# cve.now: Packagist packages

The newest entries affecting Packagist packages (up to 200). To check exact package versions, use the MCP check_stack tool or /stack.

- [CVE-2026-114542](https://cve.now/CVE-2026-114542.md): Simple OAuth (OAuth2) & OpenID Connect - Moderately critical - Access bypass - SA-CONTRIB-2026-242 (no CVSS, Drupal Simple OAuth (OAuth2) & OpenID Connect · drupal/simp…)
- [CVE-2026-118539](https://cve.now/CVE-2026-118539.md): Commerce Core - Highly critical - Access bypass - SA-CONTRIB-2026-254 (no CVSS, Drupal Commerce Core · drupal/commerce)
- [CVE-2026-118540](https://cve.now/CVE-2026-118540.md): Commerce Core - Moderately critical - Information disclosure - SA-CONTRIB-2026-255 (no CVSS, Drupal Commerce Core · drupal/commerce)
- [CVE-2026-118541](https://cve.now/CVE-2026-118541.md): Commerce Core - Less critical - Access bypass - SA-CONTRIB-2026-256 (no CVSS, Drupal Commerce Core · drupal/commerce)
- [CVE-2026-118542](https://cve.now/CVE-2026-118542.md): Commerce Core - Moderately critical - Access bypass - SA-CONTRIB-2026-257 (no CVSS, Drupal Commerce Core · drupal/commerce)
- [CVE-2026-118543](https://cve.now/CVE-2026-118543.md): Commerce Core - Moderately critical - Cross-site request forgery - SA-CONTRIB-2026-258 (no CVSS, Drupal Commerce Core · drupal/commerce)
- [CVE-2026-118544](https://cve.now/CVE-2026-118544.md): Commerce Core - Moderately critical - Information disclosure - SA-CONTRIB-2026-259 (no CVSS, Drupal Commerce Core · drupal/commerce)
- [CVE-2026-118555](https://cve.now/CVE-2026-118555.md): Commerce License - Moderately critical - Access bypass - SA-CONTRIB-2026-260 (no CVSS, Drupal Commerce License · drupal/commerce\_license)
- [CVE-2026-118556](https://cve.now/CVE-2026-118556.md): Commerce Shipping - Moderately critical - Access bypass - SA-CONTRIB-2026-261 (no CVSS, Drupal Commerce Shipping · drupal/commerce\_shipping)
- [CVE-2026-118557](https://cve.now/CVE-2026-118557.md): Commerce Shipping - Less critical - Access bypass - SA-CONTRIB-2026-262 (no CVSS, Drupal Commerce Shipping · drupal/commerce\_shipping)
- [CVE-2026-118558](https://cve.now/CVE-2026-118558.md): Commerce Stripe - Critical - Cross-site request forgery - SA-CONTRIB-2026-263 (no CVSS, Drupal Commerce Stripe · drupal/commerce\_stripe)
- [CVE-2026-118559](https://cve.now/CVE-2026-118559.md): Commerce Stripe - Moderately critical - Improper verification of cryptographic signature - SA-CONTRIB-2026-264 (no CVSS, Drupal Commerce Stripe · drupal/commerce\_stripe)
- [CVE-2026-118545](https://cve.now/CVE-2026-118545.md): AI (Artificial Intelligence) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-266 (no CVSS, Drupal AI · drupal/ai)
- [CVE-2026-118546](https://cve.now/CVE-2026-118546.md): AI (Artificial Intelligence) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-267 (no CVSS, Drupal AI · drupal/ai)
- [CVE-2026-118548](https://cve.now/CVE-2026-118548.md): AI (Artificial Intelligence) - Moderately critical - Information disclosure - SA-CONTRIB-2026-268 (no CVSS, Drupal AI · drupal/ai)
- [CVE-2026-118549](https://cve.now/CVE-2026-118549.md): AI (Artificial Intelligence) - Critical - Cross-site scripting - SA-CONTRIB-2026-269 (no CVSS, Drupal AI · drupal/ai)
- [CVE-2026-118550](https://cve.now/CVE-2026-118550.md): AI (Artificial Intelligence) - Moderately critical - Access bypass - SA-CONTRIB-2026-270 (no CVSS, Drupal AI · drupal/ai)
- [CVE-2026-118551](https://cve.now/CVE-2026-118551.md): AI (Artificial Intelligence) - Less critical - Information Disclosure - SA-CONTRIB-2026-271 (no CVSS, Drupal AI · drupal/ai)
- [CVE-2026-118552](https://cve.now/CVE-2026-118552.md): AI (Artificial Intelligence) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-272 (no CVSS, Drupal AI · drupal/ai)
- [CVE-2026-118553](https://cve.now/CVE-2026-118553.md): AI (Artificial Intelligence) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-273 (no CVSS, Drupal AI · drupal/ai)
- [CVE-2026-118561](https://cve.now/CVE-2026-118561.md): Single Content Sync - Critical - External control of file name or path - SA-CONTRIB-2026-274 (no CVSS, Drupal Single Content Sync · drupal/single\_content\_sync)
- [CVE-2026-118562](https://cve.now/CVE-2026-118562.md): Single Content Sync - Critical - Remote code execution - SA-CONTRIB-2026-275 (no CVSS, Drupal Single Content Sync · drupal/single\_content\_sync)
- [CVE-2026-118563](https://cve.now/CVE-2026-118563.md): CacheFlush - Critical - Unsupported - SA-CONTRIB-2026-276 (no CVSS, Drupal CacheFlush · drupal/cacheflush)
- [CVE-2026-118564](https://cve.now/CVE-2026-118564.md): PayUmoney for Drupal Commerce - Critical - Unsupported - SA-CONTRIB-2026-277 (no CVSS, PayUmoney for Drupal Commerce · drupal/commerce\_payumoney)
- [CVE-2026-118565](https://cve.now/CVE-2026-118565.md): GroupEx PRO ( Daxko ) integration - Critical - Unsupported - SA-CONTRIB-2026-278 (no CVSS, Drupal GroupEx PRO ( Daxko ) integration · drupal/groupexp…)
- [CVE-2026-118582](https://cve.now/CVE-2026-118582.md): CAPTCHA - Moderately critical - Session Replay (CAPTCHA bypass) - SA-CONTRIB-2026-281 (no CVSS, Drupal CAPTCHA · drupal/captcha)
- [CVE-2026-118569](https://cve.now/CVE-2026-118569.md): Fasttoggle - Moderately critical - Access bypass - SA-CONTRIB-2026-282 (no CVSS, Drupal Fasttoggle · drupal/fasttoggle)
- [CVE-2026-118570](https://cve.now/CVE-2026-118570.md): Fasttoggle - Moderately critical - Cross-Site Request Forgery - SA-CONTRIB-2026-283 (no CVSS, Drupal Fasttoggle · drupal/fasttoggle)
- [CVE-2026-118574](https://cve.now/CVE-2026-118574.md): S3 File System - Moderately critical - Access bypass - SA-CONTRIB-2026-279 (no CVSS, Drupal S3 File System · drupal/s3fs)
- [CVE-2026-118567](https://cve.now/CVE-2026-118567.md): Bulk Update User Roles - Moderately critical - Incorrect authorization - SA-CONTRIB-2026-280 (no CVSS, Drupal Bulk Update User Roles · drupal/bulk\_update\_user\_rol…)
- [CVE-2026-118572](https://cve.now/CVE-2026-118572.md): OAuth Login - OAuth OIDC SSO - Critical - Authentication bypass - SA-CONTRIB-2026-284 (no CVSS, Drupal OAuth Login - OAuth OIDC SSO · drupal/oauth\_login\_oa…)
- [CVE-2026-118575](https://cve.now/CVE-2026-118575.md): Signature pad widget - Critical - Cross-site scripting - SA-CONTRIB-2026-285 (no CVSS, Drupal Signature pad widget · drupal/sign\_widget)
- [CVE-2026-118576](https://cve.now/CVE-2026-118576.md): Stage File Proxy - Critical - Cross-site scripting - SA-CONTRIB-2026-286 (no CVSS, Drupal Stage File Proxy · drupal/stage\_file\_proxy)
- [CVE-2026-118554](https://cve.now/CVE-2026-118554.md): OpenID Connect Client - Moderately critical - Improper authentication - SA-CONTRIB-2026-287 (no CVSS, Drupal OpenID Connect Client · drupal/oidc)
- [CVE-2026-118583](https://cve.now/CVE-2026-118583.md): Field Permissions - Moderately critical - Access bypass - SA-CONTRIB-2026-288 (no CVSS, Drupal Field Permissions · drupal/field\_permissions)
- [CVE-2026-118584](https://cve.now/CVE-2026-118584.md): Field Permissions - Moderately critical - Access bypass - SA-CONTRIB-2026-289 (no CVSS, Drupal Field Permissions · drupal/field\_permissions)
- [CVE-2026-118573](https://cve.now/CVE-2026-118573.md): OAuth2 Token Manager - Critical - Access bypass - SA-CONTRIB-2026-290 (no CVSS, Drupal OAuth2 Token Manager · drupal/oauth2\_token\_manager)
- [CVE-2026-118568](https://cve.now/CVE-2026-118568.md): Content Sync (content-sync.io) - Moderately critical - Information disclosure - SA-CONTRIB-2026-291 (no CVSS, Drupal Content Sync · drupal/cms\_content\_sync)
- [CVE-2026-118571](https://cve.now/CVE-2026-118571.md): Media Alias Display - Moderately critical - Information disclosure - SA-CONTRIB-2026-292 (no CVSS, Drupal Media Alias Display · drupal/media\_alias\_display)
- [DRUPAL-CONTRIB-2026-265](https://cve.now/DRUPAL-CONTRIB-2026-265.md): This module enables you to use the Stripe Connect API to quickly configure your Drupal Commerce store to take payments via multiple Stripe A (no CVSS, drupal/commerce\_stripe)
- [CVE-2026-116675](https://cve.now/CVE-2026-116675.md): TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin \`data-mce-object\` serialization (CVSS 8.5, tinymce · tinymce/tinymce)
- [CVE-2026-117538](https://cve.now/CVE-2026-117538.md): REDAXO before 5.21.0 Reflected XSS via Packages API function Parameter (CVSS 2.1, redaxo core · redaxo/source)
- [CVE-2026-117537](https://cve.now/CVE-2026-117537.md): REDAXO before 5.21.0 Reflected XSS via Metainfo API type Parameter (CVSS 2.1, redaxo core · redaxo/source)
- [CVE-2026-116891](https://cve.now/CVE-2026-116891.md): SemanticMediaWiki 4.2.0 before 7.2.1 Reflected XSS via Special:FacetedSearch cstate (CVSS 5.1, SemanticMediaWiki · mediawiki/semantic-media-wiki)
- [CVE-2026-108357](https://cve.now/CVE-2026-108357.md): PhpSpreadsheet: XmlScanner Bypass via Double-Encoded unentity() TOCTOU Allows XXE and Denial of Service (CVSS 8.8, PHPOffice PhpSpreadsheet · phpoffice/phpspreadsheet)
- [CVE-2026-108359](https://cve.now/CVE-2026-108359.md): PhpSpreadsheet ODS Reader: Unbounded number-rows-repeated → CPU & Memory Exhaustion (DoS) (CVSS 8.7, PHPOffice PhpSpreadsheet · phpoffice/phpspreadsheet)
- [CVE-2026-108358](https://cve.now/CVE-2026-108358.md): PhpSpreadsheet: XmlScanner Bypass via ISO-2022 Escape Sequences Allows XXE and Denial of Service (CVSS 8.8, PHPOffice PhpSpreadsheet · phpoffice/phpspreadsheet)
- [CVE-2026-108360](https://cve.now/CVE-2026-108360.md): PhpSpreadsheet: SSRF whitelist bypass via unre-validated HTTP redirect in Drawing::setPath external image loading (CVSS 6.4, PHPOffice PhpSpreadsheet · phpoffice/phpspreadsheet)
- [CVE-2026-84910](https://cve.now/CVE-2026-84910.md): Advanced Search - Moderately critical - Access bypass - SA-CONTRIB-2026-118 (CVSS 4.2, Drupal Advanced Search · drupal/advanced\_search)
- [CVE-2026-84911](https://cve.now/CVE-2026-84911.md): AI (Artificial Intelligence) - Moderately critical - Cross site scripting - SA-CONTRIB-2026-119 (CVSS 3.1, Drupal AI · drupal/ai)
- [CVE-2026-84912](https://cve.now/CVE-2026-84912.md): AI (Artificial Intelligence) - Moderately critical - Access Bypass - SA-CONTRIB-2026-120 (CVSS 4.6, Drupal AI · drupal/ai)
- [CVE-2026-84913](https://cve.now/CVE-2026-84913.md): AI translate - Moderately critical - Access Bypass - SA-CONTRIB-2026-121 (CVSS 4.6, Drupal AI Translate · drupal/ai\_translate)
- [CVE-2026-84914](https://cve.now/CVE-2026-84914.md): Calculate Working Days - Critical - Access bypass - SA-CONTRIB-2026-122 (CVSS 5.3, Drupal Calculate Working Days · drupal/calculate\_working\_da…)
- [CVE-2026-84915](https://cve.now/CVE-2026-84915.md): Component blocks - Moderately critical - Cross site scripting - SA-CONTRIB-2026-123 (CVSS 4.6, Drupal Component blocks · drupal/component\_blocks)
- [CVE-2026-84916](https://cve.now/CVE-2026-84916.md): Islandora - Moderately critical - Access bypass - SA-CONTRIB-2026-126 (CVSS 3.7, Drupal Islandora · drupal/islandora)
- [CVE-2026-84917](https://cve.now/CVE-2026-84917.md): Jsonapi Role Access - Critical - Access bypass - SA-CONTRIB-2026-127 (CVSS 6.5, Drupal Jsonapi Role Access · drupal/jsonapi\_role\_access)
- [CVE-2026-16648](https://cve.now/CVE-2026-16648.md): Mailer Plus Log - Moderately critical - Access bypass - SA-CONTRIB-2026-128 (CVSS 3.8, Drupal Mailer Plus Log · drupal/symfony\_mailer\_log)
- [CVE-2026-81163](https://cve.now/CVE-2026-81163.md): Media Library Importer - Moderately critical - Access bypass - SA-CONTRIB-2026-129 (CVSS 5.4, Drupal Media Library Importer · drupal/media\_library\_import…)
- [CVE-2026-84918](https://cve.now/CVE-2026-84918.md): Monobank payment API - Moderately critical - Access bypass - SA-CONTRIB-2026-130 (CVSS 3.7, Drupal Monobank payment API · drupal/monobank)
- [CVE-2026-84919](https://cve.now/CVE-2026-84919.md): PhotoSwipe - Responsive JavaScript Modal Image Gallery - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-131 (CVSS 4.6, Drupal PhotoSwipe - Responsive JavaScript Modal Image Galle…)
- [CVE-2026-87936](https://cve.now/CVE-2026-87936.md): amazee.ai Private AI Provider - Critical - SQL injection - SA-CONTRIB-2026-134 (CVSS 6.5, Drupal amazee.ai Private AI Provider · drupal/ai\_provider\_a…)
- [CVE-2026-87937](https://cve.now/CVE-2026-87937.md): Central Authentication System (CAS) Server - Moderately critical - Open redirect - SA-CONTRIB-2026-135 (CVSS 6.5, Drupal Central Authentication System (CAS) Server · drupal/…)
- [CVE-2026-87938](https://cve.now/CVE-2026-87938.md): CSP log - Critical - SQL Injection - SA-CONTRIB-2026-136 (no CVSS, Drupal CSP log · drupal/csp\_log)
- [CVE-2026-87939](https://cve.now/CVE-2026-87939.md): Feed Block - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-137 (CVSS 4.2, Drupal Feed Block · drupal/feed\_block)
- [CVE-2026-87940](https://cve.now/CVE-2026-87940.md): Key auth - Moderately critical - Access bypass - SA-CONTRIB-2026-138 (CVSS 5.4, Drupal Key auth · drupal/key\_auth)
- [CVE-2026-87942](https://cve.now/CVE-2026-87942.md): SafeDelete - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-140 (CVSS 4.6, Drupal SafeDelete · drupal/safedelete)
- [CVE-2026-87943](https://cve.now/CVE-2026-87943.md): SAML SSO - Service Provider - Critical - Improper access control - SA-CONTRIB-2026-141 (CVSS 6.5, Drupal SAML SSO - Service Provider · drupal/miniorange\_saml)
- [CVE-2026-87944](https://cve.now/CVE-2026-87944.md): SAML SSO - Service Provider - Critical - Improper certificate validation - SA-CONTRIB-2026-142 (CVSS 4.8, Drupal SAML SSO - Service Provider · drupal/miniorange\_saml)
- [CVE-2026-87945](https://cve.now/CVE-2026-87945.md): SAML SSO - Service Provider - Critical - Open redirect - SA-CONTRIB-2026-143 (CVSS 5.4, Drupal SAML SSO - Service Provider · drupal/miniorange\_saml)
- [CVE-2026-87946](https://cve.now/CVE-2026-87946.md): SAML SSO - Service Provider - Critical - Weak cryptographic practices - SA-CONTRIB-2026-144 (CVSS 4.8, Drupal SAML SSO - Service Provider · drupal/miniorange\_saml)
- [CVE-2026-87947](https://cve.now/CVE-2026-87947.md): SAML SSO - Service Provider - Moderately critical - Authentication bypass - SA-CONTRIB-2026-145 (CVSS 4.8, Drupal SAML SSO - Service Provider · drupal/miniorange\_saml)
- [CVE-2026-87948](https://cve.now/CVE-2026-87948.md): SAML SSO - Service Provider - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-146 (CVSS 3.5, Drupal SAML SSO - Service Provider · drupal/miniorange\_saml)
- [CVE-2026-87949](https://cve.now/CVE-2026-87949.md): SAML SSO - Service Provider - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-147 (CVSS 3.3, Drupal SAML SSO - Service Provider · drupal/miniorange\_saml)
- [CVE-2026-87950](https://cve.now/CVE-2026-87950.md): SAML SSO - Service Provider - Moderately critical - Embedded credentials - SA-CONTRIB-2026-148 (CVSS 5.3, Drupal SAML SSO - Service Provider · drupal/miniorange\_saml)
- [CVE-2026-87951](https://cve.now/CVE-2026-87951.md): SAML SSO - Service Provider - Moderately critical - Information disclosure - SA-CONTRIB-2026-149 (CVSS 3.8, Drupal SAML SSO - Service Provider · drupal/miniorange\_saml)
- [CVE-2026-87952](https://cve.now/CVE-2026-87952.md): SAML SSO - Service Provider - Moderately critical - Insufficient replay protection - SA-CONTRIB-2026-150 (CVSS 3.1, Drupal SAML SSO - Service Provider · drupal/miniorange\_saml)
- [CVE-2026-87953](https://cve.now/CVE-2026-87953.md): SAML SSO - Service Provider - Moderately critical - Server Side Request Forgery - SA-CONTRIB-2026-151 (CVSS 3.3, Drupal SAML SSO - Service Provider · drupal/miniorange\_saml)
- [CVE-2026-87954](https://cve.now/CVE-2026-87954.md): Taxonomy Term Glossary - Critical - Access bypass - SA-CONTRIB-2026-152 (CVSS 4.3, Drupal Taxonomy Term Glossary · drupal/term\_glossary)
- [CVE-2026-87955](https://cve.now/CVE-2026-87955.md): Ultimate Table Field - Critical - Access bypass - SA-CONTRIB-2026-153 (CVSS 4.3, Drupal Ultimate Table Field · drupal/ultimate\_table\_field)
- [CVE-2026-96360](https://cve.now/CVE-2026-96360.md): Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-154 (CVSS 3.5, Drupal Webform · drupal/webform)
- [CVE-2026-96361](https://cve.now/CVE-2026-96361.md): Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-155 (CVSS 4.6, Drupal Webform · drupal/webform)
- [CVE-2026-96358](https://cve.now/CVE-2026-96358.md): Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-158 (CVSS 4.6, Drupal Webform · drupal/webform)
- [CVE-2026-96359](https://cve.now/CVE-2026-96359.md): Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-159 (CVSS 4.6, Drupal Webform · drupal/webform)
- [CVE-2026-96362](https://cve.now/CVE-2026-96362.md): Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-160 (CVSS 4.2, Drupal Webform · drupal/webform)
- [CVE-2026-96363](https://cve.now/CVE-2026-96363.md): Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-161 (no CVSS, Drupal Webform · drupal/webform)
- [CVE-2026-96367](https://cve.now/CVE-2026-96367.md): Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-162 (CVSS 4.6, Drupal Webform · drupal/webform)
- [CVE-2026-96368](https://cve.now/CVE-2026-96368.md): Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-163 (CVSS 4.6, Drupal Webform · drupal/webform)
- [CVE-2026-96370](https://cve.now/CVE-2026-96370.md): Webform - Moderately critical - Access bypass, Server-side request forgery - SA-CONTRIB-2026-164 (CVSS 5.4, Drupal Webform · drupal/webform)
- [CVE-2026-96369](https://cve.now/CVE-2026-96369.md): Webform - Less critical - Access bypass - SA-CONTRIB-2026-165 (CVSS 3.1, Drupal Webform · drupal/webform)
- [CVE-2026-96371](https://cve.now/CVE-2026-96371.md): Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-166 (CVSS 5.4, Drupal Webform · drupal/webform)
- [CVE-2026-96372](https://cve.now/CVE-2026-96372.md): Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-167 (CVSS 5.4, Drupal Webform · drupal/webform)
- [CVE-2026-96373](https://cve.now/CVE-2026-96373.md): Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-168 (CVSS 3.3, Drupal Webform · drupal/webform)
- [CVE-2026-96366](https://cve.now/CVE-2026-96366.md): Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-169 (CVSS 5.3, Drupal Webform · drupal/webform)
- [CVE-2026-96365](https://cve.now/CVE-2026-96365.md): Webform - Less critical - Denial of service - SA-CONTRIB-2026-170 (CVSS 7.5, Drupal Webform · drupal/webform)
- [CVE-2026-96364](https://cve.now/CVE-2026-96364.md): Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-171 (CVSS 5.3, Drupal Webform · drupal/webform)
- [CVE-2026-96357](https://cve.now/CVE-2026-96357.md): Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-172 (CVSS 4.6, Drupal Webform · drupal/webform)
- [CVE-2026-96398](https://cve.now/CVE-2026-96398.md): Webform - Less critical - Access bypass - SA-CONTRIB-2026-173 (CVSS 4.3, Drupal Webform · drupal/webform)
- [CVE-2026-96356](https://cve.now/CVE-2026-96356.md): Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-174 (CVSS 5.3, Drupal Webform · drupal/webform)
- [CVE-2026-96355](https://cve.now/CVE-2026-96355.md): Webform - Critical - Remote Code Execution - SA-CONTRIB-2026-175 (CVSS 9.1, Drupal Webform · drupal/webform)
- [CVE-2026-96375](https://cve.now/CVE-2026-96375.md): Cloud - Critical - Remote code execution - SA-CONTRIB-2026-176 (CVSS 4.8, Drupal Cloud · drupal/cloud)
- [CVE-2026-96376](https://cve.now/CVE-2026-96376.md): Cloud - Critical - Remote code execution - SA-CONTRIB-2026-177 (CVSS 6.4, Drupal Cloud · drupal/cloud)
- [CVE-2026-96374](https://cve.now/CVE-2026-96374.md): Project Browser - Critical - Cross-site request forgery - SA-CONTRIB-2026-178 (CVSS 4.2, Drupal Project Browser · drupal/project\_browser)
- [CVE-2026-96384](https://cve.now/CVE-2026-96384.md): Mermaid Diagram Field - Moderately critical - Access bypass - SA-CONTRIB-2026-180 (CVSS 3.5, Drupal Mermaid Diagram Field · drupal/mermaid\_diagram\_field)
- [CVE-2026-96379](https://cve.now/CVE-2026-96379.md): CookieCuttr - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-181 (no CVSS, Drupal CookieCuttr · drupal/cookiecuttr)
- [CVE-2026-96385](https://cve.now/CVE-2026-96385.md): REST & JSON API Authentication for Drupal - Moderately critical - Access bypass - SA-CONTRIB-2026-182 (CVSS 6.5, REST & JSON API Authentication for Drupal · drupal/rest\_api…)
- [CVE-2026-96388](https://cve.now/CVE-2026-96388.md): Tawk.to - Live chat application - Critical - Cross Site Request Forgery - SA-CONTRIB-2026-184 (CVSS 5.4, Drupal Tawk.to - Live chat application · drupal/tawk\_to)
- [CVE-2026-96390](https://cve.now/CVE-2026-96390.md): Editoria11y Accessibility Checker - Moderately critical - Access bypass - SA-CONTRIB-2026-185 (CVSS 4.3, Drupal Editoria11y Accessibility Checker · drupal/editoria1…)
- [CVE-2026-96391](https://cve.now/CVE-2026-96391.md): Webform REST - Less critical - Access bypass - SA-CONTRIB-2026-186 (no CVSS, Drupal Webform REST · drupal/webform\_rest)
- [CVE-2026-96392](https://cve.now/CVE-2026-96392.md): AI CKEditor - Moderately critical - Code execution via Twig templates - SA-CONTRIB-2026-187 (CVSS 3.5, Drupal AI CKEditor · drupal/ai\_ckeditor)
- [CVE-2026-96377](https://cve.now/CVE-2026-96377.md): Combined image style - Moderately critical - Improper access control - SA-CONTRIB-2026-188 (CVSS 5.3, Drupal Combined image style · drupal/combined\_image\_style)
- [CVE-2026-96380](https://cve.now/CVE-2026-96380.md): CSS Usage Analyzer - Moderately critical - Improper access control - SA-CONTRIB-2026-189 (CVSS 6.5, Drupal CSS Usage Analyzer · drupal/css\_usage\_analyzer)
- [CVE-2026-96386](https://cve.now/CVE-2026-96386.md): Smart Content - Moderately critical - Access bypass - SA-CONTRIB-2026-190 (CVSS 6.5, Drupal Smart Content · drupal/smart\_content)
- [CVE-2026-96382](https://cve.now/CVE-2026-96382.md): Diba carousel slider - Moderately critical - Cross Site Scripting (XSS) - SA-CONTRIB-2026-191 (CVSS 4.6, Drupal Diba carousel slider · drupal/diba\_carousel)
- [CVE-2026-114509](https://cve.now/CVE-2026-114509.md): Laravel TokenGuard authentication bypass through non-string API credentials (CVSS 9.2, laravel framework · laravel/framework)
- [CVE-2026-114508](https://cve.now/CVE-2026-114508.md): Laravel relationship inclusion can trigger unauthorized data destruction (CVSS 6.5, laravel framework · laravel/framework)
- [DRUPAL-CONTRIB-2026-238](https://cve.now/DRUPAL-CONTRIB-2026-238.md): This module enables you to share users, content and configuration across a group of domains from a single Drupal installation. (no CVSS, drupal/domain)
- [CVE-2026-113712](https://cve.now/CVE-2026-113712.md): Cachet has Stored XSS in Incident Component (CVSS 4.8, cachethq cachet · cachethq/cachet)
- [CVE-2026-104827](https://cve.now/CVE-2026-104827.md): react/http: Unbounded HTTP Client Response Header Buffering Leads to Memory Exhaustion DoS (CVSS 7.5, reactphp http · react/http)
- [CVE-2026-109413](https://cve.now/CVE-2026-109413.md): Symfony: Unbounded Recursion in the YAML Inline Lexer Lets a Single Document Crash the Process (CVSS 8.7, sensiolabs symfony · symfony/symfony +1)
- [CVE-2026-108082](https://cve.now/CVE-2026-108082.md): Symfony: ReDoS in HeaderUtils::split() Reachable Through the Cache-Control Request Header (CVSS 8.7, sensiolabs symfony · symfony/http-foundation +1)
- [CVE-2026-62858](https://cve.now/CVE-2026-62858.md): YOURLS: Unauthenticated File Inclusion (CVSS 5.3, YOURLS · yourls/yourls)
- [CVE-2026-107381](https://cve.now/CVE-2026-107381.md): svg-sanitizer: Mixed-case xlink:HrEf skips the \`\<use\>\` nesting-DoS check in Resolver::processReferences (CVSS 6.5, darylldoyle svg-sanitizer · enshrined/svg-sanitize)
- [CVE-2026-56826](https://cve.now/CVE-2026-56826.md): Shopper: Missing function-level authorization on Settings tax/zone/shipping Livewire components allows a low-privileged user to delete commerce configuration (CVSS 5.4, shopperlabs shopper · shopper/framework)
- [CVE-2026-85990](https://cve.now/CVE-2026-85990.md): Leantime: Any Authenticated User Can Self-Escalate to Admin via Unauthorized JSON-RPC Methods (CVSS 8.8, leantime · leantime/leantime)
- [CVE-2026-65954](https://cve.now/CVE-2026-65954.md): PHPCSUtils: Remote code execution via eval() in AbstractArrayDeclarationSniff::getActualArrayKey() (CVSS 8.6, PHPCSStandards PHPCSUtils · phpcsstandards/phpcsutils)
