563 matches found
CVE-2026-81165
Drupal Blazy (a Drupal contrib module) has an incorrect authorization vulnerability that allows forceful browsing . The module's Filter plugin shortcode does not consistently check entity view access, enabling a user with access to a Blazy-enabled text format to render a field from an entity they...
CVE-2026-81269 Data field - Moderately critical - Information disclosure - SA-CONTRIB-2026-108
Missing Authorization vulnerability in Drupal Data field allows Forceful Browsing. This issue affects Data field versions: from 0.0.0 to 2.0.13...
EUVD-2026-70003
Missing Authorization vulnerability in Drupal Data field allows Forceful Browsing. This issue affects Data field versions: from 0.0.0 to 2.0.13...
CVE-2026-81269
CVE-2026-81269 is a missing-authorization vulnerability in the Drupal Data field contrib module (versions 0.0.0 through 2.0.13). The module exposes structured data values through JSON endpoints but does not sufficiently check access permissions before returning them. As a result, anonymous users ...
CVE-2026-81269 Data field - Moderately critical - Information disclosure - SA-CONTRIB-2026-108
Missing Authorization vulnerability in Drupal Data field allows Forceful Browsing. This issue affects Data field versions: from 0.0.0 to 2.0.13...
EUVD-2026-70002
Missing Authorization vulnerability in Drupal Digital Signage Framework allows Forceful Browsing. This issue affects Digital Signage Framework versions: from 0.0.0 to 2.6.1...
CVE-2026-81166 Digital Signage Framework - Moderately critical - Access bypass - SA-CONTRIB-2026-109
Missing Authorization vulnerability in Drupal Digital Signage Framework allows Forceful Browsing. This issue affects Digital Signage Framework versions: from 0.0.0 to 2.6.1...
CVE-2026-81166
A missing authorization vulnerability in the Drupal Digital Signage Framework module (versions 0.0.0 through 2.6.1 ) allows forceful browsing . The module provides a route intended for signage devices to refresh dynamic blocks on a display, but it fails to verify whether the requester is an autho...
EUVD-2026-70001
Insertion of Sensitive Information Into Sent Data vulnerability in Drupal DXPR Builder: The Best Editing AI Experience for Drupal allows Forceful Browsing. This issue affects DXPR Builder: The Best Editing AI Experience for Drupal versions: from 0.0.0 to 2.8.1...
CVE-2026-81162
CVE-2026-81162 is an information disclosure vulnerability in the DXPR Builder Drupal contrib module (versions 0.0.0 through 2.8.1). The module uses a JSON Web Token (JWT) for licensing, AI services, and subscription metadata. In the 2.x version, the token is not sufficiently restricted in JavaScr...
CVE-2026-81162 DXPR Builder: The AI Visual Page Builder for Drupal - Moderately critical - Information Disclosure - SA-CONTRIB-2026-112
Insertion of Sensitive Information Into Sent Data vulnerability in Drupal DXPR Builder: The Best Editing AI Experience for Drupal allows Forceful Browsing. This issue affects DXPR Builder: The Best Editing AI Experience for Drupal versions: from 0.0.0 to 2.8.1...
CVE-2026-81158
The Drupal Entity API contrib module (versions 0.0.0 through 1.8.0 ) contains an incorrect authorization flaw in its JSON:API entity collection endpoints , where access controls are not correctly applied, allowing forceful browsing and resulting in information disclosure . The vulnerability requi...
EUVD-2026-70000
Incorrect Authorization vulnerability in Drupal Entity API allows Forceful Browsing. This issue affects Entity API versions: from 0.0.0 to 1.8.0...
CVE-2026-81164
CVE-2026-81164 is a Missing Authorization vulnerability in the Drupal Entity PDF module (versions 0.0.0 through 2.1.5 ). The module fails to check entity view access when fetching a PDF route, enabling forceful browsing : an authenticated user may access a PDF of an entity they are not authorized...
CVE-2026-81164 Entity PDF - Moderately critical - Access bypass - SA-CONTRIB-2026-114
Missing Authorization vulnerability in Drupal Entity PDF allows Forceful Browsing. This issue affects Entity PDF versions: from 0.0.0 to 2.1.5...
EUVD-2026-69999
Missing Authorization vulnerability in Drupal Entity PDF allows Forceful Browsing. This issue affects Entity PDF versions: from 0.0.0 to 2.1.5...
CVE-2026-16645
A flaw was found in PhotoSwipe - Responsive JavaScript Modal Image Gallery. This missing authorization vulnerability allows an attacker to perform forceful browsing, potentially leading to unauthorized access to sensitive information or resources. By exploiting this flaw, an attacker can bypass...
CVE-2026-16645
Missing Authorization vulnerability in Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery allows Forceful Browsing. This issue affects PhotoSwipe - Responsive JavaScript Modal Image Gallery versions: from 0.0.0 to 3.2.0...