CVE-2026-73476

Drupal External Authentication (versions 0.0.0 through 2.0.13 ) is affected by an improper handling of case sensitivity flaw that allows privilege escalation . The module fails to ensure exact matching of externally supplied identity values when storing and looking up authentication mappings unde...

CVE-2026-73477

CVE-2026-73477 is an incorrect authorization vulnerability in the Drupal Quick Tabs module (versions 0.0.0 through 4.3.1). The module failed to correctly enforce access when rendering node and block tabs: it treated a neutral access result as a grant for node tabs and block plugins, and performed...

CVE-2026-76757

CVE-2026-76757 affects the Drupal Gammu SMS Daemon contrib module across all versions (. ). The Drupal security team has marked the project as unsupported , and the known security flaw remains unaddressed by the maintainer. No specific root cause or affected function is identified in the provided...

CVE-2026-76756

CVE-2026-76756 affects the Drupal Gammu SMS Daemon module across all versions. The Drupal security team has marked the project as unsupported , with the security flaw remaining unaddressed by the maintainer . The CVSS 3.1 score is 5.9 (Medium) , with high confidentiality and integrity impact but ...

CVE-2026-76755

Drupal Gammu SMS Daemon (a Drupal contrib module) has an unpatched security vulnerability. The project has been marked unsupported by the Drupal security team, meaning the maintainer has not addressed the flaw and no fixed version is currently available. The CVSS 3.1 score is 5.9 (MEDIUM) , with ...

CVE-2026-76758

Drupal Link content parser is affected by a vulnerability tracked as SA-CONTRIB-2026-101 . The Drupal security team has marked the project unsupported due to a known security issue that has not been fixed by the maintainer. Affected versions are listed as all versions (. ), and no patched release...

CVE-2026-76782

CVE-2026-76782 affects the Drupal Screenshot contrib module across all versions (. ). The Drupal security team has marked the project as unsupported , meaning the known security flaw remains unaddressed by the maintainer and no fixed release is currently identified. The vulnerability carries a CV...

CVE-2026-76759

CVE-2026-76759 affects the Drupal Screenshot contrib module in all versions . The Drupal security team has marked the project as unsupported , meaning the known security flaw remains unaddressed by the maintainer. The CVSS 3.1 score is 7.3 (HIGH) , with a network attack vector requiring high priv...

CVE-2026-81167

Drupal Address Suggestion (a contributed module providing address autocomplete via configured providers) is affected by a cross-site scripting (XSS) vulnerability in versions 0.0.0 through 1.0.25 . The module fails to sufficiently sanitize address suggestion data returned by configured providers....

CVE-2026-81165

Drupal Blazy (a Drupal contrib module) has an incorrect authorization vulnerability that allows forceful browsing . The module's Filter plugin shortcode does not consistently check entity view access, enabling a user with access to a Blazy-enabled text format to render a field from an entity they...

CVE-2026-81168

CVE-2026-81168 affects the Drupal CAPTCHA Protected Page module (versions 0.0.0 through 1.0.2). The module does not sufficiently validate its CAPTCHA verification cookies, allowing an unauthenticated user or automated bot to forge the cookie and bypass CAPTCHA verification entirely . This constit...

CVE-2026-81159

CVE-2026-81159 affects the Drupal Commerce CyberSource module (versions 0.0.0 through 1.10.0). The root cause is a failure to correctly verify the integrity of data returned by the CyberSource payment provider , specifically in the Secure Acceptance Hosted Checkout gateway integration. An observa...

CVE-2026-81161

Content Moderation Notifications for Drupal (versions 0.0.0 through 3.9.0) contains a privilege escalation vulnerability caused by a permission to configure email templates containing Twig code that was not marked as restricted . A site administrator may inadvertently grant this permission to les...

CVE-2026-81269

CVE-2026-81269 is a missing-authorization vulnerability in the Drupal Data field contrib module (versions 0.0.0 through 2.0.13). The module exposes structured data values through JSON endpoints but does not sufficiently check access permissions before returning them. As a result, anonymous users ...

CVE-2026-81166

A missing authorization vulnerability in the Drupal Digital Signage Framework module (versions 0.0.0 through 2.6.1 ) allows forceful browsing . The module provides a route intended for signage devices to refresh dynamic blocks on a display, but it fails to verify whether the requester is an autho...

CVE-2026-81162

CVE-2026-81162 is an information disclosure vulnerability in the DXPR Builder Drupal contrib module (versions 0.0.0 through 2.8.1). The module uses a JSON Web Token (JWT) for licensing, AI services, and subscription metadata. In the 2.x version, the token is not sufficiently restricted in JavaScr...

CVE-2026-81158

The Drupal Entity API contrib module (versions 0.0.0 through 1.8.0 ) contains an incorrect authorization flaw in its JSON:API entity collection endpoints , where access controls are not correctly applied, allowing forceful browsing and resulting in information disclosure . The vulnerability requi...

CVE-2026-81164

CVE-2026-81164 is a Missing Authorization vulnerability in the Drupal Entity PDF module (versions 0.0.0 through 2.1.5 ). The module fails to check entity view access when fetching a PDF route, enabling forceful browsing : an authenticated user may access a PDF of an entity they are not authorized...

CVE-2026-81205

CVE-2026-81205 is an LDAP injection vulnerability in the Drupal LDAP / Active Directory Integration module (versions 0.0.0 through 2.2.1). The module does not sufficiently sanitize user-supplied input before incorporating it into an LDAP search filter, allowing an unauthenticated, remote attacker...

CVE-2026-81201

Drupal Monster Menus (a contrib module for creating multisite page structures with granular permissions) is affected by a Stored XSS vulnerability in versions 0.0.0 through 9.5.3. The root cause is insufficient sanitization of HTML code in page names when rendered in the module's built-in tree br...

CVE-2026-81160

A Stored Cross-Site Scripting (XSS) vulnerability exists in the Slick UI sub-module of the Drupal Slick Carousel contrib module. The root cause is insufficient validation of user input within Slick option sets that may contain HTML for carousel buttons, allowing attackers to inject malicious scri...

CVE-2026-84217

CVE-2026-84217 is a Missing Authorization (Broken Access Control) vulnerability in the WordPress plugin Classified Listing by Mamunur Rashid, affecting versions from unknown (n/a) through 6.1.1 . The flaw allows authenticated low-privilege users to access functionality not properly constrained by...

CVE-2026-84835

CVE-2026-84835 is a Missing Authorization (Broken Access Control) vulnerability in the DimaFreund Rentsyst WordPress plugin, affecting versions through 2.1.2 . The flaw allows an unauthenticated, remote attacker to exploit incorrectly configured access control security levels, resulting in low co...

CVE-2026-66652

CVE-2026-66652 is a Cross-Site Request Forgery (CSRF) vulnerability in the ThemeGoods Grand Tour WordPress theme, affecting versions from an unspecified start through 5.5.1 . The CNA-assigned CVSS 3.1 score is 5.4 (Medium) , with a network attack vector, low complexity, no required privileges, re...

CVE-2026-84780

WP Go Maps is a WordPress plugin affected by an unauthenticated Denial of Service vulnerability in versions ≤ 10.1.08 , as reported by researcher Asim Alshaya via Patchstack. The CVSS 3.1 score is 5.3 (Medium) with a network attack vector, low complexity, and no privileges required, resulting in ...

CVE-2026-84775

CVE-2026-84775 affects the Really Simple SSL WordPress plugin, versions 9.8.0 and earlier . The vulnerability allows an unauthenticated Denial of Service attack, meaning a remote attacker with no prior access can disrupt service availability. The CVSS 3.1 base score is 5.3 (MEDIUM) , with the pri...

CVE-2026-84772

A Server-Side Request Forgery (SSRF) vulnerability was identified in the Broken Link Checker WordPress plugin, affecting versions ≤ 2.4.14 . The flaw is exploitable by users with Editor privileges, allowing them to forge server-side requests. The CVSS 3.1 score is 5.5 (Medium) with a changed scop...

CVE-2026-84771

This unauthenticated IDOR vulnerability affects the WordPress PublishPress Permissions plugin in versions 4.8.3 and earlier . Discovered by Brobicho and assigned by Patchstack , it allows a remote attacker with no privileges to access resources they should not, resulting in a low confidentiality ...

CVE-2026-84770

CVE-2026-84770 is an unauthenticated Cross-Site Request Forgery (CSRF) vulnerability in the Mang Board WP WordPress plugin, affecting versions ≤ 2.3.8 . The vulnerability was discovered by John Ryan Albon and is rated CVSS 8.8 (HIGH) with the vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, meaning a ...

CVE-2026-84760

CVE-2026-84760 is an unauthenticated Broken Access Control vulnerability in the Ultimate Gift Cards For WooCommerce WordPress plugin, affecting versions

CVE-2026-84764

CVE-2026-84764 is an unauthenticated Cross-Site Request Forgery (CSRF) vulnerability in the WordPress plugin Simply Schedule Appointments , affecting versions 1.6.12.23 and below . The flaw was discovered by Anthony Green of Greenhat Security . The assigned CVSS 3.1 score is 8.8 (High) , reflecti...

CVE-2026-84759

CVE-2026-84759 is an unauthenticated Cross-Site Request Forgery (CSRF) vulnerability in the WordPress Activity Log plugin by ArYo, affecting versions ≤ 2.13.1 . The flaw was discovered by Asim Alshaya and is rated CVSS 3.1: 7.1 (HIGH) with a vector of AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, indicati...

CVE-2026-83562

CVE-2026-83562 is a Contributor Cross Site Scripting (XSS) vulnerability in the WordPress plugin WCFM Marketplace (versions ≤ 3.8.2 ). Discovered by Ananda Dhakal via Patchstack, the flaw requires an authenticated contributor-level user and user interaction to exploit, but results in a changed sc...

CVE-2026-82223

CVE-2026-82223 affects the WP Event Solution WordPress plugin in versions 4.1.22 and earlier . The vulnerability is an Unauthenticated Broken Access Control flaw, meaning a remote attacker with no prior authentication can bypass access controls. The CVSS 3.1 score is 6.5 (Medium) , with impacts o...

