528 matches found
CVE-2026-73478
An Incorrect Authorization vulnerability in the Drupal Diff module allows forceful browsing of non-node entity revision diffs. The module does not sufficiently restrict access to these diffs, meaning an attacker who holds a role with permission to view the entity can access revision differences t...
CVE-2026-76756
CVE-2026-76756 affects the Drupal Gammu SMS Daemon module across all versions. The Drupal security team has marked the project as unsupported , with the security flaw remaining unaddressed by the maintainer . The CVSS 3.1 score is 5.9 (Medium) , with high confidentiality and integrity impact but ...
CVE-2026-81167 Address Suggestion - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-103
Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Address Suggestion allows Cross-Site Scripting XSS. This issue affects Address Suggestion versions: from 0.0.0 to 1.0.25...
CVE-2026-81162 DXPR Builder: The AI Visual Page Builder for Drupal - Moderately critical - Information Disclosure - SA-CONTRIB-2026-112
Insertion of Sensitive Information Into Sent Data vulnerability in Drupal DXPR Builder: The Best Editing AI Experience for Drupal allows Forceful Browsing. This issue affects DXPR Builder: The Best Editing AI Experience for Drupal versions: from 0.0.0 to 2.8.1...
CVE-2026-81164
CVE-2026-81164 is a Missing Authorization vulnerability in the Drupal Entity PDF module (versions 0.0.0 through 2.1.5 ). The module fails to check entity view access when fetching a PDF route, enabling forceful browsing : an authenticated user may access a PDF of an entity they are not authorized...
CVE-2026-81164 Entity PDF - Moderately critical - Access bypass - SA-CONTRIB-2026-114
Missing Authorization vulnerability in Drupal Entity PDF allows Forceful Browsing. This issue affects Entity PDF versions: from 0.0.0 to 2.1.5...
CVE-2026-81201 Monster Menus - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-116
Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Monster Menus allows Stored XSS. This issue affects Monster Menus versions: from 0.0.0 to 9.5.3...
DRUPAL-CONTRIB-2026-113
The Entity API module extends the Drupal core entity API to provide a unified way to deal with entities and their properties. The module doesn't correctly apply access controls for JSON:API entity collection endpoints. This exposes an information disclosure vulnerability. This vulnerability is...
DRUPAL-CONTRIB-2026-104
This module enables users to display a field of a target entity through a Blazy Filter plugin shortcode. The module does not consistently check entity view access. If a user has access to a Blazy-enabled text format, this allows them to render a field from an entity they are not permitted to view...
Disable Login Page - Moderately critical - Access bypass - SA-CONTRIB-2026-111
This module enables you to disable access to the /user/login form unless a secret key is provided. The module does not invalidate the relevant caches when login page access restrictions are enabled. As a result, previously cached login page responses may remain accessible until caches are cleared...
CAPTCHA Protected Page - Moderately critical - Cookie Forgery - SA-CONTRIB-2026-105
This module enables site administrators to require CAPTCHA confirmation on specific pages. The module does not sufficiently validate its CAPTCHA verification cookies. Under certain circumstances, an unauthenticated user or automated bot can forge the cookie and bypass CAPTCHA verification entirel...
Entity PDF - Moderately critical - Access bypass - SA-CONTRIB-2026-114
The Entity PDF module can create a PDF from any entity based on any View mode. This module does not check entity view access when fetching a PDF route. This could result in a user accessing a PDF of an entity that they should not be able to view...
Monster Menus - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-116
This module enables you to create one or more multisites with highly granular page permissions. The module doesn't sufficiently sanitize HTML code contained in the page name when displayed in the built-in tree browser. This results in a cross-site scripting vulnerability that may allow attackers ...
Blazy - Less critical - Access bypass - SA-CONTRIB-2026-104
This module enables users to display a field of a target entity through a Blazy Filter plugin shortcode. The module does not consistently check entity view access. If a user has access to a Blazy-enabled text format, this allows them to render a field from an entity they are not permitted to view...
CVE-2026-18261
Vulnerability in Drupal Powerful Surveys. This issue affects Powerful Surveys versions:...
CVE-2026-16639
CVE-2026-16639 is a critical authentication bypass in the Drupal Internationalization Single Sign-On module (versions 0.0.0 through 1.8.0). The module, used in multilingual websites with separate domain names per language, fails to sufficiently validate a short-lived token , allowing an attacker ...
CVE-2026-16641 Commerce Elavon - Critical - Unsupported - SA-CONTRIB-2026-084
Vulnerability in Drupal Commerce Elavon. This issue affects Commerce Elavon versions:...
CVE-2026-16641
CVE-2026-16641 affects the Drupal Commerce Elavon contrib module, with all versions (. ) impacted. The project has been marked unsupported by the Drupal security team, and the known security issue remains unaddressed by the maintainer . No specific root cause or fixed version is provided in the a...
CVE-2026-16642
Drupal Email Login OTP (a Drupal contrib module) has a critical-severity security issue affecting all versions (. ). The Drupal security team has marked the project unsupported , meaning the maintainer has not provided a fix. The CNA-assigned CVSS 3.1 score is 5.7 (MEDIUM) with a vector requiring...