[ Latest · 16,702 CVEs ]
Newly published CVEs.
Every CVE the NVD lists as published in the last 30 days, newest first. Rows marked green on the left are on the matters-most list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-112085 | 22 Oct 2026 | CVSS 8.2 | webpack-dev-serverwebpack-dev-server is a development server that provides live reloading for webpack projects. In versions before 5.2.7 and in version 6.0.0, when a… | |
| CVE-2026-114348 | 22 Oct 2026 | CVSS 5.3 | webpack-dev-serverwebpack-dev-server is a development server that provides live reloading for webpack projects. In versions from 5.1.0 before 5.2.7 and in version… | |
| CVE-2026-106017 | 22 Oct 2026 | CVSS 6.3 | OpenVPN 3 Core LibraryImproper certificate validation in the OpenVPN 3 Core library version 3.4 through 3.11.7 allows attackers to circumvent extended key usage… | |
| CVE-2026-96293 | 22 Oct 2026 | CVSS 6.9 | WatchGuard AgentA cleartext storage of sensitive information vulnerability in WatchGuard Endpoint Security's Full Disk Encryption feature for macOS allows a local… | |
| CVE-2026-114703 | 22 Oct 2026 | CVSS 6.5 | hupe13 Extensions for Leaflet MapImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hupe13 Extensions for Leaflet Map… | |
| CVE-2026-115253 | 22 Oct 2026 | CVSS 7.3 | WatchGuard AgentAn incorrect permission assignment vulnerability in the WatchGuard Agent's log directory allows a local, authenticated non-administrative user to… | |
| CVE-2026-21811 | 22 Oct 2026 | CVSS 3.8 | HCL Software AppScan Integration with Azure Boards for ASoC & A360HCL AppScan Azure Boards Plugin is potentially affected by an Information Disclosure vulnerability involving secrets accessible in plaintext during… | |
| CVE-2026-21812 | 22 Oct 2026 | CVSS 2.2 | HCL Software AppScan Integration with Azure Boards for ASoC & A360HCL AppScan Azure Boards Plugin is affected by a Cleartext Transmission of Sensitive Information vulnerability when configured to communicate with… | |
| CVE-2026-86696 | 22 Oct 2026 | CVSS 8.2 | handnot2 esamlAllocation of Resources Without Limits or Throttling vulnerability in esaml in dropbox esaml allows an unauthenticated attacker to exhaust the Erlang… | |
| CVE-2026-93471 | 22 Oct 2026 | CVSS 8.7 | handnot2 esamlImproper Handling of Highly Compressed Data (Data Amplification) in esaml_binding in dropbox esaml allows an unauthenticated attacker to exhaust… | |
| CVE-2026-114195 | 22 Oct 2026 | CVSS 5.3 | WP Desk ShopMagicInsertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in WP Desk ShopMagic shopmagic-for-woocommerce allows… | |
| CVE-2026-114696 | 22 Oct 2026 | CVSS 5.3 | miniOrange Page Restriction WordPress (WP)Missing Authorization vulnerability in miniOrange Page Restriction WordPress (WP) page-and-post-restriction allows Exploiting Incorrectly Configured… | |
| CVE-2026-114698 | 22 Oct 2026 | CVSS 5.4 | myCredAuthorization Bypass Through User-Controlled Key vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control… | |
| CVE-2026-114699 | 22 Oct 2026 | CVSS 5.3 | yoomoney ЮKassa для WooCommerceMissing Authorization vulnerability in yoomoney ЮKassa для WooCommerce yookassa allows Exploiting Incorrectly Configured Access Control Security… | |
| CVE-2026-114700 | 22 Oct 2026 | CVSS 6.5 | Gloriafood Restaurant Menu – Food Ordering System – Table ReservationImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Gloriafood Restaurant Menu – Food Ordering… | |
| CVE-2026-114701 | 22 Oct 2026 | CVSS 6.5 | xootix Waitlist Woocommerce ( Back in stock notifier )Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in xootix Waitlist Woocommerce ( Back in stock… | |
| CVE-2026-114702 | 22 Oct 2026 | CVSS 6.5 | nicdark ND Shortcodes For Visual ComposerImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nicdark ND Shortcodes For Visual Composer… | |
| CVE-2026-112218 | 22 Oct 2026 | CVSS 5.3 | Ahmad Majestic SupportMissing Authorization vulnerability in Ahmad Majestic Support majestic-support allows Exploiting Incorrectly Configured Access Control Security… | |
| CVE-2026-112241 | 22 Oct 2026 | CVSS 9.8 | Brainstorm Force SureCartAuthentication Bypass by Spoofing vulnerability in Brainstorm Force SureCart surecart allows Authentication Abuse.This issue affects SureCart: from… | |
| CVE-2026-112242 | 22 Oct 2026 | CVSS 8.8 | Cozmoslabs Profile BuilderIncorrect Privilege Assignment vulnerability in Cozmoslabs Profile Builder profile-builder allows Privilege Escalation.This issue affects Profile… | |
| CVE-2026-112311 | 22 Oct 2026 | CVSS 6.5 | ACF ExtendedImproper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ACF Extended ACF Extended acf-extended allows Path… | |
| CVE-2026-112312 | 22 Oct 2026 | CVSS 7.5 | ACF ExtendedMissing Authorization vulnerability in ACF Extended ACF Extended acf-extended allows Exploiting Incorrectly Configured Access Control Security… | |
| CVE-2026-112327 | 22 Oct 2026 | CVSS 9.3 | TMS AmeliaImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TMS Amelia ameliabooking allows SQL… | |
| CVE-2026-112379 | 22 Oct 2026 | CVSS 7.1 | Codepeople Contact Form EmailImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Codepeople Contact Form Email… | |
| CVE-2026-112845 | 22 Oct 2026 | CVSS 6.5 | Jory Hogeveen Off-Canvas Sidebars & Menus (Slidebars)Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jory Hogeveen Off-Canvas Sidebars & Menus… | |
| CVE-2026-110893 | 22 Oct 2026 | CVSS 5.3 | Brainstorm Force SureDashMissing Authorization vulnerability in Brainstorm Force SureDash suredash allows Exploiting Incorrectly Configured Access Control Security… | |
| CVE-2026-110894 | 22 Oct 2026 | CVSS 5.3 | Brainstorm Force SureDashMissing Authorization vulnerability in Brainstorm Force SureDash suredash allows Exploiting Incorrectly Configured Access Control Security… | |
| CVE-2026-110974 | 22 Oct 2026 | CVSS 6.3 | vaadin android-jsonThe org.json parser in com.vaadin.external.google:android-json recurses once per nesting level with no depth limit: JSONTokener.nextValue() calls… | |
| CVE-2026-111830 | 22 Oct 2026 | CVSS 7.1 | WP MailsterImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Mailster WP Mailster wp-mailster allows… | |
| CVE-2026-111842 | 22 Oct 2026 | CVSS 5.3 | WP Sunshine Sunshine Photo CartMissing Authorization vulnerability in WP Sunshine Sunshine Photo Cart sunshine-photo-cart allows Exploiting Incorrectly Configured Access Control… | |
| CVE-2026-111851 | 22 Oct 2026 | CVSS 7.6 | WProyal Royal Elementor AddonsUse of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in WProyal Royal Elementor Addons… | |
| CVE-2026-114180 | 22 Oct 2026 | CVSS 5.3 | Wpmet MetformMissing Authorization vulnerability in Wpmet Metform metform allows Exploiting Incorrectly Configured Access Control Security Levels.This issue… | |
| CVE-2026-114182 | 22 Oct 2026 | CVSS 4.3 | IdeaBox Creations PowerPack Addons for ElementorMissing Authorization vulnerability in IdeaBox Creations PowerPack Addons for Elementor powerpack-lite-for-elementor allows Exploiting Incorrectly… | |
| CVE-2026-114184 | 22 Oct 2026 | CVSS 6.5 | WPVibes Elementor Addon ElementsImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPVibes Elementor Addon Elements… | |
| CVE-2026-114457 | 22 Oct 2026 | CVSS 3.7 | pbuchbinder mod_qosA flaw was found in mod_qos. An unauthenticated remote attacker could cause a Denial of Service (DoS) by sending a specially crafted JSON request… | |
| CVE-2026-114458 | 22 Oct 2026 | CVSS 5.9 | pbuchbinder mod_qosA flaw was found in mod_qos. An unauthenticated remote attacker can cause a Denial of Service (DoS) by maintaining numerous concurrent low-rate… | |
| CVE-2026-114459 | 22 Oct 2026 | CVSS 3.7 | pbuchbinder mod_qosA flaw was found in mod_qos. When inspecting HTTP response bodies, improper boundary checking can cause the module to read memory outside allocated… | |
| CVE-2026-114460 | 22 Oct 2026 | CVSS 5.3 | pbuchbinder mod_qosA flaw was found in mod_qos. An off-by-one pointer calculation error occurs when merging request body parameters with an existing URL query, which… | |
| CVE-2026-111847 | 22 Oct 2026 | CVSS 5.4 | Kings Plugins MarketKingMissing Authorization vulnerability in Kings Plugins MarketKing marketking-multivendor-marketplace-for-woocommerce allows Exploiting Incorrectly… | |
| CVE-2026-112826 | 22 Oct 2026 | CVSS 5.3 | eLightUp Falcon – WordPress Optimizations & TweaksMissing Authorization vulnerability in eLightUp Falcon – WordPress Optimizations & Tweaks falcon allows Exploiting Incorrectly Configured Access… | |
| CVE-2026-112843 | 22 Oct 2026 | CVSS 4.3 | WP Chill Strong TestimonialsMissing Authorization vulnerability in WP Chill Strong Testimonials strong-testimonials allows Exploiting Incorrectly Configured Access Control… | |
| CVE-2026-112867 | 22 Oct 2026 | CVSS 6.5 | H5PImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in H5P H5P h5p allows Stored XSS.This issue… | |
| CVE-2026-114175 | 22 Oct 2026 | CVSS 5.4 | DigitalME eRoomMissing Authorization vulnerability in DigitalME eRoom eroom-zoom-meetings-webinar allows Exploiting Incorrectly Configured Access Control Security… | |
| CVE-2026-114177 | 22 Oct 2026 | CVSS 8.8 | Xpro Elementor AddonsCross-Site Request Forgery (CSRF) vulnerability in Xpro Xpro Elementor Addons xpro-elementor-addons allows Cross Site Request Forgery.This issue… | |
| CVE-2026-103634 | 22 Oct 2026 | Not scored yet | Apache Software Foundation Apache DataSketchesOut-of-bounds read and write in the Count-Min sketch deserialization of Apache DataSketches C++ (repo: datasketches-cpp)… | |
| CVE-2026-105270 | 22 Oct 2026 | CVSS 8.7 | arekinath esamlAllocation of Resources Without Limits or Throttling vulnerability in esaml_binding in dropbox esaml allows an unauthenticated attacker to exhaust… | |
| CVE-2026-78392 | 22 Oct 2026 | CVSS 6.8 | Unknown Link LibraryThe Link Library WordPress plugin before 7.9.6 does not sanitise and escape a link field before outputting it inside an attribute of a link preview… | |
| CVE-2026-88849 | 22 Oct 2026 | CVSS 2.7 | Unknown MasterStudy LMS WordPress PluginThe MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.55 does not verify that a user targeted through its student-enrolment feature has… | |
| CVE-2026-97328 | 22 Oct 2026 | CVSS 7.5 | Unknown WebP ExpressThe WebP Express WordPress plugin before 0.25.16 does not escape values that its bundled HTML parser re-emits into element attributes when a… | |
| CVE-2026-110011 | 22 Oct 2026 | CVSS 2.7 | Unknown MB Custom Post Types & Custom TaxonomiesThe MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.12.3 does not perform a capability check in its export feature, allowing users… | |
| CVE-2026-111958 | 22 Oct 2026 | CVSS 7.5 | Unknown Royal MCPThe Royal MCP WordPress plugin before 1.5.7 does not limit a preview-link token to the single preview it was issued for, so any party that obtains a… | |
| CVE-2026-111971 | 22 Oct 2026 | CVSS 6.8 | Unknown Photo Engine (Media Organizer & Lightroom)The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.5.8 does not sanitise and escape collection and gallery names before storing… | |
| CVE-2026-111972 | 22 Oct 2026 | CVSS 4.9 | Unknown Photo Engine (Media Organizer & Lightroom)The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.5.8 does not verify that a user is authorised to act on the targeted media… | |
| CVE-2026-114570 | 22 Oct 2026 | CVSS 4.9 | WordPress Foundation WordPressWordPress Core is vulnerable to Stored Cross-Site Scripting via Quick Edit in all versions up to, and including, 7.0.2 due to insufficient escaping… | |
| CVE-2026-103234 | 22 Oct 2026 | CVSS 4.8 | Unknown WP Ultimate ReviewThe WP Ultimate Review WordPress plugin before 2.4.5 does not neutralise shortcodes in all of the review fields submitted through its public review… | |
| CVE-2026-109927 | 22 Oct 2026 | CVSS 7.2 | Unknown HIPAA FormsThe HIPAA Forms WordPress plugin before 3.3.2 does not perform a capability check when handling a request that rebuilds its own custom user role… | |
| CVE-2026-109931 | 22 Oct 2026 | CVSS 3.7 | Unknown Infility GlobalThe Infility Global WordPress plugin before 2.16.25 does not perform any authorisation or nonce check on an AJAX action available to unauthenticated… | |