CVE-2026-81775

CVE-2026-81775 affects the WordPress Estatik plugin, versions 4.3.4 and below . The vulnerability is an unauthenticated Cross-Site Scripting (XSS) flaw, meaning an attacker can inject malicious scripts without prior authentication. The CVSS 3.1 score is 7.1 (HIGH) with the vector AV:N/AC:L/PR:N/U...

CVE-2026-81772

CVE-2026-81772 affects the Ninja Forms – Layout & Styles WordPress plugin in versions ≤ 3.0.31 . The vulnerability is an unauthenticated PHP Object Injection , rated CVSS 3.1 8.8 (HIGH) with the vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating that a remote, unauthenticated attacker requiri...

CVE-2026-81774

CVE-2026-81774 affects the WooCommerce Product Attachment WordPress plugin in versions 2.3.3 and below , introducing an unauthenticated Sensitive Data Exposure vulnerability. The flaw allows a remote, unauthenticated attacker over the network to access confidential data, with a CVSS 3.1 base scor...

CVE-2026-81771

Unauthenticated Cross-Site Scripting (XSS) was identified in the WordPress TrustedSite plugin , affecting versions 1.2.5 and earlier . The flaw allows an unauthenticated attacker to inject script that executes in the context of a different site (scope changed), with low impact on confidentiality,...

CVE-2026-81769

CVE-2026-81769 is an Incorrect Privilege Assignment vulnerability in the LiquidThemes Booking Hub WordPress plugin, affecting versions up to and including 1.3.1 . The flaw allows an attacker with low privileges to escalate access, potentially compromising confidentiality, integrity, and availabil...

CVE-2026-81770

CVE-2026-81770 affects the WordPress Interactive Geo Maps plugin in versions ≤ 1.6.30 . The vulnerability is an unauthenticated Reflected Cross-Site Scripting (XSS) , meaning no prior login is required to exploit it, though user interaction is needed (CVSS 3.1: 7.1 HIGH , vector AV:N/AC:L/PR:N/UI...

CVE-2026-81294

CVE-2026-81294 is an unauthenticated privilege escalation vulnerability in the WordPress Authorizer plugin , affecting versions ≤ 3.15.1 . The flaw allows a remote attacker with no prior access to escalate privileges, rated CVSS 3.1: 9.8 (CRITICAL) — network vector, low complexity, no privileges ...

CVE-2026-81289

CVE-2026-81289 is an unauthenticated Cross-Site Scripting (XSS) vulnerability in the MP3 Audio Player for Music, Radio & Podcast by Sonaar WordPress plugin, affecting versions 5.13.1 and earlier . The vulnerability requires user interaction (victim must visit a crafted page) but needs no prior au...

CVE-2026-81288

CVE-2026-81288 is an unauthenticated Cross Site Scripting (XSS) vulnerability in the Upsell Order Bump Offer for WooCommerce WordPress plugin, affecting versions 3.1.5 and below . The CVSS v3.1 score is 7.1 (HIGH) with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L , indicating a network-based attack...

CVE-2026-81286

CVE-2026-81286 is an unauthenticated SQL Injection in the WCFM Marketplace WordPress plugin, affecting versions 3.8.1 and earlier . The CNA (Patchstack) assigns a CVSS 3.1 score of 9.3 (CRITICAL) with a changed scope, indicating high confidentiality impact and low availability impact with no requ...

CVE-2026-84781

CVE-2026-84781 is a Contributor-level Cross Site Scripting (XSS) vulnerability in the WordPress Gallery PhotoBlocks plugin, affecting versions ≤ 1.3.4 . The flaw was discovered by V1T via Patchstack. An attacker with at least Contributor privileges can inject malicious scripts that execute in ano...

CVE-2026-81283

WP User Frontend is a WordPress plugin affected by a PHP Object Injection vulnerability in versions 4.3.10 and below . The vulnerability requires low privileges (subscriber-level access), no user interaction, and a low attack complexity, making it accessible to any authenticated subscriber on a s...

CVE-2026-84808

Kimai (a self-hosted time-tracking application) versions before 2.65.0 are affected by an authorization bypass in the REST API timesheet collection endpoint. The vulnerability stems from a failure to enforce activity-team access controls : a user holding the view_other_timesheet permission can li...

CVE-2026-84807

Kimai (kimai/kimai) versions prior to 2.65.0 contain an improper authorization flaw in its default team-creation endpoints (POST /api/customers/{id}/team, POST /api/projects/{id}/team, POST /api/activities/{id}/team). An authenticated user holding project permission-management privileges can crea...

CVE-2026-84806

Kimai versions before 2.63.0 contain an improper authorization flaw in team access endpoints. Authenticated users holding team edit permissions combined with read-only access can send POST requests to team access endpoints to modify access control lists for customers, projects, or activities beyo...

CVE-2026-84805

Kimai versions 2.61.0 through 2.62.x contain an authorization bypass in the PATCH /api/users/{id}/preferences API endpoint. The WorkContractPreferenceSubscriber, introduced in 2.61.0, registers admin-only work-contract preferences as enabled without verifying the contract_other_profile permission...