CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.06)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The Block Attributes module for Drupal contains a Stored Cross-site Scripting vulnerability caused by improper neutralization of input during web page generation. The issue affects versions from 0.0.0 to 2.1.0.
The Ágora Transparency Theme for Drupal has a missing authorization vulnerability that allows forceful browsing. The issue affects versions from 0.0.0 to 1.2.3.
The UI Icons module for Drupal contains a Cross-site Scripting (XSS) vulnerability caused by improper neutralization of input during web page generation. The issue affects versions from 0.0.0 to 1.1.3 and from 2.0.0 to 2.0.2.
The Swiper formatter module for Drupal contains a Stored XSS vulnerability caused by improper neutralization of input during web page generation. The issue affects versions from 0.0.0 to 2.1.2 and from 3.0.1 to 3.1.0.
The Dopup module for Drupal has an incorrect authorization vulnerability that allows forceful browsing. The issue affects versions from 0.0.0 to 1.0.7.
The CSV Field module for Drupal contains a Stored XSS vulnerability caused by improper neutralization of input during web page generation. The issue affects versions from 0.0.0 to 2.0.10 and from 3.0.0 to 3.0.7.
The Zero Point module for Drupal contains a Stored XSS vulnerability caused by improper neutralization of input during web page generation. The issue affects versions from 0.0.0 to 1.30.0 and from 2.0.0 to 2.0.1.
The UI Icons module for Drupal contains a Cross-site Scripting (XSS) vulnerability caused by improper neutralization of input during web page generation. The issue affects versions from 0.0.0 to 1.1.3 and from 2.0.0 to 2.0.2.
The Black Hole module for Drupal contains a Stored XSS vulnerability caused by improper neutralization of input during web page generation. The issue affects versions from 0.0.0 to 1.26.0 and from 2.0.0 to 2.0.1.
The ABC module for Drupal contains a Stored XSS vulnerability caused by improper neutralization of input during web page generation. The issue affects versions from 0.0.0 to 1.25.0 and from 2.0.0 to 2.0.1.
A Privilege Defined With Unsafe Actions vulnerability in the Drupal Custom Formatters module allows privilege escalation. This issue affects Custom Formatters versions from 0.0.0 to 4.2.1.
The Drupal Ffmpeg Image Toolkit module contains an OS Command Injection vulnerability due to improper neutralization of special elements used in OS commands. This issue affects Ffmpeg Image Toolkit versions from 0.0.0 to 1.0.3.
The Drupal Gin Admin Theme contains a Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. This issue affects Gin Admin Theme versions from 0.0.0 to 4.1.4 and from 5.0.0 to 5.0.16.
Drupal core contains a Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. This issue affects Drupal core versions from 8.9.0 to 10.6.19, from 11.0.0 to 11.3.19, from 11.4.0 to 11.4.10, and from 12.0.0-alpha1 to 12.0.0-beta2.
Drupal core contains a Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. This issue affects Drupal core versions from 10.3.0 to 10.6.19, from 11.0.0 to 11.3.19, from 11.4.0 to 11.4.10, and from 12.0.0-alpha1 to 12.0.0-beta2.
The Drupal Entity List module contains an Unsafe Reflection vulnerability that uses externally-controlled input to select classes or code. This issue affects Entity List versions from 0.0.0 to 3.0.10.
Drupal core contains an Unsafe Reflection vulnerability that uses externally-controlled input to select classes or code. This issue affects Drupal core versions from 8.9.0 to 10.6.19, from 11.0.0 to 11.3.19, from 11.4.0 to 11.4.10, and from 12.0.0-alpha1 to 12.0.0-beta2.
The Drupal Examples for Developers module contains an Allocation of Resources Without Limits or Throttling vulnerability that allows excessive allocation. This issue affects Examples for Developers versions from 0.0.0 to 4.0.7.
The Drupal Permissions by Term module contains an Improper Check for Unusual or Exceptional Conditions vulnerability that allows forceful browsing. This issue affects Permissions by Term versions from 0.0.0 to 3.1.41.
The Drupal Freelinking module contains a Server-Side Request Forgery (SSRF) vulnerability that allows server-side request forgery. This issue affects Freelinking versions from 0.0.0 to 4.0.3.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS