CVE-2026-55807

Drupal core is affected by CVE-2026-55807 via a Server-Side Request Forgery (SSRF) in the Media module’s oEmbed URL discovery, allowing the server to be induced to fetch arbitrary URLs. Affected versions include Drupal core from 0.0.0 up to 10.5.12, 10.6.0–10.6.11, 11.2.0–11.2.14, 11.3.0–11.3.12,...

CVE-2026-55806

CVE-2026-55806 affects Drupal core and is caused by a flaw in the rebuild.php front controller’s Host header validation, enabling an open redirect and related cache-poisoning risks. Affected versions include Drupal core 10.5.x before 10.5.12, 10.6.x before 10.6.11, 11.2.x before 11.2.14, and 11.3...

CVE-2026-55804

CVE-2026-55804 affects Drupal core across multiple branches (10.x, 11.x) and is related to a chain of gadget methods that could enable code execution or altered behavior when untrusted data is deserialized. The core issue is described as Improperly Controlled Modification of Dynamically-Determine...

CVE-2026-55803

Drupal core is affected by CVE-2026-55803: Improperly Controlled Modification of Dynamically-Determined Object Attributes, enabling PHP object injection via deserialization. Affected versions include 0.0.0–10.5.12, 10.6.0–10.6.11, 11.2.0–11.2.14, 11.3.0–11.3.12, and 0.0.0–11.0.* / 11.1.*. Remedia...

CVE-2026-15085

The affected software is the Drupal AI SEO/GEO Analyzer module. It is vulnerable to Stored Cross‑site Scripting (XSS) in versions 0.0.0 through 1.1.3. The root cause, as described in the connected DRUPAL-SA-CONTRIB-2026-076 entry and PT-2026-56665, is that the module sends entity content (includi...

CVE-2026-15084

The issue is a Stored XSS in Drupal UI Patterns (SDC in Drupal UI) caused by insufficient sanitization in versions 2.0.0–2.0.17. An attacker must have permissions to create/update content rendered by UI Patterns. Remediation: upgrade to a version later than 2.0.17.

CVE-2026-15083

Summary: CVE-2026-15083 affects the Drupal ECA: Event - Condition - Action (ECA) module. The issue is an unitary vulnerability where an Improperly Controlled Modification of Dynamically-Determined Object Attributes can lead to Object Injection. Affected versions: ECA: Event - Condition - Action i...

CVE-2026-15082

CVE-2026-15082 affects Drupal Siteimprove Analytics module; versions 0.0.0 through 2.0.1 are vulnerable to Cross-site Scripting (XSS) due to improper neutralization during web page generation. The root cause is insufficient sanitization of the Siteimprove Analytics identification code when insert...

CVE-2026-15081

CVE-2026-15081 affects Drupal Location Selector module (versions 0.0.0–1.3.0). The vulnerability arises from a Views filter that does not sufficiently sanitize user input, allowing improper neutralization of special elements in an SQL command (SQL Injection). Impact is_high confidentiality and in...

CVE-2026-15080

Summary: CVE-2026-15080 is a CSRF vulnerability in Ray Enterprise Translation for Drupal. The issue affects versions 0.0.0–4.0.4, 4.1.0–4.1.4, and 11.0.0–11.0.4. The root cause, as described in the connected PT-2026-56660 entry, is that the module fails to protect several state-changing administr...

CVE-2026-15079

The CVE-2026-15079 entry concerns the Drupal Login Disable module, affected on versions 0.0.0 through 2.1.4. The underlying issue is an improper restriction of excessive authentication attempts, which can enable brute-force login attempts to bypass protection. The attack surface is the Drupal log...

CVE-2026-58591

Drupal Colorbox CVE-2026-58591 exhibits an XSS due to improper input neutralization during web page generation. Affected Colorbox for Drupal: 0.0.0–2.1.5 and 0.0.0–2.2.0. Root cause: module does not sufficiently protect against HTML JavaScript injection when an attacker can enter HTML content. Im...

CVE-2026-58590

FlowDrop for Drupal is affected by a Missing Authorization vulnerability that enables forceful browsing. Publicly reported details cover FlowDrop versions 0.0.0 through 1.6.0 as vulnerable. The root cause is insufficient access checks, allowing unauthorized navigation to access resources. The iss...

CVE-2026-58589

CVE-2026-58589 describes a Missing Authorization vulnerability in Drupal FlowDrop (FlowDrop versions 0.0.0 to 1.6.0) allowing forceful browsing to access endpoints without proper permissions. The issue affects the FlowDrop module used for AI-driven workflows via a chat interface, where endpoints ...

CVE-2026-58587

CVE-2026-58587 affects Drupal Canvas (Canvas AI submodule). The issue is an improper neutralization of input during web page generation, leading to Cross-Site Scripting (XSS). Affected versions include 0.0.0 through 1.4.2, 1.5.0 through 1.5.2, 1.6.0 through 1.6.1, and 1.7.0 through 1.7.1. Root ca...

CVE-2026-58588

CVE-2026-58588 describes an XSS vulnerability in the Drupal Canvas module caused by improper neutralization of input during web page generation. Affected versions are: 0.0.0–1.4.2, 1.5.0–1.5.2, 1.6.0–1.6.1, and 1.7.0–1.7.1. The issue stems from allowing image uploads via a custom API while valida...

CVE-2026-13244

CVE-2026-13244 affects the Drupal integration module Tealium iQ Tag Management. The issue arises from how the module stores data in the PHP-serialized field tealiumiq, which can lead to an Object Injection vulnerability when serialized data is unserialized. Affected versions are Tealium iQ Tag Ma...

CVE-2026-13243

CVE-2026-13243 describes a CSRF vulnerability in the Drupal Salesforce Suite where the OAuth handshake during interactive authentication is not properly validated, enabling an attacker to hijack the authorization token and bind the site to the attacker’s Salesforce account. Affected versions are ...

CVE-2026-13242

Geolocation Field in Drupal is affected: versions 0.0.0 through 3.15.0 expose an SQL injection due to improper neutralization in a view filter. The root cause is insufficient sanitization when user input reaches a view-filtered SQL path. Impact is SQL injection risk within Drupal sites using the ...

CVE-2026-13240

CVE-2026-13240 affects Drupal Paragraphs (and Paragraphs Library) with a missing authorization flaw that enables forceful browsing. Affected versions are 0.0.0 through 1.21.0. Root cause: insufficient access checks allowing access to unpublished library items when Paragraphs Library is active (e....