CVE-2026-118567

Incorrect Authorization vulnerability in Drupal Bulk Update User Roles allows Forceful Browsing. This issue affects Bulk Update User Roles versions: from 0.0.0 to 1.0.5...

DRUPAL-CONTRIB-2026-232

This module allows you to define custom attributes for a block. You can specify an attribute name to be added to the block in a predefined format. The module does not sufficiently sanitize attributes against cross site scripting. This issue is mitigated by the fact that the attacker must have the...

EUVD-2026-106293

Vulnerability in the PeopleSoft Enterprise HCM Human Resources product of Oracle PeopleSoft component: Administer Workforce. The supported version that is affected is 9.2. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise PeopleSoft...

PT-2026-120909

This module allows you to define custom attributes for a block. You can specify an attribute name to be added to the block in a predefined format. The module does not sufficiently sanitize attributes against cross site scripting. This issue is mitigated by the fact that the attacker must have the...

Block Attributes - Moderately critical - Cross site Scripting - SA-CONTRIB-2026-232

This module allows you to define custom attributes for a block. You can specify an attribute name to be added to the block in a predefined format. The module does not sufficiently sanitize attributes against cross site scripting. This issue is mitigated by the fact that the attacker must have the...

CVE-2026-83375

Vulnerability in the PeopleSoft Enterprise HCM Human Resources product of Oracle PeopleSoft component: Administer Workforce. The supported version that is affected is 9.2. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise PeopleSoft...

CVE-2026-83375

The Oracle PeopleSoft Enterprise HCM Human Resources product (component: Administer Workforce ) is affected by a high-complexity vulnerability in version 9.2 . A high-privileged attacker with network access via HTTP can compromise the system, but the attack requires human interaction from a third...

PT-2026-119570

Vulnerability in the PeopleSoft Enterprise HCM Human Resources product of Oracle PeopleSoft component: Administer Workforce. The supported version that is affected is 9.2. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise PeopleSoft...

Oracle PeopleSoft Enterprise HCM Human Resources security vulnerabilities

Oracle PeopleSoft Enterprise HCM Human Resources version 9.2 has a security vulnerability. This vulnerability stems from issues with the Administer Workforce component. It may allow attackers with high privileges to access through the HTTP network. Without user interaction, unauthorized actions c...

DRUPAL-CONTRIB-2026-181

This module enables you to provide information and options about cookie usage. The module does not sufficiently filter input submitted through the Cookiecuttr administration form. This could allow specially crafted values to be stored and later rendered without adequate sanitization, resulting in...

CookieCuttr - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-181

This module enables you to provide information and options about cookie usage. The module does not sufficiently filter input submitted through the Cookiecuttr administration form. This could allow specially crafted values to be stored and later rendered without adequate sanitization, resulting in...

PT-2026-97671

Name of the Vulnerable Software and Affected Versions Drupal CookieCuttr versions 2.0.0 through 2.0.3 Description Stored Cross-site Scripting XSS occurs because the module does not sufficiently filter input submitted through the administration form. This allows specially crafted values to be stor...

CVE-2026-92127

Jenkins Script Security Plugin 1415.v9af9b3ac253d and earlier automatically approves the classpath entries in an item configuration when a user with Overall/Administer permission copies the item, or updates that configuration through the REST API or CLI, allowing attackers able to define classpat...

CVE-2026-92127

Jenkins Script Security Plugin 1415.v9af9b3ac253d and earlier automatically approves the classpath entries in an item configuration when a user with Overall/Administer permission copies the item, or updates that configuration through the REST API or CLI, allowing attackers able to define classpat...

DRUPAL-CONTRIB-2026-073

The module doesn't sufficiently sanitize the Siteimprove Analytics identification code when inserting the JavaScript tracking code; this could be exploited to achieve Cross-Site Scripting XSS. This vulnerability is mitigated by the fact that an attacker must have a role with the permission...

EUVD-2026-33229

An access bypass vulnerability in Drupal TFA Basic Plugins allows users with the administer users permission to view or generate recovery codes for other users. This issue affects TFA Basic Plugins: from 7.x-1.0 through 7.x-1.2...

CVE-2026-6816: Privilege Defined With Unsafe Actions

An access bypass vulnerability in Drupal TFA Basic Plugins allows users with the administer users permission to view or generate recovery codes for other users. This issue affects TFA Basic Plugins: from 7.x-1.0 through 7.x-1.2...

Jenkins AppSpider Plugin does not perform a permission check in a method implementing form validation

Jenkins AppSpider Plugin 1.0.17 and earlier does not perform a permission check in a method implementing form validation. This allows attackers with Overall/Read permission to connect to an attacker-specified URL. AppSpider Plugin 1.0.18 requires Overall/Administer permission to use the affected...

Missing permission check in jenkinsci-appspider-plugin allows sending requests

jenkinsci-appspider-plugin 1.0.17 and earlier does not perform a permission check in a method implementing form validation. This allows attackers with Overall/Read permission to connect to an attacker-specified URL. jenkinsci-appspider-plugin 1.0.18 requires Overall/Administer permission to use t...

Jenkins Script Security Plugin: Missing permission checks allow enumeration of pending and approved classpaths

Jenkins Script Security Plugin versions 1399.ve6a66547f6e1 and earlier do not perform a permission check in an HTTP endpoint. This allows attackers with Overall/Read permission to enumerate pending and approved Script Security classpaths. Script Security Plugin 1402.v94c9ce464861 requires...