Entity API - Moderately critical - Information disclosure - SA-CONTRIB-2026-113

The Entity API module extends the Drupal core entity API to provide a unified way to deal with entities and their properties. The module doesn't correctly apply access controls for JSON:API entity collection endpoints. This exposes an information disclosure vulnerability. This vulnerability is...

Monster Menus - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-116

This module enables you to create one or more multisites with highly granular page permissions. The module doesn't sufficiently sanitize HTML code contained in the page name when displayed in the built-in tree browser. This results in a cross-site scripting vulnerability that may allow attackers ...

Entity PDF - Moderately critical - Access bypass - SA-CONTRIB-2026-114

The Entity PDF module can create a PDF from any entity based on any View mode. This module does not check entity view access when fetching a PDF route. This could result in a user accessing a PDF of an entity that they should not be able to view...

Disable Login Page - Moderately critical - Access bypass - SA-CONTRIB-2026-111

This module enables you to disable access to the /user/login form unless a secret key is provided. The module does not invalidate the relevant caches when login page access restrictions are enabled. As a result, previously cached login page responses may remain accessible until caches are cleared...

PT-2026-82366

Name of the Vulnerable Software and Affected Versions DXPR Builder: The Best Editing AI Experience for Drupal versions 0.0.0 through 2.8.1 Description DXPR Builder allows Forceful Browsing due to the insertion of sensitive information into sent data. In the 2.x version, the module does not...

CAPTCHA Protected Page - Moderately critical - Cookie Forgery - SA-CONTRIB-2026-105

This module enables site administrators to require CAPTCHA confirmation on specific pages. The module does not sufficiently validate its CAPTCHA verification cookies. Under certain circumstances, an unauthenticated user or automated bot can forge the cookie and bypass CAPTCHA verification entirel...

PT-2026-82362

Name of the Vulnerable Software and Affected Versions Entity API versions 0.0.0 through 1.8.0 Description An incorrect authorization issue in the Entity API allows forceful browsing. The module fails to correctly apply access controls for JSON:API entity collection endpoints, leading to an...

DXPR Builder: The AI Visual Page Builder for Drupal - Moderately critical - Information Disclosure - SA-CONTRIB-2026-112

The DXPR Builder module provides a visual / AI page builder for Drupal. The module uses a JSON Web Token for licensing, user license management, AI services, and subscription metadata. The 2.x version of the module does not sufficiently restrict access to API credentials in JavaScript settings...

CVE-2026-55805

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Drupal core allows Stored XSS. This issue affects Drupal core versions: from 0.0.0 to 10.6.13, from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, from 0.0.0 to 11.0., from 0.0.0 to 11.1., from...

CVE-2026-16643

Vulnerability in Drupal Lunr exposed filters. This issue affects Lunr exposed filters versions:...

CVE-2026-16644

Incorrect Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. This issue affects Webform REST versions: from 0.0.0 to 4.1.0...

CVE-2026-16646

Vulnerability in Drupal PanKM. This issue affects PanKM versions:...

CVE-2026-18985

Incorrect Authorization vulnerability in Drupal Edit in-place field allows Forceful Browsing. This issue affects Edit in-place field versions: from 0.0.0 to 2.1.1...

CVE-2026-16645

Missing Authorization vulnerability in Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery allows Forceful Browsing. This issue affects PhotoSwipe - Responsive JavaScript Modal Image Gallery versions: from 0.0.0 to 3.2.0...

CVE-2026-18259

Observable Timing Discrepancy vulnerability in Drupal Token Content Access allows Brute Force. This issue affects Token Content Access versions: from 0.0.0 to 3.1.2...

CVE-2026-18260

Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Disable Login Page allows Brute Force. This issue affects Disable Login Page versions: from 0.0.0 to 1.1.4...

CVE-2026-18261

Vulnerability in Drupal Powerful Surveys. This issue affects Powerful Surveys versions:...

CVE-2026-15916

Missing Authorization vulnerability in Drupal Drupal core allows Forceful Browsing. This issue affects Drupal core versions: from 0.0.0 to 10.6.13, from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, from 0.0.0 to 11.0., from 0.0.0 to 11.1., from 0.0.0 to 11.2...

CVE-2026-15917

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Drupal core allows Cross-Site Scripting XSS. This issue affects Drupal core versions: from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, from 0.0.0 to 11.2...

CVE-2026-16640

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Search API Autocomplete allows Reflected XSS. This issue affects Search API Autocomplete versions: from 0.0.0 to 1.12.0...