CVE-2026-96371

The Webform module for Drupal allows users with webform creation or editing permissions to enter source configurations that are rendered unsafely when the Webform UI module is disabled. This vulnerability arises from insufficient restrictions on raw webform source editing, potentially leading to ...

CVE-2026-96374

The Project Browser module for Drupal is vulnerable to cross-site request forgery (CSRF) attacks because it fails to sufficiently validate administrative actions performed through the web user interface. An attacker could potentially exploit this to apply recipes or enable modules without proper ...

CookieCuttr - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-181

This module enables you to provide information and options about cookie usage. The module does not sufficiently filter input submitted through the Cookiecuttr administration form. This could allow specially crafted values to be stored and later rendered without adequate sanitization, resulting in...

Project Browser - Critical - Cross-site request forgery - SA-CONTRIB-2026-178

The Project Browser module enables you to apply recipes and enable modules from the web user interface. The module doesn't sufficiently validate admin actions to protect against cross-site request forgery attacks CSRF...

PT-2026-97678

This module provides integration of the tawk.to live chat for Drupal sites. The module does not sufficiently validate certain requests. This may allow an attacker to trick an authenticated user into performing unintended actions through a Cross-Site Request Forgery CSRF vulnerability...

CVE-2026-96378

A vulnerability exists in a Drupal Commerce Decoupled Checkout module that enables REST endpoints for remote order creation. The module fails to sufficiently sanitize order data passed into the order creation endpoint, which could allow an attacker to set potentially unsafe order properties . No ...

CVE-2026-96379

The CookieCuttr module for Drupal contains a cross-site scripting (XSS) vulnerability due to insufficient input filtering on the administration form. This flaw allows for the storage and subsequent rendering of specially crafted values without adequate sanitization. Exploitation requires a role w...

PT-2026-97653

Name of the Vulnerable Software and Affected Versions Drupal Webform module affected versions not specified Description The Webform module fails to sufficiently sanitize text counter configuration before passing options to the bundled jQuery Text Counter library. This flaw allows markup from...

CVE-2026-96369

The Drupal Webform module contains a vulnerability where, when used with JSON:API enabled, submissions may be cached without correctly varying by the authenticated user. This allows an authenticated user to potentially view another user's webform submission data via the JSON:API collection endpoi...

PT-2026-97655

Name of the Vulnerable Software and Affected Versions Drupal Webform Entity Print submodule affected versions not specified Description The Webform Entity Print submodule does not sufficiently limit access to its print templates. A user with permissions to create and edit their own webforms can...

PT-2026-97651

Name of the Vulnerable Software and Affected Versions Webform affected versions not specified Description The Webform module fails to sufficiently sanitize attributes used by its color element. This can lead to cross-site scripting XSS, a technique where malicious scripts are injected into truste...

Editoria11y Accessibility Checker - Moderately critical - Access bypass - SA-CONTRIB-2026-185

This module runs a client-side accessibility checker that automatically reports results to dashboard views over an API. The module incorrectly described a permission as a "view" permission when it grants edit and delete access to module data, resulting in a potential access bypass...

AI CKEditor - Moderately critical - Code execution via Twig templates - SA-CONTRIB-2026-187

This module enables you to use AI to fill in or replace text in CKEditor. The module doesn't sufficiently mitigate Twig template injections in certain AI CKEditor rules, making it possible to use Twig functions to extract certain confidential system data...

PT-2026-97661

Name of the Vulnerable Software and Affected Versions Drupal Webform module affected versions not specified Description When the Webform module is used with JSON:API enabled, submissions may be cached without varying correctly by the authenticated user. This occurs when a webform is configured to...

Stop administrator login - Moderately critical - Access bypass - SA-CONTRIB-2026-183

This module enables sites to block access for the administrative user account user 1 or users with the administrator role. The module does not sufficiently enforce these access restrictions across all supported authentication mechanisms. As a result, a blocked administrative user may still be abl...

CVE-2026-96355

The Drupal Webform module contains a vulnerability where it fails to sufficiently exclude certain format templates from token replacement . This allows an attacker to submit data that is evaluated as template code during rendering. Depending on site configuration and active modules, the impact ca...

PT-2026-97677

This module enables sites to block access for the administrative user account user 1 or users with the administrator role. The module does not sufficiently enforce these access restrictions across all supported authentication mechanisms. As a result, a blocked administrative user may still be abl...

Combined image style - Moderately critical - Improper access control - SA-CONTRIB-2026-188

This module enables you to combine multiple image styles into a single image derivative. The module does not sufficiently validate image style names when generating image derivatives. Under certain circumstances, this allows anonymous users to generate image derivatives without a valid token,...

PT-2026-97659

Name of the Vulnerable Software and Affected Versions Drupal Webform versions 6.2.x through 6.3.x Description The Webform module does not sufficiently restrict access to the custom attributes YAML editor. Users with permissions to create or edit webforms, but lacking permissions to edit the webfo...

PT-2026-97674

This module enables you to add mermaid diagram that displays either inline on an entity or optionally in a modal. The module doesn't sufficiently respect default revision behavior and does not properly limit access to the modal content. This vulnerability is mitigated by the fact that an attacker...