CVE-2025-10928 Access code - Moderately critical - Access bypass - SA-CONTRIB-2025-108

Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Access code allows Brute Force.This issue affects Access code: from 0.0.0 before 2.0.5...

CVE-2025-10928

The CVE-2025-10928 entry concerns the Drupal Access code module. A vulnerability arises from improper restriction of excessive authentication attempts, potentially enabling brute-force attacks. Affected versions are Access code: all versions prior to 2.0.5 (0.0.0 up to

CVE-2025-10927 Plausible tracking - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-107

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Plausible tracking allows Cross-Site Scripting XSS.This issue affects Plausible tracking: from 0.0.0 before 1.0.2...

CVE-2025-10927 Plausible tracking - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-107

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Plausible tracking allows Cross-Site Scripting XSS.This issue affects Plausible tracking: from 0.0.0 before 1.0.2...

CVE-2025-10927 Plausible tracking - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-107

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Plausible tracking allows Cross-Site Scripting XSS.This issue affects Plausible tracking: from 0.0.0 before 1.0.2...

CVE-2025-10927

CVE-2025-10927 concerns the Drupal Plausible tracking module. A flaw arises from improper input neutralization during web page generation, enabling Cross-Site Scripting (XSS). The issue affects Plausible tracking versions before 1.0.2. The CVE entry and related reports (e.g., GHSA-PR6M-QWRR-MRW9,...

CVE-2025-10926 JSON Field - Critical - Cross Site Scripting - SA-CONTRIB-2025-106

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal JSON Field allows Cross-Site Scripting XSS.This issue affects JSON Field: from 0.0.0 before 1.5...

CVE-2025-10926 JSON Field - Critical - Cross Site Scripting - SA-CONTRIB-2025-106

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal JSON Field allows Cross-Site Scripting XSS.This issue affects JSON Field: from 0.0.0 before 1.5...

CVE-2025-10926

CVE-2025-10926 affects the Drupal JSON Field module (before 1.5). The vulnerability arises from improper input neutralization during page generation, enabling Cross-Site Scripting (XSS). Affected: JSON Field module prior to 1.5. Impact: XSS risk on pages rendering JSON Field content. Remediation:...

CVE-2025-9954 Acquia DAM - Moderately critical - Access bypass, Information Disclosure - SA-CONTRIB-2025-105

Missing Authorization vulnerability in Drupal Acquia DAM allows Forceful Browsing.This issue affects Acquia DAM: from 0.0.0 before 1.1.5...

CVE-2025-9954 Acquia DAM - Moderately critical - Access bypass, Information Disclosure - SA-CONTRIB-2025-105

Missing Authorization vulnerability in Drupal Acquia DAM allows Forceful Browsing.This issue affects Acquia DAM: from 0.0.0 before 1.1.5...

CVE-2025-9954 Acquia DAM - Moderately critical - Access bypass, Information Disclosure - SA-CONTRIB-2025-105

Missing Authorization vulnerability in Drupal Acquia DAM allows Forceful Browsing.This issue affects Acquia DAM: from 0.0.0 before 1.1.5...

CVE-2025-9954

CVE-2025-9954 affects Drupal Acquia DAM (versions 0.0.0 up to 1.1.4). Root cause: missing authorization enabling forceful browsing of DAM assets. Impact is information disclosure and unauthorized resource access. Mitigation: update to Acquia DAM 1.1.5 or later. Multiple sources corroborate the vu...

DRUPAL-CONTRIB-2025-114

This module introduces an OAuth 2.0 authorization server, which can be configured to protect your Drupal instance with access tokens, or allow clients to request new access tokens and refresh them. The module doesn't sufficiently respect granted scopes, it affects all access checks that are based...

PT-2025-44365

Name of the Vulnerable Software and Affected Versions Acquia DAM versions 0.0.0 through 1.1.4 Description A missing authorization issue exists in Drupal Acquia DAM, allowing for forceful browsing. This allows unauthorized access to resources. Recommendations Update Acquia DAM to version 1.1.5 or...

PT-2025-44362

Name of the Vulnerable Software and Affected Versions Drupal Simple OAuth OAuth2 & OpenID Connect versions 6.0.0 through 6.0.6 Description A flaw exists in Simple OAuth OAuth2 & OpenID Connect that permits authentication bypass. This issue allows bypassing normal authentication mechanisms through...

PT-2025-44357

Name of the Vulnerable Software and Affected Versions Drupal Reverse Proxy Header versions prior to 1.1.2 Description An improper validation of consistency within input exists in Drupal Reverse Proxy Header, allowing manipulation of user-controlled variables. Recommendations Update to version 1.1...

PT-2025-44354

Name of the Vulnerable Software and Affected Versions Drupal JSON Field versions prior to 1.5 Description A flaw exists in Drupal JSON Field that allows for Cross-Site Scripting XSS. This issue is due to improper neutralization of input during web page generation. Successful exploitation could...

PT-2025-44359

Name of the Vulnerable Software and Affected Versions Drupal Umami Analytics versions prior to 1.0.1 Description A flaw exists in Drupal Umami Analytics that allows for Cross-Site Scripting XSS. This issue arises from improper neutralization of input during web page generation. The vulnerability...

PT-2025-44361

Name of the Vulnerable Software and Affected Versions Drupal CivicTheme Design System versions prior to 1.12.0 Description A flaw exists in the CivicTheme Design System that allows for Cross-Site Scripting XSS. This occurs due to improper neutralization of input during web page generation. The...