Upcoming
Vulnerabilities that other sources know about before their CVE record appears in cvelistV5. Data from the GitHub Advisory Database (CC BY 4.0), OSV.dev sources and the Zero Day Initiative; see sources and licenses.
CVE IDs that a GitHub advisory, an OSV.dev record or a ZDI advisory already names, but that cvelistV5 doesn't contain yet: usually reserved and about to be published. Each badge links to the source's record.
234 CVE IDs · page 1 of 5
| CVE ID | First seen | Severity | Affects | Title | Sources |
|---|---|---|---|---|---|
| CVE-2026-112902 | 2026-10-21 | High 8.8 | Pillow | Pillow: Memory disclosure and segfault in libtiff encoder via crafted TIFF tags | GitHub advisory |
| CVE-2026-114573 | 2026-10-21 | Unscored | drupal/monster_menus | This module enables you to create one or more multisites with highly granular page permissions. The included RSS... | OSV.dev |
| CVE-2026-114571 | 2026-10-21 | Unscored | drupal/rabbit_hole | Rabbit Hole lets site builders control what happens when an entity's page is viewed: show it, return an access... | OSV.dev |
| CVE-2026-114554 | 2026-10-21 | Unscored | drupal/ai_file_to_text | The AI File to Text module extracts text from uploaded documents, including Word, PDF, OpenDocument, CSV, Markdown... | OSV.dev |
| CVE-2026-114555 | 2026-10-21 | Unscored | drupal/datafield | Data Field allows you to create custom fields with multiple values under the default table form. The `file_uri`... | OSV.dev |
| CVE-2026-114572 | 2026-10-21 | Unscored | drupal/domain_login_restrict | This module enables you to restrict user logins on a multi-domain site built with the Domain module, so that users... | OSV.dev |
| CVE-2026-107256 | 2026-10-21 | Unscored | drupal/shield | The Shield module enables you to protect a site behind an HTTP basic authentication prompt, so that an unfinished or... | OSV.dev |
| CVE-2026-114548 | 2026-10-21 | Unscored | drupal/imageapi_optimize_webp | This module enables you to generate and serve WebP derivatives of image style images, overriding Drupal core's image... | OSV.dev |
| CVE-2026-114546 | 2026-10-21 | Unscored | drupal/media_alias_display | This module allows for direct viewing of a file with the URL alias. In some cases, files may be served with the... | OSV.dev |
| CVE-2026-114545 | 2026-10-21 | Unscored | drupal/fullcalendar_view | This module provides a View plugin that integrates a calendar view format powered by FullCalendar JavaScript... | OSV.dev |
| CVE-2026-114544 | 2026-10-21 | Unscored | drupal/media_bulk_upload | This module enables users to upload files and create media items in bulk. The module doesn't sufficiently check... | OSV.dev |
| CVE-2026-114542 | 2026-10-21 | Unscored | drupal/simple_oauth | This module introduces an OAuth 2.0 authorization server, which can be configured to protect your Drupal instance... | OSV.dev |
| CVE-2026-114553 | 2026-10-21 | Unscored | drupal/frontend_editing | This module enables editors to edit content, including paragraphs, directly on the rendered page. The module... | OSV.dev |
| CVE-2026-114541 | 2026-10-21 | Unscored | drupal/frontend_editing | This module enables editors to edit content, including paragraphs, directly on the rendered page. The module... | OSV.dev |
| CVE-2026-114543 | 2026-10-21 | Unscored | drupal/simple_user_management | This module lets non-administrators approve, deactivate and delete users, limited by the roles they can delegate... | OSV.dev |
| CVE-2026-114538 | 2026-10-21 | Unscored | drupal/bootstrap | Provides the Bootstrap front-end framework as a Drupal theme. Bootstrap theme did not sufficiently filter certain... | OSV.dev |
| CVE-2026-114537 | 2026-10-21 | Unscored | drupal/view_unpublished | This module allows granting access to unpublished nodes per content type. For nodes with at least one unpublished... | OSV.dev |
| CVE-2026-114536 | 2026-10-21 | Unscored | drupal/uswds_paragraph_components | This module provides a suite of Paragraphs bundles that works within the USWDS framework. The module's twig... | OSV.dev |
| CVE-2026-114535 | 2026-10-21 | Unscored | drupal/swiper_formatter | Swiper is mobile first, layout and gestures wise, it provides great amount of options for designing your own widget... | OSV.dev |
| CVE-2026-114534 | 2026-10-21 | Unscored | drupal/block_attributes | This module allows you to define custom attributes for a block. You can specify an attribute name to be added to the... | OSV.dev |
| CVE-2026-114533 | 2026-10-21 | Unscored | drupal/agora_theme | This theme provides a front-end design for transparency and open-government sites, including a table preview of CSV... | OSV.dev |
| CVE-2026-114532 | 2026-10-21 | Unscored | drupal/ui_icons | This module provides a user interface to select and configure icons, including a CKEditor 5 button and widget that... | OSV.dev |
| CVE-2026-107260 | 2026-10-21 | Unscored | drupal/sector | Sector is a distribution targeted towards Drupal site builders and site owners who are looking for a fully... | OSV.dev |
