CVE-2026-11915

MediumCVSS 5.9/10Last modified Oct 25, 2026

Description

vulnerability in Drupal Brute force attack protection allows . This issue affects Brute force attack protection versions: *.*.

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-307

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Jul 10, 2026
Last modified
Oct 25, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-1191525.4The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Stored Cross-Site ScrCVE-2026-1191557.5The wpForo Forum plugin for WordPress is vulnerable to time-based SQL Injection via the 'href[locale]' parameter in all versions up to, and CVE-2026-1191567.2The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpdm_reg[first_name], wpdm_reg[last_name], wCVE-2026-1191587.2The Pie Register – User Registration, Profiles & Content Restriction plugin for WordPress is vulnerable to Stored Cross-Site Scripting via tCVE-2026-1191606.4The Smart Post – Post Grid, Post Carousel, Post Slider Gutenberg Blocks for Blog & News plugin for WordPress is vulnerable to Stored Cross-SCVE-2026-1191627.2The User Submitted Posts – Enable Users to Submit Posts from the Front End plugin for WordPress is vulnerable to Stored DOM-Based Cross-SiteCVE-2026-1191637.5The FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce plugin for WordPress is vulnerable to time-based CVE-2026-1191647.5The wpForo Forum plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.2.2 via the `data[secondCVE-2026-1191656.4The WPBakery Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name / nickname' parameter in aCVE-2026-1191665.3The Welcart e-Commerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.12.5 vCVE-2026-1191677.2The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via CVE-2026-1191688.8HashiCorp Nomad and Nomad Enterprise are vulnerable to symlink following during same-client allocation data migration that may allow a malic
CVE-2026-11915: Medium severity, CVSS 5.9 | Vulnix