CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.06)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
The Webform module for Drupal has an incorrect authorization vulnerability that allows forceful browsing. This affects versions from 0.0.0 to 6.2.12 and from 6.3.0 to 6.3.1.
The Webform module for Drupal (versions 0.0.0 to 6.2.12 and 6.3.0 to 6.3.1) is vulnerable to code injection due to improper neutralization of special elements used in a template engine.
Missing Authorization vulnerability in Drupal Ultimate Table Field allows Forceful Browsing. This issue affects Ultimate Table Field versions from 0.0.0 to 1.1.1 and from 2.0.0 to 2.0.1.
Missing Authorization vulnerability in Drupal Taxonomy Term Glossary allows Forceful Browsing. This issue affects Taxonomy Term Glossary versions from 0.0.0 to 4.6.0.
A Server-Side Request Forgery (SSRF) vulnerability in the Drupal SAML SSO - Service Provider module allows server-side request forgery. The issue affects versions from 0.0.0 to 3.2.0.
The Drupal SAML SSO - Service Provider module is vulnerable to authentication bypass via capture-replay, allowing remote services with stolen credentials. This issue affects SAML SSO - Service Provider versions from 0.0.0 to 3.2.0.
The Drupal SAML SSO - Service Provider module in versions from 0.0.0 to 3.2.0 stores sensitive information insecurely, allowing retrieval of embedded sensitive data. The vulnerability concerns improper protection of data stored by the module.
The Drupal SAML SSO - Service Provider module contains a use of hard-coded credentials vulnerability, allowing retrieval of embedded sensitive data. This issue affects SAML SSO - Service Provider versions from 0.0.0 to 3.2.0.
A Cross-Site Scripting (XSS) vulnerability in the Drupal SAML SSO - Service Provider module arises from improper neutralization of input during web page generation. The issue affects versions from 0.0.0 to 3.2.0.
A Cross-Site Scripting (XSS) vulnerability in the Drupal SAML SSO - Service Provider module arises from improper neutralization of input during web page generation. The issue affects versions from 0.0.0 to 3.2.0.
The Drupal SAML SSO - Service Provider module contains an improper cryptographic signature verification vulnerability enabling signature spoofing. The issue affects versions from 0.0.0 to 3.2.0.
Observable Timing Discrepancy vulnerability in Drupal SAML SSO - Service Provider allows Brute Force. This issue affects SAML SSO - Service Provider versions from 0.0.0 to 3.2.0.
The Drupal SAML SSO - Service Provider module contains an open redirect vulnerability, allowing faking the source of data by redirecting users to an untrusted site. This issue affects SAML SSO - Service Provider versions from 0.0.0 to 3.2.0.
The Drupal SAML SSO - Service Provider module contains an improper certificate validation vulnerability enabling an Adversary in the Middle (AiTM) attack. The issue affects versions from 0.0.0 to 3.2.0.
The Drupal SAML SSO - Service Provider module contains a missing authorization vulnerability, allowing forceful browsing. This issue affects SAML SSO - Service Provider versions from 0.0.0 to 3.2.0.
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal SafeDelete allows Stored XSS. This issue affects SafeDelete versions from 0.0.0 to 1.0.88.
A vulnerability was found in the Drupal Patreon module. This issue affects Patreon versions 7.x; the description does not specify the nature of the vulnerability.
The Drupal Key auth module uses browser cache containing sensitive information, allowing exploitation of incorrectly configured access control security levels. This issue affects Key auth versions from 0.0.0 to 2.2.4.
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Feed Block allows Stored XSS. This issue affects Feed Block versions from 0.0.0 to 2.0.2 and from 3.0.0 to 3.0.2.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS