CVE Vulnerability Catalog

Nezha Monitoring before version 2.2.5 returns full resource objects in API responses for /api/v1/ddns and /api/v1/notification, including plaintext third-party API credentials such as Cloudflare API tokens, TencentCloud SecretKeys, Slack, Discord, and Telegram webhook URLs with embedded bot tokens, and Authorization header values. Any authenticated admin or PAT with nezha:ddns:read or nezha:notification:read scope can retrieve stored credentials via the listDDNS and listNotification handlers in a single API response.

The Colorbox plugin for Drupal contains a Cross-Site Scripting (XSS) vulnerability due to improper input neutralization during page generation. Affected versions are from 0.0.0 to 2.1.5 and from 0.0.0 to 2.2.0.

Missing Authorization vulnerability in Drupal FlowDrop allows Forceful Browsing. This issue affects FlowDrop versions from 0.0.0 to 1.6.0.

Missing Authorization vulnerability in Drupal FlowDrop allows Forceful Browsing. This issue affects FlowDrop versions from 0.0.0 to 1.6.0.

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal Canvas allows Cross-Site Scripting (XSS). This issue affects Drupal Canvas versions: from 0.0.0 to 1.4.2, from 1.5.0 to 1.5.2, from 1.6.0 to 1.6.1, from 1.7.0 to 1.7.1.

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal Canvas allows Cross-Site Scripting (XSS). This issue affects Drupal Canvas versions: from 0.0.0 to 1.4.2, from 1.5.0 to 1.5.2, from 1.6.0 to 1.6.1, from 1.7.0 to 1.7.1.

In Frappe framework prior to versions 16.16.0 and 15.106.0, the reset_password endpoint allowed user enumeration. An attacker could verify if a given email address exists in the system.

A Cross-Site Scripting (XSS) vulnerability has been discovered in Drupal Core due to improper input neutralization during web page generation. It affects a wide range of versions: from 0.0.0 to 10.5.12, 10.6.0-10.6.11, 11.2.0-11.2.14, 11.3.0-11.3.12, and all 11.0.* and 11.1.* releases.

An Open Redirect vulnerability in Drupal core allows URL redirection to untrusted sites, enabling content spoofing. This affects Drupal core versions from 0.0.0 to 10.5.12, 10.6.0 to 10.6.11, 11.2.0 to 11.2.14, 11.3.0 to 11.3.12, and older branches 11.0.* and 11.1.*.

An improperly controlled modification of dynamically-determined object attributes vulnerability in Drupal core allows object injection. Affected versions include Drupal core from 0.0.0 to 10.5.12, 10.6.0 to 10.6.11, 11.2.0 to 11.2.14, 11.3.0 to 11.3.12, and branches 11.0.* and 11.1.*.

An improperly controlled modification of dynamically-determined object attributes vulnerability in Drupal core allows object injection. This affects Drupal core versions from 0.0.0 to 10.5.12, 10.6.0 to 10.6.11, 11.2.0 to 11.2.14, 11.3.0 to 11.3.12, and older branches 11.0.* and 11.1.*.

Mailpit prior to version 1.30.2 has an incomplete fix for CVE-2026-27808 that fails to block all IPv6 transition mechanisms (NAT64, 6to4, ISATAP, etc.). An attacker can use the Link Check API to scan internal services, including cloud metadata endpoints.

A vulnerability in ModSecurity versions 3.0.0 through 3.0.15 affects the t:utf8toUnicode transformation on i386 architecture. The snprintf function uses the size of a pointer instead of the Unicode buffer length, causing incorrect output and allowing WAF rule bypass.

Improper encoding of non-finite floating-point values in Apache Log4j API MapMessage JSON serialization produces invalid JSON. Affects versions 2.13.1 through 2.25.4 and 2.26.0, as the fix for CVE-2026-34481 missed some code paths.

In Frappe framework prior to versions 16.20.0 and 15.110.0, users without write access could attach files to any doctype via file-handling API endpoints such as add_attachments. This issue is fixed in versions 16.20.0 and 15.110.0.

In the Frappe framework prior to versions 15.107.5 and 16.18.2, an endpoint in reportview lacked proper permission checks. This vulnerability has been fixed in the mentioned versions.

A path traversal vulnerability in the Frappe framework allows unauthorized access to backup files via the download_backups function. The issue exists in versions prior to 16.19.0 and 15.109.0 due to insufficient path hardening.

The AI SEO/GEO Analyzer plugin for Drupal contains a Stored Cross-Site Scripting (XSS) vulnerability due to improper input neutralization during page generation. This affects versions from 0.0.0 to 1.1.3.

A stored Cross-Site Scripting (XSS) vulnerability has been discovered in Drupal UI Patterns (SDC), caused by improper input neutralization during page generation. This allows an attacker to inject malicious scripts that execute whenever the affected page is viewed.

An improperly controlled modification of dynamically-determined object attributes vulnerability in the Drupal ECA: Event - Condition - Action module allows object injection. This affects versions from 0.0.0 to 2.1.20, from 3.0.0 to 3.0.12, and from 3.1.0 to 3.1.4.