CVE-2026-95868

A SQL injection vulnerability exists in the Search Form component of the AdithyaYelloju Restaurant-Management-System (up to commit 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c). The flaw is caused by the improper handling of the s1 argument within the mysqli_query function in the admin/display_menu.p...

CVE-2026-96384

The Mermaid Diagram Field module for Drupal contains an access bypass vulnerability. The module fails to sufficiently respect default revision behavior and lacks proper access controls for modal content . This issue is mitigated by the requirement that an attacker must either have the modal displ...

CVE-2026-96390

The Editoria11y Accessibility Checker module for Drupal contains an access bypass vulnerability. The module incorrectly labels a permission as a "view" permission when it actually grants edit and delete access to module data. This occurs within the functionality that runs a client-side accessibil...

CVE-2026-96380

The CSS Usage Analyzer module for Drupal is vulnerable to an improper access control flaw. The module fails to sufficiently protect the /css-usage-analyzer/save endpoint against forged or repeated submissions . This allows unauthorized users to post CSS-usage measurements, which are intended to b...

CVE-2026-96367

The Webform module in Drupal contains a vulnerability where the custom attributes YAML editor does not sufficiently restrict access. Users with permissions to create or edit webforms, but who lack permission to edit webform source, can add custom attributes, which may lead to cross-site scripting...

CVE-2026-96358

The Webform module for Drupal contains a vulnerability in its rating element due to insufficient data validation. This flaw could allow cross-site scripting (XSS) on pages featuring a rating element. The risk is mitigated by the requirement that an attacker must first be able to place crafted HTM...

CVE-2026-96387

The DRUPAL-CONTRIB-2026-183 module fails to sufficiently enforce access restrictions for the administrative user account (user 1) or users with the administrator role across all supported authentication mechanisms. Consequently, a blocked administrative user might still authenticate via certain a...

CVE-2026-96388

The Tawk.to - Live chat application module for Drupal sites contains a Cross-Site Request Forgery (CSRF) vulnerability due to insufficient validation of certain requests. This flaw could allow an attacker to trick an authenticated user into performing unintended actions. No specific versions or r...

CVE-2026-96371

The Webform module for Drupal allows users with webform creation or editing permissions to enter source configurations that are rendered unsafely when the Webform UI module is disabled. This vulnerability arises from insufficient restrictions on raw webform source editing, potentially leading to ...

CVE-2026-96365

The Webform module for Drupal is vulnerable to a Denial of Service (DoS) because it fails to sufficiently validate an optional token query value . Under specific configurations where a Webform is rendered for anonymous visitors , a malicious request can cause the system to consume significant res...

CVE-2026-96356

The Webform module for Drupal contains an access bypass vulnerability. The component fails to sufficiently guard user-specific access rules against malformed saved configurations . Under specific site conditions, an access rule intended to restrict submission access to selected user accounts coul...

CVE-2026-96379

The CookieCuttr module for Drupal contains a cross-site scripting (XSS) vulnerability due to insufficient input filtering on the administration form. This flaw allows for the storage and subsequent rendering of specially crafted values without adequate sanitization. Exploitation requires a role w...

CVE-2026-96355

The Drupal Webform module contains a vulnerability where it fails to sufficiently exclude certain format templates from token replacement . This allows an attacker to submit data that is evaluated as template code during rendering. Depending on site configuration and active modules, the impact ca...

CVE-2026-96374

The Project Browser module for Drupal is vulnerable to cross-site request forgery (CSRF) attacks because it fails to sufficiently validate administrative actions performed through the web user interface. An attacker could potentially exploit this to apply recipes or enable modules without proper ...

CVE-2026-96370

The Webform module for Drupal contains a server-side request forgery (SSRF) vulnerability within its Webform Submission Export/Import submodule. The root cause is insufficient access validation , allowing users with permissions to edit webform submissions and access results to reach the import in...

CVE-2026-96386

The Smart Content Block submodule of the Smart Content module for Drupal contains an access bypass vulnerability. The root cause is an insufficient check of block access when the module renders blocks of a "Display Blocks" reaction via its AJAX endpoint . Impact is mitigated if sites only use Vie...

CVE-2026-96392

The AI CKEditor module for Drupal contains a vulnerability where it fails to sufficiently mitigate Twig template injections within specific AI CKEditor rules. This flaw allows an attacker to use Twig functions to extract confidential system data . While the documentation describes the impact as p...

