CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The Drupal Commerce Decoupled Checkout module contains an improperly controlled modification of dynamically-determined object attributes vulnerability allowing object injection. This affects versions 1.0.0 through 1.8.0.
The Drupal Combined image style module contains an allocation of resources without limits or throttling vulnerability, allowing excessive allocation. This issue affects Combined image style versions from 0.0.0 to 1.0.7.
Drupal Cloud contains an OS Command Injection vulnerability due to improper neutralization of special elements used in OS commands. This issue affects Cloud versions from 0.0.0 to 7.0.1.
The Drupal Cloud module contains an improper certificate validation vulnerability enabling an Adversary in the Middle (AiTM) attack. The issue affects versions from 0.0.0 to 7.0.1.
The Drupal Project Browser module contains a Cross-Site Request Forgery (CSRF) vulnerability that may allow unwanted actions on behalf of a logged-in user. The issue affects versions from 0.0.0 to 2.0.3 and from 2.1.0 to 2.1.5.
The Drupal Webform module has an insufficient granularity of access control vulnerability, allowing forceful browsing. This issue affects Webform versions from 0.0.0 to 6.2.12 and from 6.3.0 to 6.3.1.
The Drupal Webform module contains a Privilege Defined With Unsafe Actions vulnerability that allows stored XSS. The issue affects versions from 0.0.0 to 6.2.12 and from 6.3.0 to 6.3.1.
The Drupal Webform module has an incorrect authorization vulnerability, allowing Server Side Request Forgery (SSRF). This issue affects Webform versions from 0.0.0 to 6.2.12 and from 6.3.0 to 6.3.1.
The Drupal Webform module has an improper neutralization of input during web page generation vulnerability, leading to stored Cross-site Scripting (XSS). This issue affects Webform versions from 0.0.0 to 6.2.12 and from 6.3.0 to 6.3.1.
The Webform module for Drupal contains a Privilege Defined With Unsafe Actions vulnerability that allows Stored XSS. This issue affects Webform versions from 0.0.0 to 6.2.12 and from 6.3.0 to 6.3.1.
The Drupal Webform module has an incorrect authorization vulnerability, allowing forceful browsing. This issue affects Webform versions from 0.0.0 to 6.2.12 and from 6.3.0 to 6.3.1.
Improper Control of Interaction Frequency vulnerability in Drupal Webform allows Functionality Misuse. This issue affects Webform versions from 0.0.0 to 6.2.12 and from 6.3.0 to 6.3.1.
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Cross-Site Scripting (XSS). This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Cross-Site Scripting (XSS). This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Cross-Site Scripting (XSS). This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
The Webform module for Drupal is vulnerable to Cross-Site Scripting (XSS) due to improper neutralization of input during web page generation. This affects versions from 0.0.0 to 6.2.12 and from 6.3.0 to 6.3.1.
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
The Webform module for Drupal has an incorrect authorization vulnerability that allows forceful browsing. This affects versions from 0.0.0 to 6.2.12 and from 6.3.0 to 6.3.1.
Missing Authorization vulnerability in Drupal Ultimate Table Field allows Forceful Browsing. This issue affects Ultimate Table Field versions from 0.0.0 to 1.1.1 and from 2.0.0 to 2.0.1.
Missing Authorization vulnerability in Drupal Taxonomy Term Glossary allows Forceful Browsing. This issue affects Taxonomy Term Glossary versions from 0.0.0 to 4.6.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS