# cve.now: latest entries

Every published entry, newest first, 100 per page.

- [CVE-2026-107249](https://cve.now/CVE-2026-107249.md): Block AJAX - Highly critical - PHP object injection - SA-CONTRIB-2026-192 (no CVSS, Drupal Block AJAX)
- [CVE-2026-107250](https://cve.now/CVE-2026-107250.md): ECA Helper - Critical - Unsupported - SA-CONTRIB-2026-193 (no CVSS, Drupal ECA Helper)
- [CVE-2026-107251](https://cve.now/CVE-2026-107251.md): Entity Reference Manager (Merge entities) - Critical - Access bypass - SA-CONTRIB-2026-194 (no CVSS, Drupal Entity Reference Manager)
- [CVE-2026-107252](https://cve.now/CVE-2026-107252.md): MathJax: LaTeX for Drupal - Critical - Cross site scripting - SA-CONTRIB-2026-195 (no CVSS, MathJax: LaTeX for Drupal)
- [CVE-2026-107253](https://cve.now/CVE-2026-107253.md): Orphans Media - Critical - Unsupported - SA-CONTRIB-2026-196 (no CVSS, Drupal Orphans Media)
- [CVE-2026-107254](https://cve.now/CVE-2026-107254.md): Authenticator Login Plus (2FA) - Critical - Improper authentication - SA-CONTRIB-2026-197 (no CVSS, Drupal Authenticator Login Plus)
- [CVE-2026-107257](https://cve.now/CVE-2026-107257.md): Actstream - Critical - Access bypass - SA-CONTRIB-2026-198 (no CVSS, Drupal Actstream)
- [CVE-2026-107258](https://cve.now/CVE-2026-107258.md): Inline Entity Form Dialog - Moderately critical - Access bypass - SA-CONTRIB-2026-199 (no CVSS, Drupal Inline Entity Form Dialog)
- [CVE-2026-107259](https://cve.now/CVE-2026-107259.md): Linked Field - Moderately critical - Server-side template injection - SA-CONTRIB-2026-200 (no CVSS, Drupal Linked Field)
- [CVE-2026-107261](https://cve.now/CVE-2026-107261.md): Authenticator Login Plus (2FA) - Moderately critical - Improper authentication - SA-CONTRIB-2026-201 (no CVSS, Drupal Authenticator Login Plus)
- [CVE-2026-107263](https://cve.now/CVE-2026-107263.md): Gutenberg - Moderately critical - Access bypass - SA-CONTRIB-2026-202 (no CVSS, Drupal Gutenberg)
- [CVE-2026-107264](https://cve.now/CVE-2026-107264.md): Inline Formatter Field - Moderately critical - Server-side template injection - SA-CONTRIB-2026-203 (no CVSS, Drupal Inline Formatter Field)
- [CVE-2026-107265](https://cve.now/CVE-2026-107265.md): Leaflet - Moderately critical - Cross site scripting - SA-CONTRIB-2026-204 (no CVSS, Drupal Leaflet)
- [CVE-2026-107266](https://cve.now/CVE-2026-107266.md): Views Share - Moderately critical - Access bypass - SA-CONTRIB-2026-205 (no CVSS, Drupal Views Share)
- [CVE-2026-96389](https://cve.now/CVE-2026-96389.md): Xray Audit - Moderately critical - Access bypass - SA-CONTRIB-2026-206 (no CVSS, Drupal Xray Audit)
- [CVE-2026-107268](https://cve.now/CVE-2026-107268.md): Two Factor Authentication - TFA / Passwordless Login - Moderately critical - Information disclosure - SA-CONTRIB-2026-207 (no CVSS, Drupal Two Factor Authentication - TFA / Passwordless Login)
- [CVE-2026-107267](https://cve.now/CVE-2026-107267.md): DKAN - Moderately critical - Access bypass - SA-CONTRIB-2026-208 (no CVSS, Drupal DKAN)
- [CVE-2026-107306](https://cve.now/CVE-2026-107306.md): Menu Link Attributes - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-209 (no CVSS, Drupal Menu Link Attributes)
- [CVE-2026-107307](https://cve.now/CVE-2026-107307.md): SmartLinker AI - Moderately critical - Information disclosure - SA-CONTRIB-2026-210 (no CVSS, Drupal SmartLinker AI)
- [CVE-2026-107308](https://cve.now/CVE-2026-107308.md): Country - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-211 (no CVSS, Drupal Country)
- [CVE-2026-107309](https://cve.now/CVE-2026-107309.md): Easy Breadcrumb - Moderately critical - Information disclosure - SA-CONTRIB-2026-212 (no CVSS, Drupal Easy Breadcrumb)
- [CVE-2026-107310](https://cve.now/CVE-2026-107310.md): Freelinking - Moderately critical - Information Disclosure - SA-CONTRIB-2026-213 (no CVSS, Drupal Freelinking)
- [CVE-2026-107311](https://cve.now/CVE-2026-107311.md): Permissions by Term - Moderately critical - Information disclosure - SA-CONTRIB-2026-214 (no CVSS, Drupal Permissions by Term)
- [CVE-2026-107312](https://cve.now/CVE-2026-107312.md): Examples for Developers - Less critical - Allocation of resources without limits or throttling - SA-CONTRIB-2026-215 (no CVSS, Drupal Examples for Developers)
- [CVE-2026-107255](https://cve.now/CVE-2026-107255.md): Restrict route by IP - Critical - Access bypass - SA-CONTRIB-2026-216 (no CVSS, Drupal Restrict route by IP)
- [CVE-2026-107262](https://cve.now/CVE-2026-107262.md): Advanced Filesystem - Moderately critical - Cross-Site Request Forgery - SA-CONTRIB-2026-217 (no CVSS, Drupal Advanced Filesystem)
- [CVE-2026-108097](https://cve.now/CVE-2026-108097.md): Drupal core - Critical - Remote code execution - SA-CORE-2026-014 (no CVSS, Drupal core)
- [CVE-2026-110738](https://cve.now/CVE-2026-110738.md): Gin Admin Theme - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-219 (no CVSS, Drupal Gin Admin Theme)
- [CVE-2026-108515](https://cve.now/CVE-2026-108515.md): Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-015 (no CVSS, Drupal core)
- [CVE-2026-108514](https://cve.now/CVE-2026-108514.md): Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-016 (no CVSS, Drupal core)
- [CVE-2026-108099](https://cve.now/CVE-2026-108099.md): Entity List - Critical - Remote code execution - SA-CONTRIB-2026-218 (no CVSS, Drupal Entity List)
- [CVE-2026-114523](https://cve.now/CVE-2026-114523.md): Ffmpeg Image Toolkit - Highly critical - Remote Code Execution - SA-CONTRIB-2026-220 (no CVSS, Drupal Ffmpeg Image Toolkit)
- [CVE-2026-114527](https://cve.now/CVE-2026-114527.md): UI Icons - Critical - Cross site scripting - SA-CONTRIB-2026-221 (no CVSS, Drupal UI Icons)
- [CVE-2026-114528](https://cve.now/CVE-2026-114528.md): Zero Point - Critical - Cross-site scripting - SA-CONTRIB-2026-222 (no CVSS, Drupal Zero Point)
- [CVE-2026-114526](https://cve.now/CVE-2026-114526.md): Black Hole - Critical - Cross-site scripting - SA-CONTRIB-2026-223 (no CVSS, Drupal Black Hole)
- [CVE-2026-114525](https://cve.now/CVE-2026-114525.md): ABC - Critical - Cross-site scripting - SA-CONTRIB-2026-224 (no CVSS, Drupal ABC)
- [CVE-2026-114524](https://cve.now/CVE-2026-114524.md): Custom Formatters - Critical - Remote code execution - SA-CONTRIB-2026-225 (no CVSS, Drupal Custom Formatters)
- [CVE-2026-114529](https://cve.now/CVE-2026-114529.md): CSV Field - Moderately critical - Cross site Scripting - SA-CONTRIB-2026-226 (no CVSS, Drupal CSV Field)
- [CVE-2026-114530](https://cve.now/CVE-2026-114530.md): Dopup - Critical - Information disclosure - SA-CONTRIB-2026-227 (no CVSS, Drupal Dopup)
- [CVE-2026-114531](https://cve.now/CVE-2026-114531.md): Swiper formatter - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-228 (no CVSS, Drupal Swiper formatter)
- [CVE-2026-107260](https://cve.now/CVE-2026-107260.md): Sector Distribution - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-229 (no CVSS, Drupal Sector Distribution)
- [CVE-2026-114532](https://cve.now/CVE-2026-114532.md): UI Icons - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-230 (no CVSS, Drupal UI Icons)
- [CVE-2026-114533](https://cve.now/CVE-2026-114533.md): Ágora Transparency Theme - Moderately critical - Information disclosure - SA-CONTRIB-2026-231 (no CVSS, Drupal Ágora Transparency Theme)
- [CVE-2026-114534](https://cve.now/CVE-2026-114534.md): Block Attributes - Moderately critical - Cross site Scripting - SA-CONTRIB-2026-232 (no CVSS, Drupal Block Attributes)
- [CVE-2026-114535](https://cve.now/CVE-2026-114535.md): Swiper formatter - Moderately critical - Information disclosure - SA-CONTRIB-2026-233 (no CVSS, Drupal Swiper formatter)
- [CVE-2026-114536](https://cve.now/CVE-2026-114536.md): USWDS Paragraph Components - Moderately critical - Cross site scripting - SA-CONTRIB-2026-234 (no CVSS, Drupal USWDS Paragraph Components)
- [CVE-2026-114537](https://cve.now/CVE-2026-114537.md): View Unpublished - Moderately critical - Access bypass - SA-CONTRIB-2026-235 (no CVSS, Drupal View Unpublished)
- [CVE-2026-114538](https://cve.now/CVE-2026-114538.md): Bootstrap - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-236 (no CVSS, Drupal Bootstrap)
- [CVE-2026-114539](https://cve.now/CVE-2026-114539.md): DocCheck Basic - Moderately critical - Access bypass - SA-CONTRIB-2026-237 (no CVSS, Drupal DocCheck Basic)
- [CVE-2026-114540](https://cve.now/CVE-2026-114540.md): Domain - Moderately critical - Access bypass - SA-CONTRIB-2026-238 (no CVSS, Drupal Domain)
- [CVE-2026-114543](https://cve.now/CVE-2026-114543.md): Simple User Management - Moderately critical - Access bypass - SA-CONTRIB-2026-239 (no CVSS, Drupal Simple User Management)
- [CVE-2026-114541](https://cve.now/CVE-2026-114541.md): Frontend Editing - Moderately critical - Cross-Site Request Forgery (CSRF) - SA-CONTRIB-2026-240 (no CVSS, Drupal Frontend Editing)
- [CVE-2026-114553](https://cve.now/CVE-2026-114553.md): Frontend Editing - Less critical - Access bypass - SA-CONTRIB-2026-241 (no CVSS, Drupal Frontend Editing)
- [CVE-2026-114542](https://cve.now/CVE-2026-114542.md): Simple OAuth (OAuth2) & OpenID Connect - Moderately critical - Access bypass - SA-CONTRIB-2026-242 (no CVSS, Drupal Simple OAuth (OAuth2) & OpenID Connect · drupal/simp…)
- [CVE-2026-114544](https://cve.now/CVE-2026-114544.md): Media Bulk Upload - Moderately critical - Access bypass - SA-CONTRIB-2026-243 (no CVSS, Drupal Media Bulk Upload)
- [CVE-2026-114545](https://cve.now/CVE-2026-114545.md): Fullcalendar View - Moderately critical - Access bypass - SA-CONTRIB-2026-244 (no CVSS, Drupal Fullcalendar View)
- [CVE-2026-114546](https://cve.now/CVE-2026-114546.md): Media Alias Display - Moderately critical - Information disclosure - SA-CONTRIB-2026-245 (no CVSS, Drupal Media Alias Display)
- [CVE-2026-114547](https://cve.now/CVE-2026-114547.md): TinyPNG - Moderately critical - Information disclosure - SA-CONTRIB-2026-246 (no CVSS, Drupal TinyPNG)
- [CVE-2026-114548](https://cve.now/CVE-2026-114548.md): ImageAPI Optimize WebP - Moderately critical - Information disclosure - SA-CONTRIB-2026-247 (no CVSS, Drupal ImageAPI Optimize WebP)
- [CVE-2026-107256](https://cve.now/CVE-2026-107256.md): Shield - Moderately critical - Access bypass - SA-CONTRIB-2026-248 (no CVSS, Drupal Shield)
- [CVE-2026-114572](https://cve.now/CVE-2026-114572.md): Domain Login Restrict - Moderately critical - Access bypass - SA-CONTRIB-2026-249 (no CVSS, Drupal Domain Login Restrict)
- [CVE-2026-114555](https://cve.now/CVE-2026-114555.md): Data field - Moderately critical - Cross site scripting - SA-CONTRIB-2026-250 (no CVSS, Drupal Data field)
- [CVE-2026-114554](https://cve.now/CVE-2026-114554.md): AI File to Text - Moderately critical - Access bypass - SA-CONTRIB-2026-251 (no CVSS, Drupal AI File to Text)
- [CVE-2026-114571](https://cve.now/CVE-2026-114571.md): Rabbit Hole - Moderately critical - Access Bypass - SA-CONTRIB-2026-252 (no CVSS, Drupal Rabbit Hole)
- [CVE-2026-114573](https://cve.now/CVE-2026-114573.md): Monster Menus - Critical - PHP object injection - SA-CONTRIB-2026-253 (no CVSS, Drupal Monster Menus)
- [CVE-2026-118539](https://cve.now/CVE-2026-118539.md): Commerce Core - Highly critical - Access bypass - SA-CONTRIB-2026-254 (no CVSS, Drupal Commerce Core · drupal/commerce)
- [CVE-2026-118540](https://cve.now/CVE-2026-118540.md): Commerce Core - Moderately critical - Information disclosure - SA-CONTRIB-2026-255 (no CVSS, Drupal Commerce Core · drupal/commerce)
- [CVE-2026-118541](https://cve.now/CVE-2026-118541.md): Commerce Core - Less critical - Access bypass - SA-CONTRIB-2026-256 (no CVSS, Drupal Commerce Core · drupal/commerce)
- [CVE-2026-118542](https://cve.now/CVE-2026-118542.md): Commerce Core - Moderately critical - Access bypass - SA-CONTRIB-2026-257 (no CVSS, Drupal Commerce Core · drupal/commerce)
- [CVE-2026-118543](https://cve.now/CVE-2026-118543.md): Commerce Core - Moderately critical - Cross-site request forgery - SA-CONTRIB-2026-258 (no CVSS, Drupal Commerce Core · drupal/commerce)
- [CVE-2026-118544](https://cve.now/CVE-2026-118544.md): Commerce Core - Moderately critical - Information disclosure - SA-CONTRIB-2026-259 (no CVSS, Drupal Commerce Core · drupal/commerce)
- [CVE-2026-118555](https://cve.now/CVE-2026-118555.md): Commerce License - Moderately critical - Access bypass - SA-CONTRIB-2026-260 (no CVSS, Drupal Commerce License · drupal/commerce\_license)
- [CVE-2026-118556](https://cve.now/CVE-2026-118556.md): Commerce Shipping - Moderately critical - Access bypass - SA-CONTRIB-2026-261 (no CVSS, Drupal Commerce Shipping · drupal/commerce\_shipping)
- [CVE-2026-118557](https://cve.now/CVE-2026-118557.md): Commerce Shipping - Less critical - Access bypass - SA-CONTRIB-2026-262 (no CVSS, Drupal Commerce Shipping · drupal/commerce\_shipping)
- [CVE-2026-118558](https://cve.now/CVE-2026-118558.md): Commerce Stripe - Critical - Cross-site request forgery - SA-CONTRIB-2026-263 (no CVSS, Drupal Commerce Stripe · drupal/commerce\_stripe)
- [CVE-2026-118559](https://cve.now/CVE-2026-118559.md): Commerce Stripe - Moderately critical - Improper verification of cryptographic signature - SA-CONTRIB-2026-264 (no CVSS, Drupal Commerce Stripe · drupal/commerce\_stripe)
- [CVE-2026-118560](https://cve.now/CVE-2026-118560.md): Commerce Stripe - Moderately critical - Cross site scripting - SA-CONTRIB-2026-265 (no CVSS, Drupal Commerce Stripe)
- [CVE-2026-118545](https://cve.now/CVE-2026-118545.md): AI (Artificial Intelligence) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-266 (no CVSS, Drupal AI · drupal/ai)
- [CVE-2026-118546](https://cve.now/CVE-2026-118546.md): AI (Artificial Intelligence) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-267 (no CVSS, Drupal AI · drupal/ai)
- [CVE-2026-118548](https://cve.now/CVE-2026-118548.md): AI (Artificial Intelligence) - Moderately critical - Information disclosure - SA-CONTRIB-2026-268 (no CVSS, Drupal AI · drupal/ai)
- [CVE-2026-118549](https://cve.now/CVE-2026-118549.md): AI (Artificial Intelligence) - Critical - Cross-site scripting - SA-CONTRIB-2026-269 (no CVSS, Drupal AI · drupal/ai)
- [CVE-2026-118550](https://cve.now/CVE-2026-118550.md): AI (Artificial Intelligence) - Moderately critical - Access bypass - SA-CONTRIB-2026-270 (no CVSS, Drupal AI · drupal/ai)
- [CVE-2026-118551](https://cve.now/CVE-2026-118551.md): AI (Artificial Intelligence) - Less critical - Information Disclosure - SA-CONTRIB-2026-271 (no CVSS, Drupal AI · drupal/ai)
