CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The Drupal SAML SSO - Service Provider module contains a use of hard-coded credentials vulnerability, allowing retrieval of embedded sensitive data. This issue affects SAML SSO - Service Provider versions from 0.0.0 to 3.2.0.
The Drupal SAML SSO - Service Provider module contains an improper cryptographic signature verification vulnerability enabling signature spoofing. The issue affects versions from 0.0.0 to 3.2.0.
Observable Timing Discrepancy vulnerability in Drupal SAML SSO - Service Provider allows Brute Force. This issue affects SAML SSO - Service Provider versions from 0.0.0 to 3.2.0.
The Drupal SAML SSO - Service Provider module contains an open redirect vulnerability, allowing faking the source of data by redirecting users to an untrusted site. This issue affects SAML SSO - Service Provider versions from 0.0.0 to 3.2.0.
The Drupal SAML SSO - Service Provider module contains an improper certificate validation vulnerability enabling an Adversary in the Middle (AiTM) attack. The issue affects versions from 0.0.0 to 3.2.0.
The Drupal SAML SSO - Service Provider module contains a missing authorization vulnerability, allowing forceful browsing. This issue affects SAML SSO - Service Provider versions from 0.0.0 to 3.2.0.
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal SafeDelete allows Stored XSS. This issue affects SafeDelete versions from 0.0.0 to 1.0.88.
A vulnerability was found in the Drupal Patreon module. This issue affects Patreon versions 7.x; the description does not specify the nature of the vulnerability.
The Drupal Key auth module uses browser cache containing sensitive information, allowing exploitation of incorrectly configured access control security levels. This issue affects Key auth versions from 0.0.0 to 2.2.4.
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Feed Block allows Stored XSS. This issue affects Feed Block versions from 0.0.0 to 2.0.2 and from 3.0.0 to 3.0.2.
The CSP log module for Drupal contains an SQL Injection vulnerability due to improper neutralization of special elements used in SQL commands. This issue affects CSP log versions from 0.0.0 to 1.0.2.
The Drupal Central Authentication System (CAS) Server module contains an Open Redirect vulnerability (redirection to an untrusted site) that allows faking the source of data. The issue affects versions from 0.0.0 to 2.0.4 and from 2.1.0 to 2.1.3.
The amazee.ai Private AI Provider module for Drupal contains an SQL Injection vulnerability due to improper neutralization of special elements used in SQL commands. The issue affects versions from 0.0.0 to 1.3.7 and from 1.4.0 to 1.4.3.
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Email Verification / SMS Verification / OTP Verification allows Reflected XSS. This issue affects Email Verification / SMS Verification / OTP Verification versions from 0.0.0 to 2.4.0.
The Email Verification / SMS Verification / OTP Verification module for Drupal contains an Authentication Bypass Using an Alternate Path or Channel vulnerability that allows authentication bypass. This issue affects versions from 0.0.0 to 2.4.0.
The Webform Submissions Delete module for Drupal contains a Missing Authorization vulnerability that allows Forceful Browsing. This issue affects versions from 0.0.0 to 1.2.0.
The Drupal Unpublished Node Permissions module contains an incorrect authorization vulnerability, allowing forceful browsing. This issue affects Unpublished Node Permissions versions from 0.0.0 to 1.8.0.
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery allows Stored XSS. This issue affects PhotoSwipe - Responsive JavaScript Modal Image Gallery versions from 0.0.0 to 5.0.9.
Incorrect Authorization vulnerability in the Drupal Jsonapi Role Access module allows Forceful Browsing. This issue affects Jsonapi Role Access versions from 0.0.0 to 2.0.2.
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Component blocks allows Stored XSS. This issue affects Component blocks versions from 0.0.0 to 1.2.7.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS