EUVD-2026-107877

Missing Authorization vulnerability in Drupal Calculate Working Days allows Forceful Browsing. This issue affects Calculate Working Days versions: from 0.0.0 to 2.0.3...

EUVD-2026-107873

Missing Authorization vulnerability in Drupal Islandora allows Forceful Browsing. This issue affects Islandora versions: from 0.0.0 to 2.19.0...

CVE-2026-84921

The Webform Submissions Delete module for Drupal, affecting versions 0.0.0 through 1.2.0 , contains a Missing Authorization vulnerability. The root cause is that the module does not sufficiently restrict access to the delete form, allowing for Forceful Browsing . An unauthorized user can exploit ...

CVE-2026-84921 Webform Submissions Delete - Moderately critical - Access bypass - SA-CONTRIB-2026-133

Missing Authorization vulnerability in Drupal Webform Submissions Delete allows Forceful Browsing. This issue affects Webform Submissions Delete versions: from 0.0.0 to 1.2.0...

EUVD-2026-107866

Missing Authorization vulnerability in Drupal Webform Submissions Delete allows Forceful Browsing. This issue affects Webform Submissions Delete versions: from 0.0.0 to 1.2.0...

CVE-2026-84921 Webform Submissions Delete - Moderately critical - Access bypass - SA-CONTRIB-2026-133

Missing Authorization vulnerability in Drupal Webform Submissions Delete allows Forceful Browsing. This issue affects Webform Submissions Delete versions: from 0.0.0 to 1.2.0...

CVE-2026-87943 SAML SSO - Service Provider - Critical - Improper access control - SA-CONTRIB-2026-141

Missing Authorization vulnerability in Drupal SAML SSO - Service Provider allows Forceful Browsing. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0...

EUVD-2026-107858

Missing Authorization vulnerability in Drupal SAML SSO - Service Provider allows Forceful Browsing. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0...

CVE-2026-87943 SAML SSO - Service Provider - Critical - Improper access control - SA-CONTRIB-2026-141

Missing Authorization vulnerability in Drupal SAML SSO - Service Provider allows Forceful Browsing. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0...

CVE-2026-87943

The Drupal SAML SSO - Service Provider module (specifically the miniorange_saml module) is vulnerable to a Missing Authorization flaw in versions 0.0.0 through 3.2.0 . The root cause is that the module fails to correctly restrict access to specific administrative functionality, which allows unaut...

CVE-2026-87943 SAML SSO - Service Provider - Critical - Improper access control - SA-CONTRIB-2026-141

Missing Authorization vulnerability in Drupal SAML SSO - Service Provider allows Forceful Browsing. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0...

EUVD-2026-107847

Missing Authorization vulnerability in Drupal Taxonomy Term Glossary allows Forceful Browsing. This issue affects Taxonomy Term Glossary versions: from 0.0.0 to 4.6.0...

EUVD-2026-107846

Missing Authorization vulnerability in Drupal Ultimate Table Field allows Forceful Browsing. This issue affects Ultimate Table Field versions: from 0.0.0 to 1.1.1, from 2.0.0 to 2.0.1...

EUVD-2026-107815

Missing Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. This issue affects Webform REST versions: from 0.0.0 to 4.2.1...

EUVD-2026-107812

Missing Authorization vulnerability in Drupal CSS Usage Analyzer allows Forceful Browsing. This issue affects CSS Usage Analyzer versions: from 1.0.0 to 1.0.2...

EUVD-2026-107811

Missing Authorization vulnerability in Drupal Smart Content allows Forceful Browsing. This issue affects Smart Content versions: from 0.0.0 to 3.2.1...

CVE-2026-13319

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.10 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, could have allowed an authenticated to read milestone metadata, including titles, descriptions, and full project paths, from arbitrary private projects...

PT-2026-121513

Missing Authorization CWE-862 in the user API of Roskus Prospero Flow CRM from 2.0.0 before 5.26.0 allows a user with a basic role to read the accounts of other users of its own company, including accounts with higher privileges, and, in versions from 3.5.0, to delete them, because the routes GET...

PT-2026-121412

Missing authorization in the PAM AD computer import endpoint in Devolutions Server 2026.3.5.0 through 2026.3.10.0 and 2026.2.20.0 and earlier allows an authenticated non-administrative user with a PAM license to create PAM sub-providers under existing AD providers via a crafted import request...

PT-2026-120943

OpenRemote 1.2.0 before 1.31.0 contains a missing authorization vulnerability in GatewayServiceResource that allows any authenticated user to start, stop and query gateway tunnels without an administrative role. Attackers can send POST or DELETE requests to the gateway tunnel endpoint to open...