CVE-2026-107263 Gutenberg - Moderately critical - Access bypass - SA-CONTRIB-2026-202

Incorrect Authorization vulnerability in Drupal Gutenberg allows Forceful Browsing. This issue affects Gutenberg versions: from 0.0.0 to 2.15.0, from 3.0.0 to 3.0.7...

EUVD-2026-113573

Incorrect Authorization vulnerability in Drupal Gutenberg allows Forceful Browsing. This issue affects Gutenberg versions: from 0.0.0 to 2.15.0, from 3.0.0 to 3.0.7...

CVE-2026-107263

The Drupal Gutenberg module is vulnerable to an Incorrect Authorization issue, allowing Forceful Browsing . The root cause is that the module fails to sufficiently check entity access across several editor endpoints. This vulnerability affects Gutenberg versions 0.0.0 to 2.15.0 and 3.0.0 to 3.0.7...

EUVD-2026-113570

Missing Authorization vulnerability in Drupal Views Share allows Forceful Browsing. This issue affects Views Share versions: from 0.0.0 to 2.0.1...

CVE-2026-107266

The Drupal Views Share module (versions 0.0.0 to 2.0.1 ) is vulnerable to a missing authorization issue that allows forceful browsing . Because the module fails to sufficiently block access to view displays, an attacker who knows the specific view and display IDs can execute resource-intensive vi...

EUVD-2026-113569

Missing Authorization vulnerability in Drupal Xray Audit allows Forceful Browsing. This issue affects Xray Audit versions: from 0.0.0 to 1.6.3, from 2.0.0 to 2.0.4, from 3.0.0 to 3.1.1...

CVE-2026-96389 Xray Audit - Moderately critical - Access bypass - SA-CONTRIB-2026-206

Missing Authorization vulnerability in Drupal Xray Audit allows Forceful Browsing. This issue affects Xray Audit versions: from 0.0.0 to 1.6.3, from 2.0.0 to 2.0.4, from 3.0.0 to 3.1.1...

CVE-2026-96389

The Drupal Xray Audit module is vulnerable to an access bypass issue due to missing authorization checks. Specifically, the module fails to sufficiently verify entity access when rendering an entity via the display-mode example route . This flaw allows an attacker to perform Forceful Browsing to ...

CVE-2026-96389 Xray Audit - Moderately critical - Access bypass - SA-CONTRIB-2026-206

Missing Authorization vulnerability in Drupal Xray Audit allows Forceful Browsing. This issue affects Xray Audit versions: from 0.0.0 to 1.6.3, from 2.0.0 to 2.0.4, from 3.0.0 to 3.1.1...

EUVD-2026-113568

Insertion of Sensitive Information Into Sent Data vulnerability in Drupal Two Factor Authentication - TFA / Passwordless Login allows Forceful Browsing. This issue affects Two Factor Authentication - TFA / Passwordless Login versions: from 0.0.0 to 5.4.1, from 5.5.0 to 5.5.2...

CVE-2026-107268

The Two Factor Authentication - TFA / Passwordless Login module for Drupal (versions 0.0.0 to 5.4.1 and 5.5.0 to 5.5.2) is vulnerable to an information disclosure flaw via its headless login endpoint. The root cause is an insertion of sensitive information into sent data where the module returns ...

CVE-2026-107268 Two Factor Authentication - TFA / Passwordless Login - Moderately critical - Information disclosure - SA-CONTRIB-2026-207

Insertion of Sensitive Information Into Sent Data vulnerability in Drupal Two Factor Authentication - TFA / Passwordless Login allows Forceful Browsing. This issue affects Two Factor Authentication - TFA / Passwordless Login versions: from 0.0.0 to 5.4.1, from 5.5.0 to 5.5.2...

CVE-2026-107268 Two Factor Authentication - TFA / Passwordless Login - Moderately critical - Information disclosure - SA-CONTRIB-2026-207

Insertion of Sensitive Information Into Sent Data vulnerability in Drupal Two Factor Authentication - TFA / Passwordless Login allows Forceful Browsing. This issue affects Two Factor Authentication - TFA / Passwordless Login versions: from 0.0.0 to 5.4.1, from 5.5.0 to 5.5.2...

EUVD-2026-113567

Missing Authorization vulnerability in Drupal DKAN allows Forceful Browsing. This issue affects DKAN versions: from 0.0.0 to 4.0.4, from 4.1.0 to 4.1.5...

CVE-2026-107267

The DKAN module for Drupal is vulnerable to a Missing Authorization vulnerability, which allows for Forceful Browsing . The issue arises because the module fails to correctly check access for all of its endpoints when exposing tabular data via a JSON API . This affects DKAN versions 0.0.0 to 4.0....

CVE-2026-107267 DKAN - Moderately critical - Access bypass - SA-CONTRIB-2026-208

Missing Authorization vulnerability in Drupal DKAN allows Forceful Browsing. This issue affects DKAN versions: from 0.0.0 to 4.0.4, from 4.1.0 to 4.1.5...

CVE-2026-107267 DKAN - Moderately critical - Access bypass - SA-CONTRIB-2026-208

Missing Authorization vulnerability in Drupal DKAN allows Forceful Browsing. This issue affects DKAN versions: from 0.0.0 to 4.0.4, from 4.1.0 to 4.1.5...

EUVD-2026-113565

Incorrect Authorization vulnerability in Drupal SmartLinker AI allows Forceful Browsing. This issue affects SmartLinker AI versions: from 0.0.0 to 1.0.3...

CVE-2026-107307

Drupal SmartLinker AI (versions 0.0.0 to 1.0.3) is vulnerable to an Incorrect Authorization issue (CWE-863) that enables Forceful Browsing . The root cause is that the module's search query, used by the "Generate internal links" action in the AI CKEditor toolbar, fails to respect entity access wh...

CVE-2026-107307 SmartLinker AI - Moderately critical - Information disclosure - SA-CONTRIB-2026-210

Incorrect Authorization vulnerability in Drupal SmartLinker AI allows Forceful Browsing. This issue affects SmartLinker AI versions: from 0.0.0 to 1.0.3...