PT-2026-84707

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Disable Login Page allows Functionality Bypass. This issue affects Disable Login Page versions: from 0.0.0 to 1.1.4...

CVE-2026-16647: Authentication Bypass Using an Alternate Path or Channel

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Disable Login Page allows Functionality Bypass. This issue affects Disable Login Page versions: from 0.0.0 to 1.1.4...

CVE-2026-81168: Authentication Bypass Using an Alternate Path or Channel

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal CAPTCHA Protected Page allows Functionality Bypass. This issue affects CAPTCHA Protected Page versions: from 0.0.0 to 1.0.2...

CVE-2026-84910

CVE-2026-84910 is currently in reserved status with no public technical details available. The vulnerability type, affected products, and impact are not yet disclosed. Monitor for future updates when the assignee publishes the full description.

PT-2026-84897

This module enables you to delete Webform submissions in bulk using a specified date range. The module doesn't sufficiently restrict access to the delete form. A separate PHP fatal error issue may prevent exploitation in practice on Drupal 10+...

CVE-2026-76755: Improper Restriction of Operations within the Bounds of a Memory Buffer

Vulnerability in Drupal Gammu SMS Daemon. This issue affects Gammu SMS Daemon versions:...

CVE-2026-76756: Improper Restriction of Operations within the Bounds of a Memory Buffer

Vulnerability in Drupal Gammu SMS Daemon. This issue affects Gammu SMS Daemon versions:...

Unpublished Node Permissions - Critical - Access bypass - SA-CONTRIB-2026-132

This module creates permissions per node content type to control access to unpublished content. The module has allowed view access for published content, overriding other access mechanisms that might have been in place...

CVE-2026-81205: Improper Neutralization of Special Elements used in an LDAP Query

Improper Neutralization of Special Elements used in an LDAP Query 'LDAP Injection' vulnerability in Drupal LDAP / Active Directory Integration allows LDAP Injection. This issue affects LDAP / Active Directory Integration versions: from 0.0.0 to 2.2.1...

CVE-2026-81159: Observable Timing Discrepancy

Observable Timing Discrepancy vulnerability in Drupal Commerce CyberSource allows Brute Force. This issue affects Commerce CyberSource versions: from 0.0.0 to 1.10.0...

Email Verification / SMS Verification / OTP Verification - Critical - Cross Site Scripting - SA-CONTRIB-2026-125

This module enables you to add an extra layer of verification for user registration. The module doesn't sufficiently filter user-supplied input before output, resulting in an unauthenticated reflected Cross-site Scripting XSS vulnerability...

CVE-2026-16648

CVE-2026-16648 has been reserved but no technical details are yet publicly available in the provided documents. The affected product, root cause, and impact remain unknown. Action: monitor for updates when the candidate is publicized.

wappalyzergo v0.2.96

Wappalyzergo A high performance port of the Wappalyzer Technology Detection Library to Go. Inspired by Webanalyze. Uses data from https://github.com/enthec/webappanalyzer https://github.com/HTTPArchive/wappalyzer Features Very simple and easy to use, with clean codebase. Normalized regexes +...

pathFinder

🧭 Pathfinder // CTF & Penetration Testing Playbook A mode...

DakshSCRA v0.38-beta

Daksh SCRA Source Code Review Assist root@kitploit: Author: - Debasis Mohanty [email protected] - Twitter / X: @coffeensecurity - www.coffeeandsecurity.com About Daksh SCRA Daksh SCRA Source Code Review Assist tool is built to enhance the efficiency of the source code review process, providi...

DRUPAL-CONTRIB-2026-117

Slick UI, a sub-module of Slick, enables you to add Slick option sets that may contain HTML for carousel buttons. Previous releases of the module did not sufficiently validate user input, leading to a Cross Site Scripting XSS vulnerability. Note: This vulnerability was fixed in 8.x-2.1 but that w...

DRUPAL-CONTRIB-2026-116

This module enables you to create one or more multisites with highly granular page permissions. The module doesn't sufficiently sanitize HTML code contained in the page name when displayed in the built-in tree browser. This results in a cross-site scripting vulnerability that may allow attackers ...

DRUPAL-CONTRIB-2026-115

This module enables users to authenticate using LDAP or Active Directory credentials. The module does not sufficiently sanitize user-supplied input before incorporating it into an LDAP search filter. This allows an attacker to discover additional information they should not normally be able to...

DRUPAL-CONTRIB-2026-114

The Entity PDF module can create a PDF from any entity based on any View mode. This module does not check entity view access when fetching a PDF route. This could result in a user accessing a PDF of an entity that they should not be able to view...

DRUPAL-CONTRIB-2026-113

The Entity API module extends the Drupal core entity API to provide a unified way to deal with entities and their properties. The module doesn't correctly apply access controls for JSON:API entity collection endpoints. This exposes an information disclosure vulnerability. This vulnerability is...