Threat database

1,062 threats

Severity	CVSS	Threat	Source	Published
High	–	CVE-2026-114524Drupal Custom Formatters · Privilege Defined With Unsafe Actions Vulnerability High2026-10-30GCVE DatabaseCVE-2026-114524 Privilege Defined With Unsafe Actions vulnerability in Drupal Custom Formatters allows Privilege Escalation. This issue affects Custom Formatters versions: from 0.0.0 to 4.2.1. Report on CVE-2026-114524 Vulnerability CWE-267 #ghsa-v2vw-2hfx-2h4m	GCVE Database	2026-10-30
High	–	CVE-2026-114532Drupal UI Icons · Cross-site Scripting High2026-10-30GCVE DatabaseCVE-2026-114532 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal UI Icons allows Cross-Site Scripting (XSS). This issue affects UI Icons versions: from 0.0.0 to 1.1.3, from 2.0.0 to 2.0.2. Report on CVE-2026-114532 Vulnerability CWE-79 #ghsa-rxw8-5346-9f4r	GCVE Database	2026-10-30
High	–	CVE-2026-114531 · Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability High2026-10-30GCVE Database Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Swiper formatter allows Stored XSS. This issue affects Swiper formatter versions: from 0.0.0 to 2.1.2, from 3.0.1 to 3.1.0. Report on CVE-2026-114531 Vulnerability CWE-79 #ghsa-qq39-577c-fc5w	GCVE Database	2026-10-30
High	–	CVE-2026-110738Drupal Gin Admin Theme · Cross-site Scripting High2026-10-30GCVE DatabaseCVE-2026-110738 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Gin Admin Theme allows Cross-Site Scripting (XSS). This issue affects Gin Admin Theme versions: from 0.0.0 to 4.1.4, from 5.0.0 to 5.0.16. Report on CVE-2026-110738 Vulnerability CWE-79 #ghsa-pgj3-xvxh-67cp	GCVE Database	2026-10-30
High	–	CVE-2026-114525 · Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability High2026-10-30GCVE Database Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal ABC allows Stored XSS. This issue affects ABC versions: from 0.0.0 to 1.25.0, from 2.0.0 to 2.0.1. Report on CVE-2026-114525 Vulnerability CWE-79 #ghsa-pc6g-hcpv-rfp9	GCVE Database	2026-10-30
High	–	CVE-2026-114530Drupal Dopup · Incorrect Authorization Vulnerability High2026-10-30GCVE DatabaseCVE-2026-114530 Incorrect Authorization vulnerability in Drupal Dopup allows Forceful Browsing. This issue affects Dopup versions: from 0.0.0 to 1.0.7. Report on CVE-2026-114530 Vulnerability CWE-863 #ghsa-j7q7-fjvx-wqxr	GCVE Database	2026-10-30
High	–	CVE-2026-114528 · Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability High2026-10-30GCVE Database Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Zero Point allows Stored XSS. This issue affects Zero Point versions: from 0.0.0 to 1.30.0, from 2.0.0 to 2.0.1. Report on CVE-2026-114528 Vulnerability CWE-79 #ghsa-g5xr-324v-xf2r	GCVE Database	2026-10-30
High	–	CVE-2026-108514Drupal Drupal core · Cross-site Scripting High2026-10-30GCVE DatabaseCVE-2026-108514 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Drupal core versions: from 10.3.0 to 10.6.19, from 11.0.0 to 11.3.19, from 11.4.0 to 11.4.10, from 12.0.0-alpha1 to 12.0.0-beta2. Report on CVE-2026-108514 Vulnerability CWE-79 #ghsa-8pmv-83q8-mcx5	GCVE Database	2026-10-30
High	–	CVE-2026-114526 · Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability High2026-10-30GCVE Database Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Black Hole allows Stored XSS. This issue affects Black Hole versions: from 0.0.0 to 1.26.0, from 2.0.0 to 2.0.1. Report on CVE-2026-114526 Vulnerability CWE-79 #ghsa-8j7f-9vj8-grqv	GCVE Database	2026-10-30
High	–	CVE-2026-114523Drupal Ffmpeg Image Toolkit · Improper Neutralization of Special Elements Used High2026-10-30GCVE DatabaseCVE-2026-114523 Improper Neutralization of Special Elements used in an OS Command ("OS Command Injection") vulnerability in Drupal Ffmpeg Image Toolkit allows OS Command Injection. This issue affects Ffmpeg Image Toolkit versions: from 0.0.0 to 1.0.3. Report on CVE-2026-114523 Vulnerability CWE-78 #ghsa-8hr7-865w-p2c4	GCVE Database	2026-10-30
High	–	CVE-2026-114529 · Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability High2026-10-30GCVE Database Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal CSV Field allows Stored XSS. This issue affects CSV Field versions: from 0.0.0 to 2.0.10, from 3.0.0 to 3.0.7. Report on CVE-2026-114529 Vulnerability CWE-79 #ghsa-6j4f-769r-j7ww	GCVE Database	2026-10-30
High	–	CVE-2026-114527Drupal UI Icons · Cross-site Scripting High2026-10-30GCVE DatabaseCVE-2026-114527 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal UI Icons allows Cross-Site Scripting (XSS). This issue affects UI Icons versions: from 0.0.0 to 1.1.3, from 2.0.0 to 2.0.2. Report on CVE-2026-114527 Vulnerability CWE-79 #ghsa-3cw8-5v68-cpr4	GCVE Database	2026-10-30
High	–	CVE-2026-108515Drupal Drupal core · Cross-site Scripting High2026-10-30GCVE DatabaseCVE-2026-108515 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Drupal core versions: from 8.9.0 to 10.6.19, from 11.0.0 to 11.3.19, from 11.4.0 to 11.4.10, from 12.0.0-alpha1 to 12.0.0-beta2. Report on CVE-2026-108515 Vulnerability CWE-79 #ghsa-297f-h4fx-vc6c	GCVE Database	2026-10-30
High	–	CVE-2026-108097 · Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in High2026-10-30GCVE Database Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Drupal Drupal core allows Reflection Injection. This issue affects Drupal core versions: from 8.9.0 to 10.6.19, from 11.0.0 to 11.3.19, from 11.4.0 to 11.4.10, from 12.0.0-alpha1 to 12.0.0-beta2. Report on CVE-2026-108097 Vulnerability CWE-470 #ghsa-x75q-mvwp-2h36	GCVE Database	2026-10-30
High	–	CVE-2026-107311 · Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal Permissions by Term High2026-10-30GCVE Database Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal Permissions by Term allows Forceful Browsing. This issue affects Permissions by Term versions: from 0.0.0 to 3.1.41. Report on CVE-2026-107311 Vulnerability CWE-754 #ghsa-wm34-8fvp-f9p7	GCVE Database	2026-10-30
High	–	CVE-2026-107266Drupal Views Share · Missing Authorization Vulnerability High2026-10-30GCVE DatabaseCVE-2026-107266 Missing Authorization vulnerability in Drupal Views Share allows Forceful Browsing. This issue affects Views Share versions: from 0.0.0 to 2.0.1. Report on CVE-2026-107266 Vulnerability CWE-862 #ghsa-w828-mg5j-r2g3	GCVE Database	2026-10-30
High	–	CVE-2026-107310Drupal Freelinking · Server-Side Request Forgery (SSRF) Vulnerability High2026-10-30GCVE DatabaseCVE-2026-107310 Server-Side Request Forgery (SSRF) vulnerability in Drupal Freelinking allows Server Side Request Forgery. This issue affects Freelinking versions: from 0.0.0 to 4.0.3. Report on CVE-2026-107310 Vulnerability CWE-918 #ghsa-p6fh-9484-jwr6	GCVE Database	2026-10-30
Medium	–	CVE-2026-107312 · Allocation of Resources Without Limits or Throttling vulnerability in Drupal Examples for Developers Medium2026-10-30GCVE Database Allocation of Resources Without Limits or Throttling vulnerability in Drupal Examples for Developers allows Excessive Allocation. This issue affects Examples for Developers versions: from 0.0.0 to 4.0.7. Report on CVE-2026-107312 Vulnerability CWE-770 #ghsa-j54p-jqj3-27c9	GCVE Database	2026-10-30
High	–	CVE-2026-107307Drupal SmartLinker AI · Incorrect Authorization Vulnerability High2026-10-30GCVE DatabaseCVE-2026-107307 Incorrect Authorization vulnerability in Drupal SmartLinker AI allows Forceful Browsing. This issue affects SmartLinker AI versions: from 0.0.0 to 1.0.3. Report on CVE-2026-107307 Vulnerability CWE-863 #ghsa-hvjg-3x8r-ppfw	GCVE Database	2026-10-30
High	–	CVE-2026-108099 · Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in High2026-10-30GCVE Database Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Drupal Entity List allows Reflection Injection. This issue affects Entity List versions: from 0.0.0 to 3.0.10. Report on CVE-2026-108099 Vulnerability CWE-470 #ghsa-9xvr-v24x-c9rf	GCVE Database	2026-10-30

Page 8 of 164