CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.06)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in Drupal LDAP / Active Directory Integration allows LDAP Injection. This issue affects LDAP / Active Directory Integration versions from 0.0.0 to 2.2.1.
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Monster Menus allows Stored XSS. This issue affects Monster Menus versions from 0.0.0 to 9.5.3.
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal CAPTCHA Protected Page allows Functionality Bypass. This issue affects CAPTCHA Protected Page versions from 0.0.0 to 1.0.2.
A Cross-site Scripting (XSS) vulnerability in the Drupal Address Suggestion module is caused by improper neutralization of input during web page generation. Affects versions from 0.0.0 to 1.0.25.
Missing authorization in Drupal Digital Signage Framework allows forceful browsing. Affects versions from 0.0.0 to 2.6.1.
Incorrect authorization in Drupal Blazy allows forceful browsing. Affects versions from 0.0.0 to 3.0.18.
Missing authorization in Drupal Entity PDF allows forceful browsing. Affects versions from 0.0.0 to 2.1.5.
Insertion of sensitive information into sent data in Drupal DXPR Builder allows forceful browsing. Affects versions from 0.0.0 to 2.8.1.
Privilege defined with unsafe actions in Drupal Content Moderation Notifications allows privilege escalation. Affects versions from 0.0.0 to 3.9.0.
Improper neutralization of input during web page generation (Cross-site Scripting) in Drupal Slick Carousel allows stored XSS. Affects versions from 0.0.0 to 2.1.0.
Observable timing discrepancy in Drupal Commerce CyberSource allows brute force attacks. Affects versions from 0.0.0 to 1.10.0.
Incorrect authorization in Drupal Entity API allows forceful browsing. Affects versions from 0.0.0 to 1.8.0.
Vulnerability in Drupal Screenshot. Affects all versions.
Vulnerability in Drupal Screenshot. Affects all versions.
Vulnerability in Drupal Link content parser. The issue affects all versions of the Link content parser.
Vulnerability in Drupal Gammu SMS Daemon. The issue affects all versions of Gammu SMS Daemon.
Vulnerability in Drupal Gammu SMS Daemon. The issue affects all versions of Gammu SMS Daemon.
Vulnerability in Drupal Gammu SMS Daemon. The issue affects all versions of Gammu SMS Daemon.
Incorrect Authorization vulnerability in Drupal Diff allows Forceful Browsing. Affects versions from 0.0.0 to 2.0.1 and from 2.1.0 to 2.1.1.
Incorrect Authorization vulnerability in Drupal Quick Tabs allows Forceful Browsing. Affects versions from 0.0.0 to 4.3.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS