CVE-2026-81165

CVE-2026-81165 is an Incorrect Authorization (Access Bypass) vulnerability in the Drupal Blazy module, affecting versions 0.0.0 through 3.0.18 . Blazy enables users to display a field of a target entity through a filter plugin shortcode. The module does not consistently check entity view access, ...

CVE-2026-81168 CAPTCHA Protected Page - Moderately critical - Cookie Forgery - SA-CONTRIB-2026-105

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal CAPTCHA Protected Page allows Functionality Bypass. This issue affects CAPTCHA Protected Page versions: from 0.0.0 to 1.0.2...

CVE-2026-81168

The Drupal CAPTCHA Protected Page module (versions 0.0.0 through 1.0.2 ) is vulnerable to an Authentication Bypass due to an Authentication Bypass Using an Alternate Path or Channel . The root cause is that the module fails to sufficiently validate its CAPTCHA verification cookies , which allows ...

EUVD-2026-70006

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal CAPTCHA Protected Page allows Functionality Bypass. This issue affects CAPTCHA Protected Page versions: from 0.0.0 to 1.0.2...

CVE-2026-81168 CAPTCHA Protected Page - Moderately critical - Cookie Forgery - SA-CONTRIB-2026-105

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal CAPTCHA Protected Page allows Functionality Bypass. This issue affects CAPTCHA Protected Page versions: from 0.0.0 to 1.0.2...

CVE-2026-81159 Commerce CyberSource - Moderately critical - Insufficient input validation - SA-CONTRIB-2026-106

Observable Timing Discrepancy vulnerability in Drupal Commerce CyberSource allows Brute Force. This issue affects Commerce CyberSource versions: from 0.0.0 to 1.10.0...

CVE-2026-81159

An Observable Timing Discrepancy in the Drupal Commerce CyberSource module (versions 0.0.0 through 1.10.0 ) allows brute force attacks. The module fails to correctly verify the integrity of data returned by the CyberSource payment provider, enabling an attacker to use a timing attack to trick the...

EUVD-2026-70005

Observable Timing Discrepancy vulnerability in Drupal Commerce CyberSource allows Brute Force. This issue affects Commerce CyberSource versions: from 0.0.0 to 1.10.0...

CVE-2026-81159 Commerce CyberSource - Moderately critical - Insufficient input validation - SA-CONTRIB-2026-106

Observable Timing Discrepancy vulnerability in Drupal Commerce CyberSource allows Brute Force. This issue affects Commerce CyberSource versions: from 0.0.0 to 1.10.0...

EUVD-2026-70004

Privilege Defined With Unsafe Actions vulnerability in Drupal Content Moderation Notifications allows Privilege Escalation. This issue affects Content Moderation Notifications versions: from 0.0.0 to 3.9.0...

CVE-2026-81161

The Content Moderation Notifications module for Drupal (versions 0.0.0 through 3.9.0 ) is vulnerable to privilege escalation because a permission to configure email templates containing Twig code was not marked as restricted. A site administrator might inadvertently grant this permission to less-...

CVE-2026-81161 Content Moderation Notifications - Moderately critical - Access bypass - SA-CONTRIB-2026-107

Privilege Defined With Unsafe Actions vulnerability in Drupal Content Moderation Notifications allows Privilege Escalation. This issue affects Content Moderation Notifications versions: from 0.0.0 to 3.9.0...

CVE-2026-81269 Data field - Moderately critical - Information disclosure - SA-CONTRIB-2026-108

Missing Authorization vulnerability in Drupal Data field allows Forceful Browsing. This issue affects Data field versions: from 0.0.0 to 2.0.13...

CVE-2026-81269

The Drupal Data field module (versions 0.0.0 to 2.0.13 ) contains a Missing Authorization vulnerability that allows Forceful Browsing . The root cause is that the module fails to sufficiently verify access permissions when returning structured data values through its JSON endpoints . This allows ...

EUVD-2026-70003

Missing Authorization vulnerability in Drupal Data field allows Forceful Browsing. This issue affects Data field versions: from 0.0.0 to 2.0.13...

CVE-2026-81269 Data field - Moderately critical - Information disclosure - SA-CONTRIB-2026-108

Missing Authorization vulnerability in Drupal Data field allows Forceful Browsing. This issue affects Data field versions: from 0.0.0 to 2.0.13...

CVE-2026-81166 Digital Signage Framework - Moderately critical - Access bypass - SA-CONTRIB-2026-109

Missing Authorization vulnerability in Drupal Digital Signage Framework allows Forceful Browsing. This issue affects Digital Signage Framework versions: from 0.0.0 to 2.6.1...

EUVD-2026-70002

Missing Authorization vulnerability in Drupal Digital Signage Framework allows Forceful Browsing. This issue affects Digital Signage Framework versions: from 0.0.0 to 2.6.1...

CVE-2026-81166

Drupal Digital Signage Framework (contrib module) is affected by a missing authorization flaw in a route intended for signage devices to refresh dynamic blocks. The route failed to verify that the requester was an authorized signage device or that the requested block was one the module delivers t...

CVE-2026-81166 Digital Signage Framework - Moderately critical - Access bypass - SA-CONTRIB-2026-109

Missing Authorization vulnerability in Drupal Digital Signage Framework allows Forceful Browsing. This issue affects Digital Signage Framework versions: from 0.0.0 to 2.6.1...