CVE-2026-44383

CVE-2026-44383 concerns Hydro-Québec Le Circuit Electrique charging station backend with insufficient session expiration. The issue allows multiple connections using the same charging station ID, enabling attackers to deploy multiple OCPP clients to overwhelm the backend, impacting availability (...

CVE-2026-42952

CVE-2026-42952 concerns the Hydro-Québec Le Circuit Électrique charging-station backend. The issue is an improper restriction of excessive authentication attempts due to lack of throttling, which could enable a denial-of-service condition. Technical details in the connected records indicate an ex...

CVE-2026-20744

CVE-2026-20744 concerns Hydro-Québec Le Circuit Electrique charging station backend. The issue is an improper access control on the charging station websocket endpoint, allowing connections without authentication and potentially enabling privilege escalation. ICSCERT metrics show critical impact ...

CVE-2026-11913

CVE-2026-11913 concerns a vulnerability in the Drupal module “Mother May I.” The official CVE notes a critical impact (CVSS 9.8) with affected versions listed as wildcards (. ). Connected sources indicate the Drupal project marks the module as unsupported and a fix has not been provided (SA-CONTR...

CVE-2026-11914

Technical details (affected versions, root cause, impact, and available fixes) for CVE-2026-11914 are not publicly provided in the given documents. Monitor for updates from Drupal SA-CONTRIB-2026-046 and related advisories for concrete info.

CVE-2026-11915

The CVE-2026-11915 entry concerns Drupal Brute force attack protection where a vulnerability exists in the Brute force attack protection module affecting versions . . The NVD/NVDC and related records describe the issue as a vulnerability in the Drupal brute-force protection mechanism with impact ...

CVE-2026-15087

CVE-2026-15087 concerns Drupal Clean RESTful. Connected PT-2026-56667 confirms affected versions are Drupal Clean RESTful versions *, i.e., all versions, but details on the exact vulnerability, root cause, exploitability, or fixes are not provided in the connected documents. The related Drupal SA...

CVE-2026-15086

Technical details about CVE-2026-15086 are not publicly available in the provided documents. Monitor for updates from official advisories and vulnerability feeds.

CVE-2026-15089

The CVE-2026-15089 entry concerns a vulnerability in Drupal Commerce guest registration. Affected component: Drupal Commerce guest registration feature; details on affected versions are not provided beyond “. ” in the documents. The CVSS 3.1 base score is listed as 9.1 (CRITICAL) with high confid...

CVE-2026-55175

Spinnaker CVE-2026-55175 affects Rosco/Kustomize bake operations where unsafe YAML tag processing in rosco manifests can lead to remote code execution on rosco pods. Affected versions are prior to 2026.1.1, 2026.0.3, 2025.4.4, and 2025.3.4 across release lines; fixes are available in 2026.1.1, 20...

CVE-2026-44795

CVE-2026-44795 affects Spinnaker (Cloud deployments/baking paths) where unsafe YAML processing bypasses safe deserialization via a non-safe constructor, enabling arbitrary Java class loading and remote code execution. Affected versions precede fixed releases and include 2026.1.0, 2026.0.3, 2025.4...

CVE-2026-55808

CVE-2026-55808 is a Drupal core XSS vulnerability caused by improper input neutralization during web page generation. Affects Drupal core versions including 10.5.x before 10.5.12, 10.6.x before 10.6.11, 11.2.x before 11.2.14, 11.3.x before 11.3.12, and earlier 11.0./11.1. ranges. The issue arises...

CVE-2026-55807

Drupal core is affected by CVE-2026-55807 via a Server-Side Request Forgery (SSRF) in the Media module’s oEmbed URL discovery, allowing the server to be induced to fetch arbitrary URLs. Affected versions include Drupal core from 0.0.0 up to 10.5.12, 10.6.0–10.6.11, 11.2.0–11.2.14, 11.3.0–11.3.12,...

