{"kind": "stack", "path": "vulns/stack/php", "name": "php", "stack": "php", "items": [{"id": "GHSA-mhf7-xp6r-6qrc", "noindex": false, "published": "2026-10-23T20:51:30Z", "modified": "2026-10-23T21:00:04.354707498Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "severity": "medium", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/ghsa-mhf7-xp6r-6qrc", "title": "Livewire: Authorization bypass in #[Authorize] via reordered parameter keys and #[Json] execution order", "description": "### Impact\n\nThree issues allowed actions protected by the `#[Authorize]` attribute to run against records the current user is not authorized for:\n\n1. **Out-of-order parameter keys on actions.** `#[Authorize]` resolved a model parameter by its array key, while the action itself received parameters positionally. A request sending params as an object with reordered integer keys (e.g. `{\"1\": 2, \"0\": 1}`) could pass authorization with a record the user owns while the action received a different record. With `#[Authorize('delete', 'comment')]` on `deleteComment(Comment $comment)`, a user could delete another user's comment.\n2. **The same issue on e", "references": ["https://github.com/livewire/livewire/security/advisories/GHSA-mhf7-xp6r-6qrc", "https://github.com/livewire/livewire/commit/822a4fa9b1e1123691133a2e2eb379a3dab11191", "https://github.com/livewire/livewire"], "fixes": ["4.4.8"], "products": [{"name": "livewire/livewire", "path": "vulns/packagist/livewire%2Flivewire", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-84910", "noindex": false, "published": "2026-10-22T01:22:18.564Z", "modified": "2026-10-22T13:47:41.423Z", "cvss": 4.2, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N", "severity": "medium", "epss": 0.00149, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-84910", "title": "Advanced Search - Moderately critical - Access bypass - SA-CONTRIB-2026-118", "description": "Missing Authorization vulnerability in Drupal Advanced Search allows Forceful Browsing. This issue affects Advanced Search versions: from 0.0.0 to 2.4.5.", "references": ["https://www.drupal.org/sa-contrib-2026-118", "https://nvd.nist.gov/vuln/detail/CVE-2026-84910"], "fixes": ["2.4.5"], "products": [{"name": "advanced search", "path": "vulns/advanced-search", "ecosystem": ""}, {"name": "drupal/advanced_search", "path": "vulns/packagist-https-%2F%2Fpackages.drupal.org%2F8/drupal%2Fadvanced_search", "ecosystem": "Packagist:https://packages.drupal.org/8"}]}, {"id": "CVE-2026-84911", "noindex": false, "published": "2026-10-22T01:22:17.746Z", "modified": "2026-10-22T13:48:23.369Z", "cvss": 3.1, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N", "severity": "low", "epss": 0.0015, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-84911", "title": "AI (Artificial Intelligence) - Moderately critical - Cross site scripting - SA-CONTRIB-2026-119", "description": "Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal AI (Artificial Intelligence) allows Stored XSS. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.3.13, from 1.4.0 to 1.4.8.", "references": ["https://www.drupal.org/sa-contrib-2026-119", "https://nvd.nist.gov/vuln/detail/CVE-2026-84911"], "fixes": ["1.3.13", "1.4.8"], "products": [{"name": "ai (artificial intelligence)", "path": "vulns/ai-%28artificial-intelligence%29", "ecosystem": ""}, {"name": "drupal/ai", "path": "vulns/packagist-https-%2F%2Fpackages.drupal.org%2F8/drupal%2Fai", "ecosystem": "Packagist:https://packages.drupal.org/8"}]}, {"id": "CVE-2026-84912", "noindex": false, "published": "2026-10-22T01:22:16.899Z", "modified": "2026-10-22T13:49:28.251Z", "cvss": 4.6, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N", "severity": "medium", "epss": 0.00148, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-84912", "title": "AI (Artificial Intelligence) - Moderately critical - Access Bypass - SA-CONTRIB-2026-120", "description": "Missing Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Forceful Browsing. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.3.13, from 1.4.0 to 1.4.8.", "references": ["https://www.drupal.org/sa-contrib-2026-120", "https://nvd.nist.gov/vuln/detail/CVE-2026-84912"], "fixes": ["1.3.13", "1.4.8"], "products": [{"name": "ai (artificial intelligence)", "path": "vulns/ai-%28artificial-intelligence%29", "ecosystem": ""}, {"name": "drupal/ai", "path": "vulns/packagist-https-%2F%2Fpackages.drupal.org%2F8/drupal%2Fai", "ecosystem": "Packagist:https://packages.drupal.org/8"}]}, {"id": "CVE-2026-84913", "noindex": false, "published": "2026-10-22T01:22:16.062Z", "modified": "2026-10-22T13:50:08.966Z", "cvss": 4.6, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N", "severity": "medium", "epss": 0.00148, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-84913", "title": "AI translate - Moderately critical - Access Bypass - SA-CONTRIB-2026-121", "description": "Missing Authorization vulnerability in Drupal AI Translate allows Forceful Browsing. This issue affects AI Translate versions: from 0.0.0 to 1.3.2, from 1.4.0 to 1.4.1.", "references": ["https://www.drupal.org/sa-contrib-2026-121", "https://nvd.nist.gov/vuln/detail/CVE-2026-84913"], "fixes": ["1.3.2", "1.4.1"], "products": [{"name": "ai translate", "path": "vulns/ai-translate", "ecosystem": ""}, {"name": "drupal/ai_translate", "path": "vulns/packagist-https-%2F%2Fpackages.drupal.org%2F8/drupal%2Fai_translate", "ecosystem": "Packagist:https://packages.drupal.org/8"}]}, {"id": "CVE-2026-84914", "noindex": false, "published": "2026-10-22T01:22:15.195Z", "modified": "2026-10-22T17:08:38.215Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "severity": "medium", "epss": 0.00214, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-84914", "title": "Calculate Working Days - Critical - Access bypass - SA-CONTRIB-2026-122", "description": "Missing Authorization vulnerability in Drupal Calculate Working Days allows Forceful Browsing. This issue affects Calculate Working Days versions: from 0.0.0 to 2.0.3.", "references": ["https://www.drupal.org/sa-contrib-2026-122", "https://nvd.nist.gov/vuln/detail/CVE-2026-84914"], "fixes": ["2.0.3"], "products": [{"name": "calculate working days", "path": "vulns/calculate-working-days", "ecosystem": ""}, {"name": "drupal/calculate_working_days", "path": "vulns/packagist-https-%2F%2Fpackages.drupal.org%2F8/drupal%2Fcalculate_working_days", "ecosystem": "Packagist:https://packages.drupal.org/8"}]}, {"id": "CVE-2026-84915", "noindex": false, "published": "2026-10-22T01:22:14.360Z", "modified": "2026-10-22T17:09:33.536Z", "cvss": 4.6, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N", "severity": "medium", "epss": 0.00162, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-84915", "title": "Component blocks - Moderately critical - Cross site scripting - SA-CONTRIB-2026-123", "description": "Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal Component blocks allows Stored XSS. This issue affects Component blocks versions: from 0.0.0 to 1.2.7.", "references": ["https://www.drupal.org/sa-contrib-2026-123", "https://nvd.nist.gov/vuln/detail/CVE-2026-84915"], "fixes": ["1.2.7"], "products": [{"name": "component blocks", "path": "vulns/component-blocks", "ecosystem": ""}, {"name": "drupal/component_blocks", "path": "vulns/packagist-https-%2F%2Fpackages.drupal.org%2F8/drupal%2Fcomponent_blocks", "ecosystem": "Packagist:https://packages.drupal.org/8"}]}, {"id": "CVE-2026-84923", "noindex": false, "published": "2026-10-22T01:22:13.548Z", "modified": "2026-10-22T17:10:34.544Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "severity": "medium", "epss": 0.00252, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-84923", "title": "Email Verification / SMS Verification / OTP Verification - Critical - Access Bypass - SA-CONTRIB-2026-124", "description": "Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Email Verification / SMS Verification / OTP Verification allows Authentication Bypass. This issue affects Email Verification / SMS Verification / OTP Verification versions: from 0.0.0 to 2.4.0.", "references": ["https://www.drupal.org/sa-contrib-2026-124", "https://nvd.nist.gov/vuln/detail/CVE-2026-84923"], "fixes": ["2.4.0"], "products": [{"name": "email verification / sms verification / otp verification", "path": "vulns/email-verification-%2F-sms-verification-%2F-otp-verification", "ecosystem": ""}, {"name": "drupal/otp_verification", "path": "vulns/packagist-https-%2F%2Fpackages.drupal.org%2F8/drupal%2Fotp_verification", "ecosystem": "Packagist:https://packages.drupal.org/8"}]}, {"id": "CVE-2026-84924", "noindex": false, "published": "2026-10-22T01:22:12.714Z", "modified": "2026-10-22T17:11:16.517Z", "cvss": 5.4, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "severity": "medium", "epss": 0.00181, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-84924", "title": "Email Verification / SMS Verification / OTP Verification - Critical - Cross Site Scripting - SA-CONTRIB-2026-125", "description": "Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal Email Verification / SMS Verification / OTP Verification allows Reflected XSS. This issue affects Email Verification / SMS Verification / OTP Verification versions: from 0.0.0 to 2.4.0.", "references": ["https://www.drupal.org/sa-contrib-2026-125", "https://nvd.nist.gov/vuln/detail/CVE-2026-84924"], "fixes": ["2.4.0"], "products": [{"name": "email verification / sms verification / otp verification", "path": "vulns/email-verification-%2F-sms-verification-%2F-otp-verification", "ecosystem": ""}, {"name": "drupal/otp_verification", "path": "vulns/packagist-https-%2F%2Fpackages.drupal.org%2F8/drupal%2Fotp_verification", "ecosystem": "Packagist:https://packages.drupal.org/8"}]}, {"id": "CVE-2026-84916", "noindex": false, "published": "2026-10-22T01:22:11.876Z", "modified": "2026-10-22T17:11:51.927Z", "cvss": 3.7, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "severity": "low", "epss": 0.00197, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-84916", "title": "Islandora  - Moderately critical - Access bypass - SA-CONTRIB-2026-126", "description": "Missing Authorization vulnerability in Drupal Islandora  allows Forceful Browsing. This issue affects Islandora  versions: from 0.0.0 to 2.19.0.", "references": ["https://www.drupal.org/sa-contrib-2026-126", "https://nvd.nist.gov/vuln/detail/CVE-2026-84916"], "fixes": ["2.19.0"], "products": [{"name": "islandora", "path": "vulns/islandora", "ecosystem": ""}, {"name": "drupal/islandora", "path": "vulns/packagist-https-%2F%2Fpackages.drupal.org%2F8/drupal%2Fislandora", "ecosystem": "Packagist:https://packages.drupal.org/8"}]}, {"id": "CVE-2026-84917", "noindex": false, "published": "2026-10-22T01:22:11.076Z", "modified": "2026-10-22T17:14:41.654Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "severity": "medium", "epss": 0.00194, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-84917", "title": "Jsonapi Role Access  - Critical - Access bypass - SA-CONTRIB-2026-127", "description": "Incorrect Authorization vulnerability in Drupal Jsonapi Role Access  allows Forceful Browsing. This issue affects Jsonapi Role Access  versions: from 0.0.0 to 2.0.2.", "references": ["https://www.drupal.org/sa-contrib-2026-127", "https://nvd.nist.gov/vuln/detail/CVE-2026-84917"], "fixes": ["2.0.2"], "products": [{"name": "jsonapi role access", "path": "vulns/jsonapi-role-access", "ecosystem": ""}, {"name": "drupal/jsonapi_role_access", "path": "vulns/packagist-https-%2F%2Fpackages.drupal.org%2F8/drupal%2Fjsonapi_role_access", "ecosystem": "Packagist:https://packages.drupal.org/8"}]}, {"id": "CVE-2026-16648", "noindex": false, "published": "2026-10-22T01:22:10.256Z", "modified": "2026-10-22T17:15:23.605Z", "cvss": 3.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N", "severity": "low", "epss": 0.00196, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-16648", "title": "Mailer Plus Log - Moderately critical - Access bypass - SA-CONTRIB-2026-128", "description": "Insertion of Sensitive Information into Log File vulnerability in Drupal Mailer Plus Log allows Remote Services with Stolen Credentials. This issue affects Mailer Plus Log versions: from 0.0.0 to 1.2.7.", "references": ["https://www.drupal.org/sa-contrib-2026-128", "https://nvd.nist.gov/vuln/detail/CVE-2026-16648"], "fixes": ["1.2.7"], "products": [{"name": "mailer plus log", "path": "vulns/mailer-plus-log", "ecosystem": ""}, {"name": "drupal/symfony_mailer_log", "path": "vulns/packagist-https-%2F%2Fpackages.drupal.org%2F8/drupal%2Fsymfony_mailer_log", "ecosystem": "Packagist:https://packages.drupal.org/8"}]}, {"id": "CVE-2026-81163", "noindex": false, "published": "2026-10-22T01:22:09.449Z", "modified": "2026-10-22T17:15:58.879Z", "cvss": 5.4, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "severity": "medium", "epss": 0.00216, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-81163", "title": "Media Library Importer - Moderately critical - Access bypass - SA-CONTRIB-2026-129", "description": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Drupal Media Library Importer allows Path Traversal. This issue affects Media Library Importer versions: from 0.0.0 to 2.1.6.", "references": ["https://www.drupal.org/sa-contrib-2026-129", "https://nvd.nist.gov/vuln/detail/CVE-2026-81163"], "fixes": ["2.1.6"], "products": [{"name": "media library importer", "path": "vulns/media-library-importer", "ecosystem": ""}, {"name": "drupal/media_library_importer", "path": "vulns/packagist-https-%2F%2Fpackages.drupal.org%2F8/drupal%2Fmedia_library_importer", "ecosystem": "Packagist:https://packages.drupal.org/8"}]}, {"id": "CVE-2026-84918", "noindex": false, "published": "2026-10-22T01:22:08.604Z", "modified": "2026-10-22T17:16:33.894Z", "cvss": 3.7, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N", "severity": "low", "epss": 0.00126, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-84918", "title": "Monobank payment API - Moderately critical - Access bypass - SA-CONTRIB-2026-130", "description": "Improper Verification of Cryptographic Signature vulnerability in Drupal Monobank payment API allows Signature Spoof. This issue affects Monobank payment API versions: from 0.0.0 to 1.0.3.", "references": ["https://www.drupal.org/sa-contrib-2026-130", "https://nvd.nist.gov/vuln/detail/CVE-2026-84918"], "fixes": ["1.0.3"], "products": [{"name": "monobank payment api", "path": "vulns/monobank-payment-api", "ecosystem": ""}, {"name": "drupal/monobank", "path": "vulns/packagist-https-%2F%2Fpackages.drupal.org%2F8/drupal%2Fmonobank", "ecosystem": "Packagist:https://packages.drupal.org/8"}]}, {"id": "CVE-2026-84919", "noindex": false, "published": "2026-10-22T01:22:07.765Z", "modified": "2026-10-22T17:17:13.561Z", "cvss": 4.6, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N", "severity": "medium", "epss": 0.00162, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-84919", "title": "PhotoSwipe - Responsive JavaScript Modal Image Gallery - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-131", "description": "Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery allows Stored XSS. This issue affects PhotoSwipe - Responsive JavaScript Modal Image Gallery versions: from 0.0.0 to 5.0.9.", "references": ["https://www.drupal.org/sa-contrib-2026-131", "https://nvd.nist.gov/vuln/detail/CVE-2026-84919"], "fixes": ["5.0.9"], "products": [{"name": "photoswipe - responsive javascript modal image gallery", "path": "vulns/photoswipe---responsive-javascript-modal-image-gallery", "ecosystem": ""}, {"name": "drupal/photoswipe", "path": "vulns/packagist-https-%2F%2Fpackages.drupal.org%2F8/drupal%2Fphotoswipe", "ecosystem": "Packagist:https://packages.drupal.org/8"}]}, {"id": "CVE-2026-84920", "noindex": false, "published": "2026-10-22T01:22:06.941Z", "modified": "2026-10-22T18:28:33.244Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "severity": "medium", "epss": 0.00228, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-84920", "title": "Unpublished Node Permissions - Critical - Access bypass - SA-CONTRIB-2026-132", "description": "Incorrect Authorization vulnerability in Drupal Unpublished Node Permissions allows Forceful Browsing. This issue affects Unpublished Node Permissions versions: from 0.0.0 to 1.8.0.", "references": ["https://www.drupal.org/sa-contrib-2026-132", "https://nvd.nist.gov/vuln/detail/CVE-2026-84920"], "fixes": ["1.8.0"], "products": [{"name": "unpublished node permissions", "path": "vulns/unpublished-node-permissions", "ecosystem": ""}, {"name": "drupal/unpublished_node_permissions", "path": "vulns/packagist-https-%2F%2Fpackages.drupal.org%2F8/drupal%2Funpublished_node_permissions", "ecosystem": "Packagist:https://packages.drupal.org/8"}]}, {"id": "CVE-2026-84921", "noindex": false, "published": "2026-10-22T01:22:06.119Z", "modified": "2026-10-22T17:17:59.733Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "severity": "medium", "epss": 0.00288, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-84921", "title": "Webform Submissions Delete - Moderately critical - Access bypass - SA-CONTRIB-2026-133", "description": "Missing Authorization vulnerability in Drupal Webform Submissions Delete allows Forceful Browsing. This issue affects Webform Submissions Delete versions: from 0.0.0 to 1.2.0.", "references": ["https://www.drupal.org/sa-contrib-2026-133", "https://nvd.nist.gov/vuln/detail/CVE-2026-84921"], "fixes": ["1.2.0"], "products": [{"name": "webform submissions delete", "path": "vulns/webform-submissions-delete", "ecosystem": ""}, {"name": "drupal/webform_submissions_delete", "path": "vulns/packagist-https-%2F%2Fpackages.drupal.org%2F8/drupal%2Fwebform_submissions_delete", "ecosystem": "Packagist:https://packages.drupal.org/8"}]}, {"id": "CVE-2026-87936", "noindex": false, "published": "2026-10-22T01:22:05.298Z", "modified": "2026-10-22T17:18:56.762Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N", "severity": "medium", "epss": 0.00215, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-87936", "title": "amazee.ai Private AI Provider - Critical - SQL injection - SA-CONTRIB-2026-134", "description": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal amazee.ai Private AI Provider allows SQL Injection. This issue affects amazee.ai Private AI Provider versions: from 0.0.0 to 1.3.7, from 1.4.0 to 1.4.3.", "references": ["https://www.drupal.org/sa-contrib-2026-134", "https://nvd.nist.gov/vuln/detail/CVE-2026-87936"], "fixes": ["1.3.7", "1.4.3"], "products": [{"name": "amazee.ai private ai provider", "path": "vulns/amazee.ai-private-ai-provider", "ecosystem": ""}, {"name": "drupal/ai_provider_amazeeio", "path": "vulns/packagist-https-%2F%2Fpackages.drupal.org%2F8/drupal%2Fai_provider_amazeeio", "ecosystem": "Packagist:https://packages.drupal.org/8"}]}, {"id": "CVE-2026-87937", "noindex": false, "published": "2026-10-22T01:22:04.473Z", "modified": "2026-10-22T17:29:54.899Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "severity": "medium", "epss": 0.00232, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-87937", "title": "Central Authentication System (CAS) Server - Moderately critical - Open redirect - SA-CONTRIB-2026-135", "description": "URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal Central Authentication System (CAS) Server allows Fake the Source of Data. This issue affects Central Authentication System (CAS) Server versions: from 0.0.0 to 2.0.4, from 2.1.0 to 2.1.3.", "references": ["https://www.drupal.org/sa-contrib-2026-135", "https://nvd.nist.gov/vuln/detail/CVE-2026-87937"], "fixes": ["2.0.4", "2.1.3"], "products": [{"name": "central authentication system (cas) server", "path": "vulns/central-authentication-system-%28cas%29-server", "ecosystem": ""}, {"name": "drupal/cas_server", "path": "vulns/packagist-https-%2F%2Fpackages.drupal.org%2F8/drupal%2Fcas_server", "ecosystem": "Packagist:https://packages.drupal.org/8"}]}, {"id": "CVE-2026-87938", "noindex": false, "published": "2026-10-22T01:22:03.658Z", "modified": "2026-10-22T01:22:03.658Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00168, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-87938", "title": "CSP log - Critical - SQL Injection - SA-CONTRIB-2026-136", "description": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal CSP log allows SQL Injection. This issue affects CSP log versions: from 0.0.0 to 1.0.2.", "references": ["https://www.drupal.org/sa-contrib-2026-136", "https://nvd.nist.gov/vuln/detail/CVE-2026-87938"], "fixes": ["1.0.2"], "products": [{"name": "csp log", "path": "vulns/csp-log", "ecosystem": ""}, {"name": "drupal/csp_log", "path": "vulns/packagist-https-%2F%2Fpackages.drupal.org%2F8/drupal%2Fcsp_log", "ecosystem": "Packagist:https://packages.drupal.org/8"}]}], "total": 7182, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 200, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "livewire/livewire", "path": "vulns/packagist/livewire%2Flivewire", "ecosystem": "Packagist"}, {"name": "advanced search", "path": "vulns/advanced-search", "ecosystem": ""}, {"name": "drupal/advanced_search", "path": "vulns/packagist-https-%2F%2Fpackages.drupal.org%2F8/drupal%2Fadvanced_search", "ecosystem": "Packagist:https://packages.drupal.org/8"}, {"name": "ai (artificial intelligence)", "path": "vulns/ai-%28artificial-intelligence%29", "ecosystem": ""}, {"name": "drupal/ai", "path": "vulns/packagist-https-%2F%2Fpackages.drupal.org%2F8/drupal%2Fai", "ecosystem": "Packagist:https://packages.drupal.org/8"}, {"name": "ai translate", "path": "vulns/ai-translate", "ecosystem": ""}, {"name": "drupal/ai_translate", "path": "vulns/packagist-https-%2F%2Fpackages.drupal.org%2F8/drupal%2Fai_translate", "ecosystem": "Packagist:https://packages.drupal.org/8"}, {"name": "calculate working days", "path": "vulns/calculate-working-days", "ecosystem": ""}, {"name": "drupal/calculate_working_days", "path": "vulns/packagist-https-%2F%2Fpackages.drupal.org%2F8/drupal%2Fcalculate_working_days", "ecosystem": "Packagist:https://packages.drupal.org/8"}, {"name": "component blocks", "path": "vulns/component-blocks", "ecosystem": ""}, {"name": "drupal/component_blocks", "path": "vulns/packagist-https-%2F%2Fpackages.drupal.org%2F8/drupal%2Fcomponent_blocks", "ecosystem": "Packagist:https://packages.drupal.org/8"}, {"name": "email verification / sms verification / otp verification", "path": "vulns/email-verification-%2F-sms-verification-%2F-otp-verification", "ecosystem": ""}, {"name": "drupal/otp_verification", "path": "vulns/packagist-https-%2F%2Fpackages.drupal.org%2F8/drupal%2Fotp_verification", "ecosystem": "Packagist:https://packages.drupal.org/8"}, {"name": "islandora", "path": "vulns/islandora", "ecosystem": ""}, {"name": "drupal/islandora", "path": "vulns/packagist-https-%2F%2Fpackages.drupal.org%2F8/drupal%2Fislandora", "ecosystem": "Packagist:https://packages.drupal.org/8"}, {"name": "jsonapi role access", "path": "vulns/jsonapi-role-access", "ecosystem": ""}, {"name": "drupal/jsonapi_role_access", "path": "vulns/packagist-https-%2F%2Fpackages.drupal.org%2F8/drupal%2Fjsonapi_role_access", "ecosystem": "Packagist:https://packages.drupal.org/8"}, {"name": "mailer plus log", "path": "vulns/mailer-plus-log", "ecosystem": ""}, {"name": "drupal/symfony_mailer_log", "path": "vulns/packagist-https-%2F%2Fpackages.drupal.org%2F8/drupal%2Fsymfony_mailer_log", "ecosystem": "Packagist:https://packages.drupal.org/8"}, {"name": "media library importer", "path": "vulns/media-library-importer", "ecosystem": ""}, {"name": "drupal/media_library_importer", "path": "vulns/packagist-https-%2F%2Fpackages.drupal.org%2F8/drupal%2Fmedia_library_importer", "ecosystem": "Packagist:https://packages.drupal.org/8"}, {"name": "monobank payment