Latest CVE Feed

Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.

Score
Vulnerability
Published
0.0 NA
CVE-2026-16646 — PanKM - Critical - Unsupported - SA-CONTRIB-2026-083

Vulnerability in Drupal PanKM. This issue affects PanKM versions: *.*.

| Misconfiguration
Aug 25, 2026 Aug 25, 2026
Aug 25, 2026
Aug 25, 2026
0.0 NA
CVE-2026-16645 — PhotoSwipe - Responsive JavaScript Modal Image Gallery - Moderately critical - Access byp…

Missing Authorization vulnerability in Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery allows Forceful Browsing. This issue affects PhotoSwipe - Responsive JavaScript Modal Image Galler…

| Authorization
Aug 25, 2026 Aug 25, 2026
Aug 25, 2026
Aug 25, 2026
0.0 NA
CVE-2026-16644 — Webform REST - Moderately critical - Access bypass - SA-CONTRIB-2026-087

Incorrect Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. This issue affects Webform REST versions: from 0.0.0 to 4.1.0.

| Authorization
Aug 25, 2026 Aug 25, 2026
Aug 25, 2026
Aug 25, 2026
0.0 NA
CVE-2026-16643 — Lunr exposed filters - Critical - Unsupported - SA-CONTRIB-2026-086

Vulnerability in Drupal Lunr exposed filters. This issue affects Lunr exposed filters versions: *.*.

| Misconfiguration
Aug 25, 2026 Aug 25, 2026
Aug 25, 2026
Aug 25, 2026
0.0 NA
CVE-2026-16642 — Email Login OTP - Critical - Unsupported - SA-CONTRIB-2026-085

Vulnerability in Drupal Email Login OTP. This issue affects Email Login OTP versions: *.*.

| Authentication
Aug 25, 2026 Aug 25, 2026
Aug 25, 2026
Aug 25, 2026
0.0 NA
CVE-2026-16641 — Commerce Elavon - Critical - Unsupported - SA-CONTRIB-2026-084

Vulnerability in Drupal Commerce Elavon. This issue affects Commerce Elavon versions: *.*.

| Misconfiguration
Aug 25, 2026 Aug 25, 2026
Aug 25, 2026
Aug 25, 2026
0.0 NA
CVE-2026-16640 — Search API Autocomplete - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-082

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Search API Autocomplete allows Reflected XSS. This issue affects Search API Autocomplete v…

| Cross-Site Scripting
Aug 25, 2026 Aug 25, 2026
Aug 25, 2026
Aug 25, 2026
0.0 NA
CVE-2026-16639 — Internationalization Single Sign-On - Critical - Access bypass - SA-CONTRIB-2026-081

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Internationalization Single Sign-On allows Authentication Bypass. This issue affects Internationalization Single Sign-…

| Authentication
Aug 25, 2026 Aug 25, 2026
Aug 25, 2026
Aug 25, 2026
0.0 NA
CVE-2026-16638 — Media Folders - Moderately critical - Cross site scripting - SA-CONTRIB-2026-080

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Media Folders allows Stored XSS. This issue affects Media Folders versions: from 0.0.0 to …

| Cross-Site Scripting
Aug 25, 2026 Aug 25, 2026
Aug 25, 2026
Aug 25, 2026
0.0 NA
CVE-2026-15917 — Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-011

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Drupal core versions: fr…

| Cross-Site Scripting
Aug 25, 2026 Aug 25, 2026
Aug 25, 2026
Aug 25, 2026
0.0 NA
CVE-2026-15916 — Drupal core - Moderately critical - Information disclosure - SA-CORE-2026-010

Missing Authorization vulnerability in Drupal Drupal core allows Forceful Browsing. This issue affects Drupal core versions: from 0.0.0 to 10.6.13, from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, from…

| Authorization
Aug 25, 2026 Aug 25, 2026
Aug 25, 2026
Aug 25, 2026
0.0 NA
CVE-2026-15088 — Development Environment - Critical - Unsupported - SA-CONTRIB-2026-089

