{"items":[{"id":"CVE-2026-111442","published":"2026-10-16T03:09:43.812Z","updated":"2026-10-21T02:10:42.533Z","title":"Backdrop CMS Core 1.35.x before 1.35.2 and 1.34.x before 1.34.6 does not sufficiently validate uploaded SVG images to ensure they lack potentially dangerous…","severity":"MEDIUM","score":5.3,"vendor":"BackdropCMS","product":"Backdrop","kev":false,"epss":0.00234,"kevAdded":null},{"id":"CVE-2026-110907","published":"2026-10-15T02:09:35.758Z","updated":"2026-10-19T18:42:32.640Z","title":"Backdrop CMS Core 1.35.x before 1.35.2 and 1.34.x before 1.34.6 mishandles tokens. A token is a small placeholder string (like [node:title] or [user:name])…","severity":"HIGH","score":7.5,"vendor":"BackdropCMS","product":"Backdrop","kev":false,"epss":0.00335,"kevAdded":null},{"id":"CVE-2026-107914","published":"2026-10-09T05:18:26.529Z","updated":"2026-10-14T01:42:54.861Z","title":"Backdrop CMS 1.34 before 1.34.5 and 1.35 before 1.35.1 doesn't sufficiently protect configuration exports when delivering a compressed archive. This…","severity":"HIGH","score":7.8,"vendor":"backdropcms","product":"Backdrop","kev":false,"epss":0.0012,"kevAdded":null},{"id":"CVE-2025-71310","published":"2026-05-26T01:06:55.755Z","updated":"2026-05-26T12:29:15.986Z","title":"The GDPR cookies module for Backdrop CMS (before 1.x-1.3.5) doesn't sufficiently protect visitors from Cross Site Scripting (XSS) if a malicious value has been…","severity":"LOW","score":1.8,"vendor":"BackdropCMS","product":"GDPR cookies module for Backdrop CMS","kev":false,"epss":0.00264,"kevAdded":null},{"id":"CVE-2025-46595","published":"2025-04-25T00:00:00.000Z","updated":"2025-04-25T14:28:38.447Z","title":"An XSS issue was discovered in the Flag module before 1.x-3.6.2 for Backdrop CMS. Flag is a module that allows flags to be added to nodes, comments, users, and…","severity":"MEDIUM","score":6.4,"vendor":"backdropcms","product":"Flag","kev":false,"epss":0.00245,"kevAdded":null},{"id":"CVE-2025-27826","published":"2025-03-07T00:00:00.000Z","updated":"2025-03-07T22:29:40.914Z","title":"An XSS issue was discovered in the Bootstrap Lite theme before 1.x-1.4.5 for Backdrop CMS. It doesn't sufficiently sanitize certain class names.","severity":"MEDIUM","score":6.4,"vendor":"backdropcms","product":"Bootstrap Lite theme","kev":false,"epss":0.00236,"kevAdded":null},{"id":"CVE-2025-27825","published":"2025-03-07T00:00:00.000Z","updated":"2025-03-07T22:30:03.942Z","title":"An XSS issue was discovered in the Bootstrap 5 Lite theme before 1.x-1.0.3 for Backdrop CMS. It doesn't sufficiently sanitize certain class names.","severity":"MEDIUM","score":6.4,"vendor":"backdropcms","product":"Bootstrap 5 Lite theme","kev":false,"epss":0.00236,"kevAdded":null},{"id":"CVE-2025-27824","published":"2025-03-07T00:00:00.000Z","updated":"2025-03-07T22:30:26.688Z","title":"An XSS issue was discovered in the Link iframe formatter module before 1.x-1.1.1 for Backdrop CMS. It doesn't sufficiently sanitize input before displaying…","severity":"MEDIUM","score":6.4,"vendor":"backdropcms","product":"Link iframe formatter","kev":false,"epss":0.00236,"kevAdded":null},{"id":"CVE-2025-27823","published":"2025-03-07T00:00:00.000Z","updated":"2025-03-07T22:30:42.387Z","title":"An issue was discovered in the Mail Disguise module before 1.x-1.0.5 for Backdrop CMS. It enables a website to obfuscate email addresses, and should prevent…","severity":"MEDIUM","score":6.4,"vendor":"backdropcms","product":"Mail Disguise","kev":false,"epss":0.00236,"kevAdded":null},{"id":"CVE-2025-27822","published":"2025-03-07T00:00:00.000Z","updated":"2025-03-07T22:29:21.287Z","title":"An issue was discovered in the Masquerade module before 1.x-1.0.1 for Backdrop CMS. It allows people to temporarily switch to another user account. The module…","severity":"HIGH","score":7.5,"vendor":"backdropcms","product":"Masquerade","kev":false,"epss":0.00297,"kevAdded":null},{"id":"CVE-2025-25063","published":"2025-02-03T00:00:00.000Z","updated":"2025-02-12T20:41:38.109Z","title":"An XSS issue was discovered in Backdrop CMS 1.28.x before 1.28.5 and 1.29.x before 1.29.3. It does not sufficiently validate uploaded SVG images to ensure they…","severity":"MEDIUM","score":4.4,"vendor":"backdropcms","product":"backdrop","kev":false,"epss":0.002,"kevAdded":null},{"id":"CVE-2025-25062","published":"2025-02-03T00:00:00.000Z","updated":"2025-05-09T12:03:34.762Z","title":"An XSS issue was discovered in Backdrop CMS 1.28.x before 1.28.5 and 1.29.x before 1.29.3. It doesn't sufficiently isolate long text content when the CKEditor…","severity":"MEDIUM","score":4.4,"vendor":"backdropcms","product":"backdrop","kev":false,"epss":0.01721,"kevAdded":null}]}