Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-96392 | low | 3.5 | No | Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal AI CKEditor allows Code Injection. This issue... | 2026-10-22 |
| CVE-2026-96390 | medium | 4.3 | No | Privilege Defined With Unsafe Actions vulnerability in Drupal Editoria11y Accessibility Checker allows Privilege Escalation. This issue affe... | 2026-10-22 |
| CVE-2026-96388 | medium | 5.4 | No | Cross-Site Request Forgery (CSRF) vulnerability in Drupal Tawk.to - Live chat application allows Cross Site Request Forgery. This issue affe... | 2026-10-22 |
| CVE-2026-96387 | low | 3.8 | No | Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Stop administrator login allows Authentication Bypass. This... | 2026-10-22 |
| CVE-2026-96386 | medium | 6.5 | No | Missing Authorization vulnerability in Drupal Smart Content allows Forceful Browsing. This issue affects Smart Content versions: from 0.0.0... | 2026-10-22 |
| CVE-2026-96385 | medium | 6.5 | No | Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal REST & JSON API Authentication for Drupal allows Authentica... | 2026-10-22 |
| CVE-2026-96384 | low | 3.5 | No | Incorrect Authorization vulnerability in Drupal Mermaid Diagram Field allows Forceful Browsing. This issue affects Mermaid Diagram Field ver... | 2026-10-22 |
| CVE-2026-96382 | medium | 4.6 | No | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Diba carousel slider allows Sto... | 2026-10-22 |
| CVE-2026-96380 | medium | 6.5 | No | Missing Authorization vulnerability in Drupal CSS Usage Analyzer allows Forceful Browsing. This issue affects CSS Usage Analyzer versions: f... | 2026-10-22 |
| CVE-2026-96378 | medium | 4.3 | No | Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Commerce Decoupled Checkout allows Ob... | 2026-10-22 |
| CVE-2026-96377 | medium | 5.3 | No | Allocation of Resources Without Limits or Throttling vulnerability in Drupal Combined image style allows Excessive Allocation. This issue af... | 2026-10-22 |
| CVE-2026-96375 | medium | 4.8 | No | Improper Certificate Validation vulnerability in Drupal Cloud allows Adversary in the Middle (AiTM). This issue affects Cloud versions: from... | 2026-10-22 |
| CVE-2026-96374 | medium | 4.2 | No | Cross-Site Request Forgery (CSRF) vulnerability in Drupal Project Browser allows Cross Site Request Forgery. This issue affects Project Brow... | 2026-10-22 |
| CVE-2026-96373 | low | 3.3 | No | Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12,... | 2026-10-22 |
| CVE-2026-96372 | medium | 5.4 | No | Insufficient Granularity of Access Control vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: fr... | 2026-10-22 |
| CVE-2026-96371 | medium | 5.4 | No | Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to... | 2026-10-22 |
| CVE-2026-96370 | medium | 5.4 | No | Incorrect Authorization vulnerability in Drupal Webform allows Server Side Request Forgery. This issue affects Webform versions: from 0.0.0... | 2026-10-22 |
| CVE-2026-96369 | low | 3.1 | No | Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Webform allows Exploiting Incorrectly Configured Access Co... | 2026-10-22 |
| CVE-2026-96368 | medium | 4.6 | No | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Stored XSS. This... | 2026-10-22 |
| CVE-2026-96367 | medium | 4.6 | No | Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to... | 2026-10-22 |