CVE database
94,291 vulnerabilities, newest first. Each page breaks the severity score down in plain language and lists affected versions, exploitation status and the fix.
- 7.5 High severity
Red Hat Enterprise Linux 10: Uncontrolled Resource Consumption
A flaw was found in glib-networking. When establishing connections using Transport Layer Security (TLS) version 1.3, the client-side session cache does not limit the number of session tickets retained for a single host. A malicious server can exploit this by s
- 7.3 High severity
CAPTCHA: Authentication Bypass Using an Alternate Path or Channel
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal CAPTCHA allows Functionality Bypass. This issue affects CAPTCHA versions: from 0.0.0 to 1.18.0, from 2.0.0 to 2.0.11.
- 7.2 High severity
Single Content Sync: Deserialization of Untrusted Data
Deserialization of Untrusted Data vulnerability in Drupal Single Content Sync allows Object Injection. This issue affects Single Content Sync versions: from 0.0.0 to 1.4.19.
- 7.2 High severity
Single Content Sync: External Control of File Name or Path
External Control of File Name or Path vulnerability in Drupal Single Content Sync allows Path Traversal. This issue affects Single Content Sync versions: from 0.0.0 to 1.4.19.
- 7.3 High severity
Commerce Stripe: Cross-Site Request Forgery
Cross-Site Request Forgery (CSRF) vulnerability in Drupal Commerce Stripe allows Cross Site Request Forgery. This issue affects Commerce Stripe versions: from 2.0.0 to 2.2.3.
- 7.1 High severity
AI (Artificial Intelligence): Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Cross-Site Scripting (XSS). This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.
- 8.8 High severity
Monster Menus: Improperly Controlled Modification of Dynamically-Determined Object Attributes
Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Monster Menus allows Object Injection. This issue affects Monster Menus versions: from 0.0.0 to 9.5.6.
- 7.1 High severity
Bootstrap: Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Bootstrap allows Cross-Site Scripting (XSS). This issue affects Bootstrap versions: from 0.0.0 to 3.45.0.
- 7.1 High severity
Zero Point: Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Zero Point allows Stored XSS. This issue affects Zero Point versions: from 0.0.0 to 1.30.0, from 2.0.0 to 2.0.1.
- 7.1 High severity
UI Icons: Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal UI Icons allows Cross-Site Scripting (XSS). This issue affects UI Icons versions: from 0.0.0 to 1.1.3, from 2.0.0 to 2.0.2.
- 7.1 High severity
Black Hole: Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Black Hole allows Stored XSS. This issue affects Black Hole versions: from 0.0.0 to 1.26.0, from 2.0.0 to 2.0.1.
- 7.1 High severity
ABC: Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal ABC allows Stored XSS. This issue affects ABC versions: from 0.0.0 to 1.25.0, from 2.0.0 to 2.0.1.
- 7.2 High severity
Custom Formatters: Privilege Defined With Unsafe Actions
Privilege Defined With Unsafe Actions vulnerability in Drupal Custom Formatters allows Privilege Escalation. This issue affects Custom Formatters versions: from 0.0.0 to 4.2.1.
- 9.8 Critical severity
Ffmpeg Image Toolkit: Improper Neutralization of Special Elements used in an OS Command
Improper Neutralization of Special Elements used in an OS Command ("OS Command Injection") vulnerability in Drupal Ffmpeg Image Toolkit allows OS Command Injection. This issue affects Ffmpeg Image Toolkit versions: from 0.0.0 to 1.0.3.
- 8.1 High severity
Entity List: Use of Externally-Controlled Input to Select Classes or Code
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Drupal Entity List allows Reflection Injection. This issue affects Entity List versions: from 0.0.0 to 3.0.10.
- 8.1 High severity
Drupal core: Use of Externally-Controlled Input to Select Classes or Code
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Drupal Drupal core allows Reflection Injection. This issue affects Drupal core versions: from 8.9.0 to 10.6.19, from 11.0.0 to 11.3.19, from 11.4.0 to 11.4.10,
- 7.3 High severity
Restrict route by IP: Incorrect Authorization
Incorrect Authorization vulnerability in Drupal Restrict route by IP allows Forceful Browsing. This issue affects Restrict route by IP versions: from 0.0.0 to 1.3.1, from 2.0.0 to 2.0.1.