CVE-2026-96364

The Webform module's Webform Share submodule allows for embedding webforms on external sites. Under certain conditions, submissions for an Ajax-enabled Webform using this submodule can bypass anti-spam protections . This vulnerability is mitigated if Webform Share is disabled, sharing is turned o...

CVE-2026-96377

The Combined image style Drupal module is vulnerable to an improper access control issue because it does not sufficiently validate image style names when generating derivatives. This allows anonymous users to generate image derivatives without a valid token, which could potentially lead to a deni...

CVE-2026-79304

CyberPanel version 1.9.1 is vulnerable to a path traversal vulnerability in the readFileContents method of the /filemanager/controller endpoint. An authenticated remote attacker who owns any configured domain can exploit this by supplying an arbitrary absolute or out-of-scope path in the fileName...

CVE-2026-96391

The Webform REST Drupal contribution module contains a permission bypass vulnerability. The module fails to sufficiently check permissions for webform and webform submission entities when retrieving elements or fields via the REST API. No specific affected versions, exploit links, or remediation ...

CVE-2026-96362

The Webform module for Drupal contains a cross-site scripting (XSS) vulnerability. The root cause is the insufficient filtering of response values from the Remote Post handler before they are rendered via handler response tokens . If a site uses these tokens in rendered output and an attacker can...

CVE-2026-96359

The Drupal Webform module is vulnerable to cross-site scripting (XSS) because it fails to sufficiently sanitize attributes used by its color element . Under specific conditions, specially crafted attributes can execute XSS when the element is rendered. This vulnerability is mitigated by the requi...

CVE-2026-96375

The Cloud module for Drupal contains a vulnerability where the Kubernetes and VMware integrations fail to properly validate TLS certificates when connecting to remote API endpoints. An attacker capable of intercepting these connections may obtain secret tokens or other credentials, potentially le...

CVE-2026-92202

The Luxion KeyShot software is vulnerable to Remote Code Execution (RCE) due to an uncontrolled search path flaw during BIP file parsing . An attacker can achieve arbitrary code execution in the context of the current process by forcing the application to load a library from an unsecured location...

CVE-2026-96369

The Drupal Webform module contains a vulnerability where, when used with JSON:API enabled, submissions may be cached without correctly varying by the authenticated user. This allows an authenticated user to potentially view another user's webform submission data via the JSON:API collection endpoi...

CVE-2026-96361

The Webform module for Drupal is vulnerable to cross-site scripting (XSS) due to insufficient sanitization of text counter configurations before they are passed to the bundled jQuery Text Counter library . Under specific configurations, this allows markup from counter-related settings to be injec...

CVE-2024-67279

Attackers can compromise MikroTik routers without authentication by chaining CVE-2024-67279 with CVE-2024-86060. This vulnerability allows for the creation of privileged accounts and the exfiltration of network configurations . A successful compromise enables attackers to pivot to internal networ...

CVE-2026-96398

The Drupal Webform module contains an access bypass vulnerability because it does not sufficiently restrict access to certain submission view modes. Under specific conditions, a user authorized to view a submission can access a more permissive view mode, potentially exposing restricted fields. Th...

CVE-2026-96357

The Webform module for Drupal is vulnerable to cross-site scripting (XSS) because it fails to sufficiently force certain uploaded file types to download when served. Under specific configurations, a browser may render an uploaded file inline. This is mitigated by the requirement that a user with ...

CVE-2026-96382

The Diba Carousel Slider module for Drupal is vulnerable to Cross-Site Scripting (XSS) . When the "Allow HTML description" option is enabled, slide descriptions are rendered using the raw stored field value rather than the rendered output, bypassing Drupal's text format filtering and output sanit...

CVE-2026-96372

The Webform module for Drupal fails to sufficiently restrict access to configure Remote HTTP Operations handlers. A user with permissions to edit a webform could potentially configure a remote HTTP operation. To mitigate this risk, administrators should review the newly added Administer webform r...

CVE-2026-96385

The REST & JSON API Authentication for Drupal module is vulnerable to an access bypass because it does not sufficiently validate authentication requirements for all API requests. This flaw allows for the circumvention of the extra authentication layer intended for the API. No specific patch versi...

CVE-2026-96376

The Drupal Cloud module is vulnerable to remote code execution (RCE) due to insufficient sanitization of user-controlled Git branch and repository URL values. These values are passed directly to shell commands within the Kubernetes integration , potentially allowing an attacker to execute arbitra...

