Total
4661 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-107263 | 2026-10-30 | N/A | 5.4 MEDIUM | ||
| Incorrect Authorization vulnerability in Drupal Gutenberg allows Forceful Browsing. This issue affects Gutenberg versions: from 0.0.0 to 2.15.0, from 3.0.0 to 3.0.7. | |||||
| CVE-2026-107258 | 2026-10-30 | N/A | 5.4 MEDIUM | ||
| Incorrect Authorization vulnerability in Drupal Inline Entity Form Dialog allows Forceful Browsing. This issue affects Inline Entity Form Dialog versions: from 0.0.0 to 1.0.6. | |||||
| CVE-2026-107257 | 2026-10-30 | N/A | 6.5 MEDIUM | ||
| Incorrect Authorization vulnerability in Drupal Actstream allows Forceful Browsing. This issue affects Actstream versions: from 0.0.0 to 2.0.1, from 2.1.0 to 2.1.1. | |||||
| CVE-2026-107251 | 2026-10-30 | N/A | 6.5 MEDIUM | ||
| Incorrect Authorization vulnerability in Drupal Entity Reference Manager (Merge entities) allows Forceful Browsing. This issue affects Entity Reference Manager (Merge entities) versions: from 0.0.0 to 1.0.3. | |||||
| CVE-2026-107049 | 2026-10-30 | N/A | 7.5 HIGH | ||
| An issue in Forkyz versionCode 8500000 allows attackers to arbitrarily change another user's storage settings via supplying a crafted URI string. | |||||
| CVE-2026-46499 | 2026-10-30 | N/A | 4.3 MEDIUM | ||
| Collabora Online is a collaborative online office suite based on LibreOffice technology. Prior to 24.04.18 and 25.04.11, several document operations delegated to `LibreOfficeKit` in the per-document kit process fail to enforce a session's read-only state. A read-only user, such as a viewer-role WOPI user, can send crafted `WebSocket` messages to execute document-mutating `UNO` commands and dialog operations despite the read-only interface. The changes can mislead co-viewers within the live session, or an authorized editor sharing the session can unknowingly save the modifications. The read-only attacker cannot save the document directly, and changes are discarded when the kit session ends unless an authorized editor saves them. This issue is fixed in versions 24.04.18 and 25.04.11. | |||||
| CVE-2026-50000 | 2026-10-30 | N/A | 5.0 MEDIUM | ||
| SecureDrop is an open-source whistleblower submission system that media organizations can use to securely accept documents from, and communicate with anonymous sources. From 2.5.0 until 2.16.0, the `Journalist Interface` can accept an `API session` token against the `web UI` because its `SessionInterface` keeps a mutable session key prefix that changes with each request and persists across requests. API and web sessions were separated in `Redis` starting in version 2.5.0, but prefix corruption confuses those session namespaces. An attacker who already has access to the secret `Journalist Interface` onion address, the required authentication access and a recent nonexpired `API session` token can reuse that token against the `web UI` until its natural expiry, at most eight hours. The corrupted prefix can also prevent logout from deleting the correct `Redis` session, although normal expiry still applies. A compromised journalist can access encrypted submissions and perform broad actions on source submissions, but this issue does not expose plaintext submissions or affect the running system's availability. This issue is fixed in version 2.16.0. | |||||
| CVE-2026-102260 | 2026-10-30 | N/A | 4.3 MEDIUM | ||
| HashiCorp Nomad and Nomad Enterprise are vulnerable to cross-namespace authorization bypasses in several read-only API endpoints that may allow an authenticated user with read permissions in one namespace to view information about objects in other namespaces. This vulnerability (CVE-2026-102260) is fixed in Nomad Community Edition 2.1.1 and Nomad Enterprise 2.1.0, 1.11.12, and 1.10.18. | |||||
| CVE-2026-118540 | 2026-10-30 | N/A | N/A | ||
| Incorrect Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41, from 3.0.0 to 3.2.0. | |||||
| CVE-2026-118583 | 2026-10-30 | N/A | N/A | ||
| Incorrect Authorization vulnerability in Drupal Field Permissions allows Forceful Browsing. This issue affects Field Permissions versions: from 0.0.0 to 1.6.0. | |||||
| CVE-2026-118541 | 2026-10-30 | N/A | N/A | ||
| Incorrect Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13. | |||||
| CVE-2026-114530 | 2026-10-30 | N/A | N/A | ||
| Incorrect Authorization vulnerability in Drupal Dopup allows Forceful Browsing. This issue affects Dopup versions: from 0.0.0 to 1.0.7. | |||||
| CVE-2026-118584 | 2026-10-30 | N/A | N/A | ||
| Incorrect Authorization vulnerability in Drupal Field Permissions allows Forceful Browsing. This issue affects Field Permissions versions: from 0.0.0 to 1.6.0. | |||||
| CVE-2026-114540 | 2026-10-30 | N/A | N/A | ||
| Incorrect Authorization vulnerability in Drupal Domain allows Forceful Browsing. This issue affects Domain versions: from 3.0.0 to 3.0.2. | |||||
| CVE-2026-107255 | 2026-10-30 | N/A | N/A | ||
| Incorrect Authorization vulnerability in Drupal Restrict route by IP allows Forceful Browsing. This issue affects Restrict route by IP versions: from 0.0.0 to 1.3.1, from 2.0.0 to 2.0.1. | |||||
| CVE-2026-118569 | 2026-10-30 | N/A | N/A | ||
| Incorrect Authorization vulnerability in Drupal Fasttoggle allows Forceful Browsing. This issue affects Fasttoggle versions: from 0.0.0 to 4.1.1. | |||||
| CVE-2026-118548 | 2026-10-30 | N/A | N/A | ||
| Incorrect Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Resource Injection. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2. | |||||
| CVE-2026-114571 | 2026-10-30 | N/A | N/A | ||
| Incorrect Authorization vulnerability in Drupal Rabbit Hole allows Forceful Browsing. This issue affects Rabbit Hole versions: from 0.0.0 to 1.3.0. | |||||
| CVE-2026-114554 | 2026-10-30 | N/A | N/A | ||
| Incorrect Authorization vulnerability in Drupal AI File to Text allows Forceful Browsing. This issue affects AI File to Text versions: from 0.0.0 to 1.0.1. | |||||
| CVE-2026-118555 | 2026-10-30 | N/A | N/A | ||
| Incorrect Authorization vulnerability in Drupal Commerce License allows Forceful Browsing. This issue affects Commerce License versions: from 0.0.0 to 3.1.1. | |||||