- 9.8 Critical severity
Block AJAX: Improperly Controlled Modification of Dynamically-Determined Object Attributes
Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Block AJAX allows Object Injection. This issue affects Block AJAX versions: from 0.0.0 to 3.0.2.
- 8.8 High severity
Graphics DDK: Use of Out-of-range Pointer Offset
A web page that contains unusual WebGPU content loaded into the GPU GLES render process can trigger a OOB read and/or write crash in the GPU GLES user-space shared library. On certain platforms, when the process executing graphics workload has system privilege
- 9.8 Critical severity
Graphics DDK: Use of Out-of-range Pointer Offset
On GPU systems with the security vulnerability fix for CVE-2026-49746 applied, the mapping range of graphics buffers is limited which causes errors when the mapping outside of that range. Integer truncation caused when mapping GPU buffer pages in the buffer’s
- 7.1 High severity
Graphics DDK: Use After Free
Software installed and run as a non-privileged user may conduct improper GPU system calls to free memory in still in use, replace with another allocation and cause arbitrary memory reads or writes to physical memory pages. A memory buffer managed by a CPU thre
- 7.8 High severity
Graphics DDK: Stack-based Buffer Overflow
Software installed and run as a non-privileged user may conduct improper GPU system calls causing a stack overflow in the kernel. The overflow occurs when processing resolved Linux/Android fence synchronization checkpoints, while user checkpoints are excluded
- 7.1 High severity
Graphics DDK: Integer Overflow or Wraparound
Software installed and run as a non-privileged user may conduct improper system calls to allocate physical memory. A 32-bit integer overflow in the KM driver during page-to-byte conversion of an allocation size can result in an undersized kernel buffer allocat
- 7.5 High severity
Graphics DDK: Integer Overflow or Wraparound
A web page that contains unusual GPU shader code is loaded into the GPU compiler process and can lead memory allocation failure. If the allocation failure is not properly handled, the compiler may dereference a NULL pointer at a controlled offset, resulting in
- 7.0 High severity
Graphics DDK: Use After Free
Software installed and run as a non-privileged user may conduct improper GPU system calls to cause race condition in hardware performance counters buffer’s destruction path leading to read and/or write UAF. The race condition in the destruction path could lead
- 8.8 High severity
Chrome: Incorrect Authorization
Incorrect authorization in Input in Google Chrome prior to 156.0.8078.79 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)
- 8.8 High severity
Chrome: Incorrect Authorization
Incorrect authorization in FileSystem in Google Chrome prior to 156.0.8078.79 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
- 8.8 High severity
Improper input validation in Network in Google Chrome prior to 156.0.8078.79 allowed a remote…
Improper input validation in Network in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via crafted network traffic. (Chromium security severity: High)
- 8.8 High severity
Chrome: Incorrect Authorization
Incorrect authorization in FileSystem in Google Chrome prior to 156.0.8078.79 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
- 8.8 High severity
Chrome: Origin Validation Error
Origin validation error in Autofill in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)
- 8.8 High severity
Chrome: Incorrect Authorization
Incorrect authorization in FileSystem in Google Chrome prior to 156.0.8078.79 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
- 8.8 High severity
Chrome: Use of Uninitialized Resource
Uninitialized resource in Skia in Google Chrome prior to 156.0.8078.79 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)
- 8.8 High severity
Chrome: Use of Incorrectly-Resolved Name or Reference
Incorrect reference resolution in CacheStorage in Google Chrome prior to 156.0.8078.79 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: High)
- 8.8 High severity
Chrome: Incorrect Authorization
Incorrect authorization in Blink in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)
- 8.8 High severity
Chrome: Use After Free
Use after free in Editing in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- 8.8 High severity
Chrome: Use After Free
Use after free in DOM in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- 8.8 High severity
Chrome: Use of Incorrectly-Resolved Name or Reference
Incorrect reference resolution in Quota in Google Chrome prior to 156.0.8078.79 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: H
- 8.8 High severity
Chrome: Use of Incorrectly-Resolved Name or Reference
Incorrect reference resolution in Quota in Google Chrome prior to 156.0.8078.79 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: High)
- 8.8 High severity
Chrome: Use After Free
Use after free in Dawn in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
- 9.6 Critical severity
Chrome: Use After Free
Use after free in GarbageCollection in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)