CVE-2026-87954

Missing Authorization vulnerability in Drupal Taxonomy Term Glossary allows Forceful Browsing. This issue affects Taxonomy Term Glossary versions: from 0.0.0 to 4.6.0...

CVE-2026-87954

The Drupal Taxonomy Term Glossary module (versions 0.0.0 to 4.6.0 ) contains a Missing Authorization vulnerability (CWE-862) that allows Forceful Browsing . The root cause is that the module fails to sufficiently check access permissions for taxonomy terms. Consequently, anonymous users can acces...

CVE-2026-87954 Taxonomy Term Glossary - Critical - Access bypass - SA-CONTRIB-2026-152

Missing Authorization vulnerability in Drupal Taxonomy Term Glossary allows Forceful Browsing. This issue affects Taxonomy Term Glossary versions: from 0.0.0 to 4.6.0...

EUVD-2026-107847

Missing Authorization vulnerability in Drupal Taxonomy Term Glossary allows Forceful Browsing. This issue affects Taxonomy Term Glossary versions: from 0.0.0 to 4.6.0...

CVE-2026-87954 Taxonomy Term Glossary - Critical - Access bypass - SA-CONTRIB-2026-152

Missing Authorization vulnerability in Drupal Taxonomy Term Glossary allows Forceful Browsing. This issue affects Taxonomy Term Glossary versions: from 0.0.0 to 4.6.0...

Drupal Taxonomy Term Glossary authorization issue vulnerability

In Drupal Taxonomy Term Glossary versions 0.0.0 through 4.6.0, there is an authorization issue vulnerability stemming from a lack of authorization checks; this may lead to forced browsing...

Taxonomy Term Glossary - Critical - Access bypass - SA-CONTRIB-2026-152

This module adds automatic highlighting of taxonomy terms in content. The module doesn't sufficiently check access on taxonomy terms. As a result, anonymous users can view any of the site's taxonomy terms at the module's JSON endpoint, including taxonomy terms that are unpublished or otherwise...

CVE-2026-86116

Metabase versions before 0.63.1 fail to enforce data analyst permission checks on glossary API endpoints, allowing any authenticated user to create, modify, and delete glossary entries. Attackers can submit requests to POST, PUT, and DELETE glossary endpoints to tamper with instance-wide business...

CVE-2026-86116

Metabase versions before 0.63.1 fail to enforce data analyst permission checks on the glossary management API endpoints. Any authenticated user can send POST, PUT, or DELETE requests to create, modify, or delete glossary entries, allowing tampering with instance-wide business glossary data withou...

EUVD-2026-71948

Metabase versions before 0.63.1 fail to enforce data analyst permission checks on glossary API endpoints, allowing any authenticated user to create, modify, and delete glossary entries. Attackers can submit requests to POST, PUT, and DELETE glossary endpoints to tamper with instance-wide business...

CVE-2026-86116

Metabase versions before 0.63.1 fail to enforce data analyst permission checks on glossary API endpoints, allowing any authenticated user to create, modify, and delete glossary entries. Attackers can submit requests to POST, PUT, and DELETE glossary endpoints to tamper with instance-wide business...

CVE-2026-86116 Metabase before 0.63.1 Missing Function-Level Authorization on the Glossary Management API

Metabase versions before 0.63.1 fail to enforce data analyst permission checks on glossary API endpoints, allowing any authenticated user to create, modify, and delete glossary entries. Attackers can submit requests to POST, PUT, and DELETE glossary endpoints to tamper with instance-wide business...

CVE-2026-86116 Metabase before 0.63.1 Missing Function-Level Authorization on the Glossary Management API

Metabase versions before 0.63.1 fail to enforce data analyst permission checks on glossary API endpoints, allowing any authenticated user to create, modify, and delete glossary entries. Attackers can submit requests to POST, PUT, and DELETE glossary endpoints to tamper with instance-wide business...

CVE-2026-86116 Metabase before 0.63.1 Missing Function-Level Authorization on the Glossary Management API

Metabase versions before 0.63.1 fail to enforce data analyst permission checks on glossary API endpoints, allowing any authenticated user to create, modify, and delete glossary entries. Attackers can submit requests to POST, PUT, and DELETE glossary endpoints to tamper with instance-wide business...

CVE-2026-86116: Missing Authorization

Metabase versions before 0.63.1 fail to enforce data analyst permission checks on glossary API endpoints, allowing any authenticated user to create, modify, and delete glossary entries. Attackers can submit requests to POST, PUT, and DELETE glossary endpoints to tamper with instance-wide business...

PT-2026-86387

Metabase versions before 0.63.1 fail to enforce data analyst permission checks on glossary API endpoints, allowing any authenticated user to create, modify, and delete glossary entries. Attackers can submit requests to POST, PUT, and DELETE glossary endpoints to tamper with instance-wide business...

Malware in pfp-forms-independent-sme-glossary-anchor

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious Package

Overview pfp-forms-independent-sme-glossary-anchor is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that...

SQL Injection

Overview thorsten/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to SQL Injection in the glossary create and update endpoints due to truncating an escaped string before embedding it in a SQL literal. An attacker can acce...

SQL Injection

Overview phpmyfaq/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to SQL Injection in the glossary create and update endpoints due to truncating an escaped string before embedding it in a SQL literal. An attacker can acce...