Threat database

247 threats

Threat database
Severity	CVSS	Signals	Threat	Source	Published
Medium	4.8	EPSS 0.1%	CVE-2026-87944SAML SSO - Service Provider · Improper Certificate Validation Medium4.8EPSS 0.1%2026-10-22CVE Database V5CVE-2026-87944 Improper Certificate Validation vulnerability in Drupal SAML SSO - Service Provider allows Adversary in the Middle (AiTM). This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0. EPSS 0.1%Vulnerability Drupal #cwe-295	CVE Database V5	2026-10-22
Medium	5.4	EPSS 0.2%	CVE-2026-87945SAML SSO - Service Provider · Open Redirect Medium5.4EPSS 0.2%2026-10-22CVE Database V5CVE-2026-87945 URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal SAML SSO - Service Provider allows Fake the Source of Data. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0. EPSS 0.2%Vulnerability Drupal #cwe-601	CVE Database V5	2026-10-22
Medium	4.8	EPSS 0.2%	CVE-2026-87946SAML SSO - Service Provider · Observable Timing Discrepancy Medium4.8EPSS 0.2%2026-10-22CVE Database V5CVE-2026-87946 Observable Timing Discrepancy vulnerability in Drupal SAML SSO - Service Provider allows Brute Force. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0. EPSS 0.2%Vulnerability Drupal #cwe-208	CVE Database V5	2026-10-22
Medium	4.8	EPSS 0.1%	CVE-2026-87947SAML SSO - Service Provider · Improper Verification of Cryptographic Signature Medium4.8EPSS 0.1%2026-10-22CVE Database V5CVE-2026-87947 Improper Verification of Cryptographic Signature vulnerability in Drupal SAML SSO - Service Provider allows Signature Spoof. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0. EPSS 0.1%Vulnerability Drupal #cwe-347	CVE Database V5	2026-10-22
Low	3.5	EPSS 0.2%	CVE-2026-87948SAML SSO - Service Provider · Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") in Drupal… Low3.5EPSS 0.2%2026-10-22CVE Database V5CVE-2026-87948 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal SAML SSO - Service Provider allows Cross-Site Scripting (XSS). This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0. EPSS 0.2%Vulnerability Drupal #cwe-79	CVE Database V5	2026-10-22
Low	3.3	EPSS 0.2%	CVE-2026-87949SAML SSO - Service Provider · Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") in Drupal… Low3.3EPSS 0.2%2026-10-22CVE Database V5CVE-2026-87949 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal SAML SSO - Service Provider allows Cross-Site Scripting (XSS). This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0. EPSS 0.2%Vulnerability Drupal #cwe-79	CVE Database V5	2026-10-22
Medium	5.3	EPSS 0.2%	CVE-2026-87950SAML SSO - Service Provider · Use of Hard-coded Credentials Medium5.3EPSS 0.2%2026-10-22CVE Database V5CVE-2026-87950 Use of Hard-coded Credentials vulnerability in Drupal SAML SSO - Service Provider allows Retrieve Embedded Sensitive Data. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0. EPSS 0.2%Vulnerability Drupal #cwe-798	CVE Database V5	2026-10-22
Low	3.8	EPSS 0.2%	CVE-2026-87951SAML SSO - Service Provider · Insecure Storage of Sensitive Information Low3.8EPSS 0.2%2026-10-22CVE Database V5CVE-2026-87951 Insecure Storage of Sensitive Information vulnerability in Drupal SAML SSO - Service Provider allows Retrieve Embedded Sensitive Data. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0. EPSS 0.2%Vulnerability Drupal #cwe-922	CVE Database V5	2026-10-22
Low	3.1	EPSS 0.2%	CVE-2026-87952SAML SSO - Service Provider · Authentication Bypass by Capture-replay Low3.1EPSS 0.2%2026-10-22CVE Database V5CVE-2026-87952 Authentication Bypass by Capture-replay vulnerability in Drupal SAML SSO - Service Provider allows Remote Services with Stolen Credentials. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0. EPSS 0.2%Vulnerability Drupal #cwe-294	CVE Database V5	2026-10-22
Low	3.3	EPSS 0.2%	CVE-2026-87953SAML SSO - Service Provider · Server-Side Request Forgery (SSRF) Low3.3EPSS 0.2%2026-10-22CVE Database V5CVE-2026-87953 Server-Side Request Forgery (SSRF) vulnerability in Drupal SAML SSO - Service Provider allows Server Side Request Forgery. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0. EPSS 0.2%Vulnerability Drupal #cwe-918	CVE Database V5	2026-10-22
