Vulnerability-Lookup

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

Full-Text Search

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2026-15916 (GCVE-0-2026-15916)

Vulnerability from cvelistv5 – Published: 2026-08-25 22:22 – Updated: 2026-08-25 22:22

Title

Drupal core - Moderately critical - Information disclosure - SA-CORE-2026-010

Summary

Missing Authorization vulnerability in Drupal Drupal core allows Forceful Browsing. This issue affects Drupal core versions: from 0.0.0 to 10.6.13, from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, from 0.0.0 to 11.0.*, from 0.0.0 to 11.1.*, from 0.0.0 to 11.2.*.

Severity

No CVSS data available.

CWE

CWE-862 - Missing Authorization

Assigner

drupal mitre root

References

1 reference

URL	Tags
https://www.drupal.org/sa-core-2026-010

Impacted products

1 product

Vendor	Product	Version
Drupal	Drupal core	Affected: 0.0.0 , < 10.6.13 (semver) Affected: 11.3.0 , < 11.3.14 (semver) Affected: 11.4.0 , < 11.4.4 (semver) Affected: 0.0.0 , < 11.0.* (semver) Affected: 0.0.0 , < 11.1.* (semver) Affected: 0.0.0 , < 11.2.* (semver)

Date Public

2026-07-15 19:50

Credits

offensive-ai Benji Fisher (benjifisher) Kim Pepper (kim.pepper) Mohit Aghera (mohit_aghera) Benji Fisher (benjifisher) catch (catch) Lee Rowlands (larowlan) Juraj Nemec (poker10) Jess (xjm)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://www.drupal.org/project/drupal",
          "product": "Drupal core",
          "repo": "https://git.drupalcode.org/project/drupal",
          "vendor": "Drupal",
          "versions": [
            {
              "lessThan": "10.6.13",
              "status": "affected",
              "version": "0.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.3.14",
              "status": "affected",
              "version": "11.3.0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.4.4",
              "status": "affected",
              "version": "11.4.0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.0.*",
              "status": "affected",
              "version": "0.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.1.*",
              "status": "affected",
              "version": "0.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.2.*",
              "status": "affected",
              "version": "0.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "offensive-ai"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Benji Fisher (benjifisher)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Kim Pepper (kim.pepper)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Mohit Aghera (mohit_aghera)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Benji Fisher (benjifisher)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "catch (catch)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Lee Rowlands (larowlan)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Juraj Nemec (poker10)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Jess  (xjm)"
        }
      ],
      "datePublic": "2026-07-15T19:50:24.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Missing Authorization vulnerability in Drupal Drupal core allows Forceful Browsing. This issue affects Drupal core versions: from 0.0.0 to 10.6.13, from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, from 0.0.0 to 11.0.*, from 0.0.0 to 11.1.*, from 0.0.0 to 11.2.*."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-87",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-87 Forceful Browsing"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T22:22:27.131Z",
        "orgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
        "shortName": "drupal"
      },
      "references": [
        {
          "url": "https://www.drupal.org/sa-core-2026-010"
        }
      ],
      "title": "Drupal core - Moderately critical - Information disclosure - SA-CORE-2026-010"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
    "assignerShortName": "drupal",
    "cveId": "CVE-2026-15916",
    "datePublished": "2026-08-25T22:22:27.131Z",
    "dateReserved": "2026-07-15T19:41:24.786Z",
    "dateUpdated": "2026-08-25T22:22:27.131Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-15917 (GCVE-0-2026-15917)

Vulnerability from cvelistv5 – Published: 2026-08-25 22:22 – Updated: 2026-08-25 22:22

Title

Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-011

Summary

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Drupal core versions: from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, from 0.0.0 to 11.2.*.

Severity

No CVSS data available.

