Search

Expected end of text, found '/' (at char 34), (line:1, col:35)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (417674 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-62991 1 Shopperlabs 1 Shopper 2026-10-30 6.5 Medium
Shopper is a Headless e-commerce Admin Panel. Prior to 2.10.1, the customer detail route `/cpanel/customers/{user}/show` in `packages/admin/src/Livewire/Pages/Customers/Show.php` checks `read_customers` but looks up an arbitrary user ID without applying the `customers` role scope used by the listing. Authenticated staff holding `access_dashboard` and `read_customers` can change the user ID to retrieve administrator or staff profiles despite lacking `view_users`, which protects the separate team-management interface. The flaw exposes account profile data and permits user-ID enumeration through differing success, denial, and not-found responses. If the same role also holds `delete_customers`, `anonymizeAction()` operates on the unrestricted loaded user model and can enable destructive follow-up against non-customer accounts. This issue is fixed in version 2.10.1.
CVE-2026-118573 1 Drupal 1 Oauth2 Token Manager 2026-10-30 N/A
Missing Authorization vulnerability in Drupal OAuth2 Token Manager allows Forceful Browsing. This issue affects OAuth2 Token Manager versions: from 0.0.0 to 1.2.0.
CVE-2026-118584 1 Drupal 1 Field Permissions 2026-10-30 N/A
Incorrect Authorization vulnerability in Drupal Field Permissions allows Forceful Browsing. This issue affects Field Permissions versions: from 0.0.0 to 1.6.0.
CVE-2026-118583 1 Drupal 1 Field Permissions 2026-10-30 N/A
Incorrect Authorization vulnerability in Drupal Field Permissions allows Forceful Browsing. This issue affects Field Permissions versions: from 0.0.0 to 1.6.0.
CVE-2026-118554 1 Drupal 1 Openid Connect Client 2026-10-30 N/A
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal OpenID Connect Client allows Authentication Bypass. This issue affects OpenID Connect Client versions: from 0.0.0 to 2.3.1.
CVE-2026-118576 1 Drupal 1 Stage File Proxy 2026-10-30 N/A
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Stage File Proxy allows Cross-Site Scripting (XSS). This issue affects Stage File Proxy versions: from 0.0.0 to 3.1.7, from 4.0.0 to 4.0.1.
CVE-2026-118575 1 Drupal 1 Signature Pad Widget 2026-10-30 N/A
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Signature pad widget allows Stored XSS. This issue affects Signature pad widget versions: from 0.0.0 to 1.15.0.
CVE-2026-118572 1 Drupal 1 Oauth Login - Oauth Oidc Sso 2026-10-30 N/A
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal OAuth Login - OAuth OIDC SSO allows Authentication Bypass. This issue affects OAuth Login - OAuth OIDC SSO versions: from 0.0.0 to 3.1.1.
CVE-2026-118567 1 Drupal 1 Bulk Update User Roles 2026-10-30 N/A
Incorrect Authorization vulnerability in Drupal Bulk Update User Roles allows Forceful Browsing. This issue affects Bulk Update User Roles versions: from 0.0.0 to 1.0.5.
CVE-2026-118574 1 Drupal 1 S3 File System 2026-10-30 N/A
Incorrect Permission Assignment for Critical Resource vulnerability in Drupal S3 File System allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects S3 File System versions: from 0.0.0 to 3.12.0.
CVE-2026-118570 1 Drupal 1 Fasttoggle 2026-10-30 N/A
Cross-Site Request Forgery (CSRF) vulnerability in Drupal Fasttoggle allows Cross Site Request Forgery. This issue affects Fasttoggle versions: from 0.0.0 to 4.1.1.
CVE-2026-118569 1 Drupal 1 Fasttoggle 2026-10-30 N/A
Incorrect Authorization vulnerability in Drupal Fasttoggle allows Forceful Browsing. This issue affects Fasttoggle versions: from 0.0.0 to 4.1.1.
CVE-2026-118565 1 Drupal 1 Groupex Pro ( Daxko ) Integration 2026-10-30 N/A
Vulnerability in Drupal GroupEx PRO ( Daxko ) integration. This issue affects GroupEx PRO ( Daxko ) integration versions: *.*.
CVE-2026-118564 1 Drupal 1 Payumoney For Drupal Commerce 2026-10-30 N/A
Vulnerability in Drupal PayUmoney for Drupal Commerce. This issue affects PayUmoney for Drupal Commerce versions: *.*.
CVE-2026-118563 1 Drupal 1 Cacheflush 2026-10-30 N/A
Vulnerability in Drupal CacheFlush. This issue affects CacheFlush versions: *.*.
CVE-2026-118562 1 Drupal 1 Single Content Sync 2026-10-30 N/A
Deserialization of Untrusted Data vulnerability in Drupal Single Content Sync allows Object Injection. This issue affects Single Content Sync versions: from 0.0.0 to 1.4.19.
CVE-2026-118561 1 Drupal 1 Single Content Sync 2026-10-30 N/A
External Control of File Name or Path vulnerability in Drupal Single Content Sync allows Path Traversal. This issue affects Single Content Sync versions: from 0.0.0 to 1.4.19.
CVE-2026-118560 1 Drupal 1 Commerce Stripe 2026-10-30 N/A
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Commerce Stripe allows Cross-Site Scripting (XSS). This issue affects Commerce Stripe versions: from 2.0.0 to 2.2.3.
CVE-2026-118559 1 Drupal 1 Commerce Stripe 2026-10-30 N/A
Improper Verification of Cryptographic Signature vulnerability in Drupal Commerce Stripe allows Signature Spoof. This issue affects Commerce Stripe versions: from 0.0.0 to 1.4, from 2.0.0 to 2.2.3.
CVE-2026-118558 1 Drupal 1 Commerce Stripe 2026-10-30 N/A
Cross-Site Request Forgery (CSRF) vulnerability in Drupal Commerce Stripe allows Cross Site Request Forgery. This issue affects Commerce Stripe versions: from 2.0.0 to 2.2.3.