# cve.now: Packagist packages

The newest entries affecting Packagist packages (up to 200). To check exact package versions, use the MCP stack.check operation or /stack.

- [CVE-2026-121619](https://cve.now/CVE-2026-121619.md): Symfony: The "private\_ranges" Trusted Proxies Shortcut Trusts Clients Presenting an IPv4-Mapped, 6to4, Teredo or NAT64 Address as Reverse… (CVSS 6.3, sensiolabs symfony/framework-bundle · sensiolabs symfony/ht…)
- [DRUPAL-CONTRIB-2026-334](https://cve.now/DRUPAL-CONTRIB-2026-334.md): This module enables you to manage user consent for external services, such as embedded videos. (no CVSS, drupal/cookies)
- [CVE-2026-126061](https://cve.now/CVE-2026-126061.md): Winter CMS: My Account preview exposes another backend user's profile by record ID (CVSS 4.3, wintercms winter · winter/wn-backend-module)
- [CVE-2026-125341](https://cve.now/CVE-2026-125341.md): Winter CMS: Stored XSS through Backend List widget image columns (CVSS 2.0, wintercms winter · winter/wn-backend-module)
- [CVE-2026-125340](https://cve.now/CVE-2026-125340.md): Winter cross-site scripting in backend table widget search (CVSS 4.5, wintercms winter · winter/wn-backend-module)
- [CVE-2026-125339](https://cve.now/CVE-2026-125339.md): Winter CMS: CSRF through AJAX handler names reachable as backend page actions (CVSS 6.1, wintercms winter · winter/wn-backend-module)
- [CVE-2026-125338](https://cve.now/CVE-2026-125338.md): Winter CMS: Stored XSS through cached Brand Settings and Editor Settings custom styles (CVSS 4.5, wintercms winter · winter/wn-backend-module)
- [CVE-2026-125337](https://cve.now/CVE-2026-125337.md): Winter CMS: ImportExportController AJAX handlers bypass granular import/export permission gate (CVSS 8.3, wintercms winter · winter/wn-backend-module)
- [CVE-2026-115934](https://cve.now/CVE-2026-115934.md): SQL injection leading to privilege escalation (CVSS 9.3, craftcms/cms)
- [CVE-2026-94619](https://cve.now/CVE-2026-94619.md): FileGator: Missing authorization in POST /upload allows cross-user read and deletion of temporary files (CVSS 5.9, filegator · filegator/filegator)
- [CVE-2026-94618](https://cve.now/CVE-2026-94618.md): FileGator: Missing authorization in GET /batchdownload allows cross-user retrieval of another user's archive (CVSS 5.4, filegator · filegator/filegator)
- [CVE-2026-123824](https://cve.now/CVE-2026-123824.md): Symfony: XXE (Local File Read) in Config XmlUtils::parse() via validateOnParse = true (CVSS 2.3, sensiolabs symfony/config)
- [CVE-2026-122053](https://cve.now/CVE-2026-122053.md): Symfony: ObjectNormalizer Dotted-Key Property-Path Traversal Bypasses #\[Ignore\] on Nested Objects (CVSS 6.9, sensiolabs symfony/serializer)
- [CVE-2026-118515](https://cve.now/CVE-2026-118515.md): Symfony: The Serializer Builds UploadedFile Objects From Request Data, Letting a Client Point an Upload at Any Server File (CVSS 8.4, sensiolabs symfony/serializer)
- [CVE-2026-121623](https://cve.now/CVE-2026-121623.md): Symfony: DataUriNormalizer Opens Data URIs With a Non-Lowercase Scheme as Local Files, Letting a Client Read Any Server File (CVSS 8.2, sensiolabs symfony/serializer)
- [CVE-2026-123792](https://cve.now/CVE-2026-123792.md): Symfony: Exponential and Quadratic Parse Times in the YAML Parser Let a Single Document Hold a Process (CVSS 8.7, sensiolabs symfony/yaml)
- [CVE-2026-123339](https://cve.now/CVE-2026-123339.md): Symfony: Inline Fragments Let Untrusted Forwarded Headers Set the Host, Scheme and Port of the URLs Generated for the Main Request (CVSS 2.3, sensiolabs symfony/http-kernel)
- [CVE-2026-118514](https://cve.now/CVE-2026-118514.md): Symfony: HEAD Requests Bypass the methods Option of security.access\_control Rules and Firewalls (CVSS 6.3, symfony/http-foundation)
- [CVE-2026-123746](https://cve.now/CVE-2026-123746.md): Symfony: Programmatic Logins Skip the checkPostAuth() Method of User Checkers (CVSS 2.3, sensiolabs symfony/security-http)
- [CVE-2026-33944](https://cve.now/CVE-2026-33944.md): Dolibarr: SQL Injection in societe/class/societe.class.php via localtax1\_value parameter (CVSS 8.8, dolibarr · dolibarr/dolibarr)
- [CVE-2026-121949](https://cve.now/CVE-2026-121949.md): Symfony: HtmlSanitizer Does Not URL-Sanitize srcset and imagesrcset: Media Scheme and Host Allow-List Bypass (CVSS 2.3, sensiolabs symfony/html-sanitizer)
- [CVE-2026-118517](https://cve.now/CVE-2026-118517.md): Symfony: HtmlSanitizer allowLinkHosts() / allowMediaHosts() Bypass via URLs Without a Well-Formed Authority (Incomplete Fix for… (CVSS 2.3, sensiolabs symfony/http-client)
- [CVE-2026-123125](https://cve.now/CVE-2026-123125.md): Symfony: Ip Constraint public/private Modes Accept IPv4-Mapped and IPv4-Compatible IPv6 Addresses allowing SSRF Filter Bypass (CVSS 6.3, sensiolabs symfony/validator)
- [CVE-2026-123119](https://cve.now/CVE-2026-123119.md): Symfony: NoPrivateNetworkHttpClient Does Not Pin the Checked IP of Cached Hosts, Letting DNS Rebinding Enumerate Internal Ports… (CVSS 2.3, sensiolabs symfony/http-client)
- [CVE-2026-121971](https://cve.now/CVE-2026-121971.md): Symfony: ScopingHttpClient Sends the Credentials of Its Default Scope to Other Origins Through Network-Path References (CVSS 8.2, sensiolabs symfony/http-client)
- [CVE-2026-121373](https://cve.now/CVE-2026-121373.md): Symfony: HtmlSanitizer MetaRefreshAttributeSanitizer Matches Only a Narrow Subset of the Browser Refresh Grammar (Incomplete Fix for… (CVSS 5.3, sensiolabs symfony/html-sanitizer)
- [CVE-2026-118516](https://cve.now/CVE-2026-118516.md): Symfony: Host Placeholders Can Match the Start of the Path in Compiled URL Matchers, Bypassing Path-Based Access Control (CVSS 6.3, sensiolabs symfony/routing)
- [CVE-2026-118513](https://cve.now/CVE-2026-118513.md): Symfony: X.509 Authentication Impersonation via DN Value Injection (incomplete fix for CVE-2026-45063) (CVSS 7.7, sensiolabs symfony/security-http)
- [CVE-2026-55186](https://cve.now/CVE-2026-55186.md): Silverstripe MFA: Can bypass MFA during password reset flow (CVSS 4.2, silverstripe-mfa · silverstripe/mfa)
- [CVE-2026-120327](https://cve.now/CVE-2026-120327.md): Open Redirection in extension "Mail" (mail) (CVSS 5.3, TYPO3 mediaessenz/mail)
- [CVE-2026-120328](https://cve.now/CVE-2026-120328.md): Information Disclosure in extension "Mail" (mail) (CVSS 6.9, TYPO3 mediaessenz/mail)
- [CVE-2026-120329](https://cve.now/CVE-2026-120329.md): Broken Access Control in extension "Mail" (mail) (CVSS 5.3, TYPO3 mediaessenz/mail)
- [CVE-2026-120330](https://cve.now/CVE-2026-120330.md): Broken Access Control in extension "Mail" (mail) (CVSS 7.1, TYPO3 mediaessenz/mail)
- [CVE-2026-120331](https://cve.now/CVE-2026-120331.md): Server-Side Request Forgery in extension "Mail" (mail) (CVSS 5.3, TYPO3 mediaessenz/mail)
- [CVE-2026-120332](https://cve.now/CVE-2026-120332.md): Cross-Site Scripting in extension "Mail" (mail) (CVSS 5.1, TYPO3 mediaessenz/mail)
- [CVE-2026-120333](https://cve.now/CVE-2026-120333.md): Broken Access Control in extension "Frontend User Registration" (sf\_register) (CVSS 8.8, TYPO3 evoweb/sf-register)
- [CVE-2026-59978](https://cve.now/CVE-2026-59978.md): AdminNeo: version-cache array injection causes persistent denial of service (CVSS 7.5, adminneo-org adminneo · adminneo-org/adminneo)
- [CVE-2026-119417](https://cve.now/CVE-2026-119417.md): CakePHP through 5.4.3 Email Header Injection via Bare CR/LF in SmtpTransport and MailTransport (CVSS 6.3, cakephp · cakephp/cakephp)
- [CVE-2026-107266](https://cve.now/CVE-2026-107266.md): Views Share - Moderately critical - Access bypass - SA-CONTRIB-2026-205 (CVSS 5.3, Drupal Views Share · drupal/views\_share)
- [CVE-2026-107255](https://cve.now/CVE-2026-107255.md): Restrict route by IP - Critical - Access bypass - SA-CONTRIB-2026-216 (CVSS 7.3, Drupal Restrict route by IP · drupal/restrict\_route\_by\_ip)
- [CVE-2026-108097](https://cve.now/CVE-2026-108097.md): Drupal core - Critical - Remote code execution - SA-CORE-2026-014 (CVSS 8.1, Drupal core · drupal/core)
- [CVE-2026-110738](https://cve.now/CVE-2026-110738.md): Gin Admin Theme - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-219 (CVSS 6.5, Drupal Gin Admin Theme · drupal/gin)
- [CVE-2026-108515](https://cve.now/CVE-2026-108515.md): Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-015 (CVSS 6.5, Drupal core · drupal/core)
- [CVE-2026-108514](https://cve.now/CVE-2026-108514.md): Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-016 (CVSS 6.5, Drupal core · drupal/core)
- [CVE-2026-108099](https://cve.now/CVE-2026-108099.md): Entity List - Critical - Remote code execution - SA-CONTRIB-2026-218 (CVSS 8.1, Drupal Entity List · drupal/entity\_list)
- [CVE-2026-114523](https://cve.now/CVE-2026-114523.md): Ffmpeg Image Toolkit - Highly critical - Remote Code Execution - SA-CONTRIB-2026-220 (CVSS 9.8, Drupal Ffmpeg Image Toolkit · drupal/ffmpeg\_image\_toolkit)
- [CVE-2026-114528](https://cve.now/CVE-2026-114528.md): Zero Point - Critical - Cross-site scripting - SA-CONTRIB-2026-222 (CVSS 7.1, Drupal Zero Point · drupal/zeropoint)
- [CVE-2026-114526](https://cve.now/CVE-2026-114526.md): Black Hole - Critical - Cross-site scripting - SA-CONTRIB-2026-223 (CVSS 7.1, Drupal Black Hole · drupal/black\_hole)
- [CVE-2026-114525](https://cve.now/CVE-2026-114525.md): ABC - Critical - Cross-site scripting - SA-CONTRIB-2026-224 (CVSS 7.1, Drupal ABC · drupal/abc)
- [CVE-2026-114524](https://cve.now/CVE-2026-114524.md): Custom Formatters - Critical - Remote code execution - SA-CONTRIB-2026-225 (CVSS 7.2, Drupal Custom Formatters · drupal/custom\_formatters)
- [CVE-2026-114529](https://cve.now/CVE-2026-114529.md): CSV Field - Moderately critical - Cross site Scripting - SA-CONTRIB-2026-226 (CVSS 6.5, Drupal CSV Field · drupal/csv\_field)
- [CVE-2026-114530](https://cve.now/CVE-2026-114530.md): Dopup - Critical - Information disclosure - SA-CONTRIB-2026-227 (CVSS 5.3, Drupal Dopup · drupal/dopup)
- [CVE-2026-114531](https://cve.now/CVE-2026-114531.md): Swiper formatter - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-228 (CVSS 6.5, Drupal Swiper formatter · drupal/swiper\_formatter)
- [CVE-2026-107260](https://cve.now/CVE-2026-107260.md): Sector Distribution - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-229 (CVSS 6.5, Drupal Sector Distribution · drupal/sector)
- [CVE-2026-114533](https://cve.now/CVE-2026-114533.md): Ágora Transparency Theme - Moderately critical - Information disclosure - SA-CONTRIB-2026-231 (CVSS 5.3, Drupal Ágora Transparency Theme · drupal/agora\_theme)
- [CVE-2026-114534](https://cve.now/CVE-2026-114534.md): Block Attributes - Moderately critical - Cross site Scripting - SA-CONTRIB-2026-232 (CVSS 5.9, Drupal Block Attributes · drupal/block\_attributes)
- [CVE-2026-114535](https://cve.now/CVE-2026-114535.md): Swiper formatter - Moderately critical - Information disclosure - SA-CONTRIB-2026-233 (CVSS 5.3, Drupal Swiper formatter · drupal/swiper\_formatter)
- [CVE-2026-114536](https://cve.now/CVE-2026-114536.md): USWDS Paragraph Components - Moderately critical - Cross site scripting - SA-CONTRIB-2026-234 (CVSS 6.5, Drupal USWDS Paragraph Components · drupal/uswds\_paragraph\_…)
- [CVE-2026-114540](https://cve.now/CVE-2026-114540.md): Domain - Moderately critical - Access bypass - SA-CONTRIB-2026-238 (CVSS 6.3, Drupal Domain · drupal/domain)
- [CVE-2026-114541](https://cve.now/CVE-2026-114541.md): Frontend Editing - Moderately critical - Cross-Site Request Forgery (CSRF) - SA-CONTRIB-2026-240 (CVSS 4.8, Drupal Frontend Editing · drupal/frontend\_editing)
- [CVE-2026-114553](https://cve.now/CVE-2026-114553.md): Frontend Editing - Less critical - Access bypass - SA-CONTRIB-2026-241 (CVSS 5.4, Drupal Frontend Editing · drupal/frontend\_editing)
- [CVE-2026-114542](https://cve.now/CVE-2026-114542.md): Simple OAuth (OAuth2) & OpenID Connect - Moderately critical - Access bypass - SA-CONTRIB-2026-242 (CVSS 5.4, Drupal Simple OAuth (OAuth2) & OpenID Connect · drupal/simp…)
- [CVE-2026-114544](https://cve.now/CVE-2026-114544.md): Media Bulk Upload - Moderately critical - Access bypass - SA-CONTRIB-2026-243 (CVSS 5.4, Drupal Media Bulk Upload · drupal/media\_bulk\_upload)
- [CVE-2026-114545](https://cve.now/CVE-2026-114545.md): Fullcalendar View - Moderately critical - Access bypass - SA-CONTRIB-2026-244 (CVSS 5.4, Drupal Fullcalendar View · drupal/fullcalendar\_view)
- [CVE-2026-114546](https://cve.now/CVE-2026-114546.md): Media Alias Display - Moderately critical - Information disclosure - SA-CONTRIB-2026-245 (CVSS 3.7, Drupal Media Alias Display · drupal/media\_alias\_display)
- [CVE-2026-114547](https://cve.now/CVE-2026-114547.md): TinyPNG - Moderately critical - Information disclosure - SA-CONTRIB-2026-246 (CVSS 3.7, Drupal TinyPNG · drupal/tinypng)
- [CVE-2026-114548](https://cve.now/CVE-2026-114548.md): ImageAPI Optimize WebP - Moderately critical - Information disclosure - SA-CONTRIB-2026-247 (CVSS 3.7, Drupal ImageAPI Optimize WebP · drupal/imageapi\_optimize\_we…)
- [CVE-2026-114554](https://cve.now/CVE-2026-114554.md): AI File to Text - Moderately critical - Access bypass - SA-CONTRIB-2026-251 (CVSS 4.3, Drupal AI File to Text · drupal/ai\_file\_to\_text)
- [CVE-2026-114573](https://cve.now/CVE-2026-114573.md): Monster Menus - Critical - PHP object injection - SA-CONTRIB-2026-253 (CVSS 8.8, Drupal Monster Menus · drupal/monster\_menus)
- [CVE-2026-118539](https://cve.now/CVE-2026-118539.md): Commerce Core - Highly critical - Access bypass - SA-CONTRIB-2026-254 (CVSS 6.5, Drupal Commerce Core · drupal/commerce)
- [CVE-2026-118540](https://cve.now/CVE-2026-118540.md): Commerce Core - Moderately critical - Information disclosure - SA-CONTRIB-2026-255 (CVSS 5.3, Drupal Commerce Core · drupal/commerce)
- [CVE-2026-118541](https://cve.now/CVE-2026-118541.md): Commerce Core - Less critical - Access bypass - SA-CONTRIB-2026-256 (CVSS 4.3, Drupal Commerce Core · drupal/commerce)
- [CVE-2026-118542](https://cve.now/CVE-2026-118542.md): Commerce Core - Moderately critical - Access bypass - SA-CONTRIB-2026-257 (CVSS 2.7, Drupal Commerce Core · drupal/commerce)
- [CVE-2026-118543](https://cve.now/CVE-2026-118543.md): Commerce Core - Moderately critical - Cross-site request forgery - SA-CONTRIB-2026-258 (CVSS 5.3, Drupal Commerce Core · drupal/commerce)
- [CVE-2026-118544](https://cve.now/CVE-2026-118544.md): Commerce Core - Moderately critical - Information disclosure - SA-CONTRIB-2026-259 (CVSS 3.7, Drupal Commerce Core · drupal/commerce)
- [CVE-2026-118555](https://cve.now/CVE-2026-118555.md): Commerce License - Moderately critical - Access bypass - SA-CONTRIB-2026-260 (CVSS 6.3, Drupal Commerce License · drupal/commerce\_license)
- [CVE-2026-118556](https://cve.now/CVE-2026-118556.md): Commerce Shipping - Moderately critical - Access bypass - SA-CONTRIB-2026-261 (CVSS 6.5, Drupal Commerce Shipping · drupal/commerce\_shipping)
- [CVE-2026-118557](https://cve.now/CVE-2026-118557.md): Commerce Shipping - Less critical - Access bypass - SA-CONTRIB-2026-262 (CVSS 2.7, Drupal Commerce Shipping · drupal/commerce\_shipping)
- [CVE-2026-118558](https://cve.now/CVE-2026-118558.md): Commerce Stripe - Critical - Cross-site request forgery - SA-CONTRIB-2026-263 (CVSS 7.3, Drupal Commerce Stripe · drupal/commerce\_stripe)
- [CVE-2026-118559](https://cve.now/CVE-2026-118559.md): Commerce Stripe - Moderately critical - Improper verification of cryptographic signature - SA-CONTRIB-2026-264 (CVSS 5.3, Drupal Commerce Stripe · drupal/commerce\_stripe)
- [CVE-2026-118560](https://cve.now/CVE-2026-118560.md): Commerce Stripe - Moderately critical - Cross site scripting - SA-CONTRIB-2026-265 (CVSS 5.1, Drupal Commerce Stripe · drupal/commerce\_stripe)
- [CVE-2026-118545](https://cve.now/CVE-2026-118545.md): AI (Artificial Intelligence) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-266 (CVSS 6.5, Drupal AI · drupal/ai)
- [CVE-2026-118546](https://cve.now/CVE-2026-118546.md): AI (Artificial Intelligence) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-267 (CVSS 6.5, Drupal AI · drupal/ai)
- [CVE-2026-118548](https://cve.now/CVE-2026-118548.md): AI (Artificial Intelligence) - Moderately critical - Information disclosure - SA-CONTRIB-2026-268 (CVSS 3.7, Drupal AI · drupal/ai)
- [CVE-2026-118549](https://cve.now/CVE-2026-118549.md): AI (Artificial Intelligence) - Critical - Cross-site scripting - SA-CONTRIB-2026-269 (CVSS 7.1, Drupal AI · drupal/ai)
- [CVE-2026-118550](https://cve.now/CVE-2026-118550.md): AI (Artificial Intelligence) - Moderately critical - Access bypass - SA-CONTRIB-2026-270 (CVSS 5.9, Drupal AI · drupal/ai)
- [CVE-2026-118551](https://cve.now/CVE-2026-118551.md): AI (Artificial Intelligence) - Less critical - Information Disclosure - SA-CONTRIB-2026-271 (CVSS 3.1, Drupal AI · drupal/ai)
- [CVE-2026-118552](https://cve.now/CVE-2026-118552.md): AI (Artificial Intelligence) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-272 (CVSS 6.5, Drupal AI · drupal/ai)
- [CVE-2026-118553](https://cve.now/CVE-2026-118553.md): AI (Artificial Intelligence) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-273 (CVSS 5.5, Drupal AI · drupal/ai)
- [CVE-2026-118561](https://cve.now/CVE-2026-118561.md): Single Content Sync - Critical - External control of file name or path - SA-CONTRIB-2026-274 (CVSS 7.2, Drupal Single Content Sync · drupal/single\_content\_sync)
- [CVE-2026-118562](https://cve.now/CVE-2026-118562.md): Single Content Sync - Critical - Remote code execution - SA-CONTRIB-2026-275 (CVSS 7.2, Drupal Single Content Sync · drupal/single\_content\_sync)
- [CVE-2026-118563](https://cve.now/CVE-2026-118563.md): CacheFlush - Critical - Unsupported - SA-CONTRIB-2026-276 (CVSS 6.6, Drupal CacheFlush · drupal/cacheflush)
- [CVE-2026-118564](https://cve.now/CVE-2026-118564.md): PayUmoney for Drupal Commerce - Critical - Unsupported - SA-CONTRIB-2026-277 (CVSS 6.6, PayUmoney for Drupal Commerce · drupal/commerce\_payumoney)
- [CVE-2026-118565](https://cve.now/CVE-2026-118565.md): GroupEx PRO ( Daxko ) integration - Critical - Unsupported - SA-CONTRIB-2026-278 (CVSS 7.2, Drupal GroupEx PRO ( Daxko ) integration · drupal/groupexp…)
- [CVE-2026-118582](https://cve.now/CVE-2026-118582.md): CAPTCHA - Moderately critical - Session Replay (CAPTCHA bypass) - SA-CONTRIB-2026-281 (CVSS 7.3, Drupal CAPTCHA · drupal/captcha)
- [CVE-2026-118569](https://cve.now/CVE-2026-118569.md): Fasttoggle - Moderately critical - Access bypass - SA-CONTRIB-2026-282 (CVSS 5.4, Drupal Fasttoggle · drupal/fasttoggle)
- [CVE-2026-118570](https://cve.now/CVE-2026-118570.md): Fasttoggle - Moderately critical - Cross-Site Request Forgery - SA-CONTRIB-2026-283 (CVSS 6.5, Drupal Fasttoggle · drupal/fasttoggle)
- [CVE-2026-118574](https://cve.now/CVE-2026-118574.md): S3 File System - Moderately critical - Access bypass - SA-CONTRIB-2026-279 (CVSS 5.6, Drupal S3 File System · drupal/s3fs)
- [CVE-2026-118567](https://cve.now/CVE-2026-118567.md): Bulk Update User Roles - Moderately critical - Incorrect authorization - SA-CONTRIB-2026-280 (CVSS 4.7, Drupal Bulk Update User Roles · drupal/bulk\_update\_user\_rol…)
- [CVE-2026-118572](https://cve.now/CVE-2026-118572.md): OAuth Login - OAuth OIDC SSO - Critical - Authentication bypass - SA-CONTRIB-2026-284 (CVSS 4.8, Drupal OAuth Login - OAuth OIDC SSO · drupal/oauth\_login\_oa…)
- [CVE-2026-118575](https://cve.now/CVE-2026-118575.md): Signature pad widget - Critical - Cross-site scripting - SA-CONTRIB-2026-285 (CVSS 6.1, Drupal Signature pad widget · drupal/sign\_widget)
- [CVE-2026-118576](https://cve.now/CVE-2026-118576.md): Stage File Proxy - Critical - Cross-site scripting - SA-CONTRIB-2026-286 (CVSS 6.5, Drupal Stage File Proxy · drupal/stage\_file\_proxy)
- [CVE-2026-118554](https://cve.now/CVE-2026-118554.md): OpenID Connect Client - Moderately critical - Improper authentication - SA-CONTRIB-2026-287 (CVSS 5.4, Drupal OpenID Connect Client · drupal/oidc)
- [CVE-2026-118583](https://cve.now/CVE-2026-118583.md): Field Permissions - Moderately critical - Access bypass - SA-CONTRIB-2026-288 (CVSS 5.3, Drupal Field Permissions · drupal/field\_permissions)
- [CVE-2026-118584](https://cve.now/CVE-2026-118584.md): Field Permissions - Moderately critical - Access bypass - SA-CONTRIB-2026-289 (CVSS 5.3, Drupal Field Permissions · drupal/field\_permissions)
- [CVE-2026-118573](https://cve.now/CVE-2026-118573.md): OAuth2 Token Manager - Critical - Access bypass - SA-CONTRIB-2026-290 (CVSS 4.8, Drupal OAuth2 Token Manager · drupal/oauth2\_token\_manager)
- [CVE-2026-118568](https://cve.now/CVE-2026-118568.md): Content Sync (content-sync.io) - Moderately critical - Information disclosure - SA-CONTRIB-2026-291 (CVSS 3.3, Drupal Content Sync · drupal/cms\_content\_sync)
- [CVE-2026-118571](https://cve.now/CVE-2026-118571.md): Media Alias Display - Moderately critical - Information disclosure - SA-CONTRIB-2026-292 (CVSS 5.9, Drupal Media Alias Display · drupal/media\_alias\_display)
- [CVE-2026-119193](https://cve.now/CVE-2026-119193.md): PHPUnit vulnerable to code execution by other local users via shared temporary directory in PHPT code coverage handling (CVSS 5.4, sebastianbergmann phpunit · phpunit/phpunit)
- [CVE-2026-56828](https://cve.now/CVE-2026-56828.md): Shopper: read-only team permissions allow administrator creation and permission escalation (CVSS 8.8, shopperlabs shopper · shopper/framework)
- [CVE-2026-116675](https://cve.now/CVE-2026-116675.md): TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin \`data-mce-object\` serialization (CVSS 8.5, tinymce · tinymce/tinymce)
- [CVE-2026-117538](https://cve.now/CVE-2026-117538.md): REDAXO before 5.21.0 Reflected XSS via Packages API function Parameter (CVSS 2.1, redaxo core · redaxo/source)
- [CVE-2026-117537](https://cve.now/CVE-2026-117537.md): REDAXO before 5.21.0 Reflected XSS via Metainfo API type Parameter (CVSS 2.1, redaxo core · redaxo/source)
- [CVE-2026-116891](https://cve.now/CVE-2026-116891.md): SemanticMediaWiki 4.2.0 before 7.2.1 Reflected XSS via Special:FacetedSearch cstate (CVSS 5.1, SemanticMediaWiki · mediawiki/semantic-media-wiki)
- [CVE-2026-116890](https://cve.now/CVE-2026-116890.md): Semantic MediaWiki 3.0.0 before 7.3.0 Missing Authorization via smwtask API (CVSS 6.9, SemanticMediaWiki · mediawiki/semantic-media-wiki)
- [CVE-2026-108357](https://cve.now/CVE-2026-108357.md): PhpSpreadsheet: XmlScanner Bypass via Double-Encoded unentity() TOCTOU Allows XXE and Denial of Service (CVSS 8.8, PHPOffice PhpSpreadsheet · phpoffice/phpspreadsheet)
- [CVE-2026-108359](https://cve.now/CVE-2026-108359.md): PhpSpreadsheet ODS Reader: Unbounded number-rows-repeated → CPU & Memory Exhaustion (DoS) (CVSS 8.7, PHPOffice PhpSpreadsheet · phpoffice/phpspreadsheet)
- [CVE-2026-108358](https://cve.now/CVE-2026-108358.md): PhpSpreadsheet: XmlScanner Bypass via ISO-2022 Escape Sequences Allows XXE and Denial of Service (CVSS 8.8, PHPOffice PhpSpreadsheet · phpoffice/phpspreadsheet)
- [CVE-2026-108360](https://cve.now/CVE-2026-108360.md): PhpSpreadsheet: SSRF whitelist bypass via unre-validated HTTP redirect in Drawing::setPath external image loading (CVSS 6.4, PHPOffice PhpSpreadsheet · phpoffice/phpspreadsheet)
- [CVE-2026-84910](https://cve.now/CVE-2026-84910.md): Advanced Search - Moderately critical - Access bypass - SA-CONTRIB-2026-118 (CVSS 4.2, Drupal Advanced Search · drupal/advanced\_search)
- [CVE-2026-84911](https://cve.now/CVE-2026-84911.md): AI (Artificial Intelligence) - Moderately critical - Cross site scripting - SA-CONTRIB-2026-119 (CVSS 3.1, Drupal AI · drupal/ai)
- [CVE-2026-84912](https://cve.now/CVE-2026-84912.md): AI (Artificial Intelligence) - Moderately critical - Access Bypass - SA-CONTRIB-2026-120 (CVSS 4.6, Drupal AI · drupal/ai)
- [CVE-2026-84913](https://cve.now/CVE-2026-84913.md): AI translate - Moderately critical - Access Bypass - SA-CONTRIB-2026-121 (CVSS 4.6, Drupal AI Translate · drupal/ai\_translate)
- [CVE-2026-84914](https://cve.now/CVE-2026-84914.md): Calculate Working Days - Critical - Access bypass - SA-CONTRIB-2026-122 (CVSS 5.3, Drupal Calculate Working Days · drupal/calculate\_working\_da…)
- [CVE-2026-84915](https://cve.now/CVE-2026-84915.md): Component blocks - Moderately critical - Cross site scripting - SA-CONTRIB-2026-123 (CVSS 4.6, Drupal Component blocks · drupal/component\_blocks)
- [CVE-2026-84916](https://cve.now/CVE-2026-84916.md): Islandora - Moderately critical - Access bypass - SA-CONTRIB-2026-126 (CVSS 3.7, Drupal Islandora · drupal/islandora)
- [CVE-2026-84917](https://cve.now/CVE-2026-84917.md): Jsonapi Role Access - Critical - Access bypass - SA-CONTRIB-2026-127 (CVSS 6.5, Drupal Jsonapi Role Access · drupal/jsonapi\_role\_access)
- [CVE-2026-16648](https://cve.now/CVE-2026-16648.md): Mailer Plus Log - Moderately critical - Access bypass - SA-CONTRIB-2026-128 (CVSS 3.8, Drupal Mailer Plus Log · drupal/symfony\_mailer\_log)
- [CVE-2026-81163](https://cve.now/CVE-2026-81163.md): Media Library Importer - Moderately critical - Access bypass - SA-CONTRIB-2026-129 (CVSS 5.4, Drupal Media Library Importer · drupal/media\_library\_import…)
- [CVE-2026-84918](https://cve.now/CVE-2026-84918.md): Monobank payment API - Moderately critical - Access bypass - SA-CONTRIB-2026-130 (CVSS 3.7, Drupal Monobank payment API · drupal/monobank)
- [CVE-2026-84919](https://cve.now/CVE-2026-84919.md): PhotoSwipe - Responsive JavaScript Modal Image Gallery - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-131 (CVSS 4.6, Drupal PhotoSwipe - Responsive JavaScript Modal Image Galle…)
- [CVE-2026-87936](https://cve.now/CVE-2026-87936.md): amazee.ai Private AI Provider - Critical - SQL injection - SA-CONTRIB-2026-134 (CVSS 6.5, Drupal amazee.ai Private AI Provider · drupal/ai\_provider\_a…)
- [CVE-2026-87937](https://cve.now/CVE-2026-87937.md): Central Authentication System (CAS) Server - Moderately critical - Open redirect - SA-CONTRIB-2026-135 (CVSS 6.5, Drupal Central Authentication System (CAS) Server · drupal/…)
- [CVE-2026-87938](https://cve.now/CVE-2026-87938.md): CSP log - Critical - SQL Injection - SA-CONTRIB-2026-136 (CVSS 6.5, Drupal CSP log · drupal/csp\_log)
- [CVE-2026-87939](https://cve.now/CVE-2026-87939.md): Feed Block - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-137 (CVSS 4.2, Drupal Feed Block · drupal/feed\_block)
- [CVE-2026-87940](https://cve.now/CVE-2026-87940.md): Key auth - Moderately critical - Access bypass - SA-CONTRIB-2026-138 (CVSS 5.4, Drupal Key auth · drupal/key\_auth)
- [CVE-2026-87942](https://cve.now/CVE-2026-87942.md): SafeDelete - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-140 (CVSS 4.6, Drupal SafeDelete · drupal/safedelete)
- [CVE-2026-87943](https://cve.now/CVE-2026-87943.md): SAML SSO - Service Provider - Critical - Improper access control - SA-CONTRIB-2026-141 (CVSS 6.5, Drupal SAML SSO - Service Provider · drupal/miniorange\_saml)
- [CVE-2026-87944](https://cve.now/CVE-2026-87944.md): SAML SSO - Service Provider - Critical - Improper certificate validation - SA-CONTRIB-2026-142 (CVSS 4.8, Drupal SAML SSO - Service Provider · drupal/miniorange\_saml)
- [CVE-2026-87945](https://cve.now/CVE-2026-87945.md): SAML SSO - Service Provider - Critical - Open redirect - SA-CONTRIB-2026-143 (CVSS 5.4, Drupal SAML SSO - Service Provider · drupal/miniorange\_saml)
- [CVE-2026-87946](https://cve.now/CVE-2026-87946.md): SAML SSO - Service Provider - Critical - Weak cryptographic practices - SA-CONTRIB-2026-144 (CVSS 4.8, Drupal SAML SSO - Service Provider · drupal/miniorange\_saml)
- [CVE-2026-87947](https://cve.now/CVE-2026-87947.md): SAML SSO - Service Provider - Moderately critical - Authentication bypass - SA-CONTRIB-2026-145 (CVSS 4.8, Drupal SAML SSO - Service Provider · drupal/miniorange\_saml)
- [CVE-2026-87948](https://cve.now/CVE-2026-87948.md): SAML SSO - Service Provider - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-146 (CVSS 3.5, Drupal SAML SSO - Service Provider · drupal/miniorange\_saml)
- [CVE-2026-87949](https://cve.now/CVE-2026-87949.md): SAML SSO - Service Provider - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-147 (CVSS 3.3, Drupal SAML SSO - Service Provider · drupal/miniorange\_saml)
- [CVE-2026-87950](https://cve.now/CVE-2026-87950.md): SAML SSO - Service Provider - Moderately critical - Embedded credentials - SA-CONTRIB-2026-148 (CVSS 5.3, Drupal SAML SSO - Service Provider · drupal/miniorange\_saml)
- [CVE-2026-87951](https://cve.now/CVE-2026-87951.md): SAML SSO - Service Provider - Moderately critical - Information disclosure - SA-CONTRIB-2026-149 (CVSS 3.8, Drupal SAML SSO - Service Provider · drupal/miniorange\_saml)
- [CVE-2026-87952](https://cve.now/CVE-2026-87952.md): SAML SSO - Service Provider - Moderately critical - Insufficient replay protection - SA-CONTRIB-2026-150 (CVSS 3.1, Drupal SAML SSO - Service Provider · drupal/miniorange\_saml)
- [CVE-2026-87953](https://cve.now/CVE-2026-87953.md): SAML SSO - Service Provider - Moderately critical - Server Side Request Forgery - SA-CONTRIB-2026-151 (CVSS 3.3, Drupal SAML SSO - Service Provider · drupal/miniorange\_saml)
- [CVE-2026-87954](https://cve.now/CVE-2026-87954.md): Taxonomy Term Glossary - Critical - Access bypass - SA-CONTRIB-2026-152 (CVSS 4.3, Drupal Taxonomy Term Glossary · drupal/term\_glossary)
- [CVE-2026-87955](https://cve.now/CVE-2026-87955.md): Ultimate Table Field - Critical - Access bypass - SA-CONTRIB-2026-153 (CVSS 4.3, Drupal Ultimate Table Field · drupal/ultimate\_table\_field)
- [CVE-2026-96360](https://cve.now/CVE-2026-96360.md): Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-154 (CVSS 3.5, Drupal Webform · drupal/webform)
- [CVE-2026-96361](https://cve.now/CVE-2026-96361.md): Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-155 (CVSS 4.6, Drupal Webform · drupal/webform)
- [CVE-2026-96358](https://cve.now/CVE-2026-96358.md): Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-158 (CVSS 4.6, Drupal Webform · drupal/webform)
- [CVE-2026-96359](https://cve.now/CVE-2026-96359.md): Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-159 (CVSS 4.6, Drupal Webform · drupal/webform)
- [CVE-2026-96362](https://cve.now/CVE-2026-96362.md): Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-160 (CVSS 4.2, Drupal Webform · drupal/webform)
- [CVE-2026-96363](https://cve.now/CVE-2026-96363.md): Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-161 (CVSS 3.1, Drupal Webform · drupal/webform)
- [CVE-2026-96367](https://cve.now/CVE-2026-96367.md): Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-162 (CVSS 4.6, Drupal Webform · drupal/webform)
- [CVE-2026-96368](https://cve.now/CVE-2026-96368.md): Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-163 (CVSS 4.6, Drupal Webform · drupal/webform)
- [CVE-2026-96370](https://cve.now/CVE-2026-96370.md): Webform - Moderately critical - Access bypass, Server-side request forgery - SA-CONTRIB-2026-164 (CVSS 5.4, Drupal Webform · drupal/webform)
- [CVE-2026-96369](https://cve.now/CVE-2026-96369.md): Webform - Less critical - Access bypass - SA-CONTRIB-2026-165 (CVSS 3.1, Drupal Webform · drupal/webform)
- [CVE-2026-96371](https://cve.now/CVE-2026-96371.md): Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-166 (CVSS 5.4, Drupal Webform · drupal/webform)
- [CVE-2026-96372](https://cve.now/CVE-2026-96372.md): Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-167 (CVSS 5.4, Drupal Webform · drupal/webform)
- [CVE-2026-96373](https://cve.now/CVE-2026-96373.md): Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-168 (CVSS 3.3, Drupal Webform · drupal/webform)
- [CVE-2026-96366](https://cve.now/CVE-2026-96366.md): Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-169 (CVSS 5.3, Drupal Webform · drupal/webform)
- [CVE-2026-96365](https://cve.now/CVE-2026-96365.md): Webform - Less critical - Denial of service - SA-CONTRIB-2026-170 (CVSS 7.5, Drupal Webform · drupal/webform)
- [CVE-2026-96364](https://cve.now/CVE-2026-96364.md): Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-171 (CVSS 5.3, Drupal Webform · drupal/webform)
- [CVE-2026-96357](https://cve.now/CVE-2026-96357.md): Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-172 (CVSS 4.6, Drupal Webform · drupal/webform)
- [CVE-2026-96398](https://cve.now/CVE-2026-96398.md): Webform - Less critical - Access bypass - SA-CONTRIB-2026-173 (CVSS 4.3, Drupal Webform · drupal/webform)
- [CVE-2026-96356](https://cve.now/CVE-2026-96356.md): Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-174 (CVSS 5.3, Drupal Webform · drupal/webform)
- [CVE-2026-96355](https://cve.now/CVE-2026-96355.md): Webform - Critical - Remote Code Execution - SA-CONTRIB-2026-175 (CVSS 9.1, Drupal Webform · drupal/webform)
- [CVE-2026-96375](https://cve.now/CVE-2026-96375.md): Cloud - Critical - Remote code execution - SA-CONTRIB-2026-176 (CVSS 4.8, Drupal Cloud · drupal/cloud)
- [CVE-2026-96376](https://cve.now/CVE-2026-96376.md): Cloud - Critical - Remote code execution - SA-CONTRIB-2026-177 (CVSS 6.4, Drupal Cloud · drupal/cloud)
- [CVE-2026-96374](https://cve.now/CVE-2026-96374.md): Project Browser - Critical - Cross-site request forgery - SA-CONTRIB-2026-178 (CVSS 4.2, Drupal Project Browser · drupal/project\_browser)
- [CVE-2026-96384](https://cve.now/CVE-2026-96384.md): Mermaid Diagram Field - Moderately critical - Access bypass - SA-CONTRIB-2026-180 (CVSS 3.5, Drupal Mermaid Diagram Field · drupal/mermaid\_diagram\_field)
- [CVE-2026-96379](https://cve.now/CVE-2026-96379.md): CookieCuttr - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-181 (CVSS 3.5, Drupal CookieCuttr · drupal/cookiecuttr)
- [CVE-2026-96385](https://cve.now/CVE-2026-96385.md): REST & JSON API Authentication for Drupal - Moderately critical - Access bypass - SA-CONTRIB-2026-182 (CVSS 6.5, REST & JSON API Authentication for Drupal · drupal/rest\_api…)
- [CVE-2026-96388](https://cve.now/CVE-2026-96388.md): Tawk.to - Live chat application - Critical - Cross Site Request Forgery - SA-CONTRIB-2026-184 (CVSS 5.4, Drupal Tawk.to - Live chat application · drupal/tawk\_to)
- [CVE-2026-96390](https://cve.now/CVE-2026-96390.md): Editoria11y Accessibility Checker - Moderately critical - Access bypass - SA-CONTRIB-2026-185 (CVSS 4.3, Drupal Editoria11y Accessibility Checker · drupal/editoria1…)
- [CVE-2026-96391](https://cve.now/CVE-2026-96391.md): Webform REST - Less critical - Access bypass - SA-CONTRIB-2026-186 (CVSS 4.3, Drupal Webform REST · drupal/webform\_rest)
- [CVE-2026-96392](https://cve.now/CVE-2026-96392.md): AI CKEditor - Moderately critical - Code execution via Twig templates - SA-CONTRIB-2026-187 (CVSS 3.5, Drupal AI CKEditor · drupal/ai\_ckeditor)
- [CVE-2026-96377](https://cve.now/CVE-2026-96377.md): Combined image style - Moderately critical - Improper access control - SA-CONTRIB-2026-188 (CVSS 5.3, Drupal Combined image style · drupal/combined\_image\_style)
- [CVE-2026-96380](https://cve.now/CVE-2026-96380.md): CSS Usage Analyzer - Moderately critical - Improper access control - SA-CONTRIB-2026-189 (CVSS 6.5, Drupal CSS Usage Analyzer · drupal/css\_usage\_analyzer)
- [CVE-2026-96386](https://cve.now/CVE-2026-96386.md): Smart Content - Moderately critical - Access bypass - SA-CONTRIB-2026-190 (CVSS 6.5, Drupal Smart Content · drupal/smart\_content)
- [CVE-2026-96382](https://cve.now/CVE-2026-96382.md): Diba carousel slider - Moderately critical - Cross Site Scripting (XSS) - SA-CONTRIB-2026-191 (CVSS 4.6, Drupal Diba carousel slider · drupal/diba\_carousel)
- [CVE-2026-114509](https://cve.now/CVE-2026-114509.md): Laravel TokenGuard authentication bypass through non-string API credentials (CVSS 9.2, needs attention: First public exploit on GitHub Oct 30, laravel framework · laravel/framework)
- [CVE-2026-114508](https://cve.now/CVE-2026-114508.md): Laravel relationship inclusion can trigger unauthorized data destruction (CVSS 6.5, laravel framework · laravel/framework)
- [CVE-2026-109413](https://cve.now/CVE-2026-109413.md): Symfony: Unbounded Recursion in the YAML Inline Lexer Lets a Single Document Crash the Process (CVSS 8.7, sensiolabs symfony · symfony/symfony +1)
- [CVE-2026-108082](https://cve.now/CVE-2026-108082.md): Symfony: ReDoS in HeaderUtils::split() Reachable Through the Cache-Control Request Header (CVSS 8.7, sensiolabs symfony · symfony/http-foundation +1)
- [CVE-2026-73858](https://cve.now/CVE-2026-73858.md): Solspace Freeform: Limited Twig template injection via submitted field values (CVSS 5.3, solspace craft-freeform · solspace/craft-freeform)
- [CVE-2026-86198](https://cve.now/CVE-2026-86198.md): PocketMine-MP before 5.44.2 Denial of Service via ResourcePackClientResponsePacket (CVSS 2.3, pmmp PocketMine-MP · pocketmine/pocketmine-mp)
- [GHSA-HGJX-R89M-M7V4](https://cve.now/GHSA-HGJX-R89M-M7V4.md): FacturaScripts: Path traversal in UploadedFile::move() via getClientOriginalName() — arbitrary file write outside MyFiles/ leading to RCE (critical (no CVSS), facturascripts/facturascripts)
- [CVE-2026-44212](https://cve.now/CVE-2026-44212.md): PrestaShop: Stored XSS executable in customer service view (CVSS 9.3, PrestaShop · prestashop/prestashop)
- [CVE-2025-32432](https://cve.now/CVE-2025-32432.md): Craft CMS Allows Remote Code Execution (CVSS 10.0, KEV, craftcms cms · craftcms/cms)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/packagist
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.