1212325 matches found
CVE-2026-16638 Media Folders - Moderately critical - Cross site scripting - SA-CONTRIB-2026-080
Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Media Folders allows Stored XSS. This issue affects Media Folders versions: from 0.0.0 to 1.0.8...
CVE-2026-16638
Drupal Media Folders (versions 0.0.0 through 1.0.8) contains a stored cross-site scripting (XSS) vulnerability. The module does not sufficiently sanitize the names and descriptions of media items and folders when displayed in the media browser, allowing an attacker with permission to create or ed...
CVE-2026-16638 Media Folders - Moderately critical - Cross site scripting - SA-CONTRIB-2026-080
Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Media Folders allows Stored XSS. This issue affects Media Folders versions: from 0.0.0 to 1.0.8...
CVE-2026-16638 Media Folders - Moderately critical - Cross site scripting - SA-CONTRIB-2026-080
Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Media Folders allows Stored XSS. This issue affects Media Folders versions: from 0.0.0 to 1.0.8...
CVE-2026-16639 Internationalization Single Sign-On - Critical - Access bypass - SA-CONTRIB-2026-081
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Internationalization Single Sign-On allows Authentication Bypass. This issue affects Internationalization Single Sign-On versions: from 0.0.0 to 1.8.0...
CVE-2026-16639
CVE-2026-16639 is a critical authentication bypass in the Drupal Internationalization Single Sign-On module (versions 0.0.0 through 1.8.0). The module, used in multilingual websites with separate domain names per language, fails to sufficiently validate a short-lived token , allowing an attacker ...
CVE-2026-16639 Internationalization Single Sign-On - Critical - Access bypass - SA-CONTRIB-2026-081
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Internationalization Single Sign-On allows Authentication Bypass. This issue affects Internationalization Single Sign-On versions: from 0.0.0 to 1.8.0...
CVE-2026-16640 Search API Autocomplete - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-082
Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Search API Autocomplete allows Reflected XSS. This issue affects Search API Autocomplete versions: from 0.0.0 to 1.12.0...
CVE-2026-16640
Drupal Search API Autocomplete (versions 0.0.0 through 1.12.0) is affected by a Reflected XSS vulnerability. The root cause is a test script that is accessible to anonymous users and fails to sufficiently validate user input, allowing malicious scripts to be injected and reflected back. The issue...
CVE-2026-16640 Search API Autocomplete - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-082
Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Search API Autocomplete allows Reflected XSS. This issue affects Search API Autocomplete versions: from 0.0.0 to 1.12.0...
CVE-2026-16646
PanKM is a Drupal contrib module affected across all versions (. ). Drupal's security team has marked the project unsupported , indicating a known security issue that the maintainer has not fixed. The vulnerability is rated Critical by Drupal, with a CVSS 3.1 base score of 5.7 (Medium) (AV:N/AC:H...
CVE-2026-16646 PanKM - Critical - Unsupported - SA-CONTRIB-2026-083
Vulnerability in Drupal PanKM. This issue affects PanKM versions:...
CVE-2026-16646 PanKM - Critical - Unsupported - SA-CONTRIB-2026-083
Vulnerability in Drupal PanKM. This issue affects PanKM versions:...
CVE-2026-16641 Commerce Elavon - Critical - Unsupported - SA-CONTRIB-2026-084
Vulnerability in Drupal Commerce Elavon. This issue affects Commerce Elavon versions:...
CVE-2026-16641 Commerce Elavon - Critical - Unsupported - SA-CONTRIB-2026-084
Vulnerability in Drupal Commerce Elavon. This issue affects Commerce Elavon versions:...
CVE-2026-16641
CVE-2026-16641 affects the Drupal Commerce Elavon contrib module, with all versions (. ) impacted. The project has been marked unsupported by the Drupal security team, and the known security issue remains unaddressed by the maintainer . No specific root cause or fixed version is provided in the a...
CVE-2026-16642
Drupal Email Login OTP (a Drupal contrib module) has a critical-severity security issue affecting all versions (. ). The Drupal security team has marked the project unsupported , meaning the maintainer has not provided a fix. The CNA-assigned CVSS 3.1 score is 5.7 (MEDIUM) with a vector requiring...
CVE-2026-16642 Email Login OTP - Critical - Unsupported - SA-CONTRIB-2026-085
Vulnerability in Drupal Email Login OTP. This issue affects Email Login OTP versions:...