Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-93895 | critical | 9.1 | No | IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow an unauthenticated remote attacker to bypass access contr... | 2026-10-22 |
| CVE-2026-106462 | medium | 6.4 | No | Backstage is an open framework for building developer portals. Prior to 1.54.6, scaffolder source-control actions may not consistently enfor... | 2026-10-22 |
| CVE-2026-106463 | medium | 5.4 | No | Backstage is an open framework for building developer portals. Prior to 0.8.7, the @backstage/plugin-catalog-backend-module-gitlab package i... | 2026-10-22 |
| CVE-2026-106487 | medium | 5.0 | No | Backstage is an open framework for building developer portals. Prior to 0.21.10, the @backstage/plugin-kubernetes-backend package is affecte... | 2026-10-22 |
| CVE-2026-87942 | medium | 4.6 | No | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal SafeDelete allows Stored XSS. T... | 2026-10-22 |
| CVE-2026-87940 | medium | 5.4 | No | Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Key auth allows Exploiting Incorrectly Configured Access C... | 2026-10-22 |
| CVE-2026-87939 | medium | 4.2 | No | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Feed Block allows Stored XSS. T... | 2026-10-22 |
| CVE-2026-87937 | medium | 6.5 | No | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal Central Authentication System (CAS) Server allows Fake the Sourc... | 2026-10-22 |
| CVE-2026-87936 | medium | 6.5 | No | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal amazee.ai Private AI Provider a... | 2026-10-22 |
| CVE-2026-84924 | medium | 5.4 | No | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Email Verification / SMS Verifi... | 2026-10-22 |
| CVE-2026-84923 | medium | 6.5 | No | Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Email Verification / SMS Verification / OTP Verification al... | 2026-10-22 |
| CVE-2026-84921 | medium | 5.3 | No | Missing Authorization vulnerability in Drupal Webform Submissions Delete allows Forceful Browsing. This issue affects Webform Submissions De... | 2026-10-22 |
| CVE-2026-84919 | medium | 4.6 | No | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal PhotoSwipe - Responsive JavaScr... | 2026-10-22 |
| CVE-2026-84918 | low | 3.7 | No | Improper Verification of Cryptographic Signature vulnerability in Drupal Monobank payment API allows Signature Spoof. This issue affects Mon... | 2026-10-22 |
| CVE-2026-84917 | medium | 6.5 | No | Incorrect Authorization vulnerability in Drupal Jsonapi Role Access allows Forceful Browsing. This issue affects Jsonapi Role Access version... | 2026-10-22 |
| CVE-2026-84916 | low | 3.7 | No | Missing Authorization vulnerability in Drupal Islandora allows Forceful Browsing. This issue affects Islandora versions: from 0.0.0 to 2.19.... | 2026-10-22 |
| CVE-2026-84915 | medium | 4.6 | No | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Component blocks allows Stored... | 2026-10-22 |
| CVE-2026-84914 | medium | 5.3 | No | Missing Authorization vulnerability in Drupal Calculate Working Days allows Forceful Browsing. This issue affects Calculate Working Days ver... | 2026-10-22 |
| CVE-2026-81163 | medium | 5.4 | No | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Drupal Media Library Importer allows Path Tr... | 2026-10-22 |
| CVE-2026-16648 | low | 3.8 | No | Insertion of Sensitive Information into Log File vulnerability in Drupal Mailer Plus Log allows Remote Services with Stolen Credentials. Thi... | 2026-10-22 |