CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.06)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The Drupal Commerce Stripe module contains an improper verification of cryptographic signature vulnerability, allowing signature spoofing. This issue affects versions from 0.0.0 to 1.4 and from 2.0.0 to 2.2.3.
The Drupal Commerce Stripe module is vulnerable to Cross-Site Request Forgery (CSRF), which can force unwanted actions on behalf of a logged-in user. This issue affects versions from 2.0.0 to 2.2.3.
The Drupal Commerce Shipping module has an incorrect authorization vulnerability that allows forceful browsing of unauthorized resources. This issue affects versions from 0.0.0 to 2.16.0 and from 3.0.0 to 3.0.6.
The Drupal Commerce Shipping module contains an incorrect authorization vulnerability enabling forceful browsing. This issue affects versions from 0.0.0 to 2.16.0 and from 3.0.0 to 3.0.6.
The Drupal Commerce License module has an incorrect authorization vulnerability that allows forceful browsing of protected resources. This issue affects versions from 0.0.0 to 3.1.1.
The Drupal OpenID Connect Client module contains an authentication bypass vulnerability using an alternate path or channel. This issue affects versions from 0.0.0 to 2.3.1.
The Drupal AI (Artificial Intelligence) module has an improper neutralization of input during web page generation vulnerability, enabling Stored XSS attacks. This issue affects versions from 0.0.0 to 1.4.11 and from 1.5.0 to 1.5.2.
The Drupal AI (Artificial Intelligence) module contains an improper neutralization of input during web page generation vulnerability, enabling Cross-Site Scripting (XSS) attacks. This issue affects versions from 0.0.0 to 1.4.11 and from 1.5.0 to 1.5.2.
The Drupal AI (Artificial Intelligence) module stores sensitive information insecurely, allowing retrieval of embedded sensitive data. This issue affects versions from 0.0.0 to 1.4.11 and from 1.5.0 to 1.5.2.
The Drupal AI (Artificial Intelligence) module uses web browser cache containing sensitive information, allowing exploitation of incorrectly configured access control security levels. This issue affects versions from 0.0.0 to 1.4.11 and from 1.5.0 to 1.5.2.
A Cross-Site Scripting (XSS) vulnerability in the Drupal AI (Artificial Intelligence) module arises from improper neutralization of input during web page generation. The issue affects versions from 0.0.0 to 1.4.11 and from 1.5.0 to 1.5.2.
An Incorrect Authorization vulnerability in the Drupal AI (Artificial Intelligence) module allows Resource Injection. The issue affects versions from 0.0.0 to 1.4.11 and from 1.5.0 to 1.5.2.
A Cross-Site Scripting (XSS) vulnerability in the Drupal AI (Artificial Intelligence) module arises from improper neutralization of input during web page generation. The issue affects versions from 0.0.0 to 1.4.11 and from 1.5.0 to 1.5.2.
A Cross-Site Scripting (XSS) vulnerability in the Drupal AI (Artificial Intelligence) module arises from improper neutralization of input during web page generation. The issue affects versions from 0.0.0 to 1.4.11 and from 1.5.0 to 1.5.2.
An Exposure of Sensitive Information Through Data Queries vulnerability in the Drupal Commerce Core module allows Forceful Browsing. The issue affects versions from 0.0.0 to 2.41.0 and from 3.0.0 to 3.3.13.
A Cross-Site Request Forgery (CSRF) vulnerability in the Drupal Commerce Core module allows unauthorized actions to be performed on behalf of a logged-in user. The issue affects versions from 0.0.0 to 2.41.0 and from 3.0.0 to 3.3.13.
An Incorrect Authorization vulnerability in the Drupal Commerce Core module allows Forceful Browsing. The issue affects versions from 0.0.0 to 2.41.0 and from 3.0.0 to 3.3.13.
An Incorrect Authorization vulnerability in the Drupal Commerce Core module allows Forceful Browsing. The issue affects versions from 0.0.0 to 2.41.0 and from 3.0.0 to 3.3.13.
An Incorrect Authorization vulnerability in the Drupal Commerce Core module allows Forceful Browsing. The issue affects versions from 0.0.0 to 2.41 and from 3.0.0 to 3.2.0.
A Missing Authorization vulnerability in the Drupal Commerce Core module allows Forceful Browsing. The issue affects versions from 0.0.0 to 2.41 and from 3.0.0 to 3.3.13.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS