89
CVEs
10
Critical
8
High
0
KEV
1
PoC
5
Unpatched C/H
79.8%
Patch Rate
0.2%
Avg EPSS
Severity Breakdown
CRITICAL
10
HIGH
8
MEDIUM
63
LOW
8
Monthly CVE Trend
Affected Products (30)
Debian Linux
44
PHP
35
Fedora
20
Open Redirect
12
Drupal Core
12
Application Express
10
Peoplesoft Enterprise Peopletools
10
Open Social
8
Ckeditor
7
H500s Firmware
6
Miniorange 2fa
6
H700s Firmware
6
H410s Firmware
6
Jd Edwards Enterpriseone Tools
6
H300s Firmware
6
H410c Firmware
6
Weblogic Server
6
Policy Automation
5
Symfony
5
Agile Plm
5
Rest Data Services
5
Communications Interactive Session Recorder
5
Opigno
5
H700E Firmware
5
Communications Operations Monitor
5
Artificial Intelligence
5
H300E Firmware
5
Banking Platform
5
H500E Firmware
5
Financial Services Analytical Applications Infrastructure
4
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-10768 | Missing authorization in the Drupal LocalGov Workflows contrib module (all versions 0.0.0 through 1.6.0, fixed in 1.6.0) lets remote attackers reach protected workflow-related routes through forceful browsing without proper permission checks. The flaw carries a vendor CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N), but EPSS is low (0.14%, 4th percentile) and there is no public exploit identified at time of analysis. Affected sites are Drupal deployments running this LocalGov Drupal editorial-workflow module. | CRITICAL | 9.8 | 0.1% | 69 |
PoC
|
| CVE-2026-16639 | Authentication bypass in the Drupal Internationalization Single Sign-On contributed module (versions 0.0.0 through 1.8.0) lets remote unauthenticated attackers assume authenticated sessions by reaching an alternate authentication path or channel that skips the primary verification logic. Rated CVSS 9.8 with full confidentiality, integrity, and availability impact, it maps to CWE-288 and is addressed in a Drupal security advisory (SA-CONTRIB-2026-081). EPSS is low (0.18%, 8th percentile) and there is no public exploit identified at time of analysis. | CRITICAL | 9.8 | 0.2% | 49 |
|
| CVE-2026-12535 | Object injection in the Drupal Formatter Field contributed module (all versions from 0.0.0 up to but not including 2.0.0) allows remote unauthenticated attackers to improperly modify dynamically-determined object attributes, potentially leading to arbitrary code execution or full site compromise. The flaw carries a CVSS 9.8 rating, but with no public exploit identified and a low EPSS probability (0.17%, 7th percentile), and SSVC currently rates exploitation as 'none'. A vendor patch is available via Drupal advisory SA-CONTRIB-2026-048. | CRITICAL | 9.8 | 0.2% | 49 |
|
| CVE-2026-9726 | PHP object injection in the Drupal AlternativeCommerce (Basket) contributed module (all versions up to and including 2.1.17) allows remote unauthenticated attackers to modify dynamically-determined object attributes and inject crafted objects into the application. Successful exploitation can lead to code execution or full compromise of the Drupal site, with CVSS 3.1 scoring it 9.8 (Critical). No public exploit identified at time of analysis, and EPSS is low at 0.16% (6th percentile), indicating no observed exploitation activity yet despite the high severity rating. | CRITICAL | 9.8 | 0.2% | 49 |
|
| CVE-2026-11913 | Stored/reflected cross-site scripting (CWE-79) affects the Drupal contributed module 'Mother May I' across all released versions (*.*), letting attackers inject script that executes in the browser context of other Drupal users. Because the module is a Drupal add-on rather than core, exposure is limited to sites that have installed it, and no public exploit has been identified. EPSS is low (0.15%, 5th percentile) and the flaw is not on the CISA KEV list, indicating no known active exploitation despite the vendor-assigned 9.8 rating. | CRITICAL | 9.8 | 0.2% | 49 |
No patch
|
| CVE-2026-16641 | Information disclosure in the Drupal Commerce Elavon payment-gateway module stems from improper input validation (CWE-20) and, per the NVD scoring, is reachable by remote unauthenticated attackers. The Drupal security advisory (SA-CONTRIB-2026-084) leaves the affected range wholly unspecified ('*.*'), so every published version should be treated as potentially vulnerable until a fixed release is identified. No public exploit identified at time of analysis, and the EPSS score sits in the 4th percentile, indicating little observed exploitation interest despite the headline 9.8 rating. | CRITICAL | 9.8 | 0.1% | 49 |
No patch
|
| CVE-2026-15089 | Authentication bypass in the Drupal Commerce Guest Registration contributed module allows remote unauthenticated attackers to circumvent identity verification during the guest checkout/registration flow, per Drupal advisory SA-CONTRIB-2026-079. The CVSS 9.1 scoring (C:H/I:H) indicates an attacker can gain unauthorized access to or hijack account/order data without credentials or user interaction. No public exploit has been identified at time of analysis, and the low EPSS score (0.24%, 15th percentile) suggests exploitation is not yet widespread. | CRITICAL | 9.1 | 0.2% | 46 |
