CVE-2026-16641 Commerce Elavon - Critical - Unsupported - SA-CONTRIB-2026-084

Vulnerability in Drupal Commerce Elavon. This issue affects Commerce Elavon versions:...

CVE-2026-16641 Commerce Elavon - Critical - Unsupported - SA-CONTRIB-2026-084

Vulnerability in Drupal Commerce Elavon. This issue affects Commerce Elavon versions:...

CVE-2026-16641

A security issue exists in Drupal Commerce Elavon (affected versions . ). The project has been marked as unsupported by the security team because a known security flaw remains unaddressed by the maintainer. While Rapid7 identifies the issue as Improper Input Validation , there is currently no inf...

CVE-2026-16642

The Drupal Email Login OTP project is affected by CVE-2026-16642 , which involves improper input validation . This project has been marked as unsupported by the security team because a known security issue remains unfixed by the maintainer. No newer version containing a fix is currently available...

CVE-2026-16643 Lunr exposed filters - Critical - Unsupported - SA-CONTRIB-2026-086

Vulnerability in Drupal Lunr exposed filters. This issue affects Lunr exposed filters versions:...

CVE-2026-16643

A vulnerability exists in Drupal Lunr exposed filters (all versions) due to improper input validation within the exposed filters component. The security team has marked this project as unsupported because a known security issue remains unfixed by the maintainer. There is currently no information ...

CVE-2026-16645 PhotoSwipe - Responsive JavaScript Modal Image Gallery - Moderately critical - Access bypass - SA-CONTRIB-2026-088

Missing Authorization vulnerability in Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery allows Forceful Browsing. This issue affects PhotoSwipe - Responsive JavaScript Modal Image Gallery versions: from 0.0.0 to 3.2.0...

CVE-2026-15088 Development Environment - Critical - Unsupported - SA-CONTRIB-2026-089

Vulnerability in Drupal Development Environment. This issue affects Development Environment versions:...

CVE-2026-18259 Token Content Access - Moderately critical - Access bypass - SA-CONTRIB-2026-090

Observable Timing Discrepancy vulnerability in Drupal Token Content Access allows Brute Force. This issue affects Token Content Access versions: from 0.0.0 to 3.1.2...

CVE-2026-18260 Disable Login Page - Moderately critical - Access bypass - SA-CONTRIB-2026-110

Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Disable Login Page allows Brute Force. This issue affects Disable Login Page versions: from 0.0.0 to 1.1.4...

CVE-2026-18260

The Drupal Disable Login Page module (versions 0.0.0 to 1.1.4 ) is vulnerable to a brute-force attack due to an improper restriction of excessive authentication attempts . The module allows users to disable access to the /user/login form unless a secret key is provided, but it fails to sufficient...

CVE-2026-18260 Disable Login Page - Moderately critical - Access bypass - SA-CONTRIB-2026-110

Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Disable Login Page allows Brute Force. This issue affects Disable Login Page versions: from 0.0.0 to 1.1.4...

CVE-2026-18261

The Drupal Powerful Surveys module is affected by a vulnerability identified as CVE-2026-18261 . The project has been marked as unsupported by the security team due to a known security issue that has not been addressed by the maintainer. While Rapid7 identifies the root cause as Improper Input Va...

CVE-2026-18261 Powerful Surveys - Critical - Unsupported - SA-CONTRIB-2026-092

Vulnerability in Drupal Powerful Surveys. This issue affects Powerful Surveys versions:...

CVE-2026-78619

Punk::Plugin::TOTP versions before 0.05 for Perl accept another account's recovery code at the two-factor challenge because totpuserecovery compares user identifiers numerically. The helper searches the recovery model for the submitted code's digest alone, across every user's rows, so the ownersh...

CVE-2026-78619

The Punk::Plugin::TOTP Perl module (versions prior to 0.05 ) contains a vulnerability where it incorrectly validates two-factor authentication recovery codes. The root cause lies in the totp_use_recovery function, which searches for a code's digest across all users and then performs an ownership ...

CVE-2026-79066

Improper input validation in Navigation in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. Chromium security severity: Medium...

nginx: NGINX: Heap buffer over-read allows memory modification or denial of service

A vulnerability in NGINX's ngxhttpssimodule allows an unauthenticated MITM attacker to trigger a heap buffer over-read by manipulating upstream server responses. This requires SSI, proxypass, and proxybuffering off to be configured, and can result in memory modification or a Denial of Service DoS...

CVE-2026-55553

creationtimestamp| type| source ---|---|--- 2026-08-25 18:35:14+00:00| published-proof-of-concept| https://github.com/node-modules/urllib/security/advisories/GHSA-hq3h-g68c-hp78...

CVE-2026-55620 eml_parser: DoS via deeply nested parens in Received headers

emlparser serves as a python module for parsing eml files and returning various information found in the e-mail as well as computed information. Prior to 3.0.2, emlparser.routing.noparenthesis in emlparser/routing.py removes parenthesized CFWS comments from Received: headers with a regex-based...