🚨 CVE-2026-19851
A Use of Default Password vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker to gain access to user accounts created during XML import.
🎖@cveNotify
A Use of Default Password vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker to gain access to user accounts created during XML import.
🎖@cveNotify
Dassault Systèmes
CVE-2026-19851 - Dassault Systèmes
Use of Default Password vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5
🚨 CVE-2026-21754
HCL Hive is affected by multiple infrastructure and network configuration vulnerabilities, which could lead to unauthorized lateral movement, container breakout, and sensitive data exposure within internal communications.
🎖@cveNotify
HCL Hive is affected by multiple infrastructure and network configuration vulnerabilities, which could lead to unauthorized lateral movement, container breakout, and sensitive data exposure within internal communications.
🎖@cveNotify
Hcl-Software
Security Bulletin: Multiple security vulnerabilities affect HCL Hive - Customer Support
HCL Hive is affected by multiple security vulnerabilities.
🚨 CVE-2026-21758
HCL Hive is affected by an information disclosure vulnerability, which could lead to an attacker gathering sensitive information about the host environment.
🎖@cveNotify
HCL Hive is affected by an information disclosure vulnerability, which could lead to an attacker gathering sensitive information about the host environment.
🎖@cveNotify
Hcl-Software
Security Bulletin: Multiple security vulnerabilities affect HCL Hive - Customer Support
HCL Hive is affected by multiple security vulnerabilities.
🚨 CVE-2026-78581
Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized data modification via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). Under certain conditions, an authenticated user could reference another user's AI Assistant conversation identifier to access or modify a conversation they do not own. Successful exploitation requires knowledge of a hard-to-guess identifier.
🎖@cveNotify
Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized data modification via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). Under certain conditions, an authenticated user could reference another user's AI Assistant conversation identifier to access or modify a conversation they do not own. Successful exploitation requires knowledge of a hard-to-guess identifier.
🎖@cveNotify
Discuss the Elastic Stack
Kibana 8.16.3, 8.17.2 Security Update (ESA-2026-51)
Authorization Bypass Through User-Controlled Key in Kibana Leading to Unauthorized Data Modification Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized data modification via Accessing Functionality Not Properly…
🚨 CVE-2026-16599
GNU wget is vulnerable to denial of service in its FTP OPIE/S-KEY authentication functionality. The server-supplied sequence number from the FTP challenge line is used as an iteration count for an MD5 key-derivation loop without any upper bound validation. A malicious FTP server or a network attacker positioned to intercept FTP traffic can send a crafted OPIE challenge with a sequence number near INT_MAX, causing wget to perform up to approximately 2.1 billion MD5 computations and suspend for some time. The --timeout option does not mitigate this because it applies only to network I/O, not CPU computation.
This issue was fixed in commit e9697d98e7249b0f68a6be040a4f3dcc5bc101fa
🎖@cveNotify
GNU wget is vulnerable to denial of service in its FTP OPIE/S-KEY authentication functionality. The server-supplied sequence number from the FTP challenge line is used as an iteration count for an MD5 key-derivation loop without any upper bound validation. A malicious FTP server or a network attacker positioned to intercept FTP traffic can send a crafted OPIE challenge with a sequence number near INT_MAX, causing wget to perform up to approximately 2.1 billion MD5 computations and suspend for some time. The --timeout option does not mitigate this because it applies only to network I/O, not CPU computation.
This issue was fixed in commit e9697d98e7249b0f68a6be040a4f3dcc5bc101fa
🎖@cveNotify
cert.pl
Vulnerability in GNU wget software
Denial of Service vulnerability (CVE-2026-16599) has been found in GNU wget software.
🚨 CVE-2026-15088
Vulnerability in Drupal Development Environment. This issue affects Development Environment versions: *.*.
🎖@cveNotify
Vulnerability in Drupal Development Environment. This issue affects Development Environment versions: *.*.
🎖@cveNotify
Drupal.org
Development Environment - Critical - Unsupported - SA-CONTRIB-2026-089
The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466#s-becoming-owner…
🚨 CVE-2026-15916
Missing Authorization vulnerability in Drupal Drupal core allows Forceful Browsing. This issue affects Drupal core versions: from 0.0.0 to 10.6.13, from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, from 0.0.0 to 11.0.*, from 0.0.0 to 11.1.*, from 0.0.0 to 11.2.*.
