CVE-2026-2349: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal UI Icons allows Cross-Site Scripting XSS.This issue affects UI Icons: from 0.0.0 before 1.0.1, from 1.1.0 before 1.1.1...

Drupal Canvas 安全漏洞

Drupal Canvas is a page builder developed by the Drupal company. Versions of Drupal Canvas prior to 1.1.1 contained security vulnerabilities, which were due to susceptibility to server-side request forgeing attacks...

Drupal Login Disable 安全漏洞

Drupal Login Disable is an extension module for the Drupal content management system designed to restrict or disable user login functionality. Versions of Drupal Login Disable prior to 2.1.3 contained a security vulnerability; this vulnerability stemmed from using alternative paths or channels to...

Drupal UI Icons 安全漏洞

Drupal UI Icons is a content management system module provided by the Drupal company that offers interface icon display and management functions. Versions of Drupal UI Icons prior to 1.0.1 and 1.1.1 contained security vulnerabilities, which were caused by improper input handling and could lead to...

Drupal Material Icons 安全漏洞

Drupal Material Icons is a module provided by the Drupal company that offers interface icon display and management functions. Versions of Drupal Material Icons prior to 2.0.4 contained security vulnerabilities, which were caused by improper authorization and could lead to forced browsing...

CVE-2026-3218: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Responsive Favicons allows Cross-Site Scripting XSS.This issue affects Responsive Favicons: from 0.0.0 before 2.0.2...

Drupal Responsive Favicons 安全漏洞

Drupal Responsive Favicons is an extension for the Drupal content management system that is designed to generate and adapt favicon icons for multiple devices and browsers. Versions of Drupal Responsive Favicons prior to 2.0.2 contained a security vulnerability caused by improper input handling,...

Drupal Islandora 安全漏洞

Drupal Islandora is an extension platform for content management systems developed by the Drupal company, used for digital asset management and digital library construction. Versions of Drupal Islandora prior to 2.17.5 contained a security vulnerability caused by improper input handling, which...

CVE-2026-3211: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Drupal Theme Negotiation by Rules allows Cross Site Request Forgery.This issue affects Theme Negotiation by Rules: from 0.0.0 before 1.2.1...

Drupal SAML SSO 安全漏洞

Drupal SAML SSO is an extension for Drupal-based content management systems that provides SAML-based single-sign-on authentication functionality. Versions of Drupal SAML SSO prior to 3.1.3 contained a security vulnerability, which was caused by improper input handling and could lead to cross-site...

CVE-2026-3213: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Anti-Spam by CleanTalk allows Cross-Site Scripting XSS.This issue affects Anti-Spam by CleanTalk: from 0.0.0 before 9.7.0...

Drupal Theme Negotiation by Rules 安全漏洞

Drupal Theme Negotiation by Rules is a content management system module developed by Drupal that dynamically selects website theme styles based on rules. Versions of Drupal Theme Negotiation by Rules prior to 1.2.1 contained security vulnerabilities, which were caused by susceptibility to...

Drupal Anti-Spam by CleanTalk 安全漏洞

Drupal Anti-Spam by CleanTalk is a security module for content management systems provided by the Drupal company, which offers automatic spam detection and filtering capabilities. Versions of Drupal Anti-Spam by CleanTalk prior to version 9.7.0 contained a security vulnerability caused by imprope...

DRUPAL-CONTRIB-2026-030

This module provides a site administrator the ability to log users out after a specified time of inactivity. The module doesn't sufficiently protect its routes from cross-site request forgery CSRF, allowing the logout route to be triggered without user interaction...

DrupalDreggon2exploit

No d...

DRUPAL-CONTRIB-2026-029

This module creates permissions per node content type to control access to unpublished nodes per content type. The module does not consistently control access for unpublished translated nodes...

DRUPAL-CONTRIB-2026-028

The module and certain submodules AI Automators, AI Translate, AI API Explorer, AI Content Suggestions provide the ability to use an LLM to generate HTML or Markdown and preview it in a browser. Under certain circumstances, rendering of this HTML can lead to exposing secret communications in the...

PT-2026-28635

Name of the Vulnerable Software and Affected Versions Drupal AI versions 0.0.0 through 1.1.10 Drupal AI versions 1.2.0 through 1.2.11 Description An incorrect authorization issue exists in Drupal AI Artificial Intelligence that allows for resource injection. The module and certain submodules AI...

PT-2026-28676

Name of the Vulnerable Software and Affected Versions Drupal versions prior to 1.7.0 Description An incorrect authorization issue exists in Drupal’s Unpublished Node Permissions, allowing forceful browsing. The problem relates to inconsistent access control for unpublished translated nodes. The...

DRUPAL-CONTRIB-2026-027

This module enables you to use an external OpenID Connect login provider to authenticate and log in users on your site. If a user signs in with a login provider for the first time on the website, a new Drupal user will be created. The module doesn't sufficiently validate the uniqueness of certain...