CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.06)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The Field Permissions module for Drupal contains an incorrect authorization vulnerability that allows forceful browsing. This issue affects versions from 0.0.0 to 1.6.0.
The Field Permissions module for Drupal contains an incorrect authorization vulnerability that allows forceful browsing. This issue affects versions from 0.0.0 to 1.6.0.
The CAPTCHA module for Drupal contains an authentication bypass using an alternate path or channel vulnerability that allows functionality bypass. This issue affects versions from 0.0.0 to 1.18.0 and from 2.0.0 to 2.0.11.
The Stage File Proxy module for Drupal contains a Cross-site Scripting (XSS) vulnerability caused by improper neutralization of input during web page generation. This issue affects versions from 0.0.0 to 3.1.7 and from 4.0.0 to 4.0.1.
The Signature pad widget module for Drupal contains a Stored Cross-site Scripting (XSS) vulnerability caused by improper neutralization of input during web page generation. This issue affects versions from 0.0.0 to 1.15.0.
The S3 File System module for Drupal contains an incorrect permission assignment for a critical resource vulnerability that allows exploitation of incorrectly configured access control security levels. This issue affects versions from 0.0.0 to 3.12.0.
The OAuth2 Token Manager module for Drupal contains a missing authorization vulnerability that allows forceful browsing. This issue affects versions from 0.0.0 to 1.2.0.
The OAuth Login - OAuth OIDC SSO module for Drupal contains an authentication bypass using an alternate path or channel vulnerability. This issue affects versions from 0.0.0 to 3.1.1.
The Media Alias Display module for Drupal contains a use of web browser cache containing sensitive information vulnerability that allows exploitation of incorrectly configured access control security levels. This issue affects versions from 0.0.0 to 2.1.3 and from 3.0.0 to 3.0.3.
The Fasttoggle module for Drupal contains a Cross-Site Request Forgery (CSRF) vulnerability that allows an attacker to force unwanted actions on behalf of a logged-in user. The issue affects versions from 0.0.0 to 4.1.1.
The Fasttoggle module for Drupal contains an Incorrect Authorization vulnerability that allows Forceful Browsing of resources a user should not be able to access. The issue affects versions from 0.0.0 to 4.1.1.
The Content Sync (content-sync.io) module for Drupal stores sensitive information insecurely, allowing it to be retrieved. The issue affects versions from 0.0.0 to 3.2.2.
The Bulk Update User Roles module for Drupal contains an Incorrect Authorization vulnerability that allows Forceful Browsing of the module's functionality. The issue affects versions from 0.0.0 to 1.0.5.
A vulnerability has been identified in the GroupEx PRO (Daxko) integration for Drupal. The description does not specify the nature of the vulnerability, and the issue affects all versions of the integration.
A vulnerability has been identified in the PayUmoney for Drupal Commerce module. The description does not specify the nature of the vulnerability, and the issue affects all versions of the module.
A vulnerability has been identified in the CacheFlush module for Drupal. The description does not specify the nature of the vulnerability, and the issue affects all versions of the module.
The Single Content Sync module for Drupal contains a Deserialization of Untrusted Data vulnerability that allows Object Injection. The issue affects versions from 0.0.0 to 1.4.19.
The Single Content Sync module for Drupal contains an External Control of File Name or Path vulnerability that allows Path Traversal. The issue affects versions from 0.0.0 to 1.4.19.
The Commerce Stripe module for Drupal contains a Cross-Site Scripting (XSS) vulnerability caused by improper neutralization of input during web page generation. The issue affects versions from 2.0.0 to 2.2.3.
The Drupal Commerce Stripe module contains an improper verification of cryptographic signature vulnerability, allowing signature spoofing. This issue affects versions from 0.0.0 to 1.4 and from 2.0.0 to 2.2.3.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS