Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (932 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-1553 2 Drupal, Drupal Canvas Project 2 Canvas, Drupal Canvas 2026-02-11 4.8 Medium
Incorrect Authorization vulnerability in Drupal Drupal Canvas allows Forceful Browsing.This issue affects Drupal Canvas: from 0.0.0 before 1.0.4.
CVE-2026-1554 2 Drupal, Jtenman 2 Central Authentication System (cas) Server, Central Authentication System Server 2026-02-11 4.2 Medium
XML Injection (aka Blind XPath Injection) vulnerability in Drupal Central Authentication System (CAS) Server allows Privilege Escalation.This issue affects Central Authentication System (CAS) Server: from 0.0.0 before 2.0.3, from 2.1.0 before 2.1.2.
CVE-2025-14472 2 Acquia, Drupal 2 Acquia Content Hub, Acquia Content Hub 2026-02-06 8.1 High
Cross-Site Request Forgery (CSRF) vulnerability in Drupal Acquia Content Hub allows Cross Site Request Forgery.This issue affects Acquia Content Hub: from 0.0.0 before 3.6.4, from 3.7.0 before 3.7.3.
CVE-2025-13984 2 Drupal, Kanopi 2 Next.js, Next.js 2026-02-06 6.1 Medium
Permissive Cross-domain Security Policy with Untrusted Domains vulnerability in Drupal Next.Js allows Cross-Site Scripting (XSS).This issue affects Next.Js: from 0.0.0 before 1.6.4, from 2.0.0 before 2.0.1.
CVE-2025-13986 2 Drupal, Zyxware 2 Disable Login Page, Disable Login Page 2026-02-06 4.2 Medium
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Disable Login Page allows Functionality Bypass.This issue affects Disable Login Page: from 0.0.0 before 1.1.3.
CVE-2025-13985 2 Drupal, Ithom 2 Entity Share, Entity Share 2026-02-06 5.3 Medium
Incorrect Authorization vulnerability in Drupal Entity Share allows Forceful Browsing.This issue affects Entity Share: from 0.0.0 before 3.13.0.
CVE-2025-14840 2 Bmeme, Drupal 2 Http Client Manager, Http Client Manager 2026-02-06 7.5 High
Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal HTTP Client Manager allows Forceful Browsing.This issue affects HTTP Client Manager: from 0.0.0 before 9.3.13, from 10.0.0 before 10.0.2, from 11.0.0 before 11.0.1.
CVE-2025-13983 2 Drupal, Factorial 2 Tagify, Tagify 2026-02-03 5.4 Medium
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Tagify allows Cross-Site Scripting (XSS).This issue affects Tagify: from 0.0.0 before 1.2.44.
CVE-2025-14556 2 Drupal, Flag Module Project 2 Flag, Flag 2026-01-23 5.4 Medium
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Drupal Flag allows Cross-Site Scripting (XSS).This issue affects Flag: from 7.X-3.0 through 7.X-3.9.
CVE-2025-14557 2 Drupal, Facebook Pixel Project 2 Facebook Pixel, Facebook Pixel 2026-01-23 4.8 Medium
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Drupal Facebook Pixel facebook_pixel allows Stored XSS.This issue affects Facebook Pixel: from 7.X-1.0 through 7.X-1.1.
CVE-2025-13083 1 Drupal 2 Drupal, Drupal Core 2026-01-16 3.7 Low
Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Drupal core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Drupal core: from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, from 11.2.0 before 11.2.8, from 7.0 before 7.103.
CVE-2025-9552 2 Drupal, Synchronize Composer.json With Contrib Modules Project 2 Drupal, Synchronize Composer.json With Contrib Modules 2026-01-05 5.3 Medium
Vulnerability in Drupal Synchronize composer.Json With Contrib Modules.This issue affects Synchronize composer.Json With Contrib Modules: *.*.
CVE-2025-9550 2 Drupal, Facets Project 2 Drupal, Facets 2026-01-05 6.1 Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Facets allows Cross-Site Scripting (XSS).This issue affects Facets: from 0.0.0 before 2.0.10, from 3.0.0 before 3.0.1.
CVE-2025-9549 2 Drupal, Facets Project 2 Drupal, Facets 2026-01-05 6.5 Medium
Missing Authorization vulnerability in Drupal Facets allows Forceful Browsing.This issue affects Facets: from 0.0.0 before 2.0.10, from 3.0.0 before 3.0.1.
CVE-2025-8093 2 Authenticator Login Project, Drupal 2 Authenticator Login, Drupal 2026-01-05 8.8 High
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Authenticator Login allows Authentication Bypass.This issue affects Authenticator Login: from 0.0.0 before 2.1.8.
CVE-2018-7602 2 Debian, Drupal 2 Debian Linux, Drupal 2025-12-17 9.8 Critical
A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being compromised. This vulnerability is related to Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-002. Both SA-CORE-2018-002 and this vulnerability are being exploited in the wild.
CVE-2025-10930 2 2bits, Drupal 3 Currency, Currency, Drupal 2025-12-12 6.5 Medium
Cross-Site Request Forgery (CSRF) vulnerability in Drupal Currency allows Cross Site Request Forgery.This issue affects Currency: from 0.0.0 before 3.5.0.
CVE-2025-10926 2 Drupal, Json Field Project 3 Drupal, Json Field, Json Field 2025-12-12 6.1 Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal JSON Field allows Cross-Site Scripting (XSS).This issue affects JSON Field: from 0.0.0 before 1.5.
CVE-2025-10927 2 Drupal, Plausible Tracking Project 3 Drupal, Plausible Tracking, Plausible Tracking 2025-12-12 6.1 Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Plausible tracking allows Cross-Site Scripting (XSS).This issue affects Plausible tracking: from 0.0.0 before 1.0.2.
CVE-2025-10928 2 Access Code Project, Drupal 3 Access Code, Access Code, Drupal 2025-12-12 6.3 Medium
Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Access code allows Brute Force.This issue affects Access code: from 0.0.0 before 2.0.5.