| CVE-2026-109987 | 22 Oct 2026 | CVSS 7.2 | Unknown PixelYourSiteThe PixelYourSite WordPress plugin before 11.4.3, PixelYourSite Pro WordPress plugin before 12.6.8 do not sanitise and escape a cookie value before… | |
| CVE-2026-110010 | 22 Oct 2026 | CVSS 4.8 | Unknown MB Custom Post Types & Custom TaxonomiesThe MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.12.3 does not perform any capability or authentication check before allowing… | |
| CVE-2026-100142 | 22 Oct 2026 | CVSS 5.3 | Unknown FluentCart A New Era of eCommerceThe FluentCart A New Era of eCommerce WordPress plugin before 2.2.0 does not verify that a stored customer address selected during checkout belongs… | |
| CVE-2026-114220 | 22 Oct 2026 | CVSS 9.1 | NewType Infortech NT OneAPPNT OneAPP developed by NewType Infortech has an Improper Certificate Validation vulnerability. Unauthenticated network-adjacent attackers can perform… | |
| CVE-2026-114221 | 22 Oct 2026 | CVSS 7.4 | NewType Infortech NT OneAPPNT OneAPP developed by NewType Infortech has a Credential Disclosure vulnerability. Unauthenticated remote attackers can trigger an HTTP Basic… | |
| CVE-2026-114222 | 22 Oct 2026 | CVSS 6.2 | NewType Infortech NT OneAPPNT OneAPP developed by NewType Infortech has an Authentication Bypass vulnerability. Unauthenticated local attackers can bypass the App PIN lock… | |
| CVE-2026-114223 | 22 Oct 2026 | CVSS 5.5 | NewType Infortech NT OneAPPNT OneAPP developed by NewType Infortech has an Exposure of Sensitive Information vulnerability. Unauthenticated local attackers can extract… | |
| CVE-2026-114219 | 22 Oct 2026 | CVSS 7.4 | NewType Infortech NT OneAPPNT OneAPP developed by NewType Infortech has a Hard-coded Credentials vulnerability. Unauthenticated remote attackers can obtain the hard-coded… | |
| CVE-2026-114729 | 22 Oct 2026 | CVSS 5.3 | Roundcube WebmailRoundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass. rcube_washtml inspected the SVG SMIL… | |
| CVE-2026-114730 | 22 Oct 2026 | CVSS 7.2 | Roundcube WebmailRoundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a server-side request forgery filter bypass. The network blocklist used… | |
| CVE-2026-114731 | 22 Oct 2026 | CVSS 5.3 | Roundcube WebmailRoundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an uncontrolled resource consumption vulnerability in the CSS proxy (the… | |
| CVE-2026-114732 | 22 Oct 2026 | CVSS 6.8 | Roundcube WebmailRoundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an improper authentication vulnerability in multi-host installations. When a… | |
| CVE-2026-110353 | 22 Oct 2026 | CVSS 7.5 | HAProxyHAProxy 3.2 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (worker-thread CPU exhaustion) via a truncated HTTP/2… | |
| CVE-2026-110354 | 22 Oct 2026 | CVSS 7.5 | HAProxyHAProxy 3 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (persistent worker-thread CPU exhaustion) via an… | |
| CVE-2026-96388 | 22 Oct 2026 | CVSS 5.4 | Drupal Tawk.to - Live chat applicationCross-Site Request Forgery (CSRF) vulnerability in Drupal Tawk.to - Live chat application allows Cross Site Request Forgery. This issue affects… | |
| CVE-2026-96390 | 22 Oct 2026 | CVSS 4.3 | Drupal Editoria11y Accessibility CheckerPrivilege Defined With Unsafe Actions vulnerability in Drupal Editoria11y Accessibility Checker allows Privilege Escalation. This issue affects… | |
| CVE-2026-96391 | 22 Oct 2026 | Not scored yet | Drupal Webform RESTMissing Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. This issue affects Webform REST versions: from 0.0.0 to 4.2.1. | |
| CVE-2026-96392 | 22 Oct 2026 | CVSS 3.5 | Drupal AI CKEditorImproper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal AI CKEditor allows Code Injection. This issue affects… | |
| CVE-2026-96398 | 22 Oct 2026 | CVSS 4.3 | Drupal WebformIncorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from… | |
| CVE-2026-96377 | 22 Oct 2026 | CVSS 5.3 | Drupal Combined image styleAllocation of Resources Without Limits or Throttling vulnerability in Drupal Combined image style allows Excessive Allocation. This issue affects… | |
| CVE-2026-96378 | 22 Oct 2026 | CVSS 4.3 | Drupal Commerce Decoupled CheckoutImproperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Commerce Decoupled Checkout allows Object… | |