No patch
|
| CVE-2026-73475 | Incorrect authorization in the Drupal Commerce PayPal contribution module (versions up to 1.12.0 and 2.0.0 through 2.1.3) lets remote unauthenticated attackers reach protected resources or actions through forceful browsing - directly requesting URLs/endpoints that should be access-checked. A vendor patch exists via Drupal security advisory SA-contrib-2026-095. No public exploit has been identified at time of analysis, and the module is a niche payment-integration component rather than Drupal core. | CRITICAL | 9.1 | 0.2% | 46 |
|
| CVE-2026-16644 | Authorization bypass in the Drupal Webform REST contrib module (all versions from 0.0.0 up to and including 4.1.0) lets remote unauthenticated attackers reach REST resources they should not be able to access through forceful browsing. Because the module fails to properly enforce access checks on its endpoints, an attacker can read and potentially manipulate webform data or submissions guarded only by obscurity. No public exploit is identified at time of analysis and EPSS risk is low (0.18%, 7th percentile), but the CVSS 9.1 rating and SSVC 'total technical impact' make this a high-severity data-exposure issue. | CRITICAL | 9.1 | 0.2% | 46 |
|
| CVE-2026-16645 | Missing authorization in the Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery contributed module (all versions from 0.0.0 up to and including 3.2.0) lets unauthenticated remote users reach gallery resources they should not be able to see by directly requesting their URLs (forceful browsing). Because the module fails to enforce access control on protected content, an attacker can enumerate and retrieve images or associated data intended for privileged users only. No public exploit identified at time of analysis, and EPSS is low (0.13%), but the flaw is trivially automatable per CISA SSVC. | CRITICAL | 9.1 | 0.1% | 46 |
|
| CVE-2026-13244 | Object injection in the Drupal Tealium iQ Tag Management contributed module (versions before 2.4.0) lets authenticated attackers manipulate dynamically-determined object attributes to compromise data confidentiality and integrity. Because the CVSS vector (AV:N/AC:L/PR:L) indicates a low-privileged authenticated user over the network, any user with a foothold on the site can potentially abuse the flaw; there is no public exploit identified at time of analysis and the EPSS probability is low (0.42%). Drupal has published advisory SA-CONTRIB-2026-064 and released a fixed version. | HIGH | 8.1 | 0.4% | 41 |
|
| CVE-2026-55809 | Object injection in the Drupal contrib module Flag attendance field (all versions up to and including 1.2) lets an authenticated user with low privileges pass attacker-controlled data into a dynamically-determined object attribute (CWE-915), enabling PHP object injection and high-impact compromise of data confidentiality and integrity. The Drupal Security Team published advisory SA-CONTRIB-2026-049 and a fixed release is available. There is no public exploit identified at time of analysis, and the EPSS probability is low (0.17%, 7th percentile). | HIGH | 8.1 | 0.2% | 41 |
|
| CVE-2026-55810 | Object injection in the Drupal Plotly.js Graphing contributed module (all releases 0.0.0 through 3.0.2) lets an authenticated attacker with low privileges tamper with dynamically-determined object attributes, undermining both confidentiality and integrity of the site. The flaw stems from improperly controlled modification of object properties (CWE-915), and the network-reachable, low-complexity CVSS 3.1 vector (8.1) reflects meaningful severity; however, EPSS is only 0.16% (6th percentile) and no public exploit identified at time of analysis. It is not listed in CISA KEV. | HIGH | 8.1 | 0.2% | 41 |
|
| CVE-2026-18985 | Incorrect authorization in the Drupal Edit in-place field contrib module (versions 0.0.0 through pre-2.1.1) enables authenticated users to perform forceful browsing against field-edit endpoints they lack permission to access, resulting in unauthorized read and write access to protected Drupal field data. The CVSS base score of 8.1 reflects high confidentiality and integrity impact, though real-world risk is tempered by the authentication prerequisite (PR:L) and an extremely low EPSS score of 0.13% (3rd percentile). A vendor-released patch is available; no public exploit identified at time of analysis. | HIGH | 8.1 | 0.1% | 41 |
|
| CVE-2026-18259 | Observable timing discrepancy in the Drupal Token Content Access module exposes token-protected content to brute-force enumeration via side-channel analysis. All module versions from 0.0.0 through 3.1.2 are affected; unauthenticated remote attackers (PR:N, AV:N per CVSS) can measure differential response times during token validation to reconstruct valid access tokens character-by-character, ultimately bypassing content access restrictions. No active exploitation has been confirmed (SSVC exploitation: none, EPSS 0.14%, no KEV listing), and a vendor patch is available per Drupal SA-CONTRIB-2026-090. | HIGH | 7.5 | 0.1% | 38 |
|