CVE-2026-16643

CVE-2026-16643 affects the Drupal Lunr exposed filters contrib module across all versions (*.*). The Drupal security team has marked the project as unsupported , noting that a known security issue exists within the exposed filters but has not been fixed by the maintainer. The vulnerability carrie...

CVE-2026-16644 Webform REST - Moderately critical - Access bypass - SA-CONTRIB-2026-087

Incorrect Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. This issue affects Webform REST versions: from 0.0.0 to 4.1.0...

CVE-2026-16644

Drupal Webform REST (a contrib module enabling retrieval and submission of webform submissions via REST endpoints) contains an Incorrect Authorization flaw that allows Forceful Browsing . The module fails to sufficiently verify the parent webform's permissions for creating, viewing, and updating ...

CVE-2026-16644 Webform REST - Moderately critical - Access bypass - SA-CONTRIB-2026-087

Incorrect Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. This issue affects Webform REST versions: from 0.0.0 to 4.1.0...

CVE-2026-16645

CVE-2026-16645 is a missing authorization vulnerability in the PhotoSwipe – Responsive JavaScript Modal Image Gallery Drupal module. The module fails to sufficiently check access permissions when viewing an image via the photoswipe gallery display formatter, enabling forceful browsing and potenti...

CVE-2026-16645 PhotoSwipe - Responsive JavaScript Modal Image Gallery - Moderately critical - Access bypass - SA-CONTRIB-2026-088

Missing Authorization vulnerability in Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery allows Forceful Browsing. This issue affects PhotoSwipe - Responsive JavaScript Modal Image Gallery versions: from 0.0.0 to 3.2.0...

CVE-2026-16645 PhotoSwipe - Responsive JavaScript Modal Image Gallery - Moderately critical - Access bypass - SA-CONTRIB-2026-088

Missing Authorization vulnerability in Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery allows Forceful Browsing. This issue affects PhotoSwipe - Responsive JavaScript Modal Image Gallery versions: from 0.0.0 to 3.2.0...

CVE-2026-15088

Drupal Development Environment (a Drupal contrib module) is affected by a Critical -severity security issue across all versions (. ). The Drupal security team has marked the project as unsupported , meaning the maintainer has not provided a fix and no patched version is currently available. The C...

CVE-2026-15088 Development Environment - Critical - Unsupported - SA-CONTRIB-2026-089

Vulnerability in Drupal Development Environment. This issue affects Development Environment versions:...

CVE-2026-18259 Token Content Access - Moderately critical - Access bypass - SA-CONTRIB-2026-090

Observable Timing Discrepancy vulnerability in Drupal Token Content Access allows Brute Force. This issue affects Token Content Access versions: from 0.0.0 to 3.1.2...

CVE-2026-18259

Drupal Token Content Access (versions 0.0.0 through 3.1.2 ) contains an observable timing discrepancy in its access token comparison logic. Because the module does not sufficiently protect the token comparison in some cases, a persistent attacker who knows or discovers a URL for protected content...

CVE-2026-18259 Token Content Access - Moderately critical - Access bypass - SA-CONTRIB-2026-090

Observable Timing Discrepancy vulnerability in Drupal Token Content Access allows Brute Force. This issue affects Token Content Access versions: from 0.0.0 to 3.1.2...

CVE-2026-18260 Disable Login Page - Moderately critical - Access bypass - SA-CONTRIB-2026-110

Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Disable Login Page allows Brute Force. This issue affects Disable Login Page versions: from 0.0.0 to 1.1.4...

CVE-2026-18260 Disable Login Page - Moderately critical - Access bypass - SA-CONTRIB-2026-110

Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Disable Login Page allows Brute Force. This issue affects Disable Login Page versions: from 0.0.0 to 1.1.4...

CVE-2026-18260

CVE-2026-18260 affects the Drupal Disable Login Page contrib module, with all versions impacted. The project has been marked as unsupported by the Drupal security team, and the maintainer has not provided a fix, meaning no patched release is currently available. The CVSS 3.1 score is 5.7 (Medium)...

CVE-2026-18260 Disable Login Page - Moderately critical - Access bypass - SA-CONTRIB-2026-110

Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Disable Login Page allows Brute Force. This issue affects Disable Login Page versions: from 0.0.0 to 1.1.4...

CVE-2026-18261

Drupal Powerful Surveys module is affected across all versions (. ). The specific root cause is not detailed in the provided documents, but the issue is classified as Critical by the Drupal security team and scored CVSS 3.1: 5.7 (Medium) with high confidentiality and integrity impact but no avail...

CVE-2026-18261 Powerful Surveys - Critical - Unsupported - SA-CONTRIB-2026-092

Vulnerability in Drupal Powerful Surveys. This issue affects Powerful Surveys versions:...

CVE-2026-18985 Edit in-place field - Moderately critical - Access bypass - SA-CONTRIB-2026-093

Incorrect Authorization vulnerability in Drupal Edit in-place field allows Forceful Browsing. This issue affects Edit in-place field versions: from 0.0.0 to 2.1.1...

CVE-2026-18985 Edit in-place field - Moderately critical - Access bypass - SA-CONTRIB-2026-093

Incorrect Authorization vulnerability in Drupal Edit in-place field allows Forceful Browsing. This issue affects Edit in-place field versions: from 0.0.0 to 2.1.1...