Total
418179 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-107264 | 2026-10-30 | N/A | 5.4 MEDIUM | ||
| Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Inline Formatter Field allows Code Injection. This issue affects Inline Formatter Field versions: from 0.0.0 to 4.2.0. | |||||
| CVE-2026-107263 | 2026-10-30 | N/A | 5.4 MEDIUM | ||
| Incorrect Authorization vulnerability in Drupal Gutenberg allows Forceful Browsing. This issue affects Gutenberg versions: from 0.0.0 to 2.15.0, from 3.0.0 to 3.0.7. | |||||
| CVE-2026-107261 | 2026-10-30 | N/A | 4.2 MEDIUM | ||
| Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Authenticator Login Plus (2FA) allows Authentication Bypass. This issue affects Authenticator Login Plus (2FA) versions: from 0.0.0 to 1.0.1. | |||||
| CVE-2026-107259 | 2026-10-30 | N/A | 5.4 MEDIUM | ||
| Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Linked Field allows Code Injection. This issue affects Linked Field versions: from 0.0.0 to 1.8.0. | |||||
| CVE-2026-107258 | 2026-10-30 | N/A | 5.4 MEDIUM | ||
| Incorrect Authorization vulnerability in Drupal Inline Entity Form Dialog allows Forceful Browsing. This issue affects Inline Entity Form Dialog versions: from 0.0.0 to 1.0.6. | |||||
| CVE-2026-107257 | 2026-10-30 | N/A | 6.5 MEDIUM | ||
| Incorrect Authorization vulnerability in Drupal Actstream allows Forceful Browsing. This issue affects Actstream versions: from 0.0.0 to 2.0.1, from 2.1.0 to 2.1.1. | |||||
| CVE-2026-107254 | 2026-10-30 | N/A | 4.8 MEDIUM | ||
| Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Authenticator Login Plus (2FA) allows Authentication Bypass. This issue affects Authenticator Login Plus (2FA) versions: from 0.0.0 to 1.0.1. | |||||
| CVE-2026-107253 | 2026-10-30 | N/A | 5.9 MEDIUM | ||
| Vulnerability in Drupal Orphans Media. This issue affects Orphans Media versions: *.*. | |||||
| CVE-2026-107252 | 2026-10-30 | N/A | 5.4 MEDIUM | ||
| Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal MathJax: LaTeX for Drupal allows Cross-Site Scripting (XSS). This issue affects MathJax: LaTeX for Drupal versions: from 0.0.0 to 4.1.2. | |||||
| CVE-2026-107251 | 2026-10-30 | N/A | 6.5 MEDIUM | ||
| Incorrect Authorization vulnerability in Drupal Entity Reference Manager (Merge entities) allows Forceful Browsing. This issue affects Entity Reference Manager (Merge entities) versions: from 0.0.0 to 1.0.3. | |||||
| CVE-2026-107250 | 2026-10-30 | N/A | 5.9 MEDIUM | ||
| Vulnerability in Drupal ECA Helper. This issue affects ECA Helper versions: *.*. | |||||
| CVE-2026-107249 | 2026-10-30 | N/A | 9.8 CRITICAL | ||
| Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Block AJAX allows Object Injection. This issue affects Block AJAX versions: from 0.0.0 to 3.0.2. | |||||
| CVE-2026-106763 | 2026-10-30 | N/A | 7.5 HIGH | ||
| An issue in @justice8096/sagemath-mcp-server 1.0.1 allows a remote attacker to execute arbitrary code via the escapeShellString and sanitizeCode functions. | |||||
| CVE-2026-103299 | 2026-10-30 | N/A | 5.3 MEDIUM | ||
| The Payment Gateway WordPress plugin through 2.2.0 does not ensure a shared secret is configured before using it to authenticate the bank's payment-notification callback, allowing unauthenticated attackers to forge a valid notification and mark any WooCommerce order as paid on installs where the secret has not been set, and the same callback lets them move any pending order to a failed state whether or not the secret is configured. | |||||
| CVE-2026-100517 | 2026-10-30 | N/A | 7.5 HIGH | ||
| Authorization Bypass Through User-Controlled Key vulnerability in VillaTheme Photo Reviews for WooCommerce woo-photo-reviews allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Photo Reviews for WooCommerce: from n/a through 1.2.30. | |||||
| CVE-2026-51905 | 2026-10-30 | N/A | 8.8 HIGH | ||
| TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in get_agent_execution_configuration in superagi/controllers/agent_execution_config.py. A remote authenticated attacker from one organization can read another organization's agent execution configuration by supplying the victim agent_id and agent_execution_id to /agent_executions_configs/details/agent_id/{agent_id}/agent_execution_id/{agent_execution_id}. The endpoint lacks an organization ownership check on the selected agent and execution. | |||||
| CVE-2026-117182 | 2026-10-30 | N/A | N/A | ||
| An authenticated cross-site scripting (XSS) vulnerability in the /spina/embeddable.rb component of Spina CMS v2.21.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted URL. | |||||
| CVE-2026-61626 | 2026-10-30 | N/A | N/A | ||
| libass is a portable subtitle renderer for the ASS/SSA (Advanced Substation Alpha/Substation Alpha) subtitle format. From 0.17.4 until 0.17.5, libass event pruning does not guard negative Matroska `ReadOrder` values, allowing an attacker to clear arbitrarily many bits to zero at attacker-controlled positions near the NULL pointer. Exploitation requires a malicious Matroska stream loaded through `ass_process_chunk`, enabled read-order checking, and later pruning of the malicious events. Read-order checking is enabled by default unless `ass_set_check_readorder` is called with zero; pruning must occur explicitly through `ass_prune_events` or through automatic pruning previously enabled with `ass_configure_prune`. On common systems with arithmetic right shift, 32-bit int values, the upper address region reserved to the kernel, and matching binary/kernel architecture, the expected consequence is denial of service. More extensive exploitation on uncommon systems is theoretical and strongly constrained by the target addresses, bit-clearing-only mutation, and ASLR. This issue is fixed in version 0.17.5. | |||||
| CVE-2026-74915 | 2026-10-30 | N/A | N/A | ||
| A web page that contains unusual WebGPU content loaded into the GPU GLES render process can trigger a OOB read and/or write crash in the GPU GLES user-space shared library. On certain platforms, when the process executing graphics workload has system privileges this could enable further exploits on the device. | |||||
| CVE-2026-11587 | 2026-10-30 | N/A | 7.2 HIGH | ||
| SQL injection allowing an authenticated user with access to ACL management to read and modify the Centreon database | |||||