CVE-2026-55804

CVE-2026-55804 affects Drupal core across multiple branches (10.x, 11.x) and is related to a chain of gadget methods that could enable code execution or altered behavior when untrusted data is deserialized. The core issue is described as Improperly Controlled Modification of Dynamically-Determine...

CVE-2026-55806

CVE-2026-55806 affects Drupal core and is caused by a flaw in the rebuild.php front controller’s Host header validation, enabling an open redirect and related cache-poisoning risks. Affected versions include Drupal core 10.5.x before 10.5.12, 10.6.x before 10.6.11, 11.2.x before 11.2.14, and 11.3...

CVE-2026-55803

Drupal core is affected by CVE-2026-55803: Improperly Controlled Modification of Dynamically-Determined Object Attributes, enabling PHP object injection via deserialization. Affected versions include 0.0.0–10.5.12, 10.6.0–10.6.11, 11.2.0–11.2.14, 11.3.0–11.3.12, and 0.0.0–11.0.* / 11.1.*. Remedia...

CVE-2026-15085

The affected software is the Drupal AI SEO/GEO Analyzer module. It is vulnerable to Stored Cross‑site Scripting (XSS) in versions 0.0.0 through 1.1.3. The root cause, as described in the connected DRUPAL-SA-CONTRIB-2026-076 entry and PT-2026-56665, is that the module sends entity content (includi...

CVE-2026-15084

The issue is a Stored XSS in Drupal UI Patterns (SDC in Drupal UI) caused by insufficient sanitization in versions 2.0.0–2.0.17. An attacker must have permissions to create/update content rendered by UI Patterns. Remediation: upgrade to a version later than 2.0.17.

CVE-2026-15083

Summary: CVE-2026-15083 affects the Drupal ECA: Event - Condition - Action (ECA) module. The issue is an unitary vulnerability where an Improperly Controlled Modification of Dynamically-Determined Object Attributes can lead to Object Injection. Affected versions: ECA: Event - Condition - Action i...

CVE-2026-15082

CVE-2026-15082 affects Drupal Siteimprove Analytics module; versions 0.0.0 through 2.0.1 are vulnerable to Cross-site Scripting (XSS) due to improper neutralization during web page generation. The root cause is insufficient sanitization of the Siteimprove Analytics identification code when insert...

CVE-2026-15081

CVE-2026-15081 affects Drupal Location Selector module (versions 0.0.0–1.3.0). The vulnerability arises from a Views filter that does not sufficiently sanitize user input, allowing improper neutralization of special elements in an SQL command (SQL Injection). Impact is_high confidentiality and in...

CVE-2026-15080

Summary: CVE-2026-15080 is a CSRF vulnerability in Ray Enterprise Translation for Drupal. The issue affects versions 0.0.0–4.0.4, 4.1.0–4.1.4, and 11.0.0–11.0.4. The root cause, as described in the connected PT-2026-56660 entry, is that the module fails to protect several state-changing administr...

CVE-2026-15079

The CVE-2026-15079 entry concerns the Drupal Login Disable module, affected on versions 0.0.0 through 2.1.4. The underlying issue is an improper restriction of excessive authentication attempts, which can enable brute-force login attempts to bypass protection. The attack surface is the Drupal log...

CVE-2026-58591

Drupal Colorbox CVE-2026-58591 exhibits an XSS due to improper input neutralization during web page generation. Affected Colorbox for Drupal: 0.0.0–2.1.5 and 0.0.0–2.2.0. Root cause: module does not sufficiently protect against HTML JavaScript injection when an attacker can enter HTML content. Im...

CVE-2026-58590

FlowDrop for Drupal is affected by a Missing Authorization vulnerability that enables forceful browsing. Publicly reported details cover FlowDrop versions 0.0.0 through 1.6.0 as vulnerable. The root cause is insufficient access checks, allowing unauthorized navigation to access resources. The iss...

CVE-2026-58589

CVE-2026-58589 describes a Missing Authorization vulnerability in Drupal FlowDrop (FlowDrop versions 0.0.0 to 1.6.0) allowing forceful browsing to access endpoints without proper permissions. The issue affects the FlowDrop module used for AI-driven workflows via a chat interface, where endpoints ...

CVE-2026-58588

CVE-2026-58588 describes an XSS vulnerability in the Drupal Canvas module caused by improper neutralization of input during web page generation. Affected versions are: 0.0.0–1.4.2, 1.5.0–1.5.2, 1.6.0–1.6.1, and 1.7.0–1.7.1. The issue stems from allowing image uploads via a custom API while valida...

CVE-2026-58587

CVE-2026-58587 affects Drupal Canvas (Canvas AI submodule). The issue is an improper neutralization of input during web page generation, leading to Cross-Site Scripting (XSS). Affected versions include 0.0.0 through 1.4.2, 1.5.0 through 1.5.2, 1.6.0 through 1.6.1, and 1.7.0 through 1.7.1. Root ca...

CVE-2026-13244

CVE-2026-13244 affects the Drupal integration module Tealium iQ Tag Management. The issue arises from how the module stores data in the PHP-serialized field tealiumiq, which can lead to an Object Injection vulnerability when serialized data is unserialized. Affected versions are Tealium iQ Tag Ma...

CVE-2026-13243

CVE-2026-13243 describes a CSRF vulnerability in the Drupal Salesforce Suite where the OAuth handshake during interactive authentication is not properly validated, enabling an attacker to hijack the authorization token and bind the site to the attacker’s Salesforce account. Affected versions are ...

CVE-2026-13242

Geolocation Field in Drupal is affected: versions 0.0.0 through 3.15.0 expose an SQL injection due to improper neutralization in a view filter. The root cause is insufficient sanitization when user input reaches a view-filtered SQL path. Impact is SQL injection risk within Drupal sites using the ...

CVE-2026-13240

CVE-2026-13240 affects Drupal Paragraphs (and Paragraphs Library) with a missing authorization flaw that enables forceful browsing. Affected versions are 0.0.0 through 1.21.0. Root cause: insufficient access checks allowing access to unpublished library items when Paragraphs Library is active (e....

CVE-2026-13241

Summary: CVE-2026-13241 describes a Missing Authorization vulnerability in Drupal Paragraphs (affecting Paragraphs 0.0.0 – 1.21.0) compounded by the Paragraphs Library module. The issue allows forceful browsing because access to direct child paragraphs of library items via API endpoints is not su...

CVE-2026-13239

Summary: CVE-2026-13239 describes a Missing Authorization vulnerability in WissKI, enabling forceful browsing via the wisski mirador submodule. Affected software: WissKI versions 0.0.0 through 4.2.0. Root cause (per documents): insufficient access checks when parameters are submitted through a ro...

CVE-2026-13238

CVE-2026-13238 describes an incorrect authorization flaw in Drupal Commerce Realex / Global Payments. The issue permits forceful browsing when the gateway is configured with the redirect payment method, due to insufficient verification of the payment response from Global Payments. Affected versio...

CVE-2026-13237

CVE-2026-13237 affects Drupal AI Agents (versions 0.0.0–1.1.4, 1.2.0–1.2.5, 1.3.0–1.3.1). Root cause: Incorrect Authorization allowing Forceful Browsing, potentially enabling information disclosure and minor integrity concerns. The issue is documented across multiple sources (Drual SA-CONTRIB-202...

CVE-2026-13236

The CVE CVE-2026-13236 concerns a Missing Authorization issue in Drupal AI Agents that enables forceful browsing. Technical details across connected sources show that the vulnerability resides in the Drupal AI Agents module, where the tool-loading path does not sufficiently verify permissions on ...

CVE-2026-13235

This CVE concerns a Missing Authorization vulnerability in Drupal AI (Artificial Intelligence) impacting Drupal AI versions 0.0.0–1.2.17, 1.3.0–1.3.8, and 1.4.0–1.4.3. The root cause is improper access validation for agent tools exposed by Drupal core actions, enabling forceful browsing by an att...

CVE-2026-13234

CVE-2026-13234 concerns an improper neutralization of input during web page generation (XSS) in Drupal AI (Artificial Intelligence). Affected versions: 0.0.0–1.2.17, 1.3.0–1.3.8, and 1.4.0–1.4.3. The root cause is input handling within the module and certain submodules (AI Automators, AI Translat...

CVE-2026-13233

The CVE-2026-13233 entry describes a Server-Side Request Forgery (SSRF) in the Drupal OpenAI Provider module. Affected are Drupal OpenAI Provider versions 0.0.0–1.1.1 and 1.2.0–1.2.2. Root cause: insufficient sanitization of user-supplied URLs, enabling SSRF. Impact is limited to the described vu...

CVE-2026-13232

This CVE concerns Drupal Advanced Content Feedback (admin_feedback). Affected: versions 0.0.0–2.8.0. Root cause: incorrect authorization, failing to sufficiently verify authorization over the targeted feedback record during comment processing. Impact: potential access bypass/IDOR, enabling forcef...

CVE-2026-13231

Summary: CVE-2026-13231 affects Drupal Advanced Content Feedback (admin_feedback). The issue is improper neutralization of input during web page generation, causing a Stored XSS vulnerability. The vulnerable component is the admin_feedback module, with affected versions 0.0.0 through 2.8.0. The r...

CVE-2026-55810

The CVE-2026-55810 issue affects Drupal Plotly.js Graphing, with PHP object injection via unserialization in the Plotly.js Graphing module. Concrete details from connected sources: vulnerable versions 0.0.0 through 3.0.2; attacker must have permission to edit a content entity containing the plotl...

CVE-2026-55809

The CVE-2026-55809 issue affects the Drupal Flag attendance field module, with vulnerable versions 0.0.0 through 1.2. The root cause is improper control of modification of dynamically-determined object attributes, with data stored as PHP-serialized strings. If malicious data is written to the fie...

CVE-2026-55187

Mailpit contains an SSRF protection gap in Link Check API prior to v1.30.2. The internal IsInternalIP deny-list only blocks common IPv4 private/local addresses and CGNAT, and does not recognize several IPv6 forms that embed IPv4 destinations or IPv6 prefixes outside standard private ranges. Bypas...

CVE-2026-12535

CVE-2026-12535 concerns the Drupal Formatter Field module, where the vulnerability arises from storing data as PHP-serialized strings and exposing a risk of object injection when malicious data is written to the formatter_field. The affected versions span 0.0.0 through 2.0.0. The root cause invol...

CVE-2026-11909

CVE-2026-11909 involves a Missing Authorization vulnerability in Drupal Examples for Developers, enabling forceful browsing. The issue affects the Examples for Developers project, specifically the file_example submodule’s Read from a file feature, allowing access to any PHP-accessible file withou...

CVE-2026-11908

CVE-2026-11908 affects Drupal Tagify, with stored XSS due to improper sanitization when rendering Tagify dropdown suggestions. Vulnerable versions: 0.0.0 through 1.2.52. An attacker who can create or edit taxonomy terms in a vocabulary could inject arbitrary JavaScript executed in the context of ...

CVE-2026-10770

The CVE-2026-10770 entry corresponds to a Reflected XSS in Drupal Anti-Spam by CleanTalk, affecting versions 0.0.0 through 9.7.1. The root cause is improper neutralization of input in the module’s HTML output, where CleanTalk API response content is echoed directly via _cleantalk_die() and ct_die...

CVE-2026-52747

Summary of CVE-2026-52747 ModSecurity (the open‑source WAF engine for Apache/IIS/Nginx) prior to version 3.0.16 contains a parsing bug in the multipart/form-data body processor. Specifically, the libmodsecurity multipart parser silently removes embedded line breaks from non-file form-field values...