A stored cross-site scripting (XSS) vulnerability exists in the Drupal CookieCuttr module versions 2.0.0 through 2.0.3. This vulnerability is due to improper neutralization of input during web page generation, allowing malicious scripts to be stored and executed in users' browsers.
An authentication bypass vulnerability exists in Drupal REST & JSON API Authentication versions up to 3.2.0. This flaw allows attackers to bypass authentication by using an alternate path or channel. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity impact with low complexity and no user interaction required.
An authentication bypass vulnerability exists in the Drupal Stop administrator login module, affecting versions 1.0 through 1.6. This flaw allows an attacker with high privileges to bypass authentication using an alternate path or channel. The vulnerability has a low CVSS score of 3.8, indicating limited impact primarily on confidentiality and integrity without availability impact. No patch or remediation information is currently provided.
A Cross-Site Request Forgery (CSRF) vulnerability exists in the Drupal Tawk.to live chat application, affecting versions from 0.0.0 up to 3.0.4. This vulnerability allows attackers to trick authenticated users into submitting unauthorized requests. The issue has a medium severity with a CVSS score of 5.4.
A privilege escalation vulnerability exists in the Drupal Editoria11y Accessibility Checker due to unsafe actions being defined within a privilege. This affects versions from 0.0.0 to 2.2.23 and from 3.0.0 to 3.0.9. The vulnerability allows users with limited privileges to escalate their permissions. The CVSS score is 4.3 (medium severity), indicating a moderate impact primarily on integrity. No patch or remediation information is currently provided.
CVE-2026-96391 is a missing authorization vulnerability in the Drupal Webform REST module that allows forceful browsing. It affects Webform REST versions from 0.0.0 up to but not including 4.2.1. This vulnerability could enable unauthorized access to resources due to insufficient authorization checks.
A vulnerability identified as CVE-2026-96392 affects the Drupal AI CKEditor component, specifically versions from 0.0.0 up to 1.4.3. The issue involves improper neutralization of special elements used in a template engine, which can lead to code injection. The vulnerability has a low severity rating with a CVSS score of 3.5. No official patch or remediation information is provided in the available data.
A vulnerability in Drupal Combined image style versions up to 1.0.7 allows allocation of resources without limits or throttling, leading to excessive resource consumption. This can cause denial of service conditions due to resource exhaustion. The issue is identified as CVE-2026-96377 and has a medium severity rating with a CVSS score of 5.3.
A missing authorization vulnerability in the Drupal CSS Usage Analyzer module (versions 1.0.0 through 1.0.2) allows unauthorized users to perform forceful browsing, potentially exposing sensitive information. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity level. There is no indication of available patches or vendor advisories at this time.
A missing authorization vulnerability in the Drupal Smart Content module allows unauthorized users to perform forceful browsing. This affects Smart Content versions from 0.0.0 up to 3.2.1. The vulnerability has a CVSS score of 6.5, indicating a medium severity level. It can lead to limited confidentiality and integrity impacts without requiring privileges or user interaction.
A stored cross-site scripting (XSS) vulnerability exists in the Drupal Diba carousel slider module, affecting versions from 0.0.0 up to 3.0.2. This vulnerability is due to improper neutralization of input during web page generation, allowing malicious scripts to be stored and executed in users' browsers. The CVSS score is 4.6, indicating a medium severity level.
CVE-2026-114717 is a mail header injection vulnerability in Roundcube Webmail versions before 1.6.20 and 1.7.x before 1.7.5. The flaw occurs when forwarding a message as an attachment, where the subject line is used directly to name the attachment. If the subject contains CRLF sequences, it can inject arbitrary MIME headers into the outgoing message. This issue has been fixed by collapsing whitespace in the generated attachment name.
In October 2026, a Chinese-speaking threat actor conducted a global AI-assisted hacking campaign using the ARTEX penetration testing framework combined with multiple AI coding assistants. The attacks targeted organizations across finance, retail, education, cryptocurrency, and telecommunications sectors in over 20 countries worldwide. The campaign utilized custom scripts to maintain context across AI sessions and divided tasks among specialized AI agents. The attackers sought bulk personal data, transaction records, and mobile phone numbers, with indications of intent to sell stolen information on underground markets. The workflow included peer review among AI models to improve effectiveness. The campaign is financially motivated and opportunistic in nature.
CVE-2026-114716 is a mail header injection vulnerability in Roundcube Webmail versions 1.6.0 up to but not including 1.6.20, and 1.7.0 up to but not including 1.7.5. The flaw exists in the rcmail_sendmail::extract_inline_images() function, which uses the media type from an inline image data URI without proper validation. This allows a remote authenticated attacker to inject arbitrary MIME part headers into outgoing messages by inserting CRLF sequences in the media type. The issue has been fixed by validating the media type with rcube_mime::is_mimetype_valid().
CVE-2026-114715 is an incorrect authorization vulnerability in Roundcube Webmail affecting versions 1.6.0 up to but not including 1.6.20, and 1.7.0 up to but not including 1.7.5. The flaw exists in the Modoboa driver of the password plugin, where the driver incorrectly uses the first account returned by the Modoboa API instead of verifying the authenticated user's account. This could allow a password change to be applied to a different user account.
CVE-2026-114714 is a path traversal vulnerability in the squirrelmail_usercopy plugin of Roundcube Webmail. Versions before 1.6.20 and 1.7.x before 1.7.5 are affected. The vulnerability arises because the source path for file import is constructed from the login name without filtering out path separators, allowing an attacker to read files outside the intended directory. The issue was fixed by rejecting login names containing slashes.
CVE-2026-114575 is a critical command injection vulnerability in TOTOLINK A950RG version 4.1.2cu.5268_B20221104. The flaw exists in the UploadCustomModule function within the file lib/cste_modules/product.so, where manipulation of the FileMd5 argument allows remote attackers to execute arbitrary commands. An exploit has been published, increasing the risk of exploitation.
The LIFF SDK provided by LY Corporation contains a cross-site scripting (XSS) vulnerability. This vulnerability could allow an attacker to inject malicious scripts into web pages viewed by other users. No specific affected versions or patch information are provided.
A reflected cross-site scripting (XSS) vulnerability exists in localstack version 4.9.2. This flaw allows attackers to execute arbitrary JavaScript in the context of a user's browser by crafting a malicious URL. No CVSS score is provided for this vulnerability.
A vulnerability in localstack version 4.9.2 allows attackers to execute arbitrary code by providing a crafted URL to the templateURL parameter of the _localstack/cloudformation/deploy endpoint. The malicious content hosted at the URL is executed within the context of the docker container running localstack.