- [CVE-2026-118552](https://cve.now/CVE-2026-118552.md): AI (Artificial Intelligence) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-272 (no CVSS, Drupal AI · drupal/ai)
- [CVE-2026-118553](https://cve.now/CVE-2026-118553.md): AI (Artificial Intelligence) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-273 (no CVSS, Drupal AI · drupal/ai)
- [CVE-2026-118561](https://cve.now/CVE-2026-118561.md): Single Content Sync - Critical - External control of file name or path - SA-CONTRIB-2026-274 (no CVSS, Drupal Single Content Sync · drupal/single\_content\_sync)
- [CVE-2026-118562](https://cve.now/CVE-2026-118562.md): Single Content Sync - Critical - Remote code execution - SA-CONTRIB-2026-275 (no CVSS, Drupal Single Content Sync · drupal/single\_content\_sync)
- [CVE-2026-118563](https://cve.now/CVE-2026-118563.md): CacheFlush - Critical - Unsupported - SA-CONTRIB-2026-276 (no CVSS, Drupal CacheFlush · drupal/cacheflush)
- [CVE-2026-118564](https://cve.now/CVE-2026-118564.md): PayUmoney for Drupal Commerce - Critical - Unsupported - SA-CONTRIB-2026-277 (no CVSS, PayUmoney for Drupal Commerce · drupal/commerce\_payumoney)
- [CVE-2026-118565](https://cve.now/CVE-2026-118565.md): GroupEx PRO ( Daxko ) integration - Critical - Unsupported - SA-CONTRIB-2026-278 (no CVSS, Drupal GroupEx PRO ( Daxko ) integration · drupal/groupexp…)
- [CVE-2026-118582](https://cve.now/CVE-2026-118582.md): CAPTCHA - Moderately critical - Session Replay (CAPTCHA bypass) - SA-CONTRIB-2026-281 (no CVSS, Drupal CAPTCHA · drupal/captcha)
- [CVE-2026-118569](https://cve.now/CVE-2026-118569.md): Fasttoggle - Moderately critical - Access bypass - SA-CONTRIB-2026-282 (no CVSS, Drupal Fasttoggle · drupal/fasttoggle)
- [CVE-2026-118570](https://cve.now/CVE-2026-118570.md): Fasttoggle - Moderately critical - Cross-Site Request Forgery - SA-CONTRIB-2026-283 (no CVSS, Drupal Fasttoggle · drupal/fasttoggle)
- [CVE-2026-118574](https://cve.now/CVE-2026-118574.md): S3 File System - Moderately critical - Access bypass - SA-CONTRIB-2026-279 (no CVSS, Drupal S3 File System · drupal/s3fs)
- [CVE-2026-118567](https://cve.now/CVE-2026-118567.md): Bulk Update User Roles - Moderately critical - Incorrect authorization - SA-CONTRIB-2026-280 (no CVSS, Drupal Bulk Update User Roles · drupal/bulk\_update\_user\_rol…)
- [CVE-2026-118572](https://cve.now/CVE-2026-118572.md): OAuth Login - OAuth OIDC SSO - Critical - Authentication bypass - SA-CONTRIB-2026-284 (no CVSS, Drupal OAuth Login - OAuth OIDC SSO · drupal/oauth\_login\_oa…)
- [CVE-2026-118575](https://cve.now/CVE-2026-118575.md): Signature pad widget - Critical - Cross-site scripting - SA-CONTRIB-2026-285 (no CVSS, Drupal Signature pad widget · drupal/sign\_widget)
- [CVE-2026-118576](https://cve.now/CVE-2026-118576.md): Stage File Proxy - Critical - Cross-site scripting - SA-CONTRIB-2026-286 (no CVSS, Drupal Stage File Proxy · drupal/stage\_file\_proxy)
- [CVE-2026-118554](https://cve.now/CVE-2026-118554.md): OpenID Connect Client - Moderately critical - Improper authentication - SA-CONTRIB-2026-287 (no CVSS, Drupal OpenID Connect Client · drupal/oidc)
- [CVE-2026-118583](https://cve.now/CVE-2026-118583.md): Field Permissions - Moderately critical - Access bypass - SA-CONTRIB-2026-288 (no CVSS, Drupal Field Permissions · drupal/field\_permissions)

[Next page](https://cve.now/latest.md?cursor=WyIyMDI2LTEwLTMwVDAzOjA4OjM3LjI4MloiLCJDVkUtMjAyNi0xMTg1ODMiXQ)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/vulnerabilities
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.