CVE-2026-58587 Drupal Canvas - Moderately critical - Improper validation - SA-CONTRIB-2026-065

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Drupal Canvas allows Cross-Site Scripting XSS. This issue affects Drupal Canvas versions: from 0.0.0 to 1.4.2, from 1.5.0 to 1.5.2, from 1.6.0 to 1.6.1, from 1.7.0 to 1.7.1...

CVE-2026-58587

The Drupal Canvas module is vulnerable to a Cross-Site Scripting (XSS) flaw due to improper neutralization of input during web page generation. Specifically, the Canvas AI submodule fails to sufficiently validate image files uploaded via a custom API for use in the AI web chat before writing them...

CVE-2026-58587 Drupal Canvas - Moderately critical - Improper validation - SA-CONTRIB-2026-065

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Drupal Canvas allows Cross-Site Scripting XSS. This issue affects Drupal Canvas versions: from 0.0.0 to 1.4.2, from 1.5.0 to 1.5.2, from 1.6.0 to 1.6.1, from 1.7.0 to 1.7.1...

CVE-2026-13244

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Tealium iQ Tag Management allows Object Injection. This issue affects Tealium iQ Tag Management versions: from 0.0.0 to 2.4.0...

CVE-2026-13244 Tealium iQ Tag Management - Critical - PHP object injection - SA-CONTRIB-2026-064

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Tealium iQ Tag Management allows Object Injection. This issue affects Tealium iQ Tag Management versions: from 0.0.0 to 2.4.0...

CVE-2026-13244 Tealium iQ Tag Management - Critical - PHP object injection - SA-CONTRIB-2026-064

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Tealium iQ Tag Management allows Object Injection. This issue affects Tealium iQ Tag Management versions: from 0.0.0 to 2.4.0...

CVE-2026-13244

The Tealium iQ Tag Management module for Drupal (versions 0.0.0 to 2.4.0 ) is vulnerable to Object Injection due to the Improperly Controlled Modification of Dynamically-Determined Object Attributes . The tealiumiq field stores data as PHP-serialized strings , which allows for the execution of ma...

CVE-2026-13243 Salesforce Suite - Moderately critical - Cross-site request forgery - SA-CONTRIB-2026-063

Cross-Site Request Forgery CSRF vulnerability in Drupal Salesforce Suite allows Cross Site Request Forgery. This issue affects Salesforce Suite versions: from 0.0.0 to 5.1.3...

CVE-2026-13243 Salesforce Suite - Moderately critical - Cross-site request forgery - SA-CONTRIB-2026-063

Cross-Site Request Forgery CSRF vulnerability in Drupal Salesforce Suite allows Cross Site Request Forgery. This issue affects Salesforce Suite versions: from 0.0.0 to 5.1.3...

CVE-2026-13243

The Drupal Salesforce Suite (versions 0.0.0 to 5.1.3) is vulnerable to a Cross-Site Request Forgery (CSRF) issue due to improper validation of the OAuth handshake during interactive authentication. An attacker can exploit this to hijack the authorization token and bind the site to an attacker-con...

CVE-2026-13243

Cross-Site Request Forgery CSRF vulnerability in Drupal Salesforce Suite allows Cross Site Request Forgery. This issue affects Salesforce Suite versions: from 0.0.0 to 5.1.3...

CVE-2026-13243 Salesforce Suite - Moderately critical - Cross-site request forgery - SA-CONTRIB-2026-063

Cross-Site Request Forgery CSRF vulnerability in Drupal Salesforce Suite allows Cross Site Request Forgery. This issue affects Salesforce Suite versions: from 0.0.0 to 5.1.3...

CVE-2026-13242

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Drupal Geolocation Field allows SQL Injection. This issue affects Geolocation Field versions: from 0.0.0 to 3.15.0...

CVE-2026-13242 Geolocation Field - Critical - SQL Injection - SA-CONTRIB-2026-062

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Drupal Geolocation Field allows SQL Injection. This issue affects Geolocation Field versions: from 0.0.0 to 3.15.0...

CVE-2026-13242

The Drupal Geolocation Field module (versions 0.0.0 to 3.15.0 ) is vulnerable to SQL Injection due to improper neutralization of special elements in an SQL command. The root cause is a specific views filter that fails to sufficiently sanitize values when exposed to user input. This vulnerability ...

CVE-2026-13242 Geolocation Field - Critical - SQL Injection - SA-CONTRIB-2026-062

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Drupal Geolocation Field allows SQL Injection. This issue affects Geolocation Field versions: from 0.0.0 to 3.15.0...

CVE-2026-13240 Paragraphs - Less critical - Access bypass - SA-CONTRIB-2026-060

Missing Authorization vulnerability in Drupal Paragraphs allows Forceful Browsing. This issue affects Paragraphs versions: from 0.0.0 to 1.21.0...

CVE-2026-13241 Paragraphs - Moderately critical - Access bypass - SA-CONTRIB-2026-061

Missing Authorization vulnerability in Drupal Paragraphs allows Forceful Browsing. This issue affects Paragraphs versions: from 0.0.0 to 1.21.0...

CVE-2026-13240

The Drupal Paragraphs module (versions 0.0.0 through 1.21.0) contains a missing authorization vulnerability in the optional Paragraphs Library module . The root cause is that the module fails to sufficiently restrict access to unpublished library items when they are displayed in lists. This allow...

CVE-2026-13241

The Drupal Paragraphs module (versions 0.0.0 to 1.21.0 ) is vulnerable to a Missing Authorization issue in its optional Paragraphs Library module. The root cause is that the module fails to sufficiently restrict access to direct child paragraphs of library items through API endpoints , which allo...