal OAuth Login - OAuth OIDC SSO allows Authentication Bypass. This issue affects OAuth Login - OAuth OIDC SSO versions: from 0.0.0 to 3.1.1. | ||||
| CVE-2026-118567 | 1 Drupal | 1 Bulk Update User Roles | 2026-10-30 | N/A |
| Incorrect Authorization vulnerability in Drupal Bulk Update User Roles allows Forceful Browsing. This issue affects Bulk Update User Roles versions: from 0.0.0 to 1.0.5. | ||||
| CVE-2026-118574 | 1 Drupal | 1 S3 File System | 2026-10-30 | N/A |
| Incorrect Permission Assignment for Critical Resource vulnerability in Drupal S3 File System allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects S3 File System versions: from 0.0.0 to 3.12.0. | ||||
| CVE-2026-118570 | 1 Drupal | 1 Fasttoggle | 2026-10-30 | N/A |
| Cross-Site Request Forgery (CSRF) vulnerability in Drupal Fasttoggle allows Cross Site Request Forgery. This issue affects Fasttoggle versions: from 0.0.0 to 4.1.1. | ||||
| CVE-2026-118569 | 1 Drupal | 1 Fasttoggle | 2026-10-30 | N/A |
| Incorrect Authorization vulnerability in Drupal Fasttoggle allows Forceful Browsing. This issue affects Fasttoggle versions: from 0.0.0 to 4.1.1. | ||||
| CVE-2026-118565 | 1 Drupal | 1 Groupex Pro ( Daxko ) Integration | 2026-10-30 | N/A |
| Vulnerability in Drupal GroupEx PRO ( Daxko ) integration. This issue affects GroupEx PRO ( Daxko ) integration versions: *.*. | ||||
| CVE-2026-118564 | 1 Drupal | 1 Payumoney For Drupal Commerce | 2026-10-30 | N/A |
| Vulnerability in Drupal PayUmoney for Drupal Commerce. This issue affects PayUmoney for Drupal Commerce versions: *.*. | ||||
| CVE-2026-118563 | 1 Drupal | 1 Cacheflush | 2026-10-30 | N/A |
| Vulnerability in Drupal CacheFlush. This issue affects CacheFlush versions: *.*. | ||||
| CVE-2026-118562 | 1 Drupal | 1 Single Content Sync | 2026-10-30 | N/A |
| Deserialization of Untrusted Data vulnerability in Drupal Single Content Sync allows Object Injection. This issue affects Single Content Sync versions: from 0.0.0 to 1.4.19. | ||||
| CVE-2026-118561 | 1 Drupal | 1 Single Content Sync | 2026-10-30 | N/A |
| External Control of File Name or Path vulnerability in Drupal Single Content Sync allows Path Traversal. This issue affects Single Content Sync versions: from 0.0.0 to 1.4.19. | ||||
| CVE-2026-118560 | 1 Drupal | 1 Commerce Stripe | 2026-10-30 | N/A |
| Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Commerce Stripe allows Cross-Site Scripting (XSS). This issue affects Commerce Stripe versions: from 2.0.0 to 2.2.3. | ||||
| CVE-2026-118559 | 1 Drupal | 1 Commerce Stripe | 2026-10-30 | N/A |
| Improper Verification of Cryptographic Signature vulnerability in Drupal Commerce Stripe allows Signature Spoof. This issue affects Commerce Stripe versions: from 0.0.0 to 1.4, from 2.0.0 to 2.2.3. | ||||
| CVE-2026-118558 | 1 Drupal | 1 Commerce Stripe | 2026-10-30 | N/A |
| Cross-Site Request Forgery (CSRF) vulnerability in Drupal Commerce Stripe allows Cross Site Request Forgery. This issue affects Commerce Stripe versions: from 2.0.0 to 2.2.3. | ||||