CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.14)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The Siteimprove Analytics plugin for Drupal contains an XSS vulnerability due to improper input neutralization during page generation. All versions from 0.0.0 to 2.0.1 are affected.
A CSRF vulnerability in the Drupal Ray Enterprise Translation module allows an attacker to perform unauthorized actions on behalf of an authenticated user. Affected versions: 0.0.0 to 4.0.4, 4.1.0 to 4.1.4, and 11.0.0 to 11.0.4.
The Login Disable plugin for Drupal versions 0.0.0 through 2.1.4 does not restrict excessive authentication attempts, allowing brute force attacks on user passwords.
A CSRF vulnerability in Drupal Salesforce Suite allows an attacker to perform unauthorized actions on behalf of an authenticated user. The issue affects versions from 0.0.0 to 5.1.3.
The Geolocation Field plugin for Drupal contains an SQL injection vulnerability due to improper neutralization of special elements in SQL commands. This affects all versions from 0.0.0 to 3.15.0.
Missing authorization in the Drupal Paragraphs module allows Forceful Browsing. This affects versions from 0.0.0 to 1.21.0.
Missing authorization in the Drupal Paragraphs module allows Forceful Browsing. This affects versions from 0.0.0 to 1.21.0.
The WissKI plugin for Drupal contains a missing authorization vulnerability, allowing an attacker to perform forceful browsing and access unauthorized resources. This affects all versions from 0.0.0 to 4.2.0.
The Commerce Realex / Global Payments plugin for Drupal contains an incorrect authorization vulnerability allowing forceful browsing. Affected versions range from 0.0.0 to 3.0.2.
The AI Agents plugin for Drupal contains an incorrect authorization vulnerability that allows Forceful Browsing attacks. The issue affects versions from 0.0.0 to 1.1.4, from 1.2.0 to 1.2.5, and from 1.3.0 to 1.3.1.
A missing authorization vulnerability in Drupal AI Agents allows forceful browsing. This affects versions from 0.0.0 to 1.1.4, from 1.2.0 to 1.2.5, and from 1.3.0 to 1.3.1.
A Cross-Site Scripting (XSS) vulnerability has been found in the Drupal AI (Artificial Intelligence) module due to improper input neutralization during page generation. It affects versions from 0.0.0 to 1.2.17, from 1.3.0 to 1.3.8, and from 1.4.0 to 1.4.3.
A stored Cross-Site Scripting (XSS) vulnerability has been found in the Drupal Advanced Content Feedback (admin_feedback) module. The flaw stems from improper input neutralization during web page generation.
A Stored Cross-Site Scripting (XSS) vulnerability has been discovered in the Tagify module for Drupal. The flaw is caused by improper neutralization of input during web page generation.
The Anti-Spam by CleanTalk plugin for Drupal contains a reflected Cross-site Scripting (XSS) vulnerability due to improper input neutralization during page generation. This affects versions from 0.0.0 to 9.7.1.
A Stored Cross-Site Scripting (XSS) vulnerability was found in Drupal Commerce Core due to improper input neutralization during page generation. It affects versions from 3.3.0 to 3.3.6.
Misskey prior to version 2026.6.0 contains a Server-Side Request Forgery (SSRF) vulnerability in the URL preview functionality. Missing network restrictions before establishing outbound connections allow a remote attacker to send HTTP requests to loopback, private, or link-local services.
A vulnerability in OpenReplay before version 1.27.0 allows an authenticated user to read any ClickHouse table via SQL injection in the session search and analytics API. The attacker can perform blind boolean and time-based data exfiltration and disrupt session search for all users.
RabbitMQ prior to versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6 does not perform authorization checks on passive queue.declare and exchange.declare AMQP 0-9-1 operations. This allows any authenticated user connected to a virtual host to enumerate queue and exchange names and read queue message and consumer counts.
A vulnerability in RabbitMQ before version 4.2.6 allows an existing consumer to keep receiving messages after OAuth token expiry or connection.update_secret refresh to reduced scopes. This occurs because existing consumers are not canceled or reauthorized at delivery time after the channel user state changes.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS