PT-2026-89241

This module enables you to manage content deletion and provides reports for identifying orphaned content. The module doesn't sufficiently sanitize node titles when displaying the orphaned nodes report. This leads to a persistent cross-site scripting vulnerability XSS. This vulnerability is...

SAML SSO - Service Provider - Moderately critical - Embedded credentials - SA-CONTRIB-2026-148

This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider. The module contains embedded credentials used by the functionality provided by the module. Under certain circumstances, these credentials could...

CVE-2026-49311: Undefined Security Weakness

Permission control vulnerability in the event notification module.Impact: Successful exploitation of this vulnerability may affect availability...

CVE-2026-49312: Undefined Security Weakness

Permission control vulnerability in the window module. Impact: Successful exploitation of this vulnerability may affect service confidentiality...

CVE-2026-49310: Undefined Security Weakness

Permission control vulnerability in the event notification module. Impact: Successful exploitation of this vulnerability may affect service confidentiality...

CVE-2026-49309: Undefined Security Weakness

Permission control vulnerability in the Settings module. Impact: Successful exploitation of this vulnerability may affect service confidentiality...

CVE-2026-49313: Undefined Security Weakness

Permission control vulnerability in the app lock module. Impact: Successful exploitation of this vulnerability may affect service confidentiality...

CVE-2026-41987: Undefined Security Weakness

Permission control vulnerability in the app management module. Impact: Successful exploitation of this vulnerability may affect availability...

CVE-2026-16272: Use of Less Trusted Source

Use of less trusted source vulnerability in PayTR Payment and Electronic Money Institution Inc. PayTR Virtual Pos iFrame API WHMCS Module allows Exploitation of Trusted Identifiers. This issue affects PayTR Virtual Pos iFrame API WHMCS Module: from v9.0.0 before v9.0.3...

VulnCheck KEV: CVE-2026-80099

Several Newfold plugins are vulnerable to Authentication Bypass. The vulnerability exists because the plugins bundle the wp-module-data module. In the module, the authenticate method — registered on the restauthenticationerrors filter and therefore evaluated for every unauthenticated REST API...

PT-2026-89264

Name of the Vulnerable Software and Affected Versions Builderall for WordPress versions prior to 3.0.3 Description Stored Cross-Site Scripting XSS occurs due to insufficient input sanitization and output escaping in the Photo Module attributes setting. This allows authenticated attackers with...

SAML SSO - Service Provider - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-146

This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider. The module does not sufficiently sanitize user-supplied data before displaying it in generated HTML leading to a cross-site scripting...

PT-2026-88808

Permission control vulnerability in the app lock module. Impact: Successful exploitation of this vulnerability may affect service confidentiality...

CVE-2026-71807

The RuoYi-Cloud-Plus software (version

PT-2026-88801

DoS vulnerability in the preview service module. Impact: Successful exploitation of this vulnerability may affect availability...

PT-2026-89247

This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider. The module does not sufficiently sanitize user-supplied data before displaying it in generated HTML leading to a cross-site scripting...

PT-2026-88809

DoS vulnerability in the input device module. Impact: Successful exploitation of this vulnerability may affect availability...

PT-2026-89240

This module enables you to add key-based authentication on a per-user basis. The module doesn't cache per user, potentially allowing an attacker to view another user's authentication keys, if the attacker has the same permissions. This vulnerability is mitigated by the fact that the site must hav...

PT-2026-88807

Permission control vulnerability in the Settings module. Impact: Successful exploitation of this vulnerability may affect service confidentiality...

PT-2026-89248

This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider. The module does not sufficiently sanitize certain values derived from SAML assertions before displaying them to users. A malicious identity...