CVE-2026-110907

HighCVSS 7.5/10Last modified Oct 19, 2026

Description

Backdrop CMS Core 1.35.x before 1.35.2 and 1.34.x before 1.34.6 mishandles tokens. A token is a small placeholder string (like [node:title] or [user:name]) used to automatically insert dynamic data into text. A browser is provided for selecting tokens by type. The product doesn't sufficiently limit access to the types of tokens that are available in the token browser. The names of the individual tokens are adequately protected.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-669

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Oct 15, 2026
Last modified
Oct 19, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-1109088.8Netgate pfSense FRR package (pfSense-pkg-frr) 2.0.2_1 and source revision 2.1.2_1 contain an OS command injection vulnerability in the FRR sCVE-2026-1109095.0Wheels CLI through 4.1.0 does not verify that the local development server answering its HTTP requests belongs to the current project. A proCVE-2026-110918.8Inappropriate implementation in Dawn in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform out of bounds CVE-2026-1109119.8Wheels 1.1.8 through 4.1.1 allows SQL injection when caller-supplied quoted values are parsed again as SQL by dynamic finders (such as findOCVE-2026-1109127.1In DragonFly BSD through 6.4.2 before 4bb22ff, the ARP input handlers arpintr() and in_arpinput() (sys/netinet/if_ether.c) do not validate tCVE-2026-1109138.8Memory corruption in DOM in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via CVE-2026-1109148.8Memory corruption in Workers in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to potentially execute arbitrary code inside CVE-2026-1109158.8Use after free in Compositing in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandboxCVE-2026-1109169.6Improper input validation in Desktop in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to potentially execute arbitrary codeCVE-2026-1109174.3Memory corruption in SVG in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to read memory via a crafted HTML page. (ChromiumCVE-2026-1109184.3Memory corruption in Core in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to read memory via a crafted HTML page. (ChromiuCVE-2026-1109198.8Use after free in V8 in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a cr