Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (1212 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-13235 2 Artificial Intelligence Project, Drupal 2 Artificial Intelligence, Artificial Intelligence 2026-07-13 3.3 Low
Missing Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Forceful Browsing. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.2.17, from 1.3.0 to 1.3.8, from 1.4.0 to 1.4.3.
CVE-2026-13236 2 Artificial Intelligence Project, Drupal 2 Artificial Intelligence, Ai Agents 2026-07-13 4.2 Medium
Missing Authorization vulnerability in Drupal AI Agents allows Forceful Browsing. This issue affects AI Agents versions: from 0.0.0 to 1.1.4, from 1.2.0 to 1.2.5, from 1.3.0 to 1.3.1.
CVE-2026-13232 2 Anuaralfetahe, Drupal 2 Advanced Content Feedback, Advanced Content Feedback (aka Admin Feedback) 2026-07-13 3.1 Low
Incorrect Authorization vulnerability in Drupal Advanced Content Feedback (aka admin_feedback) allows Forceful Browsing. This issue affects Advanced Content Feedback (aka admin_feedback) versions: from 0.0.0 to 2.8.0.
CVE-2026-13241 2 Drupal, Md-systems 2 Paragraphs, Paragraphs 2026-07-13 6.5 Medium
Missing Authorization vulnerability in Drupal Paragraphs allows Forceful Browsing. This issue affects Paragraphs versions: from 0.0.0 to 1.21.0.
CVE-2026-13240 2 Drupal, Md-systems 2 Paragraphs, Paragraphs 2026-07-13 6.5 Medium
Missing Authorization vulnerability in Drupal Paragraphs allows Forceful Browsing. This issue affects Paragraphs versions: from 0.0.0 to 1.21.0.
CVE-2026-13239 2 Drupal, Wiss-ki 2 Wisski, Wisski 2026-07-13 6.5 Medium
Missing Authorization vulnerability in Drupal WissKI allows Forceful Browsing. This issue affects WissKI versions: from 0.0.0 to 4.2.0.
CVE-2026-13244 2 Dakku, Drupal 2 Tealium Iq Tag Management, Tealium Iq Tag Management 2026-07-13 8.1 High
Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Tealium iQ Tag Management allows Object Injection. This issue affects Tealium iQ Tag Management versions: from 0.0.0 to 2.4.0.
CVE-2026-13243 2 Drupal, Victorkane 2 Salesforce Suite, Salesforce Suite 2026-07-13 4.8 Medium
Cross-Site Request Forgery (CSRF) vulnerability in Drupal Salesforce Suite allows Cross Site Request Forgery. This issue affects Salesforce Suite versions: from 0.0.0 to 5.1.3.
CVE-2026-15080 2 Drupal, Lingotek 2 Ray Enterprise Translation, Ray Enterprise Translation 2026-07-13 4.3 Medium
Cross-Site Request Forgery (CSRF) vulnerability in Drupal Ray Enterprise Translation allows Cross Site Request Forgery. This issue affects Ray Enterprise Translation versions: from 0.0.0 to 4.0.4, from 4.1.0 to 4.1.4, from 11.0.0 to 11.0.4.
CVE-2026-15079 2 Budda, Drupal 2 Login Disable, Login Disable 2026-07-13 5.4 Medium
Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Login Disable allows Brute Force. This issue affects Login Disable versions: from 0.0.0 to 2.1.4.
CVE-2026-58590 2 Drupal, Flowdrop Project 2 Flowdrop, Flowdrop 2026-07-13 5.4 Medium
Missing Authorization vulnerability in Drupal FlowDrop allows Forceful Browsing. This issue affects FlowDrop versions: from 0.0.0 to 1.6.0.
CVE-2026-58589 2 Drupal, Flowdrop Project 2 Flowdrop, Flowdrop 2026-07-13 5.4 Medium
Missing Authorization vulnerability in Drupal FlowDrop allows Forceful Browsing. This issue affects FlowDrop versions: from 0.0.0 to 1.6.0.
CVE-2026-13231 2 Anuaralfetahe, Drupal 2 Advanced Content Feedback, Advanced Content Feedback (aka Admin Feedback) 2026-07-13 6.1 Medium
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Advanced Content Feedback (aka admin_feedback) allows Stored XSS. This issue affects Advanced Content Feedback (aka admin_feedback) versions: from 0.0.0 to 2.8.0.
CVE-2026-13234 2 Artificial Intelligence Project, Drupal 2 Artificial Intelligence, Artificial Intelligence 2026-07-13 6.1 Medium
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Cross-Site Scripting (XSS). This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.2.17, from 1.3.0 to 1.3.8, from 1.4.0 to 1.4.3.
CVE-2026-58587 2 Drupal, Drupal Canvas Project 2 Drupal Canvas, Drupal Canvas 2026-07-13 6.1 Medium
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal Canvas allows Cross-Site Scripting (XSS). This issue affects Drupal Canvas versions: from 0.0.0 to 1.4.2, from 1.5.0 to 1.5.2, from 1.6.0 to 1.6.1, from 1.7.0 to 1.7.1.
CVE-2026-13242 2 Dopry, Drupal 2 Geolocation Field, Geolocation Field 2026-07-13 6.5 Medium
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Geolocation Field allows SQL Injection. This issue affects Geolocation Field versions: from 0.0.0 to 3.15.0.
CVE-2026-9726 2 Alternativecommerce, Drupal 2 Alternativecommerce, Drupal Alternativecommerce (basket) 2026-07-13 9.8 Critical
Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal AlternativeCommerce (Basket) allows Object Injection. This issue affects Drupal AlternativeCommerce (Basket) versions: from 0.0.0 to 2.1.17.
CVE-2026-10768 2 Drupal, Localgovdrupal 2 Localgov Workflows, Localgov Workflows 2026-07-13 9.8 Critical
Missing Authorization vulnerability in Drupal LocalGov Workflows allows Forceful Browsing. This issue affects LocalGov Workflows versions: from 0.0.0 to 1.6.0.
CVE-2022-25276 1 Drupal 1 Drupal 2026-06-17 6.1 Medium
The Media oEmbed iframe route does not properly validate the iframe domain setting, which allows embeds to be displayed in the context of the primary domain. Under certain circumstances, this could lead to cross-site scripting, leaked cookies, or other vulnerabilities.
CVE-2022-24729 4 Ckeditor, Drupal, Fedoraproject and 1 more 9 Ckeditor, Drupal, Fedora and 6 more 2026-06-17 6.5 Medium
CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. CKEditor4 prior to version 4.18.0 contains a vulnerability in the `dialog` plugin. The vulnerability allows abuse of a dialog input validator regular expression, which can cause a significant performance drop resulting in a browser tab freeze. A patch is available in version 4.18.0. There are currently no known workarounds.