CVE-2026-84917 Jsonapi Role Access - Critical - Access bypass - SA-CONTRIB-2026-127

Incorrect Authorization vulnerability in Drupal Jsonapi Role Access allows Forceful Browsing. This issue affects Jsonapi Role Access versions: from 0.0.0 to 2.0.2...

CVE-2026-84917 Jsonapi Role Access - Critical - Access bypass - SA-CONTRIB-2026-127

Incorrect Authorization vulnerability in Drupal Jsonapi Role Access allows Forceful Browsing. This issue affects Jsonapi Role Access versions: from 0.0.0 to 2.0.2...

EUVD-2026-107872

Incorrect Authorization vulnerability in Drupal Jsonapi Role Access allows Forceful Browsing. This issue affects Jsonapi Role Access versions: from 0.0.0 to 2.0.2...

CVE-2026-84916

Missing Authorization vulnerability in Drupal Islandora allows Forceful Browsing. This issue affects Islandora versions: from 0.0.0 to 2.19.0...

CVE-2026-84916 Islandora - Moderately critical - Access bypass - SA-CONTRIB-2026-126

Missing Authorization vulnerability in Drupal Islandora allows Forceful Browsing. This issue affects Islandora versions: from 0.0.0 to 2.19.0...

CVE-2026-84917 Jsonapi Role Access - Critical - Access bypass - SA-CONTRIB-2026-127

Incorrect Authorization vulnerability in Drupal Jsonapi Role Access allows Forceful Browsing. This issue affects Jsonapi Role Access versions: from 0.0.0 to 2.0.2...

CVE-2026-84916 Islandora - Moderately critical - Access bypass - SA-CONTRIB-2026-126

Missing Authorization vulnerability in Drupal Islandora allows Forceful Browsing. This issue affects Islandora versions: from 0.0.0 to 2.19.0...

CVE-2026-84916

The Islandora software (versions 0.0.0 through 2.19.0) contains a Missing Authorization vulnerability in the islandora_advanced_search submodule. The issue stems from a failure to sufficiently verify block access when arbitrary block IDs are submitted to a publicly accessible AJAX endpoint . This...

CVE-2026-84920

Incorrect Authorization vulnerability in Drupal Unpublished Node Permissions allows Forceful Browsing. This issue affects Unpublished Node Permissions versions: from 0.0.0 to 1.8.0...

CVE-2026-84921

Missing Authorization vulnerability in Drupal Webform Submissions Delete allows Forceful Browsing. This issue affects Webform Submissions Delete versions: from 0.0.0 to 1.2.0...

CVE-2026-87938

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Drupal CSP log allows SQL Injection. This issue affects CSP log versions: from 0.0.0 to 1.0.2...

CVE-2026-87940 Key auth - Moderately critical - Access bypass - SA-CONTRIB-2026-138

Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Key auth allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Key auth versions: from 0.0.0 to 2.2.4...

CVE-2026-87940

The Drupal Key auth module (versions 0.0.0 through 2.2.4 ) is vulnerable to a Use of Web Browser Cache Containing Sensitive Information issue. The root cause is that the module fails to cache data on a per-user basis, which may allow an attacker with identical permissions to view another user's a...

CVE-2026-87940 Key auth - Moderately critical - Access bypass - SA-CONTRIB-2026-138

Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Key auth allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Key auth versions: from 0.0.0 to 2.2.4...

CVE-2026-87940 Key auth - Moderately critical - Access bypass - SA-CONTRIB-2026-138

Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Key auth allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Key auth versions: from 0.0.0 to 2.2.4...

EUVD-2026-107861

Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Key auth allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Key auth versions: from 0.0.0 to 2.2.4...

CVE-2026-87943

Missing Authorization vulnerability in Drupal SAML SSO - Service Provider allows Forceful Browsing. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0...

CVE-2026-87953

Server-Side Request Forgery SSRF vulnerability in Drupal SAML SSO - Service Provider allows Server Side Request Forgery. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0...

CVE-2026-87954 Taxonomy Term Glossary - Critical - Access bypass - SA-CONTRIB-2026-152

Missing Authorization vulnerability in Drupal Taxonomy Term Glossary allows Forceful Browsing. This issue affects Taxonomy Term Glossary versions: from 0.0.0 to 4.6.0...

CVE-2026-87954

The Drupal Taxonomy Term Glossary module (versions 0.0.0 to 4.6.0 ) contains a Missing Authorization vulnerability (CWE-862) that allows Forceful Browsing . The root cause is that the module fails to sufficiently check access permissions for taxonomy terms. Consequently, anonymous users can acces...