Email Verification / SMS Verification / OTP Verification - Critical - Access Bypass - SA-CONTRIB-2026-124

This module enables you to add extra layer of verification for user registration. The module doesn't sufficiently validate user-supplied input resulting in an account takeover vulnerability...

Email Verification / SMS Verification / OTP Verification - Critical - Cross Site Scripting - SA-CONTRIB-2026-125

This module enables you to add an extra layer of verification for user registration. The module doesn't sufficiently filter user-supplied input before output, resulting in an unauthenticated reflected Cross-site Scripting XSS vulnerability...

Media Library Importer - Moderately critical - Access bypass - SA-CONTRIB-2026-129

A module to import media files into media library. The import folder is a plain textfield with no validation. Point it at any directory the web user can read, and the importer copies every file whose extension matches a selected media type into the public files directory and publishes it as a Med...

CVE-2026-81201: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Monster Menus allows Stored XSS. This issue affects Monster Menus versions: from 0.0.0 to 9.5.3...

CVE-2026-84325: Improper Input Validation

Improper input validation in DataTransfer in Google Chrome prior to 152.0.7977.75 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a co-installed app. Chromium security severity: High...

Downloads Component DoS

The vulnerability of the Downloads component in Google Chrome and Microsoft Edge is related to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor to cause service failures...

Hikvision CSMP iSecure Center Arbitrary Command Execution

The vulnerability of the integrated security management platform Hikvision CSMP iSecure Center lies in the lack of measures to neutralize specific elements. Exploiting this vulnerability allows a malicious actor, operating remotely, to execute arbitrary commands in JSON data...

-based Blurams Lumi Security Camera A31C Code Execution

The vulnerability of the web interface of the Microprogramming Software-based Blurams Lumi Security Camera A31C relates to the lack of measures taken to clean data at the control level. Exploiting this vulnerability can allow a intruder to execute arbitrary code...

Navigation Component Google Chrome Microsoft Edge Confidential Data Access

The vulnerability of the Navigation component in Google Chrome and Microsoft Edge is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to gain access to confidential data through a specially created HTML page...

D-Link DNS-345 Network Storage Software Command Execution

The vulnerability in the cgi/backupmgr/iscsimgr.cgi script of the D-Link DNS-345 and DNS-340L network storage software is related to the lack of measures taken at the management level to clean up data. Exploiting this vulnerability allows an attacker to execute arbitrary commands remotely and gai...

Libde265 Heap Buffer Overflow DoS

The vulnerability of the de265imagegetbuffer function in the h.265 Libde265 implementation is related to insufficient cleaning of input data. Exploiting this vulnerability can allow an attacker to cause service failures remotely...

TOTOLINK A7000R Router Code Execution

The vulnerability of the setUploadUserData function in the /cgi-bin/cstecgi.cgi file of the TOTOLINK A7000R router’s microprogramming system exists due to the lack of measures to neutralize special elements. Exploiting this vulnerability can allow a remote attacker to execute arbitrary code...

amdgpu_userq_input_args_validate Heap Buffer Overflow DoS

The vulnerability of the amdgpuuserqinputargsvalidate function in the drivers/gpu/drm/amd/amdgpu/amdgpuuserq.c source code of the Direct Rendering Infrastructure DRI driver for AMD GPU cores in the Linux operating system is related to incorrect input validation. Exploiting this vulnerability can...

Input component in Google DoS

The vulnerability of the Input component in Google Chrome and Microsoft Edge relates to the use of memory after it is freed. Exploiting this vulnerability could allow an attacker to cause a service failure through a specially created HTML page...

Password Component Access Confidential Data

The vulnerability of the Password component in Google Chrome and Microsoft Edge relates to insufficient validation of entered data. Exploiting this vulnerability can allow an attacker to gain access to confidential data through a specially created HTML page...

Chromecast web browsers DoS

The vulnerability of Google Chrome and Microsoft Edge web browsers relates to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to cause a service failure through a specially crafted HTML page...

Input component in Google

The vulnerability of the Input component in Google Chrome and Microsoft Edge relates to the disclosure of information. Exploiting this vulnerability can allow a malicious actor to gain access to confidential data through a specially created HTML page...

AI assistant Gemini DoS

The vulnerability of the AI assistant Gemini previously known as GLIC Gemini Live in Chrome in Google Chrome and Microsoft Edge is related to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor to cause service interruptions through a specially created...

Chromecast web browsers Google Chrome Microsoft Edge Data Compromise

The vulnerability of Google Chrome and Microsoft Edge web browsers relates to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to compromise data integrity through a specially crafted HTML page...

DeviceBoundSessionCredentials Component Compromise Data Compromise

The vulnerability of the DeviceBoundSessionCredentials component in Google Chrome and Microsoft Edge is related to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor to compromise data integrity through a specially crafted HTML page...