CVE-2026-76759: Improper Neutralization of Input During Web Page Generation

Vulnerability in Drupal Screenshot. This issue affects Screenshot versions:...

PT-2026-84890

Calculate Working Days allows you to calculate working days between 2 dates. This module doesn't sufficiently restrict access to its settings form...

CVE-2026-76758: Improper Input Validation

Vulnerability in Drupal Link content parser. This issue affects Link content parser versions:...

PT-2026-84893

This module enables you to restrict access to JSON:API routes based on specific user roles. The module doesn't sufficiently enforce access controls under scenarios where a request mimics an XMLHttpRequest...

PT-2026-84877

This module enables you to log the emails sent by Mailer Plus as content entities, so they can be reviewed at Reports Mail log. The module doesn't sufficiently redact the content of the emails it logs. Account related emails are stored with their one-time login links intact, so any user who can...

CVE-2026-84920

CVE-2026-84920 has been reserved by an organization or individual, with no technical details publicly available yet. Monitor for updates when the candidate is publicized.

CVE-2026-84910

CVE-2026-84910 is currently in reserved status with no public technical details available. The vulnerability type, affected products, and impact are not yet disclosed. Monitor for future updates when the assignee publishes the full description.

PT-2026-84887

This AI Chatbot module enables you to have a Chatbot using assistants to help you with your Drupal website. The module doesn't sufficiently sanitize for cross site scripting XSS when using the structured results using legacy agent setups. This vulnerability is mitigated by the fact that an attack...

CVE-2026-84924

CVE-2026-84924 has been reserved by an organization or individual and no technical details (affected product, root cause, or impact) are publicly available yet. Monitor for updates as the candidate is expected to be publicized with full details.

PT-2026-84891

This module enables you use UI Patterns with blocks, for use in Layout Builder. The module doesn't sufficiently validate user input before passing to token replacement. This vulnerability is mitigated by the fact that an attacker must have a role with the ability to edit layout builder layouts...

CVE-2026-76782: Improper Neutralization of Input During Web Page Generation

Vulnerability in Drupal Screenshot. This issue affects Screenshot versions:...

CVE-2026-81161: Privilege Defined With Unsafe Actions

Privilege Defined With Unsafe Actions vulnerability in Drupal Content Moderation Notifications allows Privilege Escalation. This issue affects Content Moderation Notifications versions: from 0.0.0 to 3.9.0...

CVE-2026-84923

CVE-2026-84923 has been reserved but no technical details are yet publicly available in the provided documents. Affected products, root cause, and impact remain unknown. Monitor for updates as the reserving organization publishes details.

CVE-2026-84912

CVE-2026-84912 has been reserved but no public technical details are currently available. Monitor for updates when the vendor announces the vulnerability and releases associated patch information.

PT-2026-84892

This islandora advanced search sub module enables AJAX updates for advanced search, facet, and search result blocks. The module doesn't sufficiently check block access when arbitrary block ID's are submitted to its publicly accessible AJAX endpoint. This may allow an unauthenticated attacker to...

CVE-2026-81167: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Address Suggestion allows Cross-Site Scripting XSS. This issue affects Address Suggestion versions: from 0.0.0 to 1.0.25...

PT-2026-84898

This module enables you to add extra layer of verification for user registration. The module doesn't sufficiently validate user-supplied input resulting in an account takeover vulnerability...

CVE-2026-81165: Incorrect Authorization

Incorrect Authorization vulnerability in Drupal Blazy allows Forceful Browsing. This issue affects Blazy versions: from 0.0.0 to 3.0.18...

Jsonapi Role Access - Critical - Access bypass - SA-CONTRIB-2026-127

This module enables you to restrict access to JSON:API routes based on specific user roles. The module doesn't sufficiently enforce access controls under scenarios where a request mimics an XMLHttpRequest...

CVE-2026-16648

CVE-2026-16648 has been reserved but no technical details are yet publicly available in the provided documents. The affected product, root cause, and impact remain unknown. Action: monitor for updates when the candidate is publicized.