Live · 98 sources · updated 24m ago

· 21:55 UTC

The Security Standard

A daily wire for defenders: vulnerabilities, advisories, research, standards.

Section

Vulnerabilities

CVE records from NVD, ZDI advisories and the CISA KEV catalog, with CVSS, EPSS, SSVC and exploitation state.

Clear

177 matching records.

  1. 21
    CVE NVD

    The File Force Download module for Drupal 7 implements hook_file_download() to add a Content-Disposition header when a file URL carries the download…

    The File Force Download module for Drupal 7 implements hook_file_download() to add a Content-Disposition header when a file URL carries the download query parameter. In Drupal 7, returning a non-empty header array from that hook…

    CVSS 8.7 CVE-2026-110176 Drupal Web platform
  2. 14
    CVE NVD

    Improper Authorization vulnerability in Drupal Field Collection for Drupal 7 allows a user with the "edit field collections" permission to bypass…

    Improper Authorization vulnerability in Drupal Field Collection for Drupal 7 allows a user with the "edit field collections" permission to bypass access control on the parent (host) entity. The access check for field collection…

    CVSS 5.3 CVE-2026-77152 Drupal Web platform
  3. 7
    CVE NVD

    Missing Authorization vulnerability in Drupal Xray Audit allows Forceful Browsing.

    Missing Authorization vulnerability in Drupal Xray Audit allows Forceful Browsing. This issue affects Xray Audit versions: from 0.0.0 to 1.6.3, from 2.0.0 to 2.0.4, from 3.0.0 to 3.1.1.

    CVE-2026-96389 Drupal Web platform
  4. 7
    CVE NVD

    Incorrect Authorization vulnerability in Drupal Field Permissions allows Forceful Browsing.

    Incorrect Authorization vulnerability in Drupal Field Permissions allows Forceful Browsing. This issue affects Field Permissions versions: from 0.0.0 to 1.6.0.

    CVE-2026-118584 Drupal Web platform
  5. 7
    CVE NVD

    Incorrect Authorization vulnerability in Drupal Field Permissions allows Forceful Browsing.

    Incorrect Authorization vulnerability in Drupal Field Permissions allows Forceful Browsing. This issue affects Field Permissions versions: from 0.0.0 to 1.6.0.

    CVE-2026-118583 Drupal Web platform
  6. 7
    CVE NVD

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal CAPTCHA allows Functionality Bypass.

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal CAPTCHA allows Functionality Bypass. This issue affects CAPTCHA versions: from 0.0.0 to 1.18.0, from 2.0.0 to 2.0.11.

    CVE-2026-118582 Drupal Web platform
  7. 7
    CVE NVD

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Stage File Proxy allows Cross-Site…

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Stage File Proxy allows Cross-Site Scripting (XSS). This issue affects Stage File Proxy versions: from 0.0.0 to 3.1.7…

    CVE-2026-118576 Drupal Web platform
  8. 7
    CVE NVD

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Signature pad widget allows Stored XSS.

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Signature pad widget allows Stored XSS. This issue affects Signature pad widget versions: from 0.0.0 to 1.15.0.

    CVE-2026-118575 Drupal Web platform
  9. 7
    CVE NVD

    Incorrect Permission Assignment for Critical Resource vulnerability in Drupal S3 File System allows Exploiting Incorrectly Configured Access Control…

    Incorrect Permission Assignment for Critical Resource vulnerability in Drupal S3 File System allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects S3 File System versions: from 0.0.0 to…

    CVE-2026-118574 Drupal Web platform
  10. 7
    CVE NVD

    Missing Authorization vulnerability in Drupal OAuth2 Token Manager allows Forceful Browsing.

    Missing Authorization vulnerability in Drupal OAuth2 Token Manager allows Forceful Browsing. This issue affects OAuth2 Token Manager versions: from 0.0.0 to 1.2.0.

    CVE-2026-118573 Drupal Web platform
  11. 7
    CVE NVD

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal OAuth Login - OAuth OIDC SSO allows Authentication Bypass.

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal OAuth Login - OAuth OIDC SSO allows Authentication Bypass. This issue affects OAuth Login - OAuth OIDC SSO versions: from 0.0.0 to 3.1.1.

    CVE-2026-118572 Drupal Web platform
  12. 7
    CVE NVD

    Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Media Alias Display allows Exploiting Incorrectly Configured Access…

    Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Media Alias Display allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Media Alias Display versions: from…

    CVE-2026-118571 Drupal Web platform
  13. 7
    CVE NVD

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal Fasttoggle allows Cross Site Request Forgery.

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal Fasttoggle allows Cross Site Request Forgery. This issue affects Fasttoggle versions: from 0.0.0 to 4.1.1.

    CVE-2026-118570 Drupal Web platform
  14. 7
    CVE NVD

    Incorrect Authorization vulnerability in Drupal Fasttoggle allows Forceful Browsing.

    Incorrect Authorization vulnerability in Drupal Fasttoggle allows Forceful Browsing. This issue affects Fasttoggle versions: from 0.0.0 to 4.1.1.

    CVE-2026-118569 Drupal Web platform
  15. 7
    CVE NVD

    Insecure Storage of Sensitive Information vulnerability in Drupal Content Sync (content-sync.io) allows Retrieve Embedded Sensitive Data.

    Insecure Storage of Sensitive Information vulnerability in Drupal Content Sync (content-sync.io) allows Retrieve Embedded Sensitive Data. This issue affects Content Sync (content-sync.io) versions: from 0.0.0 to 3.2.2.

    CVE-2026-118568 Drupal Web platform
  16. 7
    CVE NVD

    Incorrect Authorization vulnerability in Drupal Bulk Update User Roles allows Forceful Browsing.

    Incorrect Authorization vulnerability in Drupal Bulk Update User Roles allows Forceful Browsing. This issue affects Bulk Update User Roles versions: from 0.0.0 to 1.0.5.

    CVE-2026-118567 Drupal Web platform
  17. 7
    CVE NVD

    Vulnerability in Drupal GroupEx PRO ( Daxko ) integration.

    Vulnerability in Drupal GroupEx PRO ( Daxko ) integration. This issue affects GroupEx PRO ( Daxko ) integration versions: *.*.

    CVE-2026-118565 Drupal Web platform
  18. 7
    CVE NVD

    Vulnerability in Drupal PayUmoney for Drupal Commerce.

    Vulnerability in Drupal PayUmoney for Drupal Commerce. This issue affects PayUmoney for Drupal Commerce versions: *.*.

    CVE-2026-118564 Drupal Web platform
  19. 7
    CVE NVD

    Vulnerability in Drupal CacheFlush.

    Vulnerability in Drupal CacheFlush. This issue affects CacheFlush versions: *.*.

    CVE-2026-118563 Drupal Web platform
  20. 7
    CVE NVD

    Deserialization of Untrusted Data vulnerability in Drupal Single Content Sync allows Object Injection.

    Deserialization of Untrusted Data vulnerability in Drupal Single Content Sync allows Object Injection. This issue affects Single Content Sync versions: from 0.0.0 to 1.4.19.

    CVE-2026-118562 Drupal Web platform
  21. 7
    CVE NVD

    External Control of File Name or Path vulnerability in Drupal Single Content Sync allows Path Traversal.

    External Control of File Name or Path vulnerability in Drupal Single Content Sync allows Path Traversal. This issue affects Single Content Sync versions: from 0.0.0 to 1.4.19.

    CVE-2026-118561 Drupal Web platform
  22. 7
    CVE NVD

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Commerce Stripe allows Cross-Site…

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Commerce Stripe allows Cross-Site Scripting (XSS). This issue affects Commerce Stripe versions: from 2.0.0 to 2.2.3.

