CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.08.27)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The Drupal Powerful Surveys module has an unspecified vulnerability. Affects all versions.
The Drupal Disable Login Page module has an unspecified vulnerability. Affects all versions.
The Drupal Token Content Access module has an Observable Timing Discrepancy vulnerability that allows Brute Force attacks. Affected versions: from 0.0.0 to 3.1.2.
The Drupal PanKM module has an unspecified vulnerability. Affects all versions.
Missing Authorization vulnerability in Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery allows Forceful Browsing. This issue affects versions from 0.0.0 to 3.2.0.
Incorrect Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. This issue affects versions from 0.0.0 to 4.1.0.
Vulnerability in Drupal Lunr exposed filters. This issue affects all versions.
Vulnerability in Drupal Email Login OTP. This issue affects all versions.
Vulnerability in Drupal Commerce Elavon. This issue affects all versions.
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Search API Autocomplete allows Reflected XSS. This issue affects versions from 0.0.0 to 1.12.0.
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Internationalization Single Sign-On allows Authentication Bypass. This issue affects versions from 0.0.0 to 1.8.0.
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Media Folders allows Stored XSS. This issue affects versions from 0.0.0 to 1.0.8.
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects versions: from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, and all versions up to 11.2.*.
Missing Authorization vulnerability in Drupal Drupal core allows Forceful Browsing. This issue affects versions: up to 10.6.13, from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, and all versions up to 11.0.*, 11.1.*, and 11.2.*.
Vulnerability in Drupal Development Environment. This issue affects all versions of this environment.
A stack-based buffer overflow vulnerability exists in BlueZ, the Linux Bluetooth protocol stack. A remote user within Bluetooth radio range can send a specially crafted Extended Inquiry Response (EIR) packet that causes a buffer overflow when the target device performs Bluetooth discovery. This vulnerability can lead to a Denial of Service (DoS) by crashing the bluetoothd service and may allow for arbitrary code execution.
BlueZ sdp-xml.c type confusion via RegisterProfile(ServiceRecord) can crash bluetoothd (local DoS): a crafted nested ServiceRecord can corrupt the SDP XML parser stack so scalar union data is treated as a sequence pointer, allowing a local caller to crash bluetoothd.
In OpenStack Keystone before 29.0.3, tokens obtained via delegated authentication mechanisms (OAuth1 access tokens, application credentials, trusts) could be submitted to the token-method authentication path for reauthentication to escape their intended project scope. When an application credential token was presented with no explicit scope, Keystone would issue a new token scoped to the credential owner's default project rather than the project for which the credential was issued, bypassing the intended project boundary. All Keystone deployments that permit delegated authentication through OAuth1 access tokens, application credentials, or trusts are affected.
In OpenStack Keystone before 29.0.3, tokens obtained via OAuth1 access token, application credential, or trust-scoped authentication could create new long-lived credentials or authorize new delegations that persist independently of, and outlive, the credential used to obtain them. The delegation restrictions that block these operations did not consistently apply to all delegated token types, allowing an OAuth1-scoped token, for example, to create application credentials or authorize OAuth1 request tokens despite those operations being restricted for other delegated token types. All Keystone deployments that permit delegated authentication through OAuth1 access tokens, application credentials, or trusts are affected.
A vulnerability was identified in code-projects Simple Inventory System 1.0. This vulnerability affects unknown code of the file /InventoryManagement/edit.php. The manipulation of the argument ID leads to sql injection. The attack is possible to be carried out remotely. The exploit is publicly available and might be used.