CVE-2026-11914

MediumCVSS 5.9/10Last modified Oct 25, 2026

Description

vulnerability in Drupal Composer allows . This issue affects Composer versions: *.*.

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-20

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
DrupalComposer*.*

References

Timeline

Published
Jul 10, 2026
Last modified
Oct 25, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-1191404.8Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability that allows malicious components to panic CVE-2026-1191415.3Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability that allows malicious Wasm modules to paniCVE-2026-1191424.8Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability where dropping the Future returned by TypeCVE-2026-1191434.8Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability that allows guest code to trigger a host pCVE-2026-1191448.8Frappe Framework before 15.111.0 and 16.x before 16.21.0 contains a server-side template injection vulnerability because user-controlled mesCVE-2026-1191459.9Frappe before 15.121.0 and 16.x before 16.34.0 contains a path traversal vulnerability because certain file-upload handling does not validatCVE-2026-1191465.6ProFTPD before 1.3.9e and 1.3.10rc5 contains a buffer overflow vulnerability in the mod_rewrite int:utf8trans RewriteMap that allows remote CVE-2026-1191474.3ProFTPD before 1.3.9e and 1.3.10rc5 contains an authorization bypass in the mod_sftp copy-file extension handler that skips Limit WRITE checCVE-2026-1191486.5Incomplete string validation in AWS aws-nitro-enclaves-sdk-c before 0.4.6 may allow a third party to impersonate the AWS KMS endpoint. ToCVE-2026-119155.9vulnerability in Drupal Brute force attack protection allows . This issue affects Brute force attack protection versions: *.*.CVE-2026-1191525.4The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Stored Cross-Site ScrCVE-2026-1191557.5The wpForo Forum plugin for WordPress is vulnerable to time-based SQL Injection via the 'href[locale]' parameter in all versions up to, and
CVE-2026-11914: Medium severity, CVSS 5.9 | Vulnix