| CVE-2026-96379 | 22 Oct 2026 | Not scored yet | Drupal CookieCuttrImproper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal CookieCuttr allows Stored XSS. This… | |
| CVE-2026-96380 | 22 Oct 2026 | CVSS 6.5 | Drupal CSS Usage AnalyzerMissing Authorization vulnerability in Drupal CSS Usage Analyzer allows Forceful Browsing. This issue affects CSS Usage Analyzer versions: from 1.0.0… | |
| CVE-2026-96382 | 22 Oct 2026 | CVSS 4.6 | Drupal Diba carousel sliderImproper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Diba carousel slider allows Stored XSS… | |
| CVE-2026-96384 | 22 Oct 2026 | CVSS 3.5 | Drupal Mermaid Diagram FieldIncorrect Authorization vulnerability in Drupal Mermaid Diagram Field allows Forceful Browsing. This issue affects Mermaid Diagram Field versions… | |
| CVE-2026-96385 | 22 Oct 2026 | CVSS 6.5 | Drupal REST & JSON API Authentication for DrupalAuthentication Bypass Using an Alternate Path or Channel vulnerability in Drupal REST & JSON API Authentication for Drupal allows Authentication… | |
| CVE-2026-96386 | 22 Oct 2026 | CVSS 6.5 | Drupal Smart ContentMissing Authorization vulnerability in Drupal Smart Content allows Forceful Browsing. This issue affects Smart Content versions: from 0.0.0 to 3.2.1. | |
| CVE-2026-96387 | 22 Oct 2026 | CVSS 3.8 | Drupal Stop administrator loginAuthentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Stop administrator login allows Authentication Bypass. This issue… | |
| CVE-2026-96368 | 22 Oct 2026 | CVSS 4.6 | Drupal WebformImproper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Stored XSS. This issue… | |
| CVE-2026-96369 | 22 Oct 2026 | CVSS 3.1 | Drupal WebformUse of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Webform allows Exploiting Incorrectly Configured Access Control… | |
| CVE-2026-96370 | 22 Oct 2026 | CVSS 5.4 | Drupal WebformIncorrect Authorization vulnerability in Drupal Webform allows Server Side Request Forgery. This issue affects Webform versions: from 0.0.0 to… | |
| CVE-2026-96371 | 22 Oct 2026 | CVSS 5.4 | Drupal WebformPrivilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12… | |
| CVE-2026-96372 | 22 Oct 2026 | CVSS 5.4 | Drupal WebformInsufficient Granularity of Access Control vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0… | |
| CVE-2026-96373 | 22 Oct 2026 | CVSS 3.3 | Drupal WebformIncorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from… | |
| CVE-2026-96374 | 22 Oct 2026 | CVSS 4.2 | Drupal Project BrowserCross-Site Request Forgery (CSRF) vulnerability in Drupal Project Browser allows Cross Site Request Forgery. This issue affects Project Browser… | |
| CVE-2026-96375 | 22 Oct 2026 | CVSS 4.8 | Drupal CloudImproper Certificate Validation vulnerability in Drupal Cloud allows Adversary in the Middle (AiTM). This issue affects Cloud versions: from 0.0.0 to… | |
| CVE-2026-96376 | 22 Oct 2026 | CVSS 6.4 | Drupal CloudImproper Neutralization of Special Elements used in an OS Command ("OS Command Injection") vulnerability in Drupal Cloud allows OS Command Injection… | |
| CVE-2026-96360 | 22 Oct 2026 | CVSS 3.5 | Drupal WebformImproper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Cross-Site Scripting… | |
| CVE-2026-96361 | 22 Oct 2026 | CVSS 4.6 | Drupal WebformImproper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Cross-Site Scripting… | |
| CVE-2026-96362 | 22 Oct 2026 | CVSS 4.2 | Drupal WebformImproper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Cross-Site Scripting… | |
| CVE-2026-96363 | 22 Oct 2026 | Not scored yet | Drupal WebformPrivilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12… | |
| CVE-2026-96364 | 22 Oct 2026 | CVSS 5.3 | Drupal WebformImproper Control of Interaction Frequency vulnerability in Drupal Webform allows Functionality Misuse. This issue affects Webform versions: from… | |
| CVE-2026-96365 | 22 Oct 2026 | CVSS 7.5 | Drupal WebformAllocation of Resources Without Limits or Throttling vulnerability in Drupal Webform allows Excessive Allocation. This issue affects Webform… |
Page 4 of 168