CVE-2026-73477: Incorrect Authorization

Incorrect Authorization vulnerability in Drupal Quick Tabs allows Forceful Browsing. This issue affects Quick Tabs versions: from 0.0.0 to 4.3.1...

CVE-2026-76757: Improper Restriction of Operations within the Bounds of a Memory Buffer

Vulnerability in Drupal Gammu SMS Daemon. This issue affects Gammu SMS Daemon versions:...

CVE-2026-84918

CVE-2026-84918 has been reserved but no technical details are yet publicly available. The vulnerability type, affected products, and impact remain unknown. Monitor for updates once the assigning organization publicizes the entry.

CVE-2026-73478: Incorrect Authorization

Incorrect Authorization vulnerability in Drupal Diff allows Forceful Browsing. This issue affects Diff versions: from 0.0.0 to 2.0.1, from 2.1.0 to 2.1.1...

PT-2026-84894

The Monobank payment API module provides integration with Monobank acquiring payments. The module did not verify the Monobank webhook signature before processing payment status callbacks...

CVE-2026-81163

CVE-2026-81163 is a reserved candidate with no public technical details yet. The affected product, vulnerability type, and impact remain undisclosed. Action: monitor for updates once the reserving organization publicizes the entry.

CVE-2026-81166: Missing Authorization

Missing Authorization vulnerability in Drupal Digital Signage Framework allows Forceful Browsing. This issue affects Digital Signage Framework versions: from 0.0.0 to 2.6.1...

PT-2026-84895

This module enables you to add dynamic caption support to PhotoSwipe image galleries. The module doesn't sufficiently sanitize user-supplied input such as image alt tags in its dynamic caption script, leading to a Cross-Site Scripting XSS vulnerability. This vulnerability is mitigated by the fact...

PT-2026-84889

This module enables you to automatically translate entities. The module doesn't sufficiently check access on the entity to be translated, related fields or referenced entities when performing an AI translation on an entity or when those fields / entities have a different access level than the...

PT-2026-84899

This module enables you to add an extra layer of verification for user registration. The module doesn't sufficiently filter user-supplied input before output, resulting in an unauthenticated reflected Cross-site Scripting XSS vulnerability...

PT-2026-84888

This submodule AI Translate enables you to automatically translate entities. The module doesn't sufficiently check access on the entity to be translated, related fields or referenced entities when performing an AI translation on an entity or when those fields / entities have a different access...

CVE-2026-18986: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Entity Browser allows Stored XSS. This issue affects Entity Browser versions: from 0.0.0 to 2.16.0...

CVE-2026-81158: Incorrect Authorization

Incorrect Authorization vulnerability in Drupal Entity API allows Forceful Browsing. This issue affects Entity API versions: from 0.0.0 to 1.8.0...

CVE-2026-81160: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Slick Carousel allows Stored XSS. This issue affects Slick Carousel versions: from 0.0.0 to 2.1.0...

CVE-2026-81269: Missing Authorization

Missing Authorization vulnerability in Drupal Data field allows Forceful Browsing. This issue affects Data field versions: from 0.0.0 to 2.0.13...

CVE-2026-81164: Missing Authorization

Missing Authorization vulnerability in Drupal Entity PDF allows Forceful Browsing. This issue affects Entity PDF versions: from 0.0.0 to 2.1.5...

CVE-2026-81162: Insertion of Sensitive Information Into Sent Data

Insertion of Sensitive Information Into Sent Data vulnerability in Drupal DXPR Builder: The Best Editing AI Experience for Drupal allows Forceful Browsing. This issue affects DXPR Builder: The Best Editing AI Experience for Drupal versions: from 0.0.0 to 2.8.1...

PT-2026-84896

This module creates permissions per node content type to control access to unpublished content. The module has allowed view access for published content, overriding other access mechanisms that might have been in place...

CVE-2026-84915

This CVE is currently reserved as a placeholder with no public technical details available regarding the affected product, root cause, or impact. Monitor for updates when the candidate is formally publicized.

PT-2026-84886

This module enables AJAX updates for advanced search, facet, and search result blocks. The module doesn’t sufficiently check block access when arbitrary block IDs are submitted to its publicly accessible AJAX endpoint. This may allow an unauthenticated attacker to retrieve restricted block conten...