CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.06)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The Easy Breadcrumb module for Drupal contains a missing authorization vulnerability that allows forceful browsing. This issue affects versions from 0.0.0 to 2.0.11.
The Country module for Drupal contains a Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. This issue affects versions from 0.0.0 to 2.1.3 and from 2.2.0 to 2.2.1.
The SmartLinker AI module for Drupal contains an incorrect authorization vulnerability that allows forceful browsing. This issue affects versions from 0.0.0 to 1.0.3.
The Menu Link Attributes module for Drupal contains a Stored Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. This issue affects versions from 0.0.0 to 1.8.0.
The Two Factor Authentication - TFA / Passwordless Login module for Drupal contains a vulnerability involving insertion of sensitive information into sent data, allowing forceful browsing. This issue affects versions from 0.0.0 to 5.4.1 and from 5.5.0 to 5.5.2.
The DKAN module for Drupal contains a missing authorization vulnerability that allows forceful browsing. This issue affects versions from 0.0.0 to 4.0.4 and from 4.1.0 to 4.1.5.
The Views Share module for Drupal contains a missing authorization vulnerability that allows forceful browsing. This issue affects versions from 0.0.0 to 2.0.1.
The Leaflet module for Drupal contains a Stored Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. This issue affects versions from 0.0.0 to 10.4.13.
The Inline Formatter Field module for Drupal contains a vulnerability involving improper neutralization of special elements used in a template engine, allowing code injection. This issue affects versions from 0.0.0 to 4.2.0.
The Gutenberg module for Drupal contains an incorrect authorization vulnerability that allows forceful browsing. This issue affects versions from 0.0.0 to 2.15.0 and from 3.0.0 to 3.0.7.
A Cross-Site Request Forgery (CSRF) vulnerability in the Drupal Advanced Filesystem module allows an attacker to force unwanted actions on behalf of a logged-in user. This issue affects versions from 0.0.0 to 1.0.28.
An authentication bypass using an alternate path or channel in the Drupal Authenticator Login Plus (2FA) module allows bypassing the login mechanism. This issue affects versions from 0.0.0 to 1.0.1.
An improper neutralization of input during web page generation (Cross-site Scripting) vulnerability in the Drupal Sector Distribution allows stored XSS. This issue affects versions from 0.0.0 to 10.3.3 and from 10.4.0 to 10.4.2.
An improper neutralization of special elements used in a template engine vulnerability in the Drupal Linked Field module allows code injection. This issue affects versions from 0.0.0 to 1.8.0.
An incorrect authorization vulnerability in the Drupal Inline Entity Form Dialog module allows forceful browsing. This issue affects versions from 0.0.0 to 1.0.6.
An incorrect authorization vulnerability in the Drupal Actstream module allows forceful browsing. This issue affects versions from 0.0.0 to 2.0.1 and from 2.1.0 to 2.1.1.
The Shield module for Drupal does not properly restrict excessive authentication attempts, enabling brute force attacks. This affects versions from 0.0.0 to 1.9.0.
The Restrict route by IP module for Drupal contains an incorrect authorization vulnerability enabling forceful browsing. This affects versions from 0.0.0 to 1.3.1 and from 2.0.0 to 2.0.1.
The Authenticator Login Plus (2FA) module for Drupal allows authentication bypass using an alternate path or channel. This affects versions from 0.0.0 to 1.0.1.
A vulnerability was found in the Orphans Media module for Drupal, with details not provided in the description. This affects all versions of the module (*.*).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS