Unrated
CVE-2026-114554
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 3,404
Reset filters
Unrated
CVE-2026-114572
drupal/domain_login_restrict - SA-CONTRIB-2026-249
Unrated
CVE-2026-114537
drupal/view_unpublished - SA-CONTRIB-2026-235
Unrated
CVE-2026-114538
drupal/bootstrap - SA-CONTRIB-2026-236
Unrated
drupal-contrib-2026-238
drupal/domain - SA-CONTRIB-2026-238
Unrated
CVE-2026-114529
drupal/csv_field - SA-CONTRIB-2026-226
Unrated
CVE-2026-114542
drupal/simple_oauth - SA-CONTRIB-2026-242
Medium
CVE-2026-62858
YOURLS: Unauthenticated File Inclusion
Unrated
CVE-2026-108514
Drupal core - SA-CORE-2026-016
Unrated
CVE-2026-110738
drupal/gin - SA-CONTRIB-2026-219
Unrated
CVE-2026-108515
Drupal core - SA-CORE-2026-015
Unrated
CVE-2026-114553
drupal/frontend_editing - SA-CONTRIB-2026-241
A vulnerability in the Drupal Frontend Editing module fails to properly enforce field access permissions when modifying paragraph items, requiring specific editing roles to exploit.
Unrated
CVE-2026-114541
drupal/frontend_editing - SA-CONTRIB-2026-240
A Cross-Site Request Forgery vulnerability in the Drupal frontend_editing module allows attackers to trick an authenticated editor into deleting or reordering paragraphs on a node.
Unrated
CVE-2026-114534
drupal/block_attributes - SA-CONTRIB-2026-232
A cross-site scripting vulnerability in the Drupal Block Attributes module allows attackers with specific permissions to inject malicious attributes into blocks due to insufficient sanitization.
Medium
CVE-2026-113712
Cachet has Stored XSS in Incident Component
A stored cross-site scripting vulnerability in Cachet allows authenticated users to inject malicious code via incident name and message fields. This script executes in the browsers of users viewing the public status page, potentially enabling session cookie theft, unauthorized redirection, and account takeover.
Medium
CVE-2026-107842
Contao: Protected page content disclosed to anonymous visitors after disabling index_protected
Disabling protected page indexing in Contao without clearing existing index records can expose member-only titles, URLs, and text snippets to anonymous visitors via the site search.
Medium
CVE-2026-107843
Contao: Registration module re-sends activation emails
A vulnerability in Contao's registration module allows unauthenticated attackers to repeatedly trigger activation emails to arbitrary addresses. This creates an email flooding risk and discloses whether an email address has a pending registration.
Low
CVE-2026-107848
Contao: Cross-site request forgery in custom backend actions
A cross-site request forgery vulnerability in Contao allows attackers to trigger state-changing or destructive backend actions if an authenticated backend user visits a malicious URL.
Medium
CVE-2026-107844
Contao: Path traversal in the images controller
A path traversal vulnerability in Contao's images controller allows unauthenticated visitors to read image files located outside the document root and verify path existence within the project directory.
Critical
CVE-2026-107845
Contao: Cross-site scripting in the comments bundle
An unauthenticated cross-site scripting vulnerability in Contao's comments bundle allows attackers to inject malicious script that executes when a back end user views the Comments module, potentially leading to administrative takeover or code execution.
Medium
CVE-2026-107850
Contao: Improper access control in the preview links module
An access control flaw in Contao allows non-administrator back end users with access to the preview links module to view all preview links, exposing signed preview URLs for unpublished content.
Medium
CVE-2026-107851
Contao: Improper access control in the table access voter
A caching defect in Contao's table access security voter allows low-privileged backend users to bypass module permissions and gain unauthorized read, create, update, and delete access to database tables.
Medium
CVE-2026-107380
enshrined/svg-sanitize: Stored XSS via DTD Entity / HTML5 Named Character Reference Collision
Medium
CVE-2026-107381
svg-sanitizer: Mixed-case xlink:HrEf skips the `<use>` nesting-DoS check in Resolver::processReferences
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.