    CVE-2026-118560 Drupal Web platform
  23. 7
    CVE NVD

    Improper Verification of Cryptographic Signature vulnerability in Drupal Commerce Stripe allows Signature Spoof.

    Improper Verification of Cryptographic Signature vulnerability in Drupal Commerce Stripe allows Signature Spoof. This issue affects Commerce Stripe versions: from 0.0.0 to 1.4, from 2.0.0 to 2.2.3.

    CVE-2026-118559 Drupal Web platform
  24. 7
    CVE NVD

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal Commerce Stripe allows Cross Site Request Forgery.

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal Commerce Stripe allows Cross Site Request Forgery. This issue affects Commerce Stripe versions: from 2.0.0 to 2.2.3.

    CVE-2026-118558 Drupal Web platform
  25. 7
    CVE NVD

    Incorrect Authorization vulnerability in Drupal Commerce Shipping allows Forceful Browsing.

    Incorrect Authorization vulnerability in Drupal Commerce Shipping allows Forceful Browsing. This issue affects Commerce Shipping versions: from 0.0.0 to 2.16.0, from 3.0.0 to 3.0.6.

    CVE-2026-118557 Drupal Web platform
  26. 7
    CVE NVD

    Incorrect Authorization vulnerability in Drupal Commerce Shipping allows Forceful Browsing.

    Incorrect Authorization vulnerability in Drupal Commerce Shipping allows Forceful Browsing. This issue affects Commerce Shipping versions: from 0.0.0 to 2.16.0, from 3.0.0 to 3.0.6.

    CVE-2026-118556 Drupal Web platform
  27. 7
    CVE NVD

    Incorrect Authorization vulnerability in Drupal Commerce License allows Forceful Browsing.

    Incorrect Authorization vulnerability in Drupal Commerce License allows Forceful Browsing. This issue affects Commerce License versions: from 0.0.0 to 3.1.1.

    CVE-2026-118555 Drupal Web platform
  28. 7
    CVE NVD

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal OpenID Connect Client allows Authentication Bypass.

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal OpenID Connect Client allows Authentication Bypass. This issue affects OpenID Connect Client versions: from 0.0.0 to 2.3.1.

    CVE-2026-118554 Drupal Web platform
  29. 7
    CVE NVD

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows…

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Stored XSS. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to…

    CVE-2026-118553 Drupal Web platform
  30. 7
    CVE NVD

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows…

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Cross-Site Scripting (XSS). This issue affects AI (Artificial Intelligence)…

    CVE-2026-118552 Drupal Web platform
  31. 7
    CVE NVD

    Insecure Storage of Sensitive Information vulnerability in Drupal AI (Artificial Intelligence) allows Retrieve Embedded Sensitive Data.

    Insecure Storage of Sensitive Information vulnerability in Drupal AI (Artificial Intelligence) allows Retrieve Embedded Sensitive Data. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.5.0 to…

    CVE-2026-118551 Drupal Web platform
  32. 7
    CVE NVD

    Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal AI (Artificial Intelligence) allows Exploiting Incorrectly…

    Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal AI (Artificial Intelligence) allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects AI (Artificial…

    CVE-2026-118550 Drupal Web platform
  33. 7
    CVE NVD

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows…

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Cross-Site Scripting (XSS). This issue affects AI (Artificial Intelligence)…

    CVE-2026-118549 Drupal Web platform
  34. 7
    CVE NVD

    Incorrect Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Resource Injection.

    Incorrect Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Resource Injection. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2.

    CVE-2026-118548 Drupal Web platform
  35. 7
    CVE NVD

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows…

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Cross-Site Scripting (XSS). This issue affects AI (Artificial Intelligence)…

    CVE-2026-118546 Drupal Web platform
  36. 7
    CVE NVD

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows…

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Cross-Site Scripting (XSS). This issue affects AI (Artificial Intelligence)…

    CVE-2026-118545 Drupal Web platform
  37. 7
    CVE NVD

    Exposure of Sensitive Information Through Data Queries vulnerability in Drupal Commerce Core allows Forceful Browsing.

    Exposure of Sensitive Information Through Data Queries vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13.

    CVE-2026-118544 Drupal Web platform
  38. 7
    CVE NVD

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal Commerce Core allows Cross Site Request Forgery.

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal Commerce Core allows Cross Site Request Forgery. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13.

    CVE-2026-118543 Drupal Web platform
  39. 7
    CVE NVD

    Incorrect Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing.

    Incorrect Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13.

    CVE-2026-118542 Drupal Web platform
  40. 7
    CVE NVD

    Incorrect Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing.

    Incorrect Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13.

    CVE-2026-118541 Drupal Web platform
  41. 7
    CVE NVD

    Incorrect Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing.

    Incorrect Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41, from 3.0.0 to 3.2.0.

    CVE-2026-118540 Drupal Web platform
  42. 7
    CVE NVD

    Missing Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing.

    Missing Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41, from 3.0.0 to 3.3.13.

    CVE-2026-118539 Drupal Web platform
  43. 7
    CVE NVD

    Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Monster Menus allows Object Injection.

    Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Monster Menus allows Object Injection. This issue affects Monster Menus versions: from 0.0.0 to 9.5.6.

    CVE-2026-114573 Drupal Web platform
  44. 7
    CVE NVD

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Domain Login Restrict allows Authentication Bypass.

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Domain Login Restrict allows Authentication Bypass. This issue affects Domain Login Restrict versions: from 0.0.0 to 1.5.0.

    CVE-2026-114572 Drupal Web platform
  45. 7
    CVE NVD

    Incorrect Authorization vulnerability in Drupal Rabbit Hole allows Forceful Browsing.

    Incorrect Authorization vulnerability in Drupal Rabbit Hole allows Forceful Browsing. This issue affects Rabbit Hole versions: from 0.0.0 to 1.3.0.

    CVE-2026-114571 Drupal Web platform
  46. 7
    CVE NVD

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Data field allows Stored XSS.

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Data field allows Stored XSS. This issue affects Data field versions: from 0.0.0 to 2.0.14.

    CVE-2026-114555 Drupal Web platform
  47. 7
    CVE NVD

    Incorrect Authorization vulnerability in Drupal AI File to Text allows Forceful Browsing.

    Incorrect Authorization vulnerability in Drupal AI File to Text allows Forceful Browsing. This issue affects AI File to Text versions: from 0.0.0 to 1.0.1.

    CVE-2026-114554 Drupal Web platform
  48. 7
    CVE NVD

    Incorrect Authorization vulnerability in Drupal Frontend Editing allows Forceful Browsing.

    Incorrect Authorization vulnerability in Drupal Frontend Editing allows Forceful Browsing. This issue affects Frontend Editing versions: from 0.0.0 to 1.9.3.

    CVE-2026-114553 Drupal Web platform
  49. 7
    CVE NVD

    Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal ImageAPI Optimize WebP allows Exploiting Incorrectly Configured…

    Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal ImageAPI Optimize WebP allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects ImageAPI Optimize WebP versions…

    CVE-2026-114548 Drupal Web platform
  50. 7
    CVE NVD

    Missing Authorization vulnerability in Drupal TinyPNG allows Forceful Browsing.

    Missing Authorization vulnerability in Drupal TinyPNG allows Forceful Browsing. This issue affects TinyPNG versions: from 0.0.0 to 2.0.2.

    CVE-2026-114547 Drupal Web platform
  51. 7
    CVE NVD

    Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Media Alias Display allows Exploiting Incorrectly Configured Access…

    Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Media Alias Display allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Media Alias Display versions: from…

    CVE-2026-114546 Drupal Web platform
  52. 7
    CVE NVD

    Incorrect Authorization vulnerability in Drupal Fullcalendar View allows Forceful Browsing.

