PT-2026-97657

Name of the Vulnerable Software and Affected Versions Drupal Webform module affected versions not specified Description The Webform module fails to sufficiently validate an optional token query value. In specific configurations where a form is rendered for anonymous visitors, a malicious request...

PT-2026-97668

The Cloud module enables users to manage cloud resources through Drupal. The module does not sufficiently sanitize user-controlled Git branch and repository URL values before passing them to shell commands in the Kubernetes integration. This vulnerability allows an attacker to execute arbitrary...

PT-2026-97675

This module enables you to add an extra authentication layer to the API. The module does not sufficiently validate authentication requirements for all API requests, which can result in an access bypass vulnerability...

PT-2026-97671

This module enables you to provide information and options about cookie usage. The module does not sufficiently filter input submitted through the Cookiecuttr administration form. This could allow specially crafted values to be stored and later rendered without adequate sanitization, resulting in...

PT-2026-97676

This module enables you to personalize content for anonymous and authenticated users by showing different blocks to visitors based on client-side conditions. The Smart Content Block submodule doesn't sufficiently check block access when it renders the blocks of a "Display Blocks" reaction through...

PT-2026-97670

This module enables REST endpoints for a decoupled Commerce experience which allow for remote order creation. The module doesn't sufficiently sanitize order data passed into the order creation endpoint, which allows for potentially unsafe order properties to be set on an order...

PT-2026-97663

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. The module does not sufficiently restrict access to raw webform source editing when the Webform UI module is not enabled. This could allow a user with webform creation ...

PT-2026-97648

Name of the Vulnerable Software and Affected Versions Webform affected versions not specified Description An issue exists where user-specific access rules are not sufficiently guarded against malformed saved configurations. Under specific site conditions, an access rule designed to restrict...

CVE-2026-96382

The Diba Carousel Slider module for Drupal is vulnerable to Cross-Site Scripting (XSS) . When the "Allow HTML description" option is enabled, slide descriptions are rendered using the raw stored field value rather than the rendered output, bypassing Drupal's text format filtering and output sanit...

Smart Content - Moderately critical - Access bypass - SA-CONTRIB-2026-190

This module enables you to personalize content for anonymous and authenticated users by showing different blocks to visitors based on client-side conditions. The Smart Content Block submodule doesn't sufficiently check block access when it renders the blocks of a "Display Blocks" reaction through...

CVE-2026-96380

The CSS Usage Analyzer module for Drupal is vulnerable to an improper access control flaw. The module fails to sufficiently protect the /css-usage-analyzer/save endpoint against forged or repeated submissions . This allows unauthorized users to post CSS-usage measurements, which are intended to b...

CVE-2026-96391

The Webform REST Drupal contribution module contains a permission bypass vulnerability. The module fails to sufficiently check permissions for webform and webform submission entities when retrieving elements or fields via the REST API. No specific affected versions, exploit links, or remediation ...

CVE-2026-96390

The Editoria11y Accessibility Checker module for Drupal contains an access bypass vulnerability. The module incorrectly labels a permission as a "view" permission when it actually grants edit and delete access to module data. This occurs within the functionality that runs a client-side accessibil...

Tawk.to - Live chat application - Critical - Cross Site Request Forgery - SA-CONTRIB-2026-184

This module provides integration of the tawk.to live chat for Drupal sites. The module does not sufficiently validate certain requests. This may allow an attacker to trick an authenticated user into performing unintended actions through a Cross-Site Request Forgery CSRF vulnerability...

Cloud - Critical - Remote code execution - SA-CONTRIB-2026-177

The Cloud module enables users to manage cloud resources through Drupal. The module does not sufficiently sanitize user-controlled Git branch and repository URL values before passing them to shell commands in the Kubernetes integration. This vulnerability allows an attacker to execute arbitrary...

CVE-2026-96375

The Cloud module for Drupal contains a vulnerability where the Kubernetes and VMware integrations fail to properly validate TLS certificates when connecting to remote API endpoints. An attacker capable of intercepting these connections may obtain secret tokens or other credentials, potentially le...

Cloud - Critical - Remote code execution - SA-CONTRIB-2026-176

The Cloud module enables users to manage cloud infrastructure through Drupal. The Kubernetes and VMware integrations do not properly validate TLS certificates when connecting to remote API endpoints. An attacker who can intercept these connections may obtain secret tokens or other credentials,...

Webform - Critical - Remote Code Execution - SA-CONTRIB-2026-175

The Webform module allows site builders to create forms, collect submissions, and render submitted values in configurable formats. Webform does not sufficiently exclude certain format templates from token replacement. This can allow an attacker to submit data that is evaluated as template code wh...

CVE-2026-96356

The Webform module for Drupal contains an access bypass vulnerability. The component fails to sufficiently guard user-specific access rules against malformed saved configurations . Under specific site conditions, an access rule intended to restrict submission access to selected user accounts coul...

CVE-2026-96357

The Webform module for Drupal is vulnerable to cross-site scripting (XSS) because it fails to sufficiently force certain uploaded file types to download when served. Under specific configurations, a browser may render an uploaded file inline. This is mitigated by the requirement that a user with ...