api", "path": "vulns/monobank-payment-api", "ecosystem": ""}, {"name": "drupal/monobank", "path": "vulns/packagist-https-%2F%2Fpackages.drupal.org%2F8/drupal%2Fmonobank", "ecosystem": "Packagist:https://packages.drupal.org/8"}, {"name": "photoswipe - responsive javascript modal image gallery", "path": "vulns/photoswipe---responsive-javascript-modal-image-gallery", "ecosystem": ""}, {"name": "php", "path": "vulns/php", "ecosystem": ""}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 182, "kev": 0}, "lastmod": "2026-10-23T21:00:04.354707498Z", "early_advisories": [{"fixes": [], "id": "EA-auto-43744e2e5c9a208ed806e57a9b42af7ed13757e08dcfc2e8", "cves": ["CVE-2026-115560"], "texts": {"de": {"title": "PHP: Remote-Codeausführung", "description": "Laut OpenNet wurde in PHP eine Sicherheitslücke gefunden: Remote-Codeausführung (CVE-2026-115560). Die betroffenen Versionen sind nicht genau angegeben. Im Bericht wird keine Version mit Fehlerbehebung genannt.", "action": "Prüfen Sie, ob ein Update für PHP mit der Fehlerbehebung verfügbar ist, und installieren Sie es."}, "en": {"title": "PHP: remote code execution", "description": "According to OpenNet, PHP has a remote code execution vulnerability (CVE-2026-115560). The exact affected versions are unspecified. The report does not name a fixed version.", "action": "Check whether a PHP update with the fix is available and install it."}, "es": {"title": "PHP: ejecución remota de código", "description": "Según OpenNet, PHP tiene una vulnerabilidad de ejecución remota de código (CVE-2026-115560). No se especifican las versiones exactas afectadas. El mensaje no indica una versión corregida.", "action": "Comprueba si hay una actualización de PHP con la corrección e instálala."}, "fr": {"title": "PHP : exécution de code à distance", "description": "Selon OpenNet, PHP présente une vulnérabilité d’exécution de code à distance (CVE-2026-115560). Les versions exactes affectées ne sont pas précisées. Le message ne précise pas de version corrigée.", "action": "Vérifiez si une mise à jour de sécurité de PHP contenant le correctif est disponible et installez-la."}}, "affected": {"all_supported": false, "branches": [], "ranges": []}, "updated_at": "2026-10-24T17:08:02.545120Z", "candidate_id": "63ebe2e680c5dd94d54a881dabfd180796897bf3bf44a3b15d1ec396cb8a181a", "sources": [{"name": "opennet", "url": "https://www.opennet.ru/opennews/art.shtml?num=66534"}, {"name": "the-hacker-news", "url": "https://thehackernews.com/2026/10/urgent-php-warns-of-another-unpatched.html"}], "fix_status": "unfixed", "created_at": "2026-10-24T17:05:52.430295Z", "fixed_version": "", "product": "php", "state": "published"}], "license": "Vous pouvez librement utiliser la sélection de PatchFirst et nos ajouts (priorités, alertes précoces, textes, synthèses et agrégats) pour vos propres besoins, y compris les activités internes de votre entreprise. La revente, la distribution commerciale et la mise en miroir massive de cette sélection ou de ces ajouts nécessitent un accord écrit avec l’opérateur. Lors de toute utilisation ou publication de la sélection ou de nos ajouts, citez PatchFirst (https://patchfirst.dev/vulns/) avec ce lien vers la page du flux de votre région. Les enregistrements originaux des sources ouvertes restent soumis à leurs licences et conditions respectives. Ces conditions ne limitent pas vos droits sur les données originales, que vous pouvez obtenir directement auprès de ces sources.", "terms_url": "https://patchfirst.dev/fr/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "PatchFirst sélectionne, normalise et combine les enregistrements ; des synthèses et des traductions peuvent être ajoutées. Les actualités sont accompagnées d’un lien vers la source originale dans chaque entrée.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Les licences des bases d’origine varient ; voir le catalogue des sources."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Évaluations publiques gratuites ; mention de la source demandée (FIRST EPSS, évaluations produites par Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}