CVE-2026-96366

The Webform module for Drupal is vulnerable to an access bypass due to insufficient validation of a managed file upload element during new submission processing. An attacker with permission to submit a vulnerable webform could potentially access other managed files without authorization. This imp...

CVE-2026-96373

The Drupal Webform module contains a vulnerability where it does not sufficiently validate requested filenames when serving generated submission exports. This flaw could allow a user with permission to view results for one webform to access or remove files from the configured export temporary dir...

CVE-2026-96368

Technical details for CVE-2026-96368 are not publicly available in the provided documents as the entry is currently reserved. Monitor for updates.

CVE-2026-96360

The Webform module for Drupal is vulnerable to cross-site scripting (XSS) due to improper sanitisation of announcement text used for assistive technologies. In specific configurations, specially crafted announcement text can execute malicious scripts for users interacting with the affected Webfor...

CVE-2026-79306

CyberPanel v1.9.1 is vulnerable to a path traversal vulnerability in the compress method via the /filemanager/controller endpoint. An authenticated remote attacker with ownership of any configured domain can provide absolute or out-of-scope file paths in the listOfFiles JSON property, along with ...

CVE-2026-96363

The Webform module for Drupal contains a cross-site scripting (XSS) vulnerability within its Webform Entity Print submodule. The root cause is insufficient access control over print templates. An attacker with permissions to create webform and edit own webform can exploit this when the submodule ...

CVE-2026-96378

A vulnerability exists in a Drupal Commerce Decoupled Checkout module that enables REST endpoints for remote order creation. The module fails to sufficiently sanitize order data passed into the order creation endpoint, which could allow an attacker to set potentially unsafe order properties . No ...

CVE-2026-79310

webpy web.py 0.76 is vulnerable to server-side template injection (SSTI) . The vulnerability exists because the template engine can be manipulated into executing attacker-controlled code that bypasses built-in security checks. Specifically, if an application precompiles templates from a directory...

CVE-2025-63564

The Moodle Socialwall plugin versions v.3.0 through v.3.3 are affected by a SQL injection vulnerability. An attacker can exploit this flaw by sending crafted HTTP requests , which may lead to the execution of arbitrary code . The vulnerability is classified with a CRITICAL base severity score of ...

CVE-2026-95833

A SQL injection vulnerability exists in the itsourcecode Leave Management System 1.0 . The flaw is located in an unknown function within the file /module/leavetype/index.php , where a lack of proper input validation on the ID argument allows an attacker to execute arbitrary SQL commands. This vul...

CVE-2026-95830

A security flaw in theRealSain Pixtream (up to commit 866afd4f0cea812b918780fb74b67dccf8c4d6a0) allows for an unrestricted upload via remote manipulation of the media argument in the /post_upload.php file. This vulnerability can be exploited remotely, and a public exploit is currently available f...

CVE-2026-95829

The TDuckCloud tduck-platform (up to version 5.3) contains a SQL injection vulnerability within the Pagination Inner Interceptor component. Specifically, the PaginationInnerInterceptor.concatOrderBy function in the file tduck-api/src/main/java/com/tduck/cloud/api/config/MybatisPlusConfig.java fai...

CVE-2026-94367

OpenEye Apex Network Video Recorder (NVR) firmware version 3.2.9.376 is vulnerable to an OS command injection in the recbackup component. An authenticated administrator can provide crafted backup-area configuration input that is passed to a shell command, enabling the execution of arbitrary comma...

CVE-2026-92930

OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 (and versions dating back to at least 2.2.3.4 ) contains a vulnerability in the administrator password-reset unlock-code design. Because the system lacks a per-device secret or server-side cryptographic material, an attacker with physic...

CVE-2026-92929

The OpenEye Apex Network Video Recorder (NVR) firmware, specifically version 3.2.9.376 , is vulnerable to an authentication bypass. The software incorrectly trusts the X-Forwarded-For header provided by clients to determine the request source address. This design flaw, present since at least firm...

CVE-2026-92928

The OpenEye Apex Network Video Recorder (NVR) firmware version 3.2.9.376 contains a hardcoded, undocumented recovery account with a shared credential that cannot be modified, disabled, or rotated. This design flaw, present since at least firmware 2.2.3.4 , allows an unauthenticated remote attacke...