- [CVE-2026-107851](https://cve.now/CVE-2026-107851.md): Contao: Improper access control in the table access voter (CVSS 4.3, contao · contao/core-bundle)
- [CVE-2026-107850](https://cve.now/CVE-2026-107850.md): Contao: Improper access control in the preview links module (CVSS 4.3, contao · contao/core-bundle)
- [CVE-2026-107848](https://cve.now/CVE-2026-107848.md): Contao: Cross-site request forgery in custom backend actions (CVSS 3.5, contao · contao/core-bundle)
- [CVE-2026-107845](https://cve.now/CVE-2026-107845.md): Contao: Cross-site scripting in the comments bundle (CVSS 9.3, contao · contao/comments-bundle)
- [CVE-2026-107844](https://cve.now/CVE-2026-107844.md): Contao: Path traversal in the images controller (CVSS 5.3, contao · contao/core-bundle)
- [CVE-2026-107843](https://cve.now/CVE-2026-107843.md): Contao: The registration module re-sends activation mails on any unauthenticated POST, with no throttle and no captcha check (CVSS 5.3, contao · contao/core-bundle)
- [CVE-2026-107842](https://cve.now/CVE-2026-107842.md): Contao: Protected page content is disclosed to anonymous visitors after contao.search.index\_protected is disabled (CVSS 5.3, contao · contao/core-bundle)
- [CVE-2026-107380](https://cve.now/CVE-2026-107380.md): enshrined/svg-sanitize: Stored XSS via DTD Entity / HTML5 Named Character Reference Collision (CVSS 5.4, darylldoyle svg-sanitizer · enshrined/svg-sanitize)
- [CVE-2026-107379](https://cve.now/CVE-2026-107379.md): enshrined/svg-sanitize: Denial of Service via DTD Attribute Declaration Crash (CVSS 6.5, darylldoyle svg-sanitizer · enshrined/svg-sanitize)
- [CVE-2026-107376](https://cve.now/CVE-2026-107376.md): webonyx graphql-php: Unbounded recursion in parser causes stack overflow on crafted nested input (CVSS 8.2, webonyx graphql-php · webonyx/graphql-php)
- [CVE-2026-105830](https://cve.now/CVE-2026-105830.md): league/commonmark 2.0.0 before 2.10.2 Quadratic DoS via TableStartParser (CVSS 8.7, thephpleague commonmark · league/commonmark)
- [CVE-2026-105829](https://cve.now/CVE-2026-105829.md): League CommonMark 1.3.0 before 2.10.2 Stored XSS via DisallowedRawHtml Bypass (CVSS 5.3, thephpleague commonmark · league/commonmark)
- [CVE-2026-104890](https://cve.now/CVE-2026-104890.md): Kunstmaan CMS: MediaBundle extension blacklist bypass allows authenticated administrators to upload executable PHP files leading to remote code execution (CVSS 7.2, KunstmaanBundlesCMS · kunstmaan bundles-cms +3)
- [CVE-2026-104473](https://cve.now/CVE-2026-104473.md): YesWiki before 4.5.3 Multiple Reflected XSS via BazaR and listpages (CVSS 5.1, yeswiki · yeswiki/yeswiki)
- [CVE-2026-104181](https://cve.now/CVE-2026-104181.md): Filament: Multi-factor authentication (app) management actions do not require password reauthentication (CVSS 5.4, filamentphp filament · filament/filament)
- [CVE-2026-55224](https://cve.now/CVE-2026-55224.md): MineAdmin: Path Traversal via Unsanitized identifier in Plugin Install/Uninstall (CVSS 8.7, MineAdmin · mineadmin/mineadmin)
- [CVE-2026-102601](https://cve.now/CVE-2026-102601.md): Flysystem: WhitespacePathNormalizer's control-character (CorruptedPathDetected) check is bypassed by malformed UTF-8 in the path, affecting every adapter (CVSS 3.5, thephpleague flysystem · league/flysystem)
- [CVE-2026-102279](https://cve.now/CVE-2026-102279.md): Laravel: XSS in Debug Page Information (CVSS 3.1, laravel framework · laravel/framework)
- [CVE-2026-100909](https://cve.now/CVE-2026-100909.md): OctoberCMS ResizeImages.php getSourcePathForResize server-side request forgery (CVSS 6.9, OctoberCMS · october/october)
- [CVE-2026-100857](https://cve.now/CVE-2026-100857.md): AzuraCast before 0.23.4 Remote Code Execution via Liquidsoap string interpolation (CVSS 8.6, AzuraCast · azuracast/azuracast)
- [CVE-2026-100856](https://cve.now/CVE-2026-100856.md): AzuraCast before 0.23.6 Code Injection via Remote Relay Password (CVSS 8.7, AzuraCast · azuracast/azuracast)
- [CVE-2026-100855](https://cve.now/CVE-2026-100855.md): AzuraCast before 0.23.6 Missing Permission Check via /play (CVSS 7.1, AzuraCast · azuracast/azuracast)
- [CVE-2026-100854](https://cve.now/CVE-2026-100854.md): AzuraCast before 0.23.6 Metadata Injection via Liquidsoap API (CVSS 5.3, AzuraCast · azuracast/azuracast)
- [CVE-2026-92161](https://cve.now/CVE-2026-92161.md): FriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth provider (CVSS 9.8, FriendsOfFlarum oauth · fof/oauth)
- [CVE-2026-57440](https://cve.now/CVE-2026-57440.md): Mediawiki EmbedVideo Extension has stored XSS via malformed src url with $wgEmbedVideoRequireConsent disabled (CVSS 7.5, StarCitizenWiki mediawiki-extensions-EmbedVideo · starcitiz…)
- [CVE-2026-61823](https://cve.now/CVE-2026-61823.md): code16 Sharp vulnerable to stored XSS via iframe srcdoc Attribute (CVSS 7.3, code16 sharp · code16/sharp)
