2026

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform all

Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: f

Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Webform allows Code Inject

Missing Authorization vulnerability in Drupal Ultimate Table Field allows Forceful Browsing. This issue affects Ultimate

Missing Authorization vulnerability in Drupal Taxonomy Term Glossary allows Forceful Browsing. This issue affects Taxono

Server-Side Request Forgery (SSRF) vulnerability in Drupal SAML SSO - Service Provider allows Server Side Request Forge

Authentication Bypass by Capture-replay vulnerability in Drupal SAML SSO - Service Provider allows Remote Services with

Insecure Storage of Sensitive Information vulnerability in Drupal SAML SSO - Service Provider allows Retrieve Embedded

Use of Hard-coded Credentials vulnerability in Drupal SAML SSO - Service Provider allows Retrieve Embedded Sensitive Da

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal SAML SSO -

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal SAML SSO -

Improper Verification of Cryptographic Signature vulnerability in Drupal SAML SSO - Service Provider allows Signature S

Observable Timing Discrepancy vulnerability in Drupal SAML SSO - Service Provider allows Brute Force. This issue affect

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal SAML SSO - Service Provider allows Fake the

Improper Certificate Validation vulnerability in Drupal SAML SSO - Service Provider allows Adversary in the Middle (AiT

Missing Authorization vulnerability in Drupal SAML SSO - Service Provider allows Forceful Browsing. This issue affects

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal SafeDelete

Vulnerability in Drupal Patreon. This issue affects Patreon versions: 7.x.

Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Key auth allows Exploiting Incorrectly

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Feed Block

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal CSP log all

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal Central Authentication System (CAS) Server a

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal amazee.ai P

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Email Verif

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Email Verification / SMS Verification /

Missing Authorization vulnerability in Drupal Webform Submissions Delete allows Forceful Browsing. This issue affects We

Incorrect Authorization vulnerability in Drupal Unpublished Node Permissions allows Forceful Browsing. This issue affect

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal PhotoSwipe

Improper Verification of Cryptographic Signature vulnerability in Drupal Monobank payment API allows Signature Spoof. Th

Incorrect Authorization vulnerability in Drupal Jsonapi Role Access allows Forceful Browsing. This issue affects Jsonap

Missing Authorization vulnerability in Drupal Islandora allows Forceful Browsing. This issue affects Islandora version

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Component b

Missing Authorization vulnerability in Drupal Calculate Working Days allows Forceful Browsing. This issue affects Calcul

Missing Authorization vulnerability in Drupal AI Translate allows Forceful Browsing. This issue affects AI Translate ver

Missing Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Forceful Browsing. This issue affects

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artific

Missing Authorization vulnerability in Drupal Advanced Search allows Forceful Browsing. This issue affects Advanced Sear

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Drupal Media Library Imp

Insertion of Sensitive Information into Log File vulnerability in Drupal Mailer Plus Log allows Remote Services with Sto

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass in the handling o

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 passes potentially unsafe content into ImageMagick when resizing

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability in the Bounc

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability. rcmail_send

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 contains an object injection primitive in rcube_session::unserial

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the ImageMagick resource limits to be bypassed during thum

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSS scoping bypass in HTML messages. rcube_utils

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the disabled_actions configuration setting to be bypassed.

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an IMAP command injection vulnerability. A remote

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSRF validation bypass in the mark-as-junk actio

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a cross-site scripting vulnerability in the passwo