CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.06)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The Drupal Combined image style module contains an allocation of resources without limits or throttling vulnerability, allowing excessive allocation. This issue affects Combined image style versions from 0.0.0 to 1.0.7.
Drupal Cloud contains an OS Command Injection vulnerability due to improper neutralization of special elements used in OS commands. This issue affects Cloud versions from 0.0.0 to 7.0.1.
The Drupal Cloud module contains an improper certificate validation vulnerability enabling an Adversary in the Middle (AiTM) attack. The issue affects versions from 0.0.0 to 7.0.1.
The Drupal Project Browser module contains a Cross-Site Request Forgery (CSRF) vulnerability that may allow unwanted actions on behalf of a logged-in user. The issue affects versions from 0.0.0 to 2.0.3 and from 2.1.0 to 2.1.5.
The Drupal Webform module contains an incorrect authorization vulnerability allowing forceful browsing. This issue affects Webform versions from 0.0.0 to 6.2.12 and from 6.3.0 to 6.3.1.
The Drupal Webform module has an insufficient granularity of access control vulnerability, allowing forceful browsing. This issue affects Webform versions from 0.0.0 to 6.2.12 and from 6.3.0 to 6.3.1.
The Drupal Webform module contains a Privilege Defined With Unsafe Actions vulnerability that allows stored XSS. The issue affects versions from 0.0.0 to 6.2.12 and from 6.3.0 to 6.3.1.
The Drupal Webform module has an incorrect authorization vulnerability, allowing Server Side Request Forgery (SSRF). This issue affects Webform versions from 0.0.0 to 6.2.12 and from 6.3.0 to 6.3.1.
The Drupal Webform module uses browser cache containing sensitive information due to incorrectly configured access control security levels. This issue affects Webform versions from 0.0.0 to 6.2.12 and from 6.3.0 to 6.3.1.
The Drupal Webform module has an improper neutralization of input during web page generation vulnerability, leading to stored Cross-site Scripting (XSS). This issue affects Webform versions from 0.0.0 to 6.2.12 and from 6.3.0 to 6.3.1.
The Webform module for Drupal contains a Privilege Defined With Unsafe Actions vulnerability that allows Stored XSS. This issue affects Webform versions from 0.0.0 to 6.2.12 and from 6.3.0 to 6.3.1.
The Drupal Webform module has an incorrect authorization vulnerability, allowing forceful browsing. This issue affects Webform versions from 0.0.0 to 6.2.12 and from 6.3.0 to 6.3.1.
The Drupal Webform module contains an Allocation of Resources Without Limits or Throttling vulnerability allowing Excessive Allocation. This issue affects Webform versions from 0.0.0 to 6.2.12 and from 6.3.0 to 6.3.1.
Improper Control of Interaction Frequency vulnerability in Drupal Webform allows Functionality Misuse. This issue affects Webform versions from 0.0.0 to 6.2.12 and from 6.3.0 to 6.3.1.
Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Cross-Site Scripting (XSS). This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Cross-Site Scripting (XSS). This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
The Drupal Webform module contains a cross-site scripting (XSS) vulnerability due to improper neutralization of input during web page generation. This issue affects Webform versions from 0.0.0 to 6.2.12 and from 6.3.0 to 6.3.1.
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Cross-Site Scripting (XSS). This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
The Webform module for Drupal is vulnerable to Cross-Site Scripting (XSS) due to improper neutralization of input during web page generation. This affects versions from 0.0.0 to 6.2.12 and from 6.3.0 to 6.3.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS