EUVD-2026-70008

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Address Suggestion allows Cross-Site Scripting XSS. This issue affects Address Suggestion versions: from 0.0.0 to 1.0.25...

CVE-2026-81167 Address Suggestion - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-103

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Address Suggestion allows Cross-Site Scripting XSS. This issue affects Address Suggestion versions: from 0.0.0 to 1.0.25...

EUVD-2026-70007

Incorrect Authorization vulnerability in Drupal Blazy allows Forceful Browsing. This issue affects Blazy versions: from 0.0.0 to 3.0.18...

CVE-2026-81165 Blazy - Less critical - Access bypass - SA-CONTRIB-2026-104

Incorrect Authorization vulnerability in Drupal Blazy allows Forceful Browsing. This issue affects Blazy versions: from 0.0.0 to 3.0.18...

CVE-2026-81165

Drupal Blazy (a Drupal contrib module) has an incorrect authorization vulnerability that allows forceful browsing . The module's Filter plugin shortcode does not consistently check entity view access, enabling a user with access to a Blazy-enabled text format to render a field from an entity they...

CVE-2026-81168

CVE-2026-81168 affects the Drupal CAPTCHA Protected Page module (versions 0.0.0 through 1.0.2). The module does not sufficiently validate its CAPTCHA verification cookies, allowing an unauthenticated user or automated bot to forge the cookie and bypass CAPTCHA verification entirely . This constit...

EUVD-2026-70006

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal CAPTCHA Protected Page allows Functionality Bypass. This issue affects CAPTCHA Protected Page versions: from 0.0.0 to 1.0.2...

CVE-2026-81168 CAPTCHA Protected Page - Moderately critical - Cookie Forgery - SA-CONTRIB-2026-105

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal CAPTCHA Protected Page allows Functionality Bypass. This issue affects CAPTCHA Protected Page versions: from 0.0.0 to 1.0.2...

CVE-2026-81159

CVE-2026-81159 affects the Drupal Commerce CyberSource module (versions 0.0.0 through 1.10.0). The root cause is a failure to correctly verify the integrity of data returned by the CyberSource payment provider , specifically in the Secure Acceptance Hosted Checkout gateway integration. An observa...

EUVD-2026-70005

Observable Timing Discrepancy vulnerability in Drupal Commerce CyberSource allows Brute Force. This issue affects Commerce CyberSource versions: from 0.0.0 to 1.10.0...

EUVD-2026-70004

Privilege Defined With Unsafe Actions vulnerability in Drupal Content Moderation Notifications allows Privilege Escalation. This issue affects Content Moderation Notifications versions: from 0.0.0 to 3.9.0...

CVE-2026-81161

Content Moderation Notifications for Drupal (versions 0.0.0 through 3.9.0) contains a privilege escalation vulnerability caused by a permission to configure email templates containing Twig code that was not marked as restricted . A site administrator may inadvertently grant this permission to les...

CVE-2026-81269 Data field - Moderately critical - Information disclosure - SA-CONTRIB-2026-108

Missing Authorization vulnerability in Drupal Data field allows Forceful Browsing. This issue affects Data field versions: from 0.0.0 to 2.0.13...

CVE-2026-81269

CVE-2026-81269 is a missing-authorization vulnerability in the Drupal Data field contrib module (versions 0.0.0 through 2.0.13). The module exposes structured data values through JSON endpoints but does not sufficiently check access permissions before returning them. As a result, anonymous users ...

EUVD-2026-70003

Missing Authorization vulnerability in Drupal Data field allows Forceful Browsing. This issue affects Data field versions: from 0.0.0 to 2.0.13...

CVE-2026-81269 Data field - Moderately critical - Information disclosure - SA-CONTRIB-2026-108

Missing Authorization vulnerability in Drupal Data field allows Forceful Browsing. This issue affects Data field versions: from 0.0.0 to 2.0.13...

EUVD-2026-70002

Missing Authorization vulnerability in Drupal Digital Signage Framework allows Forceful Browsing. This issue affects Digital Signage Framework versions: from 0.0.0 to 2.6.1...

CVE-2026-81166 Digital Signage Framework - Moderately critical - Access bypass - SA-CONTRIB-2026-109

Missing Authorization vulnerability in Drupal Digital Signage Framework allows Forceful Browsing. This issue affects Digital Signage Framework versions: from 0.0.0 to 2.6.1...

CVE-2026-81166

A missing authorization vulnerability in the Drupal Digital Signage Framework module (versions 0.0.0 through 2.6.1 ) allows forceful browsing . The module provides a route intended for signage devices to refresh dynamic blocks on a display, but it fails to verify whether the requester is an autho...

EUVD-2026-70001

Insertion of Sensitive Information Into Sent Data vulnerability in Drupal DXPR Builder: The Best Editing AI Experience for Drupal allows Forceful Browsing. This issue affects DXPR Builder: The Best Editing AI Experience for Drupal versions: from 0.0.0 to 2.8.1...