Upcoming
Vulnerabilities that other sources know about before their CVE record appears in cvelistV5. Data from the GitHub Advisory Database (CC BY 4.0), OSV.dev sources and the Zero Day Initiative; see sources and licenses.
CVE IDs that a GitHub advisory, an OSV.dev record or a ZDI advisory already names, but that cvelistV5 doesn't contain yet: usually reserved and about to be published. Each badge links to the source's record.
234 CVE IDs · page 2 of 5
| CVE ID | First seen | Severity | Affects | Title | Sources |
|---|---|---|---|---|---|
| CVE-2026-93523 | 2026-10-15 | High 7.8 | ZDI-26-768: X.Org Server XInput ProcXIPassiveUngrabDevice Heap-based Buffer Overflow Privilege Escalation Vulnerability | ZDI | |
| CVE-2026-93522 | 2026-10-15 | High 7.8 | ZDI-26-767: X.Org Server Glamor CopyArea Heap-based Buffer Overflow Privilege Escalation Vulnerability | ZDI | |
| CVE-2026-93521 | 2026-10-15 | High 7.8 | ZDI-26-766: X.Org Server RandR Heap-based Buffer Overflow Privilege Escalation Vulnerability | ZDI | |
| CVE-2026-93520 | 2026-10-15 | High 7.8 | ZDI-26-765: X.Org Server XKB Heap-based Buffer Overflow Privilege Escalation Vulnerability | ZDI | |
| CVE-2026-93519 | 2026-10-15 | High 7.8 | ZDI-26-764: X.Org Server XFixes Pointer Barrier Heap-based Buffer Overflow Privilege Escalation Vulnerability | ZDI | |
| CVE-2026-93518 | 2026-10-15 | High 7.8 | ZDI-26-763: X.Org Server XKB XkbResizeKeyType Numeric Truncation Privilege Escalation Vulnerability | ZDI | |
| CVE-2026-93517 | 2026-10-15 | High 7.8 | ZDI-26-762: X.Org Server GLX RenderLarge Heap-based Buffer Overflow Privilege Escalation Vulnerability | ZDI | |
| CVE-2026-93516 | 2026-10-15 | Medium 5.5 | ZDI-26-761: X.Org Server XInput Passive Grab Use-After-Free Information Disclosure Vulnerability | ZDI | |
| CVE-2026-93515 | 2026-10-15 | Medium 5.5 | ZDI-26-760: X.Org Server Present Extension Use-After-Free Information Disclosure Vulnerability | ZDI | |
| CVE-2026-93325 | 2026-10-15 | High 7.8 | ZDI-26-758: Docker Buildx Filesystem Entitlements Protection Mechanism Failure Remote Code Execution Vulnerability | ZDI | |
| CVE-2026-88812 | 2026-10-15 | High 7.8 | ZDI-26-759: X.Org Server XKB TextDoodad Double Free Privilege Escalation Vulnerability | ZDI | |
| CVE-2026-111185 | 2026-10-15 | High 7.8 | ZDI-26-774: NoMachine Uncontrolled Search Path Element Local Privilege Escalation Vulnerability | ZDI | |
| CVE-2026-107656 | 2026-10-15 | High 7.3 | ZDI-26-771: Fortinet FortiSandbox login_user_profile Hard-Coded Credentials Authentication Bypass Vulnerability | ZDI | |
| CVE-2026-62847 | 2026-10-14 | Medium 6.0 | Metalama.Framework | Metalama allows local code execution through DLL planting in shared temporary directories | GitHub advisory |
| CVE-2026-108099 | 2026-10-14 | Unscored | drupal/entity_list | The Entity List module provides a way to create lists of entities without Views. The module has a remote code... | OSV.dev |
| CVE-2026-108514 | 2026-10-14 | Unscored | drupal/core | The Navigation module doesn't sufficiently sanitize certain attributes, which can lead to a cross-site scripting... | OSV.dev |
| CVE-2026-108515 | 2026-10-14 | Unscored | drupal/core | The Drupal core Link module provides a field type that can be used for internal and external URLs. The module does... | OSV.dev |
| CVE-2026-110738 | 2026-10-14 | Unscored | drupal/gin | Gin is an administration theme that provides a modern, clean, and customizable backend UI for editors and site... | OSV.dev |
| CVE-2026-108097 | 2026-10-14 | Unscored | drupal/core | A remote code execution vulnerability exists within the Field UI module in Drupal core. The vulnerability is not... | OSV.dev |
| CVE-2026-107262 | 2026-10-07 | Unscored | drupal/advanced_filesystem | Advanced File System turns Drupal's file storage into a manageable, observable and maintainable subsystem. The... | OSV.dev |
| CVE-2026-107255 | 2026-10-07 | Unscored | drupal/restrict_route_by_ip | This module enables you to restrict access to routes by IP address. The module doesn't reliably restrict a subset... | OSV.dev |
| CVE-2026-107312 | 2026-10-07 | Unscored | drupal/examples | The Examples for Developers project aims to provide high-quality, well-documented API examples for a broad range of... | OSV.dev |
| CVE-2026-107311 | 2026-10-07 | Unscored | drupal/permissions_by_term | This module enables you to restrict view access to single nodes via taxonomy terms. The module doesn't sufficiently... | OSV.dev |
| CVE-2026-107310 | 2026-10-07 | Unscored | drupal/freelinking | This module enables you to configure a WIKI-like input filter that allows users to create links to site and external... | OSV.dev |
| CVE-2026-107309 | 2026-10-07 | Unscored | drupal/easy_breadcrumb | This module enables you to show a breadcrumb trail for taxonomy term hierarchies. The module doesn't sufficiently... | OSV.dev |
| CVE-2026-107308 | 2026-10-07 | Unscored | drupal/country | The module Country provides a dedicated field type for Drupal core's official country list. The module does not... | OSV.dev |
| CVE-2026-107307 | 2026-10-07 | Unscored | drupal/smartlinker_ai | This module adds a "Generate internal links" action to the AI CKEditor toolbar, letting editors select text and have... | OSV.dev |
| CVE-2026-107306 | 2026-10-07 | Unscored | drupal/menu_link_attributes | This module enables you to add HTML attributes to menu links and their container elements (`<li>`). The module... | OSV.dev |
| CVE-2026-107267 | 2026-10-07 | Unscored | drupal/dkan | The DKAN module enables organizations and individuals to build open data portals in Drupal. The DKAN datastore... | OSV.dev |
| CVE-2026-107268 | 2026-10-07 | Unscored | drupal/miniorange_2fa | This module enables you to add an extra layer of verification for user login flow. The Two Factor Authentication -... | OSV.dev |
| CVE-2026-96389 | 2026-10-07 | Unscored | drupal/xray_audit | This module enables you to audit a Drupal site by generating reports about its content, entities, display modes and... | OSV.dev |
| CVE-2026-107266 | 2026-10-07 | Unscored | drupal/views_share | This module enables you to "share" a view display within another website via an iframe. The module doesn't... | OSV.dev |
| CVE-2026-107265 | 2026-10-07 | Unscored | drupal/leaflet | The Leaflet module provides integration with the Leaflet JS mapping library. Under certain circumstances, when the... | OSV.dev |
| CVE-2026-107264 | 2026-10-07 | Unscored | drupal/inline_formatter_field | The Inline Formatter Field module allows site builders to template and style entities with a field. This module... | OSV.dev |
| CVE-2026-107263 | 2026-10-07 | Unscored | drupal/gutenberg | This module provides a new UI experience for node editing using the Gutenberg Editor library. The module does not... | OSV.dev |
| CVE-2026-107261 | 2026-10-07 | Unscored | drupal/auth_login_plus | This module provides TOTP-based two-factor authentication (2FA) for Drupal, with an optional setting to enforce 2FA... | OSV.dev |
| CVE-2026-107259 | 2026-10-07 | Unscored | drupal/linked_field | This module enables you to link the output of a field to a URL or to the value of another field. The module doesn't... | OSV.dev |
| CVE-2026-107258 | 2026-10-07 | Unscored | drupal/inline_entity_form_dialog | This module renders entity add/edit forms inside an AJAX dialog for use with entity reference fields. This module... | OSV.dev |
| CVE-2026-107257 | 2026-10-07 | Unscored | drupal/actstream | Actstream (short for Activity Stream) aggregates a user's activity from external services (RSS feeds, etc.) into... | OSV.dev |
| CVE-2026-107254 | 2026-10-07 | Unscored | drupal/auth_login_plus | This module provides TOTP-based two-factor authentication (2FA) for Drupal. The module doesn't enforce the second... | OSV.dev |
| CVE-2026-107253 | 2026-10-07 | Unscored | drupal/orphans_media | The Drupal Security Team is marking this project unsupported. There is a known security issue with the project that... | OSV.dev |
| CVE-2026-107252 | 2026-10-07 | Unscored | drupal/mathjax | This module integrates the MathJax library into your Drupal site. MathJax is the modern JavaScript-based LaTeX... | OSV.dev |
| CVE-2026-107251 | 2026-10-07 | Unscored | drupal/entity_reference_manager | Entity Reference Manager is an advanced administrative module for Drupal that allows site administrators to... | OSV.dev |
| CVE-2026-107250 | 2026-10-07 | Unscored | drupal/eca_helper | The Drupal Security Team is marking this project unsupported. There is a known security issue with the project that... | OSV.dev |
| CVE-2026-107249 | 2026-10-07 | Unscored | drupal/block_ajax | The Block AJAX module enables you to load blocks asynchronously via Ajax. The module doesn't sufficiently validate... | OSV.dev |
| CVE-2026-61586 | 2026-10-02 | High 8.2 | eu.copernik:copernik-xml-factory | Copernik XML Factory (stock JDK provider) has Improper restriction of XInclude resource resolution | GitHub advisory |
| CVE-2026-19772 | 2026-09-18 | High 7.8 | ZDI-26-715: Linux Mint Xreader PDF File Parsing Type Confusion Remote Code Execution Vulnerability | ZDI | |
| CVE-2026-56828 | 2026-09-11 | High 8.8 | shopper/framework | Shopper: privilege escalation via improper Livewire admin component authorization | GitHub advisory |
| CVE-2025-71416 | 2026-09-10 | High 7.8 | ZDI-26-652: TrendAI Apex One Security Agent Cache Mechanism Time-Of-Check Time-Of-Use Local Privilege Escalation... | ZDI | |
| CVE-2025-71415 | 2026-09-10 | High 7.8 | ZDI-26-653: TrendAI Apex One Security Agent Cache Mechanism Time-Of-Check Time-Of-Use Local Privilege Escalation... | ZDI |
Machine-readable: /api/upcoming · /api/upcoming/reported