    Incorrect Authorization vulnerability in Drupal Fullcalendar View allows Forceful Browsing. This issue affects Fullcalendar View versions: from 0.0.0 to 5.2.6.

    CVE-2026-114545 Drupal Web platform
  53. 7
    CVE NVD

    Incorrect Authorization vulnerability in Drupal Media Bulk Upload allows Forceful Browsing.

    Incorrect Authorization vulnerability in Drupal Media Bulk Upload allows Forceful Browsing. This issue affects Media Bulk Upload versions: from 0.0.0 to 3.0.6.

    CVE-2026-114544 Drupal Web platform
  54. 7
    CVE NVD

    Incorrect Authorization vulnerability in Drupal Simple User Management allows Forceful Browsing.

    Incorrect Authorization vulnerability in Drupal Simple User Management allows Forceful Browsing. This issue affects Simple User Management versions: from 0.0.0 to 1.11.0.

    CVE-2026-114543 Drupal Web platform
  55. 7
    CVE NVD

    Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Simple OAuth (OAuth2) & OpenID Connect allows Exploiting…

    Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Simple OAuth (OAuth2) & OpenID Connect allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Simple OAuth…

    CVE-2026-114542 Drupal Web platform
  56. 7
    CVE NVD

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal Frontend Editing allows Cross Site Request Forgery.

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal Frontend Editing allows Cross Site Request Forgery. This issue affects Frontend Editing versions: from 0.0.0 to 1.9.3.

    CVE-2026-114541 Drupal Web platform
  57. 7
    CVE NVD

    Incorrect Authorization vulnerability in Drupal Domain allows Forceful Browsing.

    Incorrect Authorization vulnerability in Drupal Domain allows Forceful Browsing. This issue affects Domain versions: from 3.0.0 to 3.0.2.

    CVE-2026-114540 Drupal Web platform
  58. 7
    CVE NVD

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal DocCheck Basic allows Authentication Bypass.

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal DocCheck Basic allows Authentication Bypass. This issue affects DocCheck Basic versions: 7.x.

    CVE-2026-114539 Drupal Web platform
  59. 7
    CVE NVD

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Bootstrap allows Cross-Site Scripting…

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Bootstrap allows Cross-Site Scripting (XSS). This issue affects Bootstrap versions: from 0.0.0 to 3.45.0.

    CVE-2026-114538 Drupal Web platform
  60. 7
    CVE NVD

    Incorrect Authorization vulnerability in Drupal View Unpublished allows Forceful Browsing.

    Incorrect Authorization vulnerability in Drupal View Unpublished allows Forceful Browsing. This issue affects View Unpublished versions: from 0.0.0 to 1.5.0.

    CVE-2026-114537 Drupal Web platform
  61. 7
    CVE NVD

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal USWDS Paragraph Components allows Stored…

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal USWDS Paragraph Components allows Stored XSS. This issue affects USWDS Paragraph Components versions: from 0.0.0 to…

    CVE-2026-114536 Drupal Web platform
  62. 7
    CVE NVD

    Missing Authorization vulnerability in Drupal Swiper formatter allows Forceful Browsing.

    Missing Authorization vulnerability in Drupal Swiper formatter allows Forceful Browsing. This issue affects Swiper formatter versions: from 0.0.0 to 2.1.2, from 3.0.1 to 3.1.0.

    CVE-2026-114535 Drupal Web platform
  63. 7
    CVE NVD

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Block Attributes allows Stored XSS.

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Block Attributes allows Stored XSS. This issue affects Block Attributes versions: from 0.0.0 to 2.1.0.

    CVE-2026-114534 Drupal Web platform
  64. 7
    CVE NVD

    Missing Authorization vulnerability in Drupal Ágora Transparency Theme allows Forceful Browsing.

    Missing Authorization vulnerability in Drupal Ágora Transparency Theme allows Forceful Browsing. This issue affects Ágora Transparency Theme versions: from 0.0.0 to 1.2.3.

    CVE-2026-114533 Drupal Web platform
  65. 7
    CVE NVD

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal UI Icons allows Cross-Site Scripting…

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal UI Icons allows Cross-Site Scripting (XSS). This issue affects UI Icons versions: from 0.0.0 to 1.1.3, from 2.0.0 to…

    CVE-2026-114532 Drupal Web platform
  66. 7
    CVE NVD

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Swiper formatter allows Stored XSS.

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Swiper formatter allows Stored XSS. This issue affects Swiper formatter versions: from 0.0.0 to 2.1.2, from 3.0.1 to…

    CVE-2026-114531 Drupal Web platform
  67. 7
    CVE NVD

    Incorrect Authorization vulnerability in Drupal Dopup allows Forceful Browsing.

    Incorrect Authorization vulnerability in Drupal Dopup allows Forceful Browsing. This issue affects Dopup versions: from 0.0.0 to 1.0.7.

    CVE-2026-114530 Drupal Web platform
  68. 7
    CVE NVD

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal CSV Field allows Stored XSS.

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal CSV Field allows Stored XSS. This issue affects CSV Field versions: from 0.0.0 to 2.0.10, from 3.0.0 to 3.0.7.

    CVE-2026-114529 Drupal Web platform
  69. 7
    CVE NVD

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Zero Point allows Stored XSS.

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Zero Point allows Stored XSS. This issue affects Zero Point versions: from 0.0.0 to 1.30.0, from 2.0.0 to 2.0.1.

    CVE-2026-114528 Drupal Web platform
  70. 7
    CVE NVD

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal UI Icons allows Cross-Site Scripting…

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal UI Icons allows Cross-Site Scripting (XSS). This issue affects UI Icons versions: from 0.0.0 to 1.1.3, from 2.0.0 to…

    CVE-2026-114527 Drupal Web platform
  71. 7
    CVE NVD

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Black Hole allows Stored XSS.

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Black Hole allows Stored XSS. This issue affects Black Hole versions: from 0.0.0 to 1.26.0, from 2.0.0 to 2.0.1.

    CVE-2026-114526 Drupal Web platform
  72. 7
    CVE NVD

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal ABC allows Stored XSS.

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal ABC allows Stored XSS. This issue affects ABC versions: from 0.0.0 to 1.25.0, from 2.0.0 to 2.0.1.

    CVE-2026-114525 Drupal Web platform
  73. 7
    CVE NVD

    Privilege Defined With Unsafe Actions vulnerability in Drupal Custom Formatters allows Privilege Escalation.

    Privilege Defined With Unsafe Actions vulnerability in Drupal Custom Formatters allows Privilege Escalation. This issue affects Custom Formatters versions: from 0.0.0 to 4.2.1.

    CVE-2026-114524 Drupal Web platform
  74. 7
    CVE NVD

    Improper Neutralization of Special Elements used in an OS Command ("OS Command Injection") vulnerability in Drupal Ffmpeg Image Toolkit allows OS…

    Improper Neutralization of Special Elements used in an OS Command ("OS Command Injection") vulnerability in Drupal Ffmpeg Image Toolkit allows OS Command Injection. This issue affects Ffmpeg Image Toolkit versions: from 0.0.0 to…

    CVE-2026-114523 Drupal Web platform
  75. 7
    CVE NVD

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Gin Admin Theme allows Cross-Site…

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Gin Admin Theme allows Cross-Site Scripting (XSS). This issue affects Gin Admin Theme versions: from 0.0.0 to 4.1.4…

    CVE-2026-110738 Drupal Web platform
  76. 7
    CVE NVD

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting…

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Drupal core versions: from 8.9.0 to 10.6.19, from…

    CVE-2026-108515 Drupal Web platform
  77. 7
    CVE NVD

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting…

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Drupal core versions: from 10.3.0 to 10.6.19, from…

    CVE-2026-108514 Drupal Web platform
  78. 7
    CVE NVD

    Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Drupal Entity List allows Reflection Injection.

    Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Drupal Entity List allows Reflection Injection. This issue affects Entity List versions: from 0.0.0 to 3.0.10.

    CVE-2026-108099 Drupal Web platform
  79. 7
    CVE NVD

    Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Drupal Drupal core allows Reflection Injection.

    Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Drupal Drupal core allows Reflection Injection. This issue affects Drupal core versions: from 8.9.0 to 10.6.19, from 11.0.0 to…

    CVE-2026-108097 Drupal Web platform
  80. 7
    CVE NVD

    Allocation of Resources Without Limits or Throttling vulnerability in Drupal Examples for Developers allows Excessive Allocation.

    Allocation of Resources Without Limits or Throttling vulnerability in Drupal Examples for Developers allows Excessive Allocation. This issue affects Examples for Developers versions: from 0.0.0 to 4.0.7.

    CVE-2026-107312 Drupal Web platform
  81. 7
    CVE NVD

    Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal Permissions by Term allows Forceful Browsing.

    Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal Permissions by Term allows Forceful Browsing. This issue affects Permissions by Term versions: from 0.0.0 to 3.1.41.

    CVE-2026-107311 Drupal Web platform
  82. 7
    CVE NVD

    Server-Side Request Forgery (SSRF) vulnerability in Drupal Freelinking allows Server Side Request Forgery.

    Server-Side Request Forgery (SSRF) vulnerability in Drupal Freelinking allows Server Side Request Forgery. This issue affects Freelinking versions: from 0.0.0 to 4.0.3.

    CVE-2026-107310 Drupal Web platform
  83. 7
    CVE NVD

    Missing Authorization vulnerability in Drupal Easy Breadcrumb allows Forceful Browsing.

    Missing Authorization vulnerability in Drupal Easy Breadcrumb allows Forceful Browsing. This issue affects Easy Breadcrumb versions: from 0.0.0 to 2.0.11.

    CVE-2026-107309 Drupal Web platform
  84. 7
    CVE NVD

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Country allows Cross-Site Scripting…

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Country allows Cross-Site Scripting (XSS). This issue affects Country versions: from 0.0.0 to 2.1.3, from 2.2.0 to 2.2.1.

    CVE-2026-107308 Drupal Web platform
  85. 7
    CVE NVD

    Incorrect Authorization vulnerability in Drupal SmartLinker AI allows Forceful Browsing.

    Incorrect Authorization vulnerability in Drupal SmartLinker AI allows Forceful Browsing. This issue affects SmartLinker AI versions: from 0.0.0 to 1.0.3.

    CVE-2026-107307 Drupal Web platform
  86. 7
    CVE NVD

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Menu Link Attributes allows Stored XSS.

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Menu Link Attributes allows Stored XSS. This issue affects Menu Link Attributes versions: from 0.0.0 to 1.8.0.

    CVE-2026-107306 Drupal Web platform
  87. 7
    CVE NVD

    Insertion of Sensitive Information Into Sent Data vulnerability in Drupal Two Factor Authentication - TFA / Passwordless Login allows Forceful…

    Insertion of Sensitive Information Into Sent Data vulnerability in Drupal Two Factor Authentication - TFA / Passwordless Login allows Forceful Browsing. This issue affects Two Factor Authentication - TFA / Passwordless Login…

    CVE-2026-107268 Drupal Web platform
  88. 7
    CVE NVD

    Missing Authorization vulnerability in Drupal DKAN allows Forceful Browsing.

    Missing Authorization vulnerability in Drupal DKAN allows Forceful Browsing. This issue affects DKAN versions: from 0.0.0 to 4.0.4, from 4.1.0 to 4.1.5.

    CVE-2026-107267 Drupal Web platform
  89. 7
    CVE NVD

    Missing Authorization vulnerability in Drupal Views Share allows Forceful Browsing.

    Missing Authorization vulnerability in Drupal Views Share allows Forceful Browsing. This issue affects Views Share versions: from 0.0.0 to 2.0.1.

