43
CVEs
5
Critical
4
High
0
KEV
0
PoC
3
Unpatched C/H
72.1%
Patch Rate
0.2%
Avg EPSS
Severity Breakdown
CRITICAL
5
HIGH
4
MEDIUM
31
LOW
3
Monthly CVE Trend
Affected Products (30)
Debian Linux
44
PHP
35
Fedora
20
Open Redirect
12
Drupal Core
12
Application Express
10
Peoplesoft Enterprise Peopletools
10
Open Social
8
Ckeditor
7
H500s Firmware
6
Miniorange 2fa
6
H700s Firmware
6
H410s Firmware
6
Jd Edwards Enterpriseone Tools
6
H300s Firmware
6
H410c Firmware
6
Weblogic Server
6
Policy Automation
5
Symfony
5
Agile Plm
5
Rest Data Services
5
Communications Interactive Session Recorder
5
Opigno
5
H700E Firmware
5
Communications Operations Monitor
5
Artificial Intelligence
5
H300E Firmware
5
Banking Platform
5
H500E Firmware
5
Financial Services Analytical Applications Infrastructure
4
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-16639 | Authentication bypass in the Drupal Internationalization Single Sign-On contributed module (versions 0.0.0 through 1.8.0) lets remote unauthenticated attackers assume authenticated sessions by reaching an alternate authentication path or channel that skips the primary verification logic. Rated CVSS 9.8 with full confidentiality, integrity, and availability impact, it maps to CWE-288 and is addressed in a Drupal security advisory (SA-CONTRIB-2026-081). EPSS is low (0.18%, 8th percentile) and there is no public exploit identified at time of analysis. | CRITICAL | 9.8 | 0.2% | 49 |
|
| CVE-2026-16641 | Information disclosure in the Drupal Commerce Elavon payment-gateway module stems from improper input validation (CWE-20) and, per the NVD scoring, is reachable by remote unauthenticated attackers. The Drupal security advisory (SA-CONTRIB-2026-084) leaves the affected range wholly unspecified ('*.*'), so every published version should be treated as potentially vulnerable until a fixed release is identified. No public exploit identified at time of analysis, and the EPSS score sits in the 4th percentile, indicating little observed exploitation interest despite the headline 9.8 rating. | CRITICAL | 9.8 | 0.1% | 49 |
No patch
|
| CVE-2026-73475 | Incorrect authorization in the Drupal Commerce PayPal contribution module (versions up to 1.12.0 and 2.0.0 through 2.1.3) lets remote unauthenticated attackers reach protected resources or actions through forceful browsing - directly requesting URLs/endpoints that should be access-checked. A vendor patch exists via Drupal security advisory SA-contrib-2026-095. No public exploit has been identified at time of analysis, and the module is a niche payment-integration component rather than Drupal core. | CRITICAL | 9.1 | 0.2% | 46 |
|
| CVE-2026-16644 | Authorization bypass in the Drupal Webform REST contrib module (all versions from 0.0.0 up to and including 4.1.0) lets remote unauthenticated attackers reach REST resources they should not be able to access through forceful browsing. Because the module fails to properly enforce access checks on its endpoints, an attacker can read and potentially manipulate webform data or submissions guarded only by obscurity. No public exploit is identified at time of analysis and EPSS risk is low (0.18%, 7th percentile), but the CVSS 9.1 rating and SSVC 'total technical impact' make this a high-severity data-exposure issue. | CRITICAL | 9.1 | 0.2% | 46 |
|
| CVE-2026-16645 | Missing authorization in the Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery contributed module (all versions from 0.0.0 up to and including 3.2.0) lets unauthenticated remote users reach gallery resources they should not be able to see by directly requesting their URLs (forceful browsing). Because the module fails to enforce access control on protected content, an attacker can enumerate and retrieve images or associated data intended for privileged users only. No public exploit identified at time of analysis, and EPSS is low (0.13%), but the flaw is trivially automatable per CISA SSVC. | CRITICAL | 9.1 | 0.1% | 46 |
|
| CVE-2026-18985 | Incorrect authorization in the Drupal Edit in-place field contrib module (versions 0.0.0 through pre-2.1.1) enables authenticated users to perform forceful browsing against field-edit endpoints they lack permission to access, resulting in unauthorized read and write access to protected Drupal field data. The CVSS base score of 8.1 reflects high confidentiality and integrity impact, though real-world risk is tempered by the authentication prerequisite (PR:L) and an extremely low EPSS score of 0.13% (3rd percentile). A vendor-released patch is available; no public exploit identified at time of analysis. | HIGH | 8.1 | 0.1% | 41 |
|
| CVE-2026-18259 | Observable timing discrepancy in the Drupal Token Content Access module exposes token-protected content to brute-force enumeration via side-channel analysis. All module versions from 0.0.0 through 3.1.2 are affected; unauthenticated remote attackers (PR:N, AV:N per CVSS) can measure differential response times during token validation to reconstruct valid access tokens character-by-character, ultimately bypassing content access restrictions. No active exploitation has been confirmed (SSVC exploitation: none, EPSS 0.14%, no KEV listing), and a vendor patch is available per Drupal SA-CONTRIB-2026-090. | HIGH | 7.5 | 0.1% | 38 |
|
| CVE-2026-76759 | Cross-site scripting in the Drupal Screenshot contributed module allows a high-privileged authenticated attacker to inject malicious script content that executes in the browser context of other users who view the affected page. The scope-changing CVSS vector (S:C) confirms that the injected payload can compromise sessions or data belonging to users other than the attacker, enabling session hijacking, credential theft, or unauthorized actions on behalf of victims. No public exploit code has been identified at time of analysis, and no KEV listing is present. | HIGH | 7.3 | 0.2% | 36 |
No patch
|
| CVE-2026-76782 | Cross-site scripting (XSS) in the Drupal Screenshot contributed module allows a high-privileged authenticated attacker to inject malicious script content that executes in the browser context of other users who view the affected output, crossing security boundaries as reflected by the scope-changed CVSS vector. All tracked versions of the module are affected per the wildcard CPE and EUVD-2026-70010 listing. No public exploit code and no CISA KEV listing have been identified at time of analysis; Drupal's security team published advisory SA-CONTRIB-2026-102. | HIGH | 7.3 | 0.2% | 36 |
No patch
|
| CVE-2026-16638 | Stored XSS in the Drupal Media Folders contributed module (versions 0.0.0 through 1.0.8) allows network-accessible injection of persistent malicious scripts that execute in the browsers of users who subsequently view affected media folder pages. The CVSS scope change (S:C) confirms the payload crosses the application security boundary into the victim's browser session, enabling session hijacking or privilege escalation against authenticated users including administrators. No active exploitation has been confirmed - no CISA KEV listing, no public exploit code, and an EPSS of 0.15% (4th percentile) - and a vendor patch is available via Drupal security advisory SA-contrib-2026-080. | MEDIUM | 6.1 | 0.1% | 31 |
|
| CVE-2026-16640 | Reflected XSS in the Drupal Search API Autocomplete contributed module (versions 0.0.0 through 1.12.0) allows remote unauthenticated attackers to inject and execute arbitrary JavaScript in the context of victims' browsers when they are socially engineered into clicking a crafted URL. The CVSS scope change (S:C) confirms the injected script executes outside the application's security zone - in the victim's browser - enabling session token theft or authenticated action hijacking. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor patch is available via Drupal Security Advisory SA-CONTRIB-2026-082. | MEDIUM | 6.1 | 0.1% | 31 |
|
| CVE-2026-81160 | Stored cross-site scripting in the Drupal Slick Carousel contributed module (all releases before 2.1.0) allows injection of persistent malicious scripts into carousel-rendered content. Any authenticated user or visitor who loads a page containing the compromised carousel triggers script execution in their browser, potentially exposing session tokens and enabling unauthorized actions performed under the victim's identity. The Drupal Security Team has released a patch via sa-contrib-2026-117; no public exploit code or confirmed active exploitation has been identified at time of analysis. | MEDIUM | 6.1 | 0.3% | 30 |
|
| CVE-2026-81201 | Stored cross-site scripting in the Drupal Monster Menus contrib module (versions 0.0.0 through 9.5.3) allows malicious script payloads to be persistently injected into navigation or menu rendering contexts, executing in the browsers of subsequent authenticated visitors. The CVSS scope-change flag (S:C) confirms the attack crosses session boundaries, enabling session hijacking, credential theft, or further lateral movement within the Drupal application. No public exploit code has been identified at time of analysis, and Drupal's security team has released an advisory (SA-CONTRIB-2026-116) with a patch. | MEDIUM | 6.1 | 0.3% | 30 |
|
| CVE-2026-76755 | Buffer overflow (CWE-119) in the Drupal Gammu SMS Daemon contributed module allows a highly privileged, authenticated attacker to achieve high confidentiality and integrity impact against affected Drupal installations. The CVSS vector (PR:H, AC:H) constrains real-world exploitability significantly, requiring both administrative access and complex attack conditions. No active exploitation has been identified; all tracked versions of the module are reported as affected with no specific patched release confirmed in available data. | MEDIUM | 5.9 | 0.2% | 30 |
No patch
|
| CVE-2026-76756 | Buffer overflow in the Drupal Gammu SMS Daemon contributed module exposes sites to memory corruption with high confidentiality and integrity impact. The vulnerability (CWE-119) requires network-reachable access by a highly privileged user under specific conditions, limiting its practical reach but making it serious when those conditions are met. No public exploit code has been identified at time of analysis, and the Drupal security team has issued advisory SA-contrib-2026-100. | MEDIUM | 5.9 | 0.2% | 30 |
No patch
|