CVE-2026-73475

The Commerce PayPal module for Drupal is vulnerable to an Incorrect Authorization issue, which allows for Forceful Browsing . The root cause is that the module fails to sufficiently validate transaction results in certain circumstances, specifically when using the Payflow Link payment gateway. Th...

CVE-2026-73475 Commerce PayPal - Moderately critical - Access bypass - SA-CONTRIB-2026-095

Incorrect Authorization vulnerability in Drupal Commerce PayPal allows Forceful Browsing. This issue affects Commerce PayPal versions: from 0.0.0 to 1.12.0, from 2.0.0 to 2.1.3...

CVE-2026-73475 Commerce PayPal - Moderately critical - Access bypass - SA-CONTRIB-2026-095

Incorrect Authorization vulnerability in Drupal Commerce PayPal allows Forceful Browsing. This issue affects Commerce PayPal versions: from 0.0.0 to 1.12.0, from 2.0.0 to 2.1.3...

CVE-2026-73478

Drupal Diff is a contrib module that enables viewing differences between revisions on any entity type. It contains an Incorrect Authorization flaw that allows forceful browsing : the module does not sufficiently restrict access to non-node entity revision diffs . The practical impact is that a us...

CVE-2026-76757 Gammu SMS Daemon - Critical - Unsupported - SA-CONTRIB-2026-100

Vulnerability in Drupal Gammu SMS Daemon. This issue affects Gammu SMS Daemon versions:...

CVE-2026-76756 Gammu SMS Daemon - Critical - Unsupported - SA-CONTRIB-2026-100

Vulnerability in Drupal Gammu SMS Daemon. This issue affects Gammu SMS Daemon versions:...

CVE-2026-76756

A vulnerability exists in Drupal Gammu SMS Daemon (all versions . ). Rapid7 identifies the root cause as an Improper Restriction of Operations within the Bounds of a Memory Buffer . The project is currently marked as unsupported due to a known security issue that has not been addressed by the mai...

CVE-2026-76756 Gammu SMS Daemon - Critical - Unsupported - SA-CONTRIB-2026-100

Vulnerability in Drupal Gammu SMS Daemon. This issue affects Gammu SMS Daemon versions:...

CVE-2026-76755 Gammu SMS Daemon - Critical - Unsupported - SA-CONTRIB-2026-100

Vulnerability in Drupal Gammu SMS Daemon. This issue affects Gammu SMS Daemon versions:...

CVE-2026-76755 Gammu SMS Daemon - Critical - Unsupported - SA-CONTRIB-2026-100

Vulnerability in Drupal Gammu SMS Daemon. This issue affects Gammu SMS Daemon versions:...

CVE-2026-81167 Address Suggestion - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-103

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Address Suggestion allows Cross-Site Scripting XSS. This issue affects Address Suggestion versions: from 0.0.0 to 1.0.25...

CVE-2026-81168 CAPTCHA Protected Page - Moderately critical - Cookie Forgery - SA-CONTRIB-2026-105

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal CAPTCHA Protected Page allows Functionality Bypass. This issue affects CAPTCHA Protected Page versions: from 0.0.0 to 1.0.2...

CVE-2026-81159 Commerce CyberSource - Moderately critical - Insufficient input validation - SA-CONTRIB-2026-106

Observable Timing Discrepancy vulnerability in Drupal Commerce CyberSource allows Brute Force. This issue affects Commerce CyberSource versions: from 0.0.0 to 1.10.0...

CVE-2026-81162 DXPR Builder: The AI Visual Page Builder for Drupal - Moderately critical - Information Disclosure - SA-CONTRIB-2026-112

Insertion of Sensitive Information Into Sent Data vulnerability in Drupal DXPR Builder: The Best Editing AI Experience for Drupal allows Forceful Browsing. This issue affects DXPR Builder: The Best Editing AI Experience for Drupal versions: from 0.0.0 to 2.8.1...

CVE-2026-81162 DXPR Builder: The AI Visual Page Builder for Drupal - Moderately critical - Information Disclosure - SA-CONTRIB-2026-112

Insertion of Sensitive Information Into Sent Data vulnerability in Drupal DXPR Builder: The Best Editing AI Experience for Drupal allows Forceful Browsing. This issue affects DXPR Builder: The Best Editing AI Experience for Drupal versions: from 0.0.0 to 2.8.1...

CVE-2026-81164

The Entity PDF module for Drupal (versions 0.0.0 through 2.1.5 ) contains a Missing Authorization vulnerability that facilitates Forceful Browsing . The root cause is that the module fails to verify entity view access when fetching a PDF route. This oversight allows an unauthorized user to access...

CVE-2026-81164 Entity PDF - Moderately critical - Access bypass - SA-CONTRIB-2026-114

Missing Authorization vulnerability in Drupal Entity PDF allows Forceful Browsing. This issue affects Entity PDF versions: from 0.0.0 to 2.1.5...

CVE-2026-81201 Monster Menus - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-116

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Monster Menus allows Stored XSS. This issue affects Monster Menus versions: from 0.0.0 to 9.5.3...

CVE-2026-81160 Slick Carousel - Moderately critical - Cross Site Scripting - SA-CONTRIB-2026-117

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Slick Carousel allows Stored XSS. This issue affects Slick Carousel versions: from 0.0.0 to 2.1.0...

DRUPAL-CONTRIB-2026-113

The Entity API module extends the Drupal core entity API to provide a unified way to deal with entities and their properties. The module doesn't correctly apply access controls for JSON:API entity collection endpoints. This exposes an information disclosure vulnerability. This vulnerability is...