17308 matches found
AI (Artificial Intelligence) - Moderately critical - Cross site scripting - SA-CONTRIB-2026-119
This AI Chatbot module enables you to have a Chatbot using assistants to help you with your Drupal website. The module doesn't sufficiently sanitize for cross site scripting XSS when using the structured results using legacy agent setups. This vulnerability is mitigated by the fact that an attack...
PT-2026-84887
This AI Chatbot module enables you to have a Chatbot using assistants to help you with your Drupal website. The module doesn't sufficiently sanitize for cross site scripting XSS when using the structured results using legacy agent setups. This vulnerability is mitigated by the fact that an attack...
PT-2026-84877
This module enables you to log the emails sent by Mailer Plus as content entities, so they can be reviewed at Reports Mail log. The module doesn't sufficiently redact the content of the emails it logs. Account related emails are stored with their one-time login links intact, so any user who can...
CVE-2026-18986: Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Entity Browser allows Stored XSS. This issue affects Entity Browser versions: from 0.0.0 to 2.16.0...
CVE-2026-81158: Incorrect Authorization
Incorrect Authorization vulnerability in Drupal Entity API allows Forceful Browsing. This issue affects Entity API versions: from 0.0.0 to 1.8.0...
CVE-2026-81159: Observable Timing Discrepancy
Observable Timing Discrepancy vulnerability in Drupal Commerce CyberSource allows Brute Force. This issue affects Commerce CyberSource versions: from 0.0.0 to 1.10.0...
CVE-2026-81160: Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Slick Carousel allows Stored XSS. This issue affects Slick Carousel versions: from 0.0.0 to 2.1.0...
CVE-2026-81269: Missing Authorization
Missing Authorization vulnerability in Drupal Data field allows Forceful Browsing. This issue affects Data field versions: from 0.0.0 to 2.0.13...
CVE-2026-81167: Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Address Suggestion allows Cross-Site Scripting XSS. This issue affects Address Suggestion versions: from 0.0.0 to 1.0.25...
CVE-2026-81168: Authentication Bypass Using an Alternate Path or Channel
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal CAPTCHA Protected Page allows Functionality Bypass. This issue affects CAPTCHA Protected Page versions: from 0.0.0 to 1.0.2...
CVE-2026-81164: Missing Authorization
Missing Authorization vulnerability in Drupal Entity PDF allows Forceful Browsing. This issue affects Entity PDF versions: from 0.0.0 to 2.1.5...
CVE-2026-81162: Insertion of Sensitive Information Into Sent Data
Insertion of Sensitive Information Into Sent Data vulnerability in Drupal DXPR Builder: The Best Editing AI Experience for Drupal allows Forceful Browsing. This issue affects DXPR Builder: The Best Editing AI Experience for Drupal versions: from 0.0.0 to 2.8.1...
CVE-2026-76759: Improper Neutralization of Input During Web Page Generation
Vulnerability in Drupal Screenshot. This issue affects Screenshot versions:...
PT-2026-84707
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Disable Login Page allows Functionality Bypass. This issue affects Disable Login Page versions: from 0.0.0 to 1.1.4...
CVE-2026-81205: Improper Neutralization of Special Elements used in an LDAP Query
Improper Neutralization of Special Elements used in an LDAP Query 'LDAP Injection' vulnerability in Drupal LDAP / Active Directory Integration allows LDAP Injection. This issue affects LDAP / Active Directory Integration versions: from 0.0.0 to 2.2.1...
CVE-2026-81166: Missing Authorization
Missing Authorization vulnerability in Drupal Digital Signage Framework allows Forceful Browsing. This issue affects Digital Signage Framework versions: from 0.0.0 to 2.6.1...
CVE-2026-76758: Improper Input Validation
Vulnerability in Drupal Link content parser. This issue affects Link content parser versions:...
Media Library Importer - Moderately critical - Access bypass - SA-CONTRIB-2026-129
A module to import media files into media library. The import folder is a plain textfield with no validation. Point it at any directory the web user can read, and the importer copies every file whose extension matches a selected media type into the public files directory and publishes it as a Med...
PT-2026-84891
This module enables you use UI Patterns with blocks, for use in Layout Builder. The module doesn't sufficiently validate user input before passing to token replacement. This vulnerability is mitigated by the fact that an attacker must have a role with the ability to edit layout builder layouts...