PT-2026-97666

The Project Browser module enables you to apply recipes and enable modules from the web user interface. The module doesn't sufficiently validate admin actions to protect against cross-site request forgery attacks CSRF...

PT-2026-97664

The Webform module enables site builders to create forms and collect submissions. The module does not sufficiently restrict access to configure Remote HTTP Operations handlers. This vulnerability could allow a user with permission to edit a webform to configure a remote HTTP operation. The update...

CVE-2026-96392

The AI CKEditor module for Drupal contains a vulnerability where it fails to sufficiently mitigate Twig template injections within specific AI CKEditor rules. This flaw allows an attacker to use Twig functions to extract confidential system data . While the documentation describes the impact as p...

CVE-2026-96363

The Webform module for Drupal contains a cross-site scripting (XSS) vulnerability within its Webform Entity Print submodule. The root cause is insufficient access control over print templates. An attacker with permissions to create webform and edit own webform can exploit this when the submodule ...

CVE-2026-96376

The Drupal Cloud module is vulnerable to remote code execution (RCE) due to insufficient sanitization of user-controlled Git branch and repository URL values. These values are passed directly to shell commands within the Kubernetes integration , potentially allowing an attacker to execute arbitra...

REST & JSON API Authentication for Drupal - Moderately critical - Access bypass - SA-CONTRIB-2026-182

This module enables you to add an extra authentication layer to the API. The module does not sufficiently validate authentication requirements for all API requests, which can result in an access bypass vulnerability...

CVE-2026-96398

The Drupal Webform module contains an access bypass vulnerability because it does not sufficiently restrict access to certain submission view modes. Under specific conditions, a user authorized to view a submission can access a more permissive view mode, potentially exposing restricted fields. Th...

PT-2026-97682

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. The module did not sufficiently restrict access to certain submission view modes. Under certain conditions, a user who can view a submission could access a more...

PT-2026-97681

This module enables you to use AI to fill in or replace text in CKEditor. The module doesn't sufficiently mitigate Twig template injections in certain AI CKEditor rules, making it possible to use Twig functions to extract certain confidential system data...

CVE-2026-96377

The Combined image style Drupal module is vulnerable to an improper access control issue because it does not sufficiently validate image style names when generating derivatives. This allows anonymous users to generate image derivatives without a valid token, which could potentially lead to a deni...

CVE-2026-96388

The Tawk.to - Live chat application module for Drupal sites contains a Cross-Site Request Forgery (CSRF) vulnerability due to insufficient validation of certain requests. This flaw could allow an attacker to trick an authenticated user into performing unintended actions. No specific versions or r...

PT-2026-97656

Name of the Vulnerable Software and Affected Versions Drupal Webform module affected versions not specified Description The Webform Share submodule, which allows site builders to expose webforms for embedding on other sites, contains a flaw where submissions for Ajax-enabled webforms can bypass...

CVE-2026-96370

The Webform module for Drupal contains a server-side request forgery (SSRF) vulnerability within its Webform Submission Export/Import submodule. The root cause is insufficient access validation , allowing users with permissions to edit webform submissions and access results to reach the import in...

Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-168

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. The module does not sufficiently validate requested filenames when serving generated submission exports. Under certain configurations, a user with permission to view...

PT-2026-97658

Name of the Vulnerable Software and Affected Versions Drupal Webform affected versions not specified Description Insufficient validation of a managed file upload element during the processing of new submissions allows a user with submission access to potentially access other managed files they ar...

CVE-2026-96384

The Mermaid Diagram Field module for Drupal contains an access bypass vulnerability. The module fails to sufficiently respect default revision behavior and lacks proper access controls for modal content . This issue is mitigated by the requirement that an attacker must either have the modal displ...

CVE-2026-96358

The Webform module for Drupal contains a vulnerability in its rating element due to insufficient data validation. This flaw could allow cross-site scripting (XSS) on pages featuring a rating element. The risk is mitigated by the requirement that an attacker must first be able to place crafted HTM...

CVE-2026-96385

The REST & JSON API Authentication for Drupal module is vulnerable to an access bypass because it does not sufficiently validate authentication requirements for all API requests. This flaw allows for the circumvention of the extra authentication layer intended for the API. No specific patch versi...

PT-2026-97662

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. The module includes a Webform Submission Export/Import submodule that allows importing submission data from uploaded CSV files or remote URLs. The submodule did not...

CVE-2026-96386

The Smart Content Block submodule of the Smart Content module for Drupal contains an access bypass vulnerability. The root cause is an insufficient check of block access when the module renders blocks of a "Display Blocks" reaction via its AJAX endpoint . Impact is mitigated if sites only use Vie...