CVE-2026-96380

The CSS Usage Analyzer module for Drupal is vulnerable to an improper access control flaw. The module fails to sufficiently protect the /css-usage-analyzer/save endpoint against forged or repeated submissions . This allows unauthorized users to post CSS-usage measurements, which are intended to b...

CVE-2026-96391

The Webform REST Drupal contribution module contains a permission bypass vulnerability. The module fails to sufficiently check permissions for webform and webform submission entities when retrieving elements or fields via the REST API. No specific affected versions, exploit links, or remediation ...

CVE-2026-96390

The Editoria11y Accessibility Checker module for Drupal contains an access bypass vulnerability. The module incorrectly labels a permission as a "view" permission when it actually grants edit and delete access to module data. This occurs within the functionality that runs a client-side accessibil...

CVE-2026-96375

The Cloud module for Drupal contains a vulnerability where the Kubernetes and VMware integrations fail to properly validate TLS certificates when connecting to remote API endpoints. An attacker capable of intercepting these connections may obtain secret tokens or other credentials, potentially le...

CVE-2026-96356

The Webform module for Drupal contains an access bypass vulnerability. The component fails to sufficiently guard user-specific access rules against malformed saved configurations . Under specific site conditions, an access rule intended to restrict submission access to selected user accounts coul...

CVE-2026-96364

The Webform module's Webform Share submodule allows for embedding webforms on external sites. Under certain conditions, submissions for an Ajax-enabled Webform using this submodule can bypass anti-spam protections . This vulnerability is mitigated if Webform Share is disabled, sharing is turned o...

CVE-2026-96365

The Webform module for Drupal is vulnerable to a Denial of Service (DoS) because it fails to sufficiently validate an optional token query value . Under specific configurations where a Webform is rendered for anonymous visitors , a malicious request can cause the system to consume significant res...

CVE-2026-96373

The Drupal Webform module contains a vulnerability where it does not sufficiently validate requested filenames when serving generated submission exports. This flaw could allow a user with permission to view results for one webform to access or remove files from the configured export temporary dir...

CVE-2026-96372

The Webform module for Drupal fails to sufficiently restrict access to configure Remote HTTP Operations handlers. A user with permissions to edit a webform could potentially configure a remote HTTP operation. To mitigate this risk, administrators should review the newly added Administer webform r...

PT-2026-97666

The Project Browser module enables you to apply recipes and enable modules from the web user interface. The module doesn't sufficiently validate admin actions to protect against cross-site request forgery attacks CSRF...

PT-2026-97664

The Webform module enables site builders to create forms and collect submissions. The module does not sufficiently restrict access to configure Remote HTTP Operations handlers. This vulnerability could allow a user with permission to edit a webform to configure a remote HTTP operation. The update...

CVE-2026-96392

The AI CKEditor module for Drupal contains a vulnerability where it fails to sufficiently mitigate Twig template injections within specific AI CKEditor rules. This flaw allows an attacker to use Twig functions to extract confidential system data . While the documentation describes the impact as p...

CVE-2026-96363

The Webform module for Drupal contains a cross-site scripting (XSS) vulnerability within its Webform Entity Print submodule. The root cause is insufficient access control over print templates. An attacker with permissions to create webform and edit own webform can exploit this when the submodule ...

CVE-2026-96376

The Drupal Cloud module is vulnerable to remote code execution (RCE) due to insufficient sanitization of user-controlled Git branch and repository URL values. These values are passed directly to shell commands within the Kubernetes integration , potentially allowing an attacker to execute arbitra...

REST & JSON API Authentication for Drupal - Moderately critical - Access bypass - SA-CONTRIB-2026-182

This module enables you to add an extra authentication layer to the API. The module does not sufficiently validate authentication requirements for all API requests, which can result in an access bypass vulnerability...

CVE-2026-96398

The Drupal Webform module contains an access bypass vulnerability because it does not sufficiently restrict access to certain submission view modes. Under specific conditions, a user authorized to view a submission can access a more permissive view mode, potentially exposing restricted fields. Th...

PT-2026-97682

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. The module did not sufficiently restrict access to certain submission view modes. Under certain conditions, a user who can view a submission could access a more...

CVE-2026-96367

The Webform module in Drupal contains a vulnerability where the custom attributes YAML editor does not sufficiently restrict access. Users with permissions to create or edit webforms, but who lack permission to edit webform source, can add custom attributes, which may lead to cross-site scripting...

CVE-2026-96377

The Combined image style Drupal module is vulnerable to an improper access control issue because it does not sufficiently validate image style names when generating derivatives. This allows anonymous users to generate image derivatives without a valid token, which could potentially lead to a deni...

CVE-2026-96388

The Tawk.to - Live chat application module for Drupal sites contains a Cross-Site Request Forgery (CSRF) vulnerability due to insufficient validation of certain requests. This flaw could allow an attacker to trick an authenticated user into performing unintended actions. No specific versions or r...