A missing authorization vulnerability in the Drupal Advanced Search module allows forceful browsing. This issue affects versions from 0.0.0 up to 2.4.5. The vulnerability has a medium severity rating with a CVSS score of 4.2, indicating limited impact on confidentiality and integrity with no impact on availability. No patch or remediation information is currently provided.
CVE-2026-84917 is an incorrect authorization vulnerability in the Drupal Jsonapi Role Access module that allows forceful browsing. It affects versions from 0.0.0 up to but not including 2.0.2. The vulnerability has a medium severity with a CVSS score of 6.5. A fix is available in version 2.0.2.
CVE-2026-84919 is a stored cross-site scripting (XSS) vulnerability in the Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery. It affects versions from 0.0.0 up to but not including 5.0.9. The vulnerability involves improper neutralization of input during web page generation, allowing attackers to inject malicious scripts. The issue has been fixed in version 5.0.9. The CVSS v3.1 base score is 4.6, indicating a medium severity level.
CVE-2026-87936 is an SQL Injection vulnerability in the Drupal amazee.ai Private AI Provider. It affects versions from 0.0.0 up to but not including 1.3.7, and from 1.4.0 up to but not including 1.4.3. The vulnerability allows improper neutralization of special elements in SQL commands, potentially leading to unauthorized data access. The issue is fixed in versions 1.3.7 and 1.4.3. The CVSS score is 6.5, indicating a medium severity risk.
CVE-2026-87937 is an Open Redirect vulnerability in the Drupal Central Authentication System (CAS) Server. It affects versions from 0.0.0 up to but not including 2.0.4, and from 2.1.0 up to but not including 2.1.3. This flaw allows attackers to redirect users to untrusted sites, potentially enabling phishing or other malicious activities. The vulnerability has a medium severity with a CVSS score of 6.5. Fixed versions are 2.0.4 and 2.1.3.
CVE-2026-87945 is an Open Redirect vulnerability (CWE-601) in the Drupal SAML SSO - Service Provider module affecting versions from 0.0.0 up to but not including 3.2.0. This flaw allows attackers to redirect users to untrusted external sites by manipulating URLs. The vulnerability has a medium severity with a CVSS score of 5.4. A fix is available in version 3.2.0.
CVE-2026-96370 is an incorrect authorization vulnerability in the Drupal Webform module that allows Server Side Request Forgery (SSRF). It affects Webform versions from 0.0.0 up to but not including 6.2.12, and from 6.3.0 up to but not including 6.3.1. The vulnerability has a medium severity with a CVSS score of 5.4. Fixed versions 6.2.12 and 6.3.1 address this issue.
An Improper Control of Interaction Frequency vulnerability (CWE-799) exists in Drupal Webform, allowing functionality misuse. This affects Webform versions from 0.0.0 to 6.2.12 and from 6.3.0 to 6.3.1. The vulnerability has a medium severity with a CVSS score of 5.3. There is no information about available patches or vendor advisories. No known exploits are reported in the wild.
An Incorrect Authorization vulnerability in the Drupal Webform module allows forceful browsing, potentially exposing information without proper access control. This affects Webform versions from 0.0.0 up to 6.2.12 and from 6.3.0 to 6.3.1. The vulnerability has a medium severity with a CVSS score of 5.3.
An authentication bypass vulnerability exists in Drupal REST & JSON API Authentication versions up to 3.2.0. This flaw allows attackers to bypass authentication by using an alternate path or channel. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity impact with low complexity and no user interaction required.
CVE-2026-96387 is an authentication bypass vulnerability in the Drupal Stop administrator login module affecting versions 1.0 through 1.5. The flaw allows an attacker with high privileges to bypass authentication using an alternate path or channel. The vulnerability has a low severity rating with a CVSS score of 3.8. A fix is available in version 1.6.
A missing authorization vulnerability in the Drupal CSS Usage Analyzer module (versions 1.0.0 through 1.0.2) allows unauthorized users to perform forceful browsing, potentially exposing sensitive information. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity level. There is no indication of available patches or vendor advisories at this time.
A vulnerability in Roundcube involves unsafe use of a login name in the SquirrelMail import file path, potentially allowing unauthorized access to sensitive data. The issue affects multiple specific versions of Roundcube. The CVSS score is 5.3, indicating a medium severity vulnerability with network attack vector, high attack complexity, low privileges required, no user interaction, and high confidentiality impact but no integrity or availability impact.
CVE-2026-114715 is an incorrect authorization vulnerability in Roundcube Webmail affecting versions 1.6.0 up to but not including 1.6.20, and 1.7.0 up to but not including 1.7.5. The flaw exists in the Modoboa driver of the password plugin, where the driver incorrectly uses the first account returned by the Modoboa API instead of verifying the authenticated user's account. This could allow a password change to be applied to a different user account.
Multiple security issues affecting the MozillaThunderbird package on openSUSE Tumbleweed have been fixed in version 153.5.1-1.1. These issues collectively represent a medium severity risk. The update addresses a range of vulnerabilities bundled in this package release.
A security update for the Linux kernel addresses multiple vulnerabilities including a NULL pointer exception caused by CALIPSO on IPv4 sockets (CVE-2025-22063). The update also fixes other kernel-related security issues and bugs. The affected kernel versions are those prior to 5.14.0-687.60.1.el9_8. Red Hat has released a patch that must be applied and requires a system reboot. The update is rated as having an Important security impact by Red Hat.
CVE-2026-114574 is an information disclosure vulnerability in massCodeIO massCode version 5.10. The flaw exists in an unspecified function within the Local HTTP Service component, specifically in the file src/main/api/index.ts. This vulnerability can be exploited remotely without privileges or user interaction. Public exploit code has been disclosed. A patch identified by commit d25d8fa3f5a1e34285c8634f18729650c0c05cda is available to address the issue.
CVE-2026-14288 is a vulnerability in GitLab Enterprise Edition affecting versions from 17.4 up to but not including 19.3.6, 19.4 up to but not including 19.4.3, and 19.5 up to but not including 19.5.1. It allows an authenticated user to bypass a required merge request approval policy on a protected branch due to improper access control during approval rule synchronization. The issue has been fixed in versions 19.3.6, 19.4.3, and 19.5.1.
CVE-2026-112378 is a vulnerability in GitLab EE versions from 17.8 up to but not including 19.3.6, 19.4 up to 19.4.3, and 19.5 up to 19.5.1. It involves insufficient server-side validation in billing eligibility checks, which could allow an authenticated user to access paid AI features without a valid subscription. GitLab has fixed this issue in versions 19.3.6, 19.4.3, and 19.5.1.
CVE-2026-112326 is a vulnerability in GitLab EE versions from 17.8 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1. It involves improper cleanup on thrown exceptions that could allow an authenticated user with read-only permissions to permanently delete existing vulnerability records. This occurs due to flawed error handling logic that fails to differentiate between pre-existing and newly created records. The issue has been fixed in versions 19.3.6, 19.4.3, and 19.5.1.