Vulnerability in Drupal Development Environment. This issue affects Development Environment versions: *.*.

| Misconfiguration
Aug 25, 2026 Aug 25, 2026
Aug 25, 2026
Aug 25, 2026
0.0 NA
CVE-2026-52776 — Trestle URLSecurityValidator SSRF allowlist bypass via IPv4-mapped IPv6 and 0.0.0.0

Compliance-trestle (Trestle) is a tooling platform for managing compliance as code. In versions before 3.12.4 and versions 4.0.0 through 4.0.3, the URLSecurityValidator that guards trestle's remote-f…

| Server-Side Request Forgery
Aug 25, 2026 Aug 25, 2026
Aug 25, 2026
Aug 25, 2026
7.6 HIGH
CVE-2026-80186 — Bluez: stack overflow in name2utf8 causes dos and potential code execution

A stack-based buffer overflow vulnerability exists in BlueZ, the Linux Bluetooth protocol stack. A remote user within Bluetooth radio range can send a specially crafted Extended Inquiry Response (EIR…

enterprise_linux enterprise_linux | Memory Corruption
Aug 25, 2026 Aug 25, 2026
Aug 25, 2026
Aug 25, 2026
5.7 MEDIUM
CVE-2026-80185 — Bluez: sdp-xml: bluez 5.86: unprivileged-local and adjacent-le-peer leads to arbitrary co…

BlueZ sdp-xml.c type confusion via RegisterProfile(ServiceRecord) can crash bluetoothd (local DoS): a crafted nested ServiceRecord can corrupt the SDP XML parser stack so scalar union data is treated…

enterprise_linux enterprise_linux | Denial of Service
Aug 25, 2026 Aug 25, 2026
Aug 25, 2026
Aug 25, 2026
7.6 HIGH
CVE-2026-80184 — OpenStack Keystone Token Scope Escalation Vulnerability

In OpenStack Keystone before 29.0.3, tokens obtained via delegated authentication mechanisms (OAuth1 access tokens, application credentials, trusts) could be submitted to the token-method authenticat…

keystone | Remote | Authentication
Aug 25, 2026 Aug 25, 2026
Aug 25, 2026
Aug 25, 2026
7.6 HIGH
CVE-2026-80182 — OpenStack Keystone Improper Authorization of Delegated Tokens

In OpenStack Keystone before 29.0.3, tokens obtained via OAuth1 access token, application credential, or trust-scoped authentication could create new long-lived credentials or authorize new delegatio…

keystone | Remote | Authentication
Aug 25, 2026 Aug 25, 2026
Aug 25, 2026
Aug 25, 2026
7.5 HIGH
CVE-2026-79845 — code-projects Simple Inventory System edit.php sql injection

A vulnerability was identified in code-projects Simple Inventory System 1.0. This vulnerability affects unknown code of the file /InventoryManagement/edit.php. The manipulation of the argument ID lea…

simple_inventory_system | Remote | Injection
Aug 25, 2026 Aug 25, 2026
Aug 25, 2026
Aug 25, 2026
7.5 HIGH
CVE-2026-79804 — SililaWijesinghe Food Ordering System search.php sql injection

A vulnerability was found in SililaWijesinghe Food Ordering System up to ba314e897e3365600461e5ea59432e39ceaa0fa5. Affected by this issue is some unknown functionality of the file /search.php. Perfor…

Remote | Injection
Aug 25, 2026 Aug 25, 2026
Aug 25, 2026
Aug 25, 2026
0.0 NA
CVE-2026-78655 — Punk::Plugin::TOTP versions before 0.05 for Perl allow the second-factor attempt limit to…

Punk::Plugin::TOTP versions before 0.05 for Perl allow the second-factor attempt limit to be reset by replaying an earlier session cookie because the challenge route counts failures in the session. …

| Authentication
Aug 25, 2026 Aug 25, 2026
Aug 25, 2026
Aug 25, 2026
Showing 20 of 12260 Results