Drupal: Vulnerability in the Disabled Login Page

Drupal Disable Login Page is a content blocking plugin for the Drupal community. Versions of Drupal Disable Login Page prior to 1.1.3 contained a security vulnerability. This vulnerability stemmed from an authentication bypass mechanism, which could lead to unauthorized functionality...

Drupal Entity Share security vulnerability

Drupal Entity Share is a content sharing plugin for the Drupal community. Versions of Drupal Entity Share prior to 3.13.0 contained a security vulnerability, which was caused by improper authorization and could lead to forced browsing...

PT-2026-5204

Name of the Vulnerable Software and Affected Versions Drupal Entity Share versions prior to 3.13.0 Description An authorization issue exists in Drupal Entity Share that permits forceful browsing. This flaw potentially allows unauthorized access to resources. Recommendations Update Drupal Entity...

PT-2026-5207

Name of the Vulnerable Software and Affected Versions Drupal HTTP Client Manager versions prior to 9.3.13 Drupal HTTP Client Manager versions 10.0.0 through 10.0.2 Drupal HTTP Client Manager versions 11.0.0 through 11.0.1 Description An improper check for unusual or exceptional conditions exists ...

PT-2026-5200

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal AI Artificial Intelligence allows Cross-Site Scripting XSS.This issue affects AI Artificial Intelligence: from 0.0.0 before 1.0.7, from 1.1.0 before 1.1.7, from 1.2.0 before 1.2.4...

PT-2026-5201

Name of the Vulnerable Software and Affected Versions Drupal Login Time Restriction versions prior to 1.0.3 Description A Cross-Site Request Forgery CSRF issue exists in the Login Time Restriction module. This allows attackers to perform actions on behalf of authenticated users without their...

CVE-2025-13980: Authentication Bypass Using an Alternate Path or Channel

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal CKEditor 5 Premium Features allows Functionality Bypass.This issue affects CKEditor 5 Premium Features: from 0.0.0 before 1.2.10, from 1.3.0 before 1.3.6, from 1.4.0 before 1.4.3, from 1.5.0 before 1.5.1, from 1.6.0...

CVE-2025-13982: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Drupal Login Time Restriction allows Cross Site Request Forgery.This issue affects Login Time Restriction: from 0.0.0 before 1.0.3...

CVE-2026-0749: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Form Builder allows Cross-Site Scripting XSS.This issue affects Drupal: from 7.X-1.0 through 7.X-1.22...

PT-2026-5189

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Form Builder allows Cross-Site Scripting XSS.This issue affects Drupal: from 7.X-1.0 through 7.X-1.22...

CVE-2025-13984: Permissive Cross-domain Policy with Untrusted Domains

Permissive Cross-domain Security Policy with Untrusted Domains vulnerability in Drupal Next.Js allows Cross-Site Scripting XSS.This issue affects Next.Js: from 0.0.0 before 1.6.4, from 2.0.0 before 2.0.1...

PT-2026-5205

Name of the Vulnerable Software and Affected Versions Drupal Disable Login Page versions prior to 1.1.3 Description An authentication bypass issue exists in Drupal Disable Login Page, allowing functionality bypass through an alternate path or channel. This allows attackers to circumvent login...

Drupal Form Builder security vulnerabilities

Drupal Form Builder is a form generation plugin for the Drupal community. Versions 7.X-1.0 to 7.X-1.22 of Drupal Form Builder have security vulnerabilities. These vulnerabilities stem from improper input handling during form generation, which may lead to cross-site scripting attacks...

Drupal Commerce Paybox security vulnerabilities

Drupal Commerce Paybox is a payment plugin for the Drupal community. There are security vulnerabilities in the Drupal Commerce Paybox versions 7-x-1.0 to 7.X-1.5. These vulnerabilities stem from improper encryption signature verification, which may lead to authentication bypasses...

Drupal CKEditor 5 Premium Features: Security Vulnerabilities

Drupal CKEditor 5 Premium Features is an editor extension module within the Drupal community. There are security vulnerabilities in Drupal CKEditor 5 Premium Features, which stem from using alternative paths or channels to bypass authentication, potentially leading to functionality bypasses. The...

PT-2026-5202

Name of the Vulnerable Software and Affected Versions Drupal Tagify versions prior to 1.2.44 Description A flaw exists in Drupal Tagify that allows for Cross-Site Scripting XSS. This issue is due to improper neutralization of input during web page generation. The vulnerability could potentially...

PT-2026-5198

Name of the Vulnerable Software and Affected Versions Drupal Mini site versions prior to 3.0.2 Description A flaw exists in Drupal Mini site that allows for Stored Cross-Site Scripting XSS due to unsafe actions with defined privileges. This allows an attacker to inject malicious scripts into the...

Drupal Mini site security vulnerabilities

Drupal Mini Site is a plugin for the Drupal community. Versions of Drupal Mini Site prior to 3.0.2 contained security vulnerabilities. These vulnerabilities stemmed from insecure permissions definitions, which could lead to storage-side cross-site scripting attacks...

PT-2026-5206

Name of the Vulnerable Software and Affected Versions Acquia Content Hub versions 0.0.0 through 3.6.3 Acquia Content Hub versions 3.7.0 through 3.7.2 Description A Cross-Site Request Forgery CSRF issue exists in Acquia Content Hub. This allows attackers to perform actions on behalf of authenticat...

PT-2026-5243

Name of the Vulnerable Software and Affected Versions Drupal Central Authentication System CAS Server versions prior to 2.0.3 Drupal Central Authentication System CAS Server versions 2.1.0 through 2.1.1 Description The Central Authentication System CAS Server module for Drupal does not adequately...