- [CVE-2026-61825](https://cve.now/CVE-2026-61825.md): code16/sharp has a stored XSS via data-html-content Sanitizer Bypass (CVSS 8.7, code16 sharp · code16/sharp)
- [CVE-2026-61816](https://cve.now/CVE-2026-61816.md): zbateson/mail-mime-parser has uncontrolled resource consumption (CPU/memory DoS) parsing untrusted MIME (CVSS 7.5, zbateson mail-mime-parser · zbateson/mail-mime-parser)
- [CVE-2026-61815](https://cve.now/CVE-2026-61815.md): zbateson/mail-mime-parser has CRLF header injection via attachment filename (CVSS 7.2, zbateson mail-mime-parser · zbateson/mail-mime-parser)
- [CVE-2026-62368](https://cve.now/CVE-2026-62368.md): Snipe-IT: Stored XSS via Custom Field name in asset-list column headers (CVSS 8.1, grokability snipe-it · snipe/snipe-it)
- [CVE-2026-63493](https://cve.now/CVE-2026-63493.md): Snipe-IT: 2FA bypass via the API token flow (CVSS 8.6, grokability snipe-it · snipe/snipe-it)
- [CVE-2026-47132](https://cve.now/CVE-2026-47132.md): phpMyFAQ: SQL LIKE Wildcard Injection in Chat User Search Allows Authenticated User Enumeration (CVSS 5.4, thorsten phpMyFAQ · thorsten/phpmyfaq)
- [CVE-2026-56738](https://cve.now/CVE-2026-56738.md): phpMyFAQ has SQL Injection in \`StopWords::add()\` — Unescaped Stop Word Insertion (CVSS 8.5, thorsten phpMyFAQ · phpmyfaq/phpmyfaq +1)
- [CVE-2026-63498](https://cve.now/CVE-2026-63498.md): Snipe-IT: Stored XSS via Inline XML Rendering in the Uploaded Files API (CVSS 8.7, grokability snipe-it · snipe/snipe-it)
- [CVE-2026-56737](https://cve.now/CVE-2026-56737.md): phpMyFAQ's two-factor authentication login bypasses the password factor (CVSS 8.1, thorsten phpMyFAQ · thorsten/phpmyfaq +1)
- [CVE-2026-56736](https://cve.now/CVE-2026-56736.md): phpMyFAQ has Stored XSS in Admin FAQ Editor via HTML Entity Bypass in Frontend FAQ Submission (CVSS 8.2, thorsten phpMyFAQ · thorsten/phpmyfaq +1)
- [CVE-2026-76087](https://cve.now/CVE-2026-76087.md): Formie: Unauthenticated users can overwrite incomplete submissions via submit action (CVSS 8.2, verbb formie · verbb/formie)
- [CVE-2026-76086](https://cve.now/CVE-2026-76086.md): Formie: Integration form-settings action allows SSRF and exfiltration of stored integration credentials (CVSS 8.5, verbb formie · verbb/formie)
- [CVE-2026-76089](https://cve.now/CVE-2026-76089.md): Formie: Missing authorization on sent notification resend modal exposes submission PII (CVSS 7.7, verbb formie · verbb/formie)
- [CVE-2026-92692](https://cve.now/CVE-2026-92692.md): Sulu: JCR-SQL2 injection via \`categories\` query parameter (unauthenticated) (CVSS 6.9, sulu · sulu/sulu)
- [CVE-2026-73858](https://cve.now/CVE-2026-73858.md): Solspace Freeform: Limited Twig template injection via submitted field values (CVSS 5.3, solspace craft-freeform · solspace/craft-freeform)
- [CVE-2026-88974](https://cve.now/CVE-2026-88974.md): WPGraphQL: Contributor can publish and modify posts without the required capabilities via updatePost (CVSS 5.4, wp-graphql · wp-graphql/wp-graphql)
- [CVE-2026-63000](https://cve.now/CVE-2026-63000.md): REDAXO: Missing CSRF Protection on Package Update Action Allows Forced Addon Updates (CVSS 6.4, redaxo core · redaxo/source)
- [CVE-2026-62998](https://cve.now/CVE-2026-62998.md): REDAXO: Unwhitelisted ORDER BY Column in rex\_list Allows Authenticated Column Enumeration (CVSS 4.3, redaxo core · redaxo/source)
- [CVE-2026-63002](https://cve.now/CVE-2026-63002.md): REDAXO: Stored XSS in Mediapool Sync Page via Unescaped Filesystem Filenames (CVSS 4.8, redaxo core · redaxo/source)
- [CVE-2026-63001](https://cve.now/CVE-2026-63001.md): REDAXO: Stored XSS via Unescaped Media Manager Type Name in \`mediaIsInUse()\` (CVSS 4.8, redaxo core · redaxo/source)
- [CVE-2026-71537](https://cve.now/CVE-2026-71537.md): Paymenter: Credit-refund double-spend race condition in service downgrade (doUpgrade) (CVSS 6.5, Paymenter · paymenter/paymenter)
- [GHSA-JR78-W6W5-M8F8](https://cve.now/GHSA-JR78-W6W5-M8F8.md): Semantic MediaWiki'a missing authorization in the smwtask API module allows unauthenticated access to admin-only maintenance tasks (high (no CVSS), mediawiki/semantic-media-wiki)
- [CVE-2026-77616](https://cve.now/CVE-2026-77616.md): Semantic MediaWiki affected by reflected XSS in \`Special:Ask\` via a forged cursor pagination token (CVSS 6.1, SemanticMediaWiki · mediawiki/semantic-media-wiki)
- [CVE-2026-77610](https://cve.now/CVE-2026-77610.md): Semantic MediaWiki has a query debug output XSS (\`DebugFormatter\`) (CVSS 6.1, SemanticMediaWiki · mediawiki/semantic-media-wiki)
- [CVE-2026-77609](https://cve.now/CVE-2026-77609.md): Semantic MediaWiki has an open redirect in Special:URIResolver (CVSS 6.1, SemanticMediaWiki · mediawiki/semantic-media-wiki)
