19182 matches found
CVE-2026-15917
Drupal core versions 11.3.0 to 11.3.14, 11.4.0 to 11.4.4, and 0.0.0 to 11.2.* are vulnerable to a Cross-Site Scripting (XSS) vulnerability. The root cause is the improper neutralization of input during web page generation, specifically because the XSS filter does not sufficiently sanitize certain...
CVE-2026-15917 Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-011
Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Drupal core allows Cross-Site Scripting XSS. This issue affects Drupal core versions: from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, from 0.0.0 to 11.2...
CVE-2026-55805 Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-012
Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Drupal core allows Stored XSS. This issue affects Drupal core versions: from 0.0.0 to 10.6.13, from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, from 0.0.0 to 11.0., from 0.0.0 to 11.1., from...
CVE-2026-55805
A Stored Cross-site Scripting (XSS) vulnerability exists in the Drupal core Layout Builder module due to insufficient sanitization of block labels in certain scenarios. An attacker with access to the Layout Builder editing interface can inject malicious scripts into a block label, which are then ...
CVE-2026-55805
Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Drupal core allows Stored XSS. This issue affects Drupal core versions: from 0.0.0 to 10.6.13, from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, from 0.0.0 to 11.0., from 0.0.0 to 11.1., from...
CVE-2026-55805 Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-012
Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Drupal core allows Stored XSS. This issue affects Drupal core versions: from 0.0.0 to 10.6.13, from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, from 0.0.0 to 11.0., from 0.0.0 to 11.1., from...
CVE-2026-55805 Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-012
Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Drupal core allows Stored XSS. This issue affects Drupal core versions: from 0.0.0 to 10.6.13, from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, from 0.0.0 to 11.0., from 0.0.0 to 11.1., from...
CVE-2026-16638 Media Folders - Moderately critical - Cross site scripting - SA-CONTRIB-2026-080
Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Media Folders allows Stored XSS. This issue affects Media Folders versions: from 0.0.0 to 1.0.8...
CVE-2026-16638 Media Folders - Moderately critical - Cross site scripting - SA-CONTRIB-2026-080
Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Media Folders allows Stored XSS. This issue affects Media Folders versions: from 0.0.0 to 1.0.8...
CVE-2026-16638
The Drupal Media Folders module (versions 0.0.0 through 1.0.8 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the insufficient sanitization of names and descriptions of media items and folders when they are displayed within the media browser. An attacker with the necessar...
CVE-2026-16638
Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Media Folders allows Stored XSS. This issue affects Media Folders versions: from 0.0.0 to 1.0.8...
CVE-2026-16638 Media Folders - Moderately critical - Cross site scripting - SA-CONTRIB-2026-080
Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Media Folders allows Stored XSS. This issue affects Media Folders versions: from 0.0.0 to 1.0.8...
CVE-2026-16639 Internationalization Single Sign-On - Critical - Access bypass - SA-CONTRIB-2026-081
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Internationalization Single Sign-On allows Authentication Bypass. This issue affects Internationalization Single Sign-On versions: from 0.0.0 to 1.8.0...
CVE-2026-16639 Internationalization Single Sign-On - Critical - Access bypass - SA-CONTRIB-2026-081
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Internationalization Single Sign-On allows Authentication Bypass. This issue affects Internationalization Single Sign-On versions: from 0.0.0 to 1.8.0...
CVE-2026-16639
The Drupal Internationalization Single Sign-On module (versions 0.0.0 to 1.8.0 ) is vulnerable to an authentication bypass due to insufficient validation of a short-lived token. In multilingual website scenarios using different domain names per language, an attacker can bypass access controls to ...
CVE-2026-16639
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Internationalization Single Sign-On allows Authentication Bypass. This issue affects Internationalization Single Sign-On versions: from 0.0.0 to 1.8.0...
CVE-2026-16640 Search API Autocomplete - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-082
Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Search API Autocomplete allows Reflected XSS. This issue affects Search API Autocomplete versions: from 0.0.0 to 1.12.0...
CVE-2026-16640 Search API Autocomplete - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-082
Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Search API Autocomplete allows Reflected XSS. This issue affects Search API Autocomplete versions: from 0.0.0 to 1.12.0...
CVE-2026-16640
The Drupal Search API Autocomplete module (versions 0.0.0 through 1.12.0 ) is vulnerable to Reflected Cross-site Scripting (XSS) due to improper neutralization of input during web page generation. The flaw resides in a test script accessible to anonymous users that fails to sufficiently validate ...