CVE-2026-11913

CriticalCVSS 9.8/10Last modified Oct 25, 2026

Description

vulnerability in Drupal Mother May I allows . This issue affects Mother May I versions: *.*.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-79

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
DrupalMother May I*.*

References

Timeline

Published
Jul 10, 2026
Last modified
Oct 25, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-1191302.6Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 does not verify that set-path-with-query values in wasmtime-wasi-httCVE-2026-1191315.3Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability in wasmtime-wasi-http that lets guests craCVE-2026-1191324.8Wasmtime from 49.0.0 before 49.0.3 contains a denial-of-service vulnerability that allows a WebAssembly guest to trigger a host panic by traCVE-2026-1191332.6Wasmtime 47.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a memory misalignment flaw in VMContext layout that causes undefined behavioCVE-2026-1191346.2Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 caps component-model resource handle tables only per component instaCVE-2026-1191354.8Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 panics when the host reads a component model stream as a different Rust item type thaCVE-2026-1191364.8Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains insufficient checks in Store when mixing async-style and sync-style WebAssemCVE-2026-1191375.3Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a stack overflow vulnerability that allows guests to crash the host through CVE-2026-1191384.8Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability that allows pending calls to trigger an asCVE-2026-1191394.8Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a leftover assertion in component::Func::call that rejects guest exports usiCVE-2026-119145.9vulnerability in Drupal Composer allows . This issue affects Composer versions: *.*.CVE-2026-1191404.8Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability that allows malicious components to panic
CVE-2026-11913: Critical severity, CVSS 9.8 | Vulnix