CVE-2026-96391 Webform REST - Less critical - Access bypass - SA-CONTRIB-2026-186

Missing Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. This issue affects Webform REST versions: from 0.0.0 to 4.2.1...

CVE-2026-96391 Webform REST - Less critical - Access bypass - SA-CONTRIB-2026-186

Missing Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. This issue affects Webform REST versions: from 0.0.0 to 4.2.1...

CVE-2026-96391

The Drupal Webform REST module (versions 0.0.0 to 4.2.1 ) is vulnerable to an access bypass due to missing authorization checks. The root cause is the module's failure to sufficiently verify permissions when retrieving webform elements or fields , as well as webform submission entities . This fla...

CVE-2026-96377 Combined image style - Moderately critical - Improper access control - SA-CONTRIB-2026-188

Allocation of Resources Without Limits or Throttling vulnerability in Drupal Combined image style allows Excessive Allocation. This issue affects Combined image style versions: from 0.0.0 to 1.0.7...

CVE-2026-96377 Combined image style - Moderately critical - Improper access control - SA-CONTRIB-2026-188

Allocation of Resources Without Limits or Throttling vulnerability in Drupal Combined image style allows Excessive Allocation. This issue affects Combined image style versions: from 0.0.0 to 1.0.7...

CVE-2026-96377

The Combined image style Drupal module (versions 0.0.0 to 1.0.7 ) contains an Allocation of Resources Without Limits or Throttling vulnerability (CWE-770). The root cause is insufficient validation of image style names during the generation of image derivatives, which allows anonymous users to ge...

CVE-2026-96377 Combined image style - Moderately critical - Improper access control - SA-CONTRIB-2026-188

Allocation of Resources Without Limits or Throttling vulnerability in Drupal Combined image style allows Excessive Allocation. This issue affects Combined image style versions: from 0.0.0 to 1.0.7...

CVE-2026-96380

The Drupal CSS Usage Analyzer module (versions 1.0.0 through 1.0.2 ) contains a Missing Authorization vulnerability. The root cause is that the module fails to sufficiently protect the /css-usage-analyzer/save endpoint against forged or repeated submissions. This allows for Forceful Browsing , wh...

CVE-2026-96380 CSS Usage Analyzer - Moderately critical - Improper access control - SA-CONTRIB-2026-189

Missing Authorization vulnerability in Drupal CSS Usage Analyzer allows Forceful Browsing. This issue affects CSS Usage Analyzer versions: from 1.0.0 to 1.0.2...

CVE-2026-96380 CSS Usage Analyzer - Moderately critical - Improper access control - SA-CONTRIB-2026-189

Missing Authorization vulnerability in Drupal CSS Usage Analyzer allows Forceful Browsing. This issue affects CSS Usage Analyzer versions: from 1.0.0 to 1.0.2...

CVE-2026-96380 CSS Usage Analyzer - Moderately critical - Improper access control - SA-CONTRIB-2026-189

Missing Authorization vulnerability in Drupal CSS Usage Analyzer allows Forceful Browsing. This issue affects CSS Usage Analyzer versions: from 1.0.0 to 1.0.2...

CVE-2026-96386

The Drupal Smart Content module (versions 0.0.0 to 3.2.1 ) is vulnerable to a Missing Authorization flaw leading to Forceful Browsing . The root cause is that the Smart Content Block submodule fails to sufficiently verify access permissions when rendering blocks through a "Display Blocks" reactio...

CVE-2026-96386 Smart Content - Moderately critical - Access bypass - SA-CONTRIB-2026-190

Missing Authorization vulnerability in Drupal Smart Content allows Forceful Browsing. This issue affects Smart Content versions: from 0.0.0 to 3.2.1...

CVE-2026-96386 Smart Content - Moderately critical - Access bypass - SA-CONTRIB-2026-190

Missing Authorization vulnerability in Drupal Smart Content allows Forceful Browsing. This issue affects Smart Content versions: from 0.0.0 to 3.2.1...

CVE-2026-96386 Smart Content - Moderately critical - Access bypass - SA-CONTRIB-2026-190

Missing Authorization vulnerability in Drupal Smart Content allows Forceful Browsing. This issue affects Smart Content versions: from 0.0.0 to 3.2.1...

CVE-2026-14288

GitLab has remediated an issue in GitLab EE affecting all versions from 17.4 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that under certain conditions could have allowed an authenticated to bypass a required merge request approval policy on a protected branch due to improper access...

DEBIAN-CVE-2026-91395

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Utility. Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1; Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM...

DEBIAN-CVE-2026-91396

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Utility. Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1; Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM...

EUVD-2026-107641

As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by...

EUVD-2026-107644

In Splunk SOAR versions below 8.7.0, a user that holds a role with the Users and Roles view permission could use the Representational State Transfer REST API to infer authentication token values for other users. If the inferred token grants administrative access, that user could gain administrati...