CVE-2026-84921 Webform Submissions Delete - Moderately critical - Access bypass - SA-CONTRIB-2026-133

Missing Authorization vulnerability in Drupal Webform Submissions Delete allows Forceful Browsing. This issue affects Webform Submissions Delete versions: from 0.0.0 to 1.2.0...

CVE-2026-84921

The Webform Submissions Delete module for Drupal, affecting versions 0.0.0 through 1.2.0 , contains a Missing Authorization vulnerability. The root cause is that the module does not sufficiently restrict access to the delete form, allowing for Forceful Browsing . An unauthorized user can exploit ...

CVE-2026-87943 SAML SSO - Service Provider - Critical - Improper access control - SA-CONTRIB-2026-141

Missing Authorization vulnerability in Drupal SAML SSO - Service Provider allows Forceful Browsing. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0...

CVE-2026-87943 SAML SSO - Service Provider - Critical - Improper access control - SA-CONTRIB-2026-141

Missing Authorization vulnerability in Drupal SAML SSO - Service Provider allows Forceful Browsing. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0...

EUVD-2026-107858

Missing Authorization vulnerability in Drupal SAML SSO - Service Provider allows Forceful Browsing. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0...

CVE-2026-87943

The Drupal SAML SSO - Service Provider module (specifically the miniorange_saml module) is vulnerable to a Missing Authorization flaw in versions 0.0.0 through 3.2.0 . The root cause is that the module fails to correctly restrict access to specific administrative functionality, which allows unaut...

CVE-2026-87943 SAML SSO - Service Provider - Critical - Improper access control - SA-CONTRIB-2026-141

Missing Authorization vulnerability in Drupal SAML SSO - Service Provider allows Forceful Browsing. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0...

EUVD-2026-107847

Missing Authorization vulnerability in Drupal Taxonomy Term Glossary allows Forceful Browsing. This issue affects Taxonomy Term Glossary versions: from 0.0.0 to 4.6.0...

EUVD-2026-107846

Missing Authorization vulnerability in Drupal Ultimate Table Field allows Forceful Browsing. This issue affects Ultimate Table Field versions: from 0.0.0 to 1.1.1, from 2.0.0 to 2.0.1...

EUVD-2026-107815

Missing Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. This issue affects Webform REST versions: from 0.0.0 to 4.2.1...

EUVD-2026-107812

Missing Authorization vulnerability in Drupal CSS Usage Analyzer allows Forceful Browsing. This issue affects CSS Usage Analyzer versions: from 1.0.0 to 1.0.2...

EUVD-2026-107811

Missing Authorization vulnerability in Drupal Smart Content allows Forceful Browsing. This issue affects Smart Content versions: from 0.0.0 to 3.2.1...

CVE-2026-13319

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.10 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, could have allowed an authenticated to read milestone metadata, including titles, descriptions, and full project paths, from arbitrary private projects...

PT-2026-121306

Missing Authorization vulnerability in ACF Extended ACF Extended acf-extended allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ACF Extended: from n/a through 0.9.2.7...

PT-2026-121312

Name of the Vulnerable Software and Affected Versions ЮKassa для WooCommerce versions prior to 2.17.3 Description An authorization flaw in the yoomoney ЮKassa для WooCommerce plugin allows the exploitation of incorrectly configured access control security levels. Recommendations Update to a versi...

PT-2026-121309

Missing Authorization vulnerability in Ahmad Majestic Support majestic-support allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Majestic Support: from n/a through 1.2.1...

PT-2026-121412

Missing authorization in the PAM AD computer import endpoint in Devolutions Server 2026.3.5.0 through 2026.3.10.0 and 2026.2.20.0 and earlier allows an authenticated non-administrative user with a PAM license to create PAM sub-providers under existing AD providers via a crafted import request...

CVE-2026-93336

Missing authorization in the unit resources download route in Canonical Juju 4.0 through 4.0.15 allows a controller-authenticated principal a unit agent, or a user with only login permission to read any application's charm resource in any model, including container-registry credentials, via a...

PT-2026-121280

Missing Authorization vulnerability in Kings Plugins MarketKing marketking-multivendor-marketplace-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MarketKing: from n/a through 2.1.72...

PT-2026-121282

Missing Authorization vulnerability in WP Chill Strong Testimonials strong-testimonials allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Strong Testimonials: from n/a through 3.3.14...