14785 matches found
DRUPAL-CONTRIB-2026-098
This module enables you to authenticate Drupal users against external identity providers. The module does not sufficiently ensure exact matching of externally supplied identity values when storing and looking up authentication mappings under certain database collation configurations. This...
DRUPAL-CONTRIB-2026-097
This module enables you to share content between sites in a hub - subscriber model. Certain inputs were not sufficiently validated, allowing an attacker to achieve server-side request forgery attacks...
DRUPAL-CONTRIB-2026-096
This module enables you to view the differences between revisions on any entity type. The module doesn't sufficiently restrict access to non-node entity revision diffs. This vulnerability is mitigated by the fact that an attacker must have a role with the permission to view the entity...
External Authentication - Moderately critical - Access bypass - SA-CONTRIB-2026-098
This module enables you to authenticate Drupal users against external identity providers. The module does not sufficiently ensure exact matching of externally supplied identity values when storing and looking up authentication mappings under certain database collation configurations. This...
PT-2026-76590
Name of the Vulnerable Software and Affected Versions Drupal External Authentication versions 0.0.0 through 2.0.13 Description Improper handling of case sensitivity allows privilege escalation. The module fails to ensure exact matching of externally supplied identity values when storing and looki...
PT-2026-76592
Name of the Vulnerable Software and Affected Versions Drupal Diff versions 0.0.0 through 2.0.1 Drupal Diff versions 2.1.0 through 2.1.1 Description An incorrect authorization issue allows forceful browsing. The module does not sufficiently restrict access to non-node entity revision diffs. This...
Diff - Moderately critical - Access bypass - SA-CONTRIB-2026-096
This module enables you to view the differences between revisions on any entity type. The module doesn't sufficiently restrict access to non-node entity revision diffs. This vulnerability is mitigated by the fact that an attacker must have a role with the permission to view the entity...
PT-2026-76591
Name of the Vulnerable Software and Affected Versions Drupal Quick Tabs versions 0.0.0 through 4.3.1 Description An incorrect authorization issue allows forceful browsing. The module fails to correctly enforce access when rendering node and block tabs by treating neutral access results as grants...
Entity Share Websub - Moderately critical - Server-side request forgery (SSRF) - SA-CONTRIB-2026-097
This module enables you to share content between sites in a hub - subscriber model. Certain inputs were not sufficiently validated, allowing an attacker to achieve server-side request forgery attacks...
Quick Tabs - Moderately critical - Access bypass - SA-CONTRIB-2026-099
This module enables you to display content in tabs, where each tab renders a block, a node, a view, or another Quick Tabs instance. The module did not correctly enforce access when rendering node and block tabs. It treated a neutral access result as a grant for node tabs and block plugins, and...
Exploit for Improper Input Validation in Drupal
CVE-2018-7600 Drupalgeddon2 — Red Team Project ITSOLERA...
DRUPAL-CONTRIB-2026-094
The Entity Browser module allows you to select entities from entity reference fields using a custom entity browser widget. The module doesn't sufficiently sanitize the the tab titles, resulting in a stored cross-site scripting XSS vulnerability. The vulnerability is mitigated by the fact an...
DRUPAL-CONTRIB-2026-093
This module provides formatters to allow in-place editing in a View or other display full content, teaser.... The module doesn't sufficiently check access when editing entities. A malicious user could craft requests to allow them to modify any field on any entity. This vulnerability is mitigated ...
Drupal Core 11.3.9 Anonymous Blind SQL Injection
A proof of concept exploit for an anonymous blind SQL injection vulnerability in Drupal Core version 11.3.9. The vulnerability affects Drupal Core versions 8.9.0 through 11.3.9 when using PostgreSQL as the database backend and is caused by improper handling of attacker-controlled array keys while...
📄 Drupal Core 11.3.9 Anonymous Blind SQL Injection
A proof of concept exploit for an anonymous blind SQL injection vulnerability in Drupal Core version 11.3.9. The vulnerability affects Drupal Core versions 8.9.0 through 11.3.9 when using PostgreSQL as the database backend and is caused by improper handling of attacker-controlled array keys while...
K000162772: Drupal vulnerability CVE-2026-9082
Security Advisory Description Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Drupal Drupal core allows SQL Injection. This issue affects Drupal core: from 8.9.0 before 10.4.10, from 10.5.0 before 10.5.10, from 10.6.0 before 10.6.9, from 11.0.0...
CLSA-2026-1785380876 TuxCare security update for drupal/core (4 CVEs)
TuxCare rebuilt drupal/core to address 4 CVEs. Fixed in 8.9.20-p2+tuxcare...
CLSA-2026-1784683000 TuxCare security update for drupal/core (3 CVEs)
TuxCare rebuilt drupal/core to address 3 CVEs. Fixed in 9.5.11-p6+tuxcare...