134 matches found
CVE-2026-114554
The Drupal AI File to Text module (versions 0.0.0 to 1.0.1) contains an Incorrect Authorization vulnerability (CWE-863) that allows for Forceful Browsing . The module fails to sufficiently verify if a user is permitted to view a file before extracting its content for use as an AI tool. This allow...
EUVD-2026-113521
Incorrect Authorization vulnerability in Drupal AI File to Text allows Forceful Browsing. This issue affects AI File to Text versions: from 0.0.0 to 1.0.1...
CVE-2026-118545
The Drupal AI (Artificial Intelligence) module is vulnerable to a Cross-Site Scripting (XSS) vulnerability due to insufficient restriction of HTML rendering. This issue affects versions 0.0.0 to 1.4.11 and 1.5.0 to 1.5.2 . The risk is mitigated by the requirement that an attacker must have access...
EUVD-2026-113506
Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal AI Artificial Intelligence allows Cross-Site Scripting XSS. This issue affects AI Artificial Intelligence versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2...
CVE-2026-118546
The Drupal AI (Artificial Intelligence) module is vulnerable to Cross-Site Scripting (XSS) due to insufficient filtering of user input before rendering, specifically within the AI Chatbot submodule . This issue affects versions 0.0.0 to 1.4.11 and 1.5.0 to 1.5.2 . The impact is mitigated by the r...
EUVD-2026-113505
Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal AI Artificial Intelligence allows Cross-Site Scripting XSS. This issue affects AI Artificial Intelligence versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2...
CVE-2026-118548
The Drupal AI (Artificial Intelligence) module is vulnerable to an Incorrect Authorization issue (CWE-863) leading to Resource Injection . The root cause is insufficient validation of links under certain conditions, which could potentially allow for the exfiltration of sensitive information to ex...
EUVD-2026-113504
Incorrect Authorization vulnerability in Drupal AI Artificial Intelligence allows Resource Injection. This issue affects AI Artificial Intelligence versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2...
CVE-2026-118549
The Drupal AI (Artificial Intelligence) module is vulnerable to Cross-Site Scripting (XSS) due to the improper neutralization of input during web page generation. The root cause is that the module fails to sufficiently validate Markdown links under specific conditions. This issue affects versions...
EUVD-2026-113503
Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal AI Artificial Intelligence allows Cross-Site Scripting XSS. This issue affects AI Artificial Intelligence versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2...
CVE-2026-118550
The Drupal AI module, specifically the AI Search submodule , is vulnerable to an access bypass due to how it interacts with the Search API cache. While the AI Search backend checks user permissions for each search result, it fails to account for these permissions when the Search API caches view r...
EUVD-2026-113502
Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal AI Artificial Intelligence allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects AI Artificial Intelligence versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2...
CVE-2026-118551
The Drupal AI (Artificial Intelligence) module (versions 0.0.0 to 1.4.11 and 1.5.0 to 1.5.2 ) contains an Insecure Storage of Sensitive Information vulnerability (CWE-922 ). The root cause is that audio for every speech-to-text request is written to the same file in the temporary directory and is...
EUVD-2026-113501
Insecure Storage of Sensitive Information vulnerability in Drupal AI Artificial Intelligence allows Retrieve Embedded Sensitive Data. This issue affects AI Artificial Intelligence versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2...
CVE-2026-118552
The Drupal AI (Artificial Intelligence) module is vulnerable to Cross-Site Scripting (XSS) due to the insufficient sanitization of certain HTMX attributes during web page generation. This issue affects versions 0.0.0 to 1.4.11 and 1.5.0 to 1.5.2 . The vulnerability allows an attacker to execute m...
EUVD-2026-113500
Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal AI Artificial Intelligence allows Cross-Site Scripting XSS. This issue affects AI Artificial Intelligence versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2...
CVE-2026-118553
The Drupal AI (Artificial Intelligence) module is vulnerable to Stored Cross-site Scripting (XSS) due to improper neutralization of input during web page generation. The issue resides in the AI Automator submodule, which allows users to automatically fill out fields using AI based on other fields...
EUVD-2026-113499
Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal AI Artificial Intelligence allows Stored XSS. This issue affects AI Artificial Intelligence versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2...
PT-2026-130580
This module provides a framework for integrating AI providers and features into Drupal. Audio for every speech-to-text request is written to the same file in the temporary directory and does not delete it afterwards. As a result, an attacker who can read the site's temporary directory could get t...