| CVE-2026-114531 | 2026-10-21 | Unscored | drupal/swiper_formatter | The module provides integration with third party JS library SwiperJs. User-entered text is used as part of the... | OSV.dev |
| CVE-2026-114530 | 2026-10-21 | Unscored | drupal/dopup | The Dopup module provides functionality for selecting and working with Webforms. The module does not perform... | OSV.dev |
| CVE-2026-114529 | 2026-10-21 | Unscored | drupal/csv_field | This module enables you to upload CSV files to a field and display them as an interactive, sortable and searchable... | OSV.dev |
| CVE-2026-114524 | 2026-10-21 | Unscored | drupal/custom_formatters | The Custom Formatters module allows users to easily create custom Field Formatters through an admin UI without... | OSV.dev |
| CVE-2026-114525 | 2026-10-21 | Unscored | drupal/abc | The ABC theme provides configurable layouts and visual styling for Drupal websites, including support for Font... | OSV.dev |
| CVE-2026-114526 | 2026-10-21 | Unscored | drupal/black_hole | The Black Hole theme provides configurable layouts and visual styling for Drupal websites, including support for... | OSV.dev |
| CVE-2026-114528 | 2026-10-21 | Unscored | drupal/zeropoint | The ZeroPoint theme provides configurable layouts and visual styling for Drupal websites, including support for Font... | OSV.dev |
| CVE-2026-114527 | 2026-10-21 | Unscored | drupal/ui_icons | This module provides a user interface to select and configure icons, including a form element, a text format filter... | OSV.dev |
| CVE-2026-114523 | 2026-10-21 | Unscored | drupal/ffmpeg_image_toolkit | This module enables you to use ffmpeg for image conversion The module doesn't sufficiently sanitize file names... | OSV.dev |
| CVE-2026-112899 | 2026-10-20 | Medium 6.9 | Pillow | Pillow: EPS load(scale) lets Ghostscript render past the decompression bomb limit | GitHub advisory |
| CVE-2026-111753 | 2026-10-20 | Medium 5.9 | @angular/common | @angular/common: XSRF Token Leakage via URL Parsing Discrepancy in Angular HTTP Client (Incomplete fix for CVE-2025-66035) | GitHub advisory |
| CVE-2026-111770 | 2026-10-20 | High 7.7 | @modelcontextprotocol/server | MCP TypeScript server SDK: Shared transport or server instances delivered one HTTP client's messages to another | GitHub advisory |
| CVE-2026-111768 | 2026-10-20 | High 7.5 | @modelcontextprotocol/sdk | MCP TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validation | GitHub advisory |
| CVE-2026-111771 | 2026-10-20 | Medium 6.8 | @modelcontextprotocol/sdk | MCP TypeScript SDK: Server bearer authentication accepted tokens issued for another service | GitHub advisory |
| CVE-2026-111769 | 2026-10-20 | Medium 6.5 | @modelcontextprotocol/sdk | MCP TypeScript client SDK: HTTP client transports and OAuth requests followed cross-origin redirects and re-sent... | GitHub advisory |
| CVE-2026-111751 | 2026-10-20 | High 8.2 | @angular/router | @angular/router: Denial of Service via RouterLink Query Parameter Retention in Server-Side Rendering (SSR) | GitHub advisory |
| CVE-2026-111752 | 2026-10-20 | High 8.2 | @angular/router | @angular/router: Denial of Service via Unmatched Empty-Path Outlet Route Matching in Server-Side Rendering (SSR) | GitHub advisory |
| CVE-2026-111754 | 2026-10-20 | Medium 5.1 | @angular/platform-server | @angular/platform-server: Open Redirect via Protocol-Relative URLs in Server-Side Rendering (SSR) | GitHub advisory |
| CVE-2026-61845 | 2026-10-20 | High 8.9 | crass | Crass : Large numeric exponents cause CPU and memory denial of service | GitHub advisory |
| CVE-2026-111062 | 2026-10-19 | Low 2.3 | russh | A russh SSH server accepts a publickey authentication whose signature uses a different algorithm than the one named... | GitHub advisory |
| CVE-2026-76894 | 2026-10-16 | Low 3.1 | @aborruso/ckan-mcp-server | ckan-mcp-server: DataStore Table UI resource does not validate postMessage origin (in) and posts to targetOrigin "*" (out) | GitHub advisory |
| CVE-2026-68549 | 2026-10-16 | Low 3.3 | ClickMigrate | ClickMigrate has Path Traversal in "revision -m" argument | GitHub advisory |
| CVE-2026-93536 | 2026-10-16 | Medium 4.4 | ZDI-26-780: X.Org Server GestureBuildSprite Use-After-Free Information Disclosure Vulnerability | ZDI | |
| CVE-2026-77622 | 2026-10-15 | High 8.2 | github.com/BishopFox/sliver | Sliver: Unauthenticated Memory Exhaustion Denial of Service in Sliver HTTP(S) Listener PNG Decoder | GitHub advisory OSV.dev |
| CVE-2026-62268 | 2026-10-15 | Medium 5.3 | borgbackup | borg extract might modify out-of-tree files when extracting maliciously crafted archives | GitHub advisory |
| CVE-2026-64672 | 2026-10-15 | Medium 4.4 | github.com/gruntwork-io/terragrunt | Terragrunt catalog predictable temp symlink clobber | GitHub advisory OSV.dev |
| CVE-2026-93524 | 2026-10-15 | Medium 6.1 | ZDI-26-769: X.Org Server XKB XkbSetMap Request Out-Of-Bounds Read Information Disclosure Vulnerability | ZDI |
Machine-readable: /api/upcoming · /api/upcoming/reported