153
CVEs
12
Critical
16
High
1
KEV
7
PoC
7
Unpatched C/H
84.3%
Patch Rate
0.1%
Avg EPSS
Severity Breakdown
CRITICAL
12
HIGH
16
MEDIUM
113
LOW
12
Monthly CVE Trend
Affected Products (30)
Debian Linux
44
PHP
35
Fedora
20
Open Redirect
12
Drupal Core
12
Application Express
10
Peoplesoft Enterprise Peopletools
10
Open Social
8
Ckeditor
7
H500s Firmware
6
Miniorange 2fa
6
H700s Firmware
6
H410s Firmware
6
Jd Edwards Enterpriseone Tools
6
H300s Firmware
6
H410c Firmware
6
Weblogic Server
6
Policy Automation
5
Symfony
5
Agile Plm
5
Rest Data Services
5
Communications Interactive Session Recorder
5
Opigno
5
H700E Firmware
5
Communications Operations Monitor
5
Artificial Intelligence
5
H300E Firmware
5
Banking Platform
5
H500E Firmware
5
Financial Services Analytical Applications Infrastructure
4
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-9082 | SQL injection in Drupal core (versions 8.9.0 through the fixed 10.4.10/10.5.10/10.6.9 and 11.x branches through 11.3.10) allows attackers to inject arbitrary SQL against the site database, per SA-CORE-2026-004. The flaw is confirmed actively exploited (CISA KEV) with publicly available exploit code (Exploit-DB 52608 and multiple public PoCs), and the CVSS 9.8 vector indicates unauthenticated remote exploitation. Notably, EPSS remains extremely low (0.01%) and SSVC lists exploitation as 'none', signaling either targeted rather than widespread activity or conflicting source data that defenders should treat cautiously while still prioritizing the patch given KEV status. | CRITICAL | 9.8 | 0.0% | 124 |
KEV
PoC
|
| CVE-2026-10768 | Missing authorization in the Drupal LocalGov Workflows contrib module (all versions 0.0.0 through 1.6.0, fixed in 1.6.0) lets remote attackers reach protected workflow-related routes through forceful browsing without proper permission checks. The flaw carries a vendor CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N), but EPSS is low (0.14%, 4th percentile) and there is no public exploit identified at time of analysis. Affected sites are Drupal deployments running this LocalGov Drupal editorial-workflow module. | CRITICAL | 9.8 | 0.1% | 69 |
PoC
|
| CVE-2026-0750 | Commerce Paybox versions up to 7.X-1.5. is affected by improper verification of cryptographic signature (CVSS 7.5). | HIGH | 7.5 | 0.0% | 58 |
PoC
No patch
|
| CVE-2026-24478 | AnythingLLM versions prior to 1.10.0 contain a path traversal vulnerability in the DrupalWiki integration that allows malicious administrators or attackers with admin privileges to write arbitrary files to the server, potentially achieving remote code execution through configuration file overwriting or malicious script injection. Public exploit code exists for this vulnerability, and no patch is currently available for affected deployments. The attack requires high-level privileges but carries critical risk due to the ability to completely compromise server integrity. | HIGH | 7.2 | 0.2% | 56 |
PoC
No patch
|
| CVE-2026-0749 | Cross-site scripting (XSS) in Drupal Form Builder 7.x versions 1.0 through 1.22 allows unauthenticated attackers to inject malicious scripts through improperly sanitized form inputs, affecting users who interact with compromised forms. Public exploit code exists for this vulnerability, and no patch is currently available, leaving vulnerable installations at active risk of session hijacking, credential theft, and defacement. | MEDIUM | 6.1 | 0.0% | 51 |
PoC
No patch
|
| CVE-2026-16639 | Authentication bypass in the Drupal Internationalization Single Sign-On contributed module (versions 0.0.0 through 1.8.0) lets remote unauthenticated attackers assume authenticated sessions by reaching an alternate authentication path or channel that skips the primary verification logic. Rated CVSS 9.8 with full confidentiality, integrity, and availability impact, it maps to CWE-288 and is addressed in a Drupal security advisory (SA-CONTRIB-2026-081). EPSS is low (0.18%, 8th percentile) and there is no public exploit identified at time of analysis. | CRITICAL | 9.8 | 0.2% | 49 |
|
| CVE-2026-12535 | Object injection in the Drupal Formatter Field contributed module (all versions from 0.0.0 up to but not including 2.0.0) allows remote unauthenticated attackers to improperly modify dynamically-determined object attributes, potentially leading to arbitrary code execution or full site compromise. The flaw carries a CVSS 9.8 rating, but with no public exploit identified and a low EPSS probability (0.17%, 7th percentile), and SSVC currently rates exploitation as 'none'. A vendor patch is available via Drupal advisory SA-CONTRIB-2026-048. | CRITICAL | 9.8 | 0.2% | 49 |
|
| CVE-2026-9726 | PHP object injection in the Drupal AlternativeCommerce (Basket) contributed module (all versions up to and including 2.1.17) allows remote unauthenticated attackers to modify dynamically-determined object attributes and inject crafted objects into the application. Successful exploitation can lead to code execution or full compromise of the Drupal site, with CVSS 3.1 scoring it 9.8 (Critical). No public exploit identified at time of analysis, and EPSS is low at 0.16% (6th percentile), indicating no observed exploitation activity yet despite the high severity rating. | CRITICAL | 9.8 | 0.2% | 49 |
|
| CVE-2026-11913 | Stored/reflected cross-site scripting (CWE-79) affects the Drupal contributed module 'Mother May I' across all released versions (*.*), letting attackers inject script that executes in the browser context of other Drupal users. Because the module is a Drupal add-on rather than core, exposure is limited to sites that have installed it, and no public exploit has been identified. EPSS is low (0.15%, 5th percentile) and the flaw is not on the CISA KEV list, indicating no known active exploitation despite the vendor-assigned 9.8 rating. | CRITICAL | 9.8 | 0.2% | 49 |
No patch
|
| CVE-2026-16641 | Information disclosure in the Drupal Commerce Elavon payment-gateway module stems from improper input validation (CWE-20) and, per the NVD scoring, is reachable by remote unauthenticated attackers. The Drupal security advisory (SA-CONTRIB-2026-084) leaves the affected range wholly unspecified ('*.*'), so every published version should be treated as potentially vulnerable until a fixed release is identified. No public exploit identified at time of analysis, and the EPSS score sits in the 4th percentile, indicating little observed exploitation interest despite the headline 9.8 rating. | CRITICAL | 9.8 | 0.1% | 49 |
No patch
|
| CVE-2026-8495 | Forceful browsing in the Drupal Date iCal contributed module (versions prior to 4.0.15) allows remote unauthenticated attackers to bypass authorization checks and access protected calendar resources. Despite a CVSS score of 9.8, the EPSS exploitation probability sits at just 0.02% (4th percentile) and no public exploit has been identified at time of analysis. The flaw is a CWE-862 missing authorization issue patched by the Drupal Security Team in version 4.0.15. | CRITICAL | 9.8 | 0.0% | 49 |
|
| CVE-2025-14556 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Drupal Flag allows Cross-Site Scripting (XSS).This issue affects Flag: from 7.X-3.0 through 7.X-3.9. [CVSS 5.4 MEDIUM] | MEDIUM | 5.4 | 0.0% | 47 |
PoC
No patch
|
| CVE-2026-15089 | Authentication bypass in the Drupal Commerce Guest Registration contributed module allows remote unauthenticated attackers to circumvent identity verification during the guest checkout/registration flow, per Drupal advisory SA-CONTRIB-2026-079. The CVSS 9.1 scoring (C:H/I:H) indicates an attacker can gain unauthorized access to or hijack account/order data without credentials or user interaction. No public exploit has been identified at time of analysis, and the low EPSS score (0.24%, 15th percentile) suggests exploitation is not yet widespread. | CRITICAL | 9.1 | 0.2% | 46 |
No patch
|
| CVE-2026-73475 | Incorrect authorization in the Drupal Commerce PayPal contribution module (versions up to 1.12.0 and 2.0.0 through 2.1.3) lets remote unauthenticated attackers reach protected resources or actions through forceful browsing - directly requesting URLs/endpoints that should be access-checked. A vendor patch exists via Drupal security advisory SA-contrib-2026-095. No public exploit has been identified at time of analysis, and the module is a niche payment-integration component rather than Drupal core. | CRITICAL | 9.1 | 0.2% | 46 |
|
| CVE-2026-16644 | Authorization bypass in the Drupal Webform REST contrib module (all versions from 0.0.0 up to and including 4.1.0) lets remote unauthenticated attackers reach REST resources they should not be able to access through forceful browsing. Because the module fails to properly enforce access checks on its endpoints, an attacker can read and potentially manipulate webform data or submissions guarded only by obscurity. No public exploit is identified at time of analysis and EPSS risk is low (0.18%, 7th percentile), but the CVSS 9.1 rating and SSVC 'total technical impact' make this a high-severity data-exposure issue. | CRITICAL | 9.1 | 0.2% | 46 |
|