14946 matches found
CVE-2026-81201
Drupal Monster Menus (a Drupal contrib module) contains a Stored Cross-site Scripting (XSS) vulnerability. The module does not sufficiently sanitize HTML code in the page name when rendered in its built-in tree browser, allowing an attacker to execute arbitrary JavaScript in the context of a user...
EUVD-2026-69997
Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Monster Menus allows Stored XSS. This issue affects Monster Menus versions: from 0.0.0 to 9.5.3...
CVE-2026-81160 Slick Carousel - Moderately critical - Cross Site Scripting - SA-CONTRIB-2026-117
Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Slick Carousel allows Stored XSS. This issue affects Slick Carousel versions: from 0.0.0 to 2.1.0...
EUVD-2026-69996
Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Slick Carousel allows Stored XSS. This issue affects Slick Carousel versions: from 0.0.0 to 2.1.0...
CVE-2026-81160
The Drupal Slick Carousel module (versions 0.0.0 through 2.1.0) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the Slick UI sub-module's failure to sufficiently validate user input within Slick option sets that contain HTML for carousel buttons. An attacker could exploit t...
CVE-2026-81160 Slick Carousel - Moderately critical - Cross Site Scripting - SA-CONTRIB-2026-117
Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Slick Carousel allows Stored XSS. This issue affects Slick Carousel versions: from 0.0.0 to 2.1.0...
CVE-2026-73475: Incorrect Authorization
Incorrect Authorization vulnerability in Drupal Commerce PayPal allows Forceful Browsing. This issue affects Commerce PayPal versions: from 0.0.0 to 1.12.0, from 2.0.0 to 2.1.3...
CVE-2026-81167: Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Address Suggestion allows Cross-Site Scripting XSS. This issue affects Address Suggestion versions: from 0.0.0 to 1.0.25...
CVE-2026-81161: Privilege Defined With Unsafe Actions
Privilege Defined With Unsafe Actions vulnerability in Drupal Content Moderation Notifications allows Privilege Escalation. This issue affects Content Moderation Notifications versions: from 0.0.0 to 3.9.0...
CVE-2026-18986: Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Entity Browser allows Stored XSS. This issue affects Entity Browser versions: from 0.0.0 to 2.16.0...
CVE-2026-81164: Missing Authorization
Missing Authorization vulnerability in Drupal Entity PDF allows Forceful Browsing. This issue affects Entity PDF versions: from 0.0.0 to 2.1.5...
CVE-2026-73478: Incorrect Authorization
Incorrect Authorization vulnerability in Drupal Diff allows Forceful Browsing. This issue affects Diff versions: from 0.0.0 to 2.0.1, from 2.1.0 to 2.1.1...
CVE-2026-81165: Incorrect Authorization
Incorrect Authorization vulnerability in Drupal Blazy allows Forceful Browsing. This issue affects Blazy versions: from 0.0.0 to 3.0.18...
PT-2026-84707
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Disable Login Page allows Functionality Bypass. This issue affects Disable Login Page versions: from 0.0.0 to 1.1.4...
CVE-2026-81162: Insertion of Sensitive Information Into Sent Data
Insertion of Sensitive Information Into Sent Data vulnerability in Drupal DXPR Builder: The Best Editing AI Experience for Drupal allows Forceful Browsing. This issue affects DXPR Builder: The Best Editing AI Experience for Drupal versions: from 0.0.0 to 2.8.1...
CVE-2026-81159: Observable Timing Discrepancy
Observable Timing Discrepancy vulnerability in Drupal Commerce CyberSource allows Brute Force. This issue affects Commerce CyberSource versions: from 0.0.0 to 1.10.0...
CVE-2026-76782: Improper Neutralization of Input During Web Page Generation
Vulnerability in Drupal Screenshot. This issue affects Screenshot versions:...
CVE-2026-81205: Improper Neutralization of Special Elements used in an LDAP Query
Improper Neutralization of Special Elements used in an LDAP Query 'LDAP Injection' vulnerability in Drupal LDAP / Active Directory Integration allows LDAP Injection. This issue affects LDAP / Active Directory Integration versions: from 0.0.0 to 2.2.1...
CVE-2026-81166: Missing Authorization
Missing Authorization vulnerability in Drupal Digital Signage Framework allows Forceful Browsing. This issue affects Digital Signage Framework versions: from 0.0.0 to 2.6.1...