Medium	4.3	EPSS 0.2%	CVE-2026-87954Taxonomy Term Glossary · Missing Authorization Medium4.3EPSS 0.2%2026-10-22CVE Database V5CVE-2026-87954 Missing Authorization vulnerability in Drupal Taxonomy Term Glossary allows Forceful Browsing. This issue affects Taxonomy Term Glossary versions: from 0.0.0 to 4.6.0. EPSS 0.2%Vulnerability Drupal #cwe-862	CVE Database V5	2026-10-22
Medium	4.3	EPSS 0.2%	CVE-2026-87955Ultimate Table Field · Missing Authorization Medium4.3EPSS 0.2%2026-10-22CVE Database V5CVE-2026-87955 Missing Authorization vulnerability in Drupal Ultimate Table Field allows Forceful Browsing. This issue affects Ultimate Table Field versions: from 0.0.0 to 1.1.1, from 2.0.0 to 2.0.1. EPSS 0.2%Vulnerability Drupal #cwe-862	CVE Database V5	2026-10-22
Low	3.5	EPSS 0.2%	CVE-2026-96360Webform · Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") in Drupal… Low3.5EPSS 0.2%2026-10-22CVE Database V5CVE-2026-96360 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Cross-Site Scripting (XSS). This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1. EPSS 0.2%Vulnerability Drupal #cwe-79	CVE Database V5	2026-10-22
Medium	4.6	EPSS 0.2%	CVE-2026-96361Webform · Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") in Drupal… Medium4.6EPSS 0.2%2026-10-22CVE Database V5CVE-2026-96361 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Cross-Site Scripting (XSS). This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1. EPSS 0.2%Vulnerability Drupal #cwe-79	CVE Database V5	2026-10-22
Medium	4.6	EPSS 0.2%	CVE-2026-96358Webform · Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") in Drupal… Medium4.6EPSS 0.2%2026-10-22CVE Database V5CVE-2026-96358 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Cross-Site Scripting (XSS). This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1. EPSS 0.2%Vulnerability Drupal #cwe-79	CVE Database V5	2026-10-22
Medium	4.6	EPSS 0.2%	CVE-2026-96359Webform · Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") in Drupal… Medium4.6EPSS 0.2%2026-10-22CVE Database V5CVE-2026-96359 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Cross-Site Scripting (XSS). This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1. EPSS 0.2%Vulnerability Drupal #cwe-79	CVE Database V5	2026-10-22
Medium	4.2	EPSS 0.2%	CVE-2026-96362Webform · Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") in Drupal… Medium4.2EPSS 0.2%2026-10-22CVE Database V5CVE-2026-96362 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Cross-Site Scripting (XSS). This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1. EPSS 0.2%Vulnerability Drupal #cwe-79	CVE Database V5	2026-10-22
High	–	EPSS 0.2%	CVE-2026-96363Webform · Privilege Defined With Unsafe Actions HighEPSS 0.2%2026-10-22CVE Database V5CVE-2026-96363 CVE-2026-96363 is a vulnerability in the Drupal Webform module where a privilege is defined with unsafe actions, leading to a Stored Cross-Site Scripting (XSS) issue. This affects Webform versions from 0.0.0 up to but not including 6.2.12, and from 6.3.0 up to but not including 6.3.1. The vulnerability allows an attacker with the affected privilege to inject persistent malicious scripts. No CVSS score is provided, and no known exploits are reported in the wild. EPSS 0.2%Vulnerability Drupal #cwe-267	CVE Database V5	2026-10-22
Medium	4.6	EPSS 0.2%	CVE-2026-96367Webform · Privilege Defined With Unsafe Actions Medium4.6EPSS 0.2%2026-10-22CVE Database V5CVE-2026-96367 Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1. EPSS 0.2%Vulnerability Drupal #cwe-267	CVE Database V5	2026-10-22
Medium	4.6	EPSS 0.2%	CVE-2026-96368Webform · Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") in Drupal… Medium4.6EPSS 0.2%2026-10-22CVE Database V5CVE-2026-96368 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1. EPSS 0.2%Vulnerability Drupal #cwe-79	CVE Database V5	2026-10-22

Showing 21–40 of 247 results