CVE-2026-16640: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Search API Autocomplete allows Reflected XSS. This issue affects Search API Autocomplete versions: from 0.0.0 to 1.12.0...

CVE-2026-16639: Authentication Bypass Using an Alternate Path or Channel

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Internationalization Single Sign-On allows Authentication Bypass. This issue affects Internationalization Single Sign-On versions: from 0.0.0 to 1.8.0...

CVE-2026-16638: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Media Folders allows Stored XSS. This issue affects Media Folders versions: from 0.0.0 to 1.0.8...

CVE-2026-15917: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Drupal core allows Cross-Site Scripting XSS. This issue affects Drupal core versions: from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, from 0.0.0 to 11.2...

CVE-2026-15088: Improper Input Validation

Vulnerability in Drupal Development Environment. This issue affects Development Environment versions:...

CVE-2026-18985: Incorrect Authorization

Incorrect Authorization vulnerability in Drupal Edit in-place field allows Forceful Browsing. This issue affects Edit in-place field versions: from 0.0.0 to 2.1.1...

CVE-2026-16642: Improper Input Validation

Vulnerability in Drupal Email Login OTP. This issue affects Email Login OTP versions:...

CVE-2026-16645: Missing Authorization

Missing Authorization vulnerability in Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery allows Forceful Browsing. This issue affects PhotoSwipe - Responsive JavaScript Modal Image Gallery versions: from 0.0.0 to 3.2.0...

CVE-2026-15916: Missing Authorization

Missing Authorization vulnerability in Drupal Drupal core allows Forceful Browsing. This issue affects Drupal core versions: from 0.0.0 to 10.6.13, from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, from 0.0.0 to 11.0., from 0.0.0 to 11.1., from 0.0.0 to 11.2...

⚡ Weekly Recap: AI-Powered PLC Attacks, GitLab Attacks, Stripe Key Leaks and More

A package gets installed. A login prompt opens. A box sits exposed to the internet. Nothing looks unusual yet. That’s roughly the mood this week. Trusted tools turn hostile, old weak spots get fresh attention, AI makes exploit work cheaper, and researchers keep finding attacks that sound harder...

Dark-Moon v1.3.1

The Open-Source AI-Powered Autonomous Penetration Testing Platform The only autonomous AI pentester where the model never sees your real IPs, hostnames or credentials. As featured in Help Net Security · Cyber Security News · SecurityBrief · LinuxLinks · IT Brief · ChannelLife Full Documentation ·...

Exploit for CVE-2026-52618

CVE-2026-52618 — @webfer/mcp-ansible-drupal: OS command inject...

Exploit for Unrestricted Upload of File with Dangerous Type in Drupal

CVE-2020-13671 RCE via File Upload — Drupal Core Softwa...

Exploit for Unrestricted Upload of File with Dangerous Type in Drupal

CVE-2020-13671 RCE via File Upload — Drupal Core Softwa...

The Vulners team has released nmap-vulners 2.0

The Vulners team has releasednmap-vulners 2.0. This plugin an NSE script turns the popular Nmap port scanner into a black-box vulnerability scanner. Simply run $ nmap -sV --script vulners to get a prioritized report on vulnerabilities and exploits. And all of this is available for free with no...

Sitadel v1.5.1

Sitadel - Web Application Security Scanner root@kitploit: | || || | / | | | | | | | | | | || | | | \ | | |/ | | | | || | | | |/ | | | | | | /|| ||\ Sitadel is basically an update for WAScan making it compatible for python = 3.11 It allows more flexibility for you to write new modules and...

Exploit for Improper Input Validation in Drupal

SAWPOC — CVE-2018-7600 A Python Proof of Concept for CVE-20...

DRUPAL-CONTRIB-2026-102

The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, read the documentation on becoming the maintainer of a project that is unsupported for security reasons...

DRUPAL-CONTRIB-2026-101

The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, read the documentation on becoming the maintainer of a project that is unsupported for security reasons...

DRUPAL-CONTRIB-2026-100

The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, read the documentation on becoming the maintainer of a project that is unsupported for security reasons...