EUVD-2026-66197

Incorrect Authorization vulnerability in Drupal Edit in-place field allows Forceful Browsing. This issue affects Edit in-place field versions: from 0.0.0 to 2.1.1...

EUVD-2026-66199

Vulnerability in Drupal Disable Login Page. This issue affects Disable Login Page versions:...

EUVD-2026-66198

Vulnerability in Drupal Powerful Surveys. This issue affects Powerful Surveys versions:...

EUVD-2026-66183

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Drupal core allows Stored XSS. This issue affects Drupal core versions: from 0.0.0 to 10.6.13, from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, from 0.0.0 to 11.0., from 0.0.0 to 11.1., from...

EUVD-2026-66200

Observable Timing Discrepancy vulnerability in Drupal Token Content Access allows Brute Force. This issue affects Token Content Access versions: from 0.0.0 to 3.1.2...

EUVD-2026-66181

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Internationalization Single Sign-On allows Authentication Bypass. This issue affects Internationalization Single Sign-On versions: from 0.0.0 to 1.8.0...

EUVD-2026-66208

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Search API Autocomplete allows Reflected XSS. This issue affects Search API Autocomplete versions: from 0.0.0 to 1.12.0...

EUVD-2026-66202

Missing Authorization vulnerability in Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery allows Forceful Browsing. This issue affects PhotoSwipe - Responsive JavaScript Modal Image Gallery versions: from 0.0.0 to 3.2.0...

EUVD-2026-66182

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Media Folders allows Stored XSS. This issue affects Media Folders versions: from 0.0.0 to 1.0.8...

EUVD-2026-66203

Incorrect Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. This issue affects Webform REST versions: from 0.0.0 to 4.1.0...

EUVD-2026-66184

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Drupal core allows Cross-Site Scripting XSS. This issue affects Drupal core versions: from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, from 0.0.0 to 11.2...

EUVD-2026-66185

Missing Authorization vulnerability in Drupal Drupal core allows Forceful Browsing. This issue affects Drupal core versions: from 0.0.0 to 10.6.13, from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, from 0.0.0 to 11.0., from 0.0.0 to 11.1., from 0.0.0 to 11.2...

EUVD-2026-66206

Vulnerability in Drupal Commerce Elavon. This issue affects Commerce Elavon versions:...

EUVD-2026-66204

Vulnerability in Drupal Lunr exposed filters. This issue affects Lunr exposed filters versions:...

EUVD-2026-66207

Vulnerability in Drupal PanKM. This issue affects PanKM versions:...

EUVD-2026-66205

Vulnerability in Drupal Email Login OTP. This issue affects Email Login OTP versions:...

EUVD-2026-66201

Vulnerability in Drupal Development Environment. This issue affects Development Environment versions:...

PT-2026-82363

Name of the Vulnerable Software and Affected Versions Drupal Commerce CyberSource versions 0.0.0 through 1.10.0 Description An observable timing discrepancy in the Secure Acceptance Hosted Checkout gateway integration allows for brute force attacks. The module fails to correctly verify the...

PT-2026-82368

Name of the Vulnerable Software and Affected Versions Drupal Blazy versions 0.0.0 through 3.0.18 Description An incorrect authorization issue allows forceful browsing. The module enables users to display a field of a target entity using a Blazy Filter plugin shortcode. Because the module does not...

Blazy - Less critical - Access bypass - SA-CONTRIB-2026-104

This module enables users to display a field of a target entity through a Blazy Filter plugin shortcode. The module does not consistently check entity view access. If a user has access to a Blazy-enabled text format, this allows them to render a field from an entity they are not permitted to view...