- [CVE-2026-77607](https://cve.now/CVE-2026-77607.md): Semantic MediaWiki affected by Special:Ask table \`sep\` parameter reflected XSS (CVSS 6.1, SemanticMediaWiki · mediawiki/semantic-media-wiki)
- [CVE-2026-77608](https://cve.now/CVE-2026-77608.md): Semantic MediaWiki has reflected XSS in \`Special:SearchByProperty\` (\`property\` and \`value\` parameters) (CVSS 6.1, SemanticMediaWiki · mediawiki/semantic-media-wiki)
- [CVE-2026-77606](https://cve.now/CVE-2026-77606.md): Semantic MediaWiki has reflected XSS in Special:Ask plain table headers (CVSS 6.1, SemanticMediaWiki · mediawiki/semantic-media-wiki)
- [CVE-2025-61682](https://cve.now/CVE-2025-61682.md): Semantic MediaWiki vulnerable to stored XSS through wikitext via improper use of non-reserved data attributes (CVSS 8.6, SemanticMediaWiki · mediawiki/semantic-media-wiki)
- [CVE-2026-45140](https://cve.now/CVE-2026-45140.md): Chamilo LMS CStudio upload flow allows unauthenticated remote code execution (CVSS 9.8, chamilo-lms · chamilo/chamilo-lms)
- [CVE-2026-79752](https://cve.now/CVE-2026-79752.md): CakePHP: Multiple methods in FunctionsBuilder vulnerable to SQL injection (CVSS 9.2, cakephp · cakephp/database +1)
- [CVE-2026-59944](https://cve.now/CVE-2026-59944.md): Composer: CVE-2026-59946 fix bypass via symlinked package bin path (CVSS 6.1, composer · composer/composer)
- [CVE-2026-84997](https://cve.now/CVE-2026-84997.md): react/http: A malformed HTTP chunked body can lead to a denial-of-service and peg the CPU (CVSS 7.5, reactphp http · react/http)
- [CVE-2026-56830](https://cve.now/CVE-2026-56830.md): Shopper: Incomplete fix for GHSA-h4mp-g9c6-xwph: Media sub-form store() still lacks authorization (CVSS 6.5, shopperlabs shopper · shopper/framework)
- [CVE-2026-56831](https://cve.now/CVE-2026-56831.md): Shopper: Negative discount values accepted and propagated through order calculation pipeline (CVSS 6.5, shopperlabs shopper · shopper/framework)
- [CVE-2026-56827](https://cve.now/CVE-2026-56827.md): Shopper: Authorization bypass in Filament bulk actions allows browse-only staff to mass-delete attributes/tags and mass-toggle visibility of brands/categories/suppliers (CVSS 8.1, shopperlabs shopper · shopper/framework)
- [CVE-2026-56829](https://cve.now/CVE-2026-56829.md): Shopper: Unauthorized inventory stock manipulation via unlocked variant property in VariantStock component (CVSS 8.1, shopperlabs shopper · shopper/framework)
- [CVE-2026-56825](https://cve.now/CVE-2026-56825.md): Shopper: Missing authorization on product removal actions in CollectionProducts component (CVSS 8.1, shopperlabs shopper · shopper/framework)
- [CVE-2026-55374](https://cve.now/CVE-2026-55374.md): canto-saas-api: Authenticated API requests can be redirected via unencoded path variables (CVSS 4.8, jleehr canto-saas-api · jleehr/canto-saas-api)
- [CVE-2026-55375](https://cve.now/CVE-2026-55375.md): canto-saas-api: OAuth credentials exposed in URL query string and exception messages (CVSS 5.3, jleehr canto-saas-api · jleehr/canto-saas-api)
- [CVE-2026-55691](https://cve.now/CVE-2026-55691.md): EmbedVideo Extension : Stored XSS via unsanitized class passed to template (CVSS 8.6, StarCitizenWiki mediawiki-extensions-EmbedVideo · starcitiz…)
- [CVE-2026-55690](https://cve.now/CVE-2026-55690.md): EmbedVideo Extension: Stored XSS via unsanitized service name in exception text (CVSS 7.5, StarCitizenWiki mediawiki-extensions-EmbedVideo · starcitiz…)
- [CVE-2026-55692](https://cve.now/CVE-2026-55692.md): EmbedVideo Extension: Stored XSS via malformed src url with $wgEmbedVideoRequireConsent enabled (CVSS 7.5, StarCitizenWiki mediawiki-extensions-EmbedVideo · starcitiz…)
- [CVE-2026-52827](https://cve.now/CVE-2026-52827.md): Kimai: Two-factor authentication bypass on the Kimai API (CVSS 7.1, kimai · kimai/kimai)
- [CVE-2026-52822](https://cve.now/CVE-2026-52822.md): Kimai: Improper Authorization in Kimai Timesheet Restart and Duplicate Allows New Timesheets After Project Access Revocation (CVSS 5.3, kimai · kimai/kimai)
- [CVE-2026-52828](https://cve.now/CVE-2026-52828.md): Kimai: ExportTemplate CRUD Missing Authorization Check Allows Unauthorized TEAMLEAD Access (CVSS 5.3, kimai · kimai/kimai)
- [CVE-2026-52826](https://cve.now/CVE-2026-52826.md): Kimai: Improper Authorization in Kimai Project, Customer, and Activity Rate Edit Endpoints Allows Cross-Scope Rate Manipulation (CVSS 5.3, kimai · kimai/kimai)
- [CVE-2026-52823](https://cve.now/CVE-2026-52823.md): Kimai: Login CSRF in Kimai Timesheet Stop and Restart API Endpoints Allows Unauthorized State Changes (CVSS 5.3, kimai · kimai/kimai)
- [CVE-2026-86198](https://cve.now/CVE-2026-86198.md): PocketMine-MP before 5.44.2 Denial of Service via ResourcePackClientResponsePacket (CVSS 2.3, pmmp PocketMine-MP · pocketmine/pocketmine-mp)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/ecosystem/packagist
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.