    CVE-2026-107266 Drupal Web platform
  90. 7
    CVE NVD

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Leaflet allows Stored XSS.

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Leaflet allows Stored XSS. This issue affects Leaflet versions: from 0.0.0 to 10.4.13.

    CVE-2026-107265 Drupal Web platform
  91. 7
    CVE NVD

    Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Inline Formatter Field allows Code Injection.

    Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Inline Formatter Field allows Code Injection. This issue affects Inline Formatter Field versions: from 0.0.0 to 4.2.0.

    CVE-2026-107264 Drupal Web platform
  92. 7
    CVE NVD

    Incorrect Authorization vulnerability in Drupal Gutenberg allows Forceful Browsing.

    Incorrect Authorization vulnerability in Drupal Gutenberg allows Forceful Browsing. This issue affects Gutenberg versions: from 0.0.0 to 2.15.0, from 3.0.0 to 3.0.7.

    CVE-2026-107263 Drupal Web platform
  93. 7
    CVE NVD

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal Advanced Filesystem allows Cross Site Request Forgery.

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal Advanced Filesystem allows Cross Site Request Forgery. This issue affects Advanced Filesystem versions: from 0.0.0 to 1.0.28.

    CVE-2026-107262 Drupal Web platform
  94. 7
    CVE NVD

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Authenticator Login Plus (2FA) allows Authentication Bypass.

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Authenticator Login Plus (2FA) allows Authentication Bypass. This issue affects Authenticator Login Plus (2FA) versions: from 0.0.0 to 1.0.1.

    CVE-2026-107261 Drupal Web platform
  95. 7
    CVE NVD

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Sector Distribution allows Stored XSS.

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Sector Distribution allows Stored XSS. This issue affects Sector Distribution versions: from 0.0.0 to 10.3.3, from…

    CVE-2026-107260 Drupal Web platform
  96. 7
    CVE NVD

    Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Linked Field allows Code Injection.

    Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Linked Field allows Code Injection. This issue affects Linked Field versions: from 0.0.0 to 1.8.0.

    CVE-2026-107259 Drupal Web platform
  97. 7
    CVE NVD

    Incorrect Authorization vulnerability in Drupal Inline Entity Form Dialog allows Forceful Browsing.

    Incorrect Authorization vulnerability in Drupal Inline Entity Form Dialog allows Forceful Browsing. This issue affects Inline Entity Form Dialog versions: from 0.0.0 to 1.0.6.

    CVE-2026-107258 Drupal Web platform
  98. 7
    CVE NVD

    Incorrect Authorization vulnerability in Drupal Actstream allows Forceful Browsing.

    Incorrect Authorization vulnerability in Drupal Actstream allows Forceful Browsing. This issue affects Actstream versions: from 0.0.0 to 2.0.1, from 2.1.0 to 2.1.1.

    CVE-2026-107257 Drupal Web platform
  99. 7
    CVE NVD

    Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Shield allows Brute Force.

    Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Shield allows Brute Force. This issue affects Shield versions: from 0.0.0 to 1.9.0.

    CVE-2026-107256 Drupal Web platform
  100. 7
    CVE NVD

    Incorrect Authorization vulnerability in Drupal Restrict route by IP allows Forceful Browsing.

    Incorrect Authorization vulnerability in Drupal Restrict route by IP allows Forceful Browsing. This issue affects Restrict route by IP versions: from 0.0.0 to 1.3.1, from 2.0.0 to 2.0.1.

    CVE-2026-107255 Drupal Web platform

Reuse this view

Same filters as JSON: /api/items?category=vuln&window=30d&vendor=Drupal&limit=100. RSS for this section: feed.xml.

Keyboard

j / k
Next / previous item
o or Enter
Open the original source
i
Open the item page
s
Save or unsave for later
/
Focus search
g then f v a r n s
Go to front, vulnerabilities, advisories, research, news, standards
t
Toggle theme
?
This help