🎖@cveNotify
Missing Authorization vulnerability in Drupal Drupal core allows Forceful Browsing. This issue affects Drupal core versions: from 0.0.0 to 10.6.13, from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, from 0.0.0 to 11.0.*, from 0.0.0 to 11.1.*, from 0.0.0 to 11.2.*.
🎖@cveNotify
Drupal.org
Drupal core - Moderately critical - Information disclosure - SA-CORE-2026-010
The Image module allows you to define and configure image fields. The module doesn't sufficiently check access to image style derivatives when those files are served via a file stream other than private://. This vulnerability is mitigated by the fact that…
🚨 CVE-2026-15917
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Drupal core versions: from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, from 0.0.0 to 11.2.*.
🎖@cveNotify
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Drupal core versions: from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, from 0.0.0 to 11.2.*.
🎖@cveNotify
Drupal.org
Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-011
Drupal core 11.2 and above integrate the HTMX JavaScript library. Drupal core's XSS filter does not sufficiently sanitize certain HTMX attributes, which can lead to a cross-site scripting (XSS) vulnerability. The vulnerability is mitigated by the fact an…
🚨 CVE-2026-16638
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Media Folders allows Stored XSS. This issue affects Media Folders versions: from 0.0.0 to 1.0.8.
🎖@cveNotify
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Media Folders allows Stored XSS. This issue affects Media Folders versions: from 0.0.0 to 1.0.8.
🎖@cveNotify
Drupal.org
Media Folders - Moderately critical - Cross site scripting - SA-CONTRIB-2026-080
This module provides a better UI for managing and selecting Media entities in a folder structure. The module doesn't sufficiently sanitize the names and descriptions of media items and folders when they are displayed in the media browser, resulting in a stored…
🚨 CVE-2026-16639
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Internationalization Single Sign-On allows Authentication Bypass. This issue affects Internationalization Single Sign-On versions: from 0.0.0 to 1.8.0.
🎖@cveNotify
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Internationalization Single Sign-On allows Authentication Bypass. This issue affects Internationalization Single Sign-On versions: from 0.0.0 to 1.8.0.
🎖@cveNotify
Drupal.org
Internationalization Single Sign-On - Critical - Access bypass - SA-CONTRIB-2026-081
In a scenario of a multilingual website with different domain names per language, this module enables you to be automatically connected across the language domains if you are logged on the main language domain. The module doesn't sufficiently validate a short…
🚨 CVE-2026-16640
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Search API Autocomplete allows Reflected XSS. This issue affects Search API Autocomplete versions: from 0.0.0 to 1.12.0.
🎖@cveNotify
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Search API Autocomplete allows Reflected XSS. This issue affects Search API Autocomplete versions: from 0.0.0 to 1.12.0.
🎖@cveNotify
Drupal.org
Search API Autocomplete - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-082
This module enables you to add autocomplete suggestions for search forms created with the Search API module. The module ships with a test script that is accessible to anonymous users and doesn't sufficiently validate user input, leading to a Cross Site Scripting…
🚨 CVE-2026-16641
Vulnerability in Drupal Commerce Elavon. This issue affects Commerce Elavon versions: *.*.
🎖@cveNotify
Vulnerability in Drupal Commerce Elavon. This issue affects Commerce Elavon versions: *.*.
🎖@cveNotify
Drupal.org
Commerce Elavon - Critical - Unsupported - SA-CONTRIB-2026-084
The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466#s-becoming-owner…
🚨 CVE-2026-16642
Vulnerability in Drupal Email Login OTP. This issue affects Email Login OTP versions: *.*.
🎖@cveNotify
Vulnerability in Drupal Email Login OTP. This issue affects Email Login OTP versions: *.*.
🎖@cveNotify
Drupal.org
Email Login OTP - Critical - Unsupported - SA-CONTRIB-2026-085
The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466#s-becoming-owner…
🚨 CVE-2026-16643
Vulnerability in Drupal Lunr exposed filters. This issue affects Lunr exposed filters versions: *.*.
🎖@cveNotify
Vulnerability in Drupal Lunr exposed filters. This issue affects Lunr exposed filters versions: *.*.
🎖@cveNotify
Drupal.org
Lunr exposed filters - Critical - Unsupported - SA-CONTRIB-2026-086
The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466#s-becoming-owner…
🚨 CVE-2026-16644
Incorrect Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. This issue affects Webform REST versions: from 0.0.0 to 4.1.0.
🎖@cveNotify
Incorrect Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. This issue affects Webform REST versions: from 0.0.0 to 4.1.0.
🎖@cveNotify
Drupal.org
Webform REST - Moderately critical - Access bypass - SA-CONTRIB-2026-087
This module enables you to retrieve and submit webform submissions via REST endpoints. The module doesn't sufficiently check the parent webform's permissions for creating, viewing and updating permissions. This vulnerability is mitigated by the fact that…
🚨 CVE-2026-16645
Missing Authorization vulnerability in Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery allows Forceful Browsing. This issue affects PhotoSwipe - Responsive JavaScript Modal Image Gallery versions: from 0.0.0 to 3.2.0.
🎖@cveNotify
Missing Authorization vulnerability in Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery allows Forceful Browsing. This issue affects PhotoSwipe - Responsive JavaScript Modal Image Gallery versions: from 0.0.0 to 3.2.0.
🎖@cveNotify
Drupal.org
PhotoSwipe - Responsive JavaScript Modal Image Gallery - Moderately critical - Access bypass - SA-CONTRIB-2026-088
The Photoswipe Drupal module provides integration for the widely used PhotoSwipe lightbox library to display / zoom images in lightbox galleries using the provided image formatters. The module didn't sufficiently check access permissions, when viewing an…
🚨 CVE-2026-18259
Observable Timing Discrepancy vulnerability in Drupal Token Content Access allows Brute Force. This issue affects Token Content Access versions: from 0.0.0 to 3.1.2.
🎖@cveNotify
Observable Timing Discrepancy vulnerability in Drupal Token Content Access allows Brute Force. This issue affects Token Content Access versions: from 0.0.0 to 3.1.2.
🎖@cveNotify
Drupal.org
Token Content Access - Moderately critical - Access bypass - SA-CONTRIB-2026-090
The Token Content Access module enables site administrators to provide access to content using access tokens. The module does not sufficiently protect access token comparison in some cases. This could allow a persistent attacker to use a timing attack to…
🚨 CVE-2026-18260
Vulnerability in Drupal Disable Login Page. This issue affects Disable Login Page versions: *.*.
🎖@cveNotify
Vulnerability in Drupal Disable Login Page. This issue affects Disable Login Page versions: *.*.
🎖@cveNotify
Drupal.org
Disable Login Page - Critical - Unsupported - SA-CONTRIB-2026-091
The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466#s-becoming-owner…
🚨 CVE-2026-18261
Vulnerability in Drupal Powerful Surveys. This issue affects Powerful Surveys versions: *.*.
🎖@cveNotify
Vulnerability in Drupal Powerful Surveys. This issue affects Powerful Surveys versions: *.*.
🎖@cveNotify
Drupal.org
Powerful Surveys - Critical - Unsupported - SA-CONTRIB-2026-092
The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466#s-becoming-owner…
🚨 CVE-2026-18985
Incorrect Authorization vulnerability in Drupal Edit in-place field allows Forceful Browsing. This issue affects Edit in-place field versions: from 0.0.0 to 2.1.1.
🎖@cveNotify
Incorrect Authorization vulnerability in Drupal Edit in-place field allows Forceful Browsing. This issue affects Edit in-place field versions: from 0.0.0 to 2.1.1.
🎖@cveNotify
Drupal.org
Edit in-place field - Moderately critical - Access bypass - SA-CONTRIB-2026-093
This module provides formatters to allow in-place editing in a View or other display (full content, teaser...). The module doesn't sufficiently check access when editing entities. A malicious user could craft requests to allow them to modify any field on…