CVE-2026-81162

CVE-2026-81162 is an information disclosure vulnerability in the DXPR Builder Drupal contrib module (versions 0.0.0 through 2.8.1). The module uses a JSON Web Token (JWT) for licensing, AI services, and subscription metadata. In the 2.x version, the token is not sufficiently restricted in JavaScr...

CVE-2026-81162 DXPR Builder: The AI Visual Page Builder for Drupal - Moderately critical - Information Disclosure - SA-CONTRIB-2026-112

Insertion of Sensitive Information Into Sent Data vulnerability in Drupal DXPR Builder: The Best Editing AI Experience for Drupal allows Forceful Browsing. This issue affects DXPR Builder: The Best Editing AI Experience for Drupal versions: from 0.0.0 to 2.8.1...

CVE-2026-81158

The Drupal Entity API contrib module (versions 0.0.0 through 1.8.0 ) contains an incorrect authorization flaw in its JSON:API entity collection endpoints , where access controls are not correctly applied, allowing forceful browsing and resulting in information disclosure . The vulnerability requi...

EUVD-2026-70000

Incorrect Authorization vulnerability in Drupal Entity API allows Forceful Browsing. This issue affects Entity API versions: from 0.0.0 to 1.8.0...

CVE-2026-81164

CVE-2026-81164 is a Missing Authorization vulnerability in the Drupal Entity PDF module (versions 0.0.0 through 2.1.5 ). The module fails to check entity view access when fetching a PDF route, enabling forceful browsing : an authenticated user may access a PDF of an entity they are not authorized...

CVE-2026-81164 Entity PDF - Moderately critical - Access bypass - SA-CONTRIB-2026-114

Missing Authorization vulnerability in Drupal Entity PDF allows Forceful Browsing. This issue affects Entity PDF versions: from 0.0.0 to 2.1.5...

EUVD-2026-69999

Missing Authorization vulnerability in Drupal Entity PDF allows Forceful Browsing. This issue affects Entity PDF versions: from 0.0.0 to 2.1.5...

CVE-2026-81205 LDAP / Active Directory Integration - Moderately critical - Information Disclosure - SA-CONTRIB-2026-115

Improper Neutralization of Special Elements used in an LDAP Query 'LDAP Injection' vulnerability in Drupal LDAP / Active Directory Integration allows LDAP Injection. This issue affects LDAP / Active Directory Integration versions: from 0.0.0 to 2.2.1...

EUVD-2026-69998

Improper Neutralization of Special Elements used in an LDAP Query 'LDAP Injection' vulnerability in Drupal LDAP / Active Directory Integration allows LDAP Injection. This issue affects LDAP / Active Directory Integration versions: from 0.0.0 to 2.2.1...

CVE-2026-81205

CVE-2026-81205 is an LDAP Injection vulnerability in the Drupal LDAP / Active Directory Integration contrib module (versions 0.0.0 through 2.2.1 ). The module enables user authentication via LDAP or Active Directory but does not sufficiently sanitize user-supplied input before incorporating it in...

CVE-2026-81201 Monster Menus - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-116

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Monster Menus allows Stored XSS. This issue affects Monster Menus versions: from 0.0.0 to 9.5.3...

CVE-2026-81201

Drupal Monster Menus (a Drupal contrib module) contains a Stored Cross-site Scripting (XSS) vulnerability. The module does not sufficiently sanitize HTML code in the page name when rendered in its built-in tree browser, allowing an attacker to execute arbitrary JavaScript in the context of a user...

EUVD-2026-69997

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Monster Menus allows Stored XSS. This issue affects Monster Menus versions: from 0.0.0 to 9.5.3...

EUVD-2026-69996

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Slick Carousel allows Stored XSS. This issue affects Slick Carousel versions: from 0.0.0 to 2.1.0...

CVE-2026-81160

A Stored Cross-Site Scripting (XSS) vulnerability exists in the Slick UI sub-module of the Drupal Slick Carousel contrib module. The root cause is insufficient validation of user input within Slick option sets that may contain HTML for carousel buttons, allowing attackers to inject malicious scri...

DRUPAL-CONTRIB-2026-117

Slick UI, a sub-module of Slick, enables you to add Slick option sets that may contain HTML for carousel buttons. Previous releases of the module did not sufficiently validate user input, leading to a Cross Site Scripting XSS vulnerability. Note: This vulnerability was fixed in 8.x-2.1 but that w...

DRUPAL-CONTRIB-2026-116

This module enables you to create one or more multisites with highly granular page permissions. The module doesn't sufficiently sanitize HTML code contained in the page name when displayed in the built-in tree browser. This results in a cross-site scripting vulnerability that may allow attackers ...

DRUPAL-CONTRIB-2026-115

This module enables users to authenticate using LDAP or Active Directory credentials. The module does not sufficiently sanitize user-supplied input before incorporating it into an LDAP search filter. This allows an attacker to discover additional information they should not normally be able to...

DRUPAL-CONTRIB-2026-114

The Entity PDF module can create a PDF from any entity based on any View mode. This module does not check entity view access when fetching a PDF route. This could result in a user accessing a PDF of an entity that they should not be able to view...

DRUPAL-CONTRIB-2026-113

The Entity API module extends the Drupal core entity API to provide a unified way to deal with entities and their properties. The module doesn't correctly apply access controls for JSON:API entity collection endpoints. This exposes an information disclosure vulnerability. This vulnerability is...