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")

Assigner

drupal mitre root

References

1 reference

URL	Tags
https://www.drupal.org/sa-core-2026-011

Impacted products

1 product

Vendor	Product	Version
Drupal	Drupal core	Affected: 11.3.0 , < 11.3.14 (semver) Affected: 11.4.0 , < 11.4.4 (semver) Affected: 0.0.0 , < 11.2.* (semver)

Date Public

2026-07-15 19:51

Credits

Pierre Rudloff (prudloff) Shawn Duncan (fathershawn) Pierre Rudloff (prudloff) catch (catch) Lee Rowlands (larowlan) Dave Long (longwave) Jess (xjm)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://www.drupal.org/project/drupal",
          "product": "Drupal core",
          "repo": "https://git.drupalcode.org/project/drupal",
          "vendor": "Drupal",
          "versions": [
            {
              "lessThan": "11.3.14",
              "status": "affected",
              "version": "11.3.0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.4.4",
              "status": "affected",
              "version": "11.4.0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.2.*",
              "status": "affected",
              "version": "0.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Pierre Rudloff (prudloff)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Shawn Duncan (fathershawn)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Pierre Rudloff (prudloff)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "catch (catch)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Lee Rowlands (larowlan)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Dave Long (longwave)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Jess  (xjm)"
        }
      ],
      "datePublic": "2026-07-15T19:51:57.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Drupal core versions: from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, from 0.0.0 to 11.2.*."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-63",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-63 Cross-Site Scripting (XSS)"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\")",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T22:22:23.680Z",
        "orgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
        "shortName": "drupal"
      },
      "references": [
        {
          "url": "https://www.drupal.org/sa-core-2026-011"
        }
      ],
      "title": "Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-011"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
    "assignerShortName": "drupal",
    "cveId": "CVE-2026-15917",
    "datePublished": "2026-08-25T22:22:23.680Z",
    "dateReserved": "2026-07-15T19:41:26.226Z",
    "dateUpdated": "2026-08-25T22:22:23.680Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-55805 (GCVE-0-2026-55805)

Vulnerability from cvelistv5 – Published: 2026-08-25 22:22 – Updated: 2026-08-25 22:22

Title

Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-012

Summary

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Stored XSS. This issue affects Drupal core versions: from 0.0.0 to 10.6.13, from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, from 0.0.0 to 11.0.*, from 0.0.0 to 11.1.*, from 0.0.0 to 11.2.*.

Severity

No CVSS data available.

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")

Assigner

drupal mitre root

References

1 reference

URL	Tags
https://www.drupal.org/sa-core-2026-012

Impacted products

1 product

Vendor	Product	Version
Drupal	Drupal core	Affected: 0.0.0 , < 10.6.13 (semver) Affected: 11.3.0 , < 11.3.14 (semver) Affected: 11.4.0 , < 11.4.4 (semver) Affected: 0.0.0 , < 11.0.* (semver) Affected: 0.0.0 , < 11.1.* (semver) Affected: 0.0.0 , < 11.2.* (semver)

Date Public

2026-07-15 19:52

Credits

haii haii (hai27ii2o) danielveza Lee Rowlands (larowlan) Mingsong (mingsong) James Gilliland (neclimdul) Greg Knaddison (greggles) Lee Rowlands (larowlan) Dave Long (longwave) Jess (xjm)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://www.drupal.org/project/drupal",
          "product": "Drupal core",
          "repo": "https://git.drupalcode.org/project/drupal",
          "vendor": "Drupal",
          "versions": [
            {
              "lessThan": "10.6.13",
              "status": "affected",
              "version": "0.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.3.14",
              "status": "affected",
              "version": "11.3.0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.4.4",
              "status": "affected",
              "version": "11.4.0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.0.*",
              "status": "affected",
              "version": "0.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.1.*",
              "status": "affected",
              "version": "0.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.2.*",
              "status": "affected",
              "version": "0.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "haii haii (hai27ii2o)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "danielveza"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Lee Rowlands (larowlan)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Mingsong  (mingsong)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "James Gilliland (neclimdul)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Greg Knaddison (greggles)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Lee Rowlands (larowlan)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Dave Long (longwave)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Jess  (xjm)"
        }
      ],
      "datePublic": "2026-07-15T19:52:26.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal Drupal core allows Stored XSS. This issue affects Drupal core versions: from 0.0.0 to 10.6.13, from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, from 0.0.0 to 11.0.*, from 0.0.0 to 11.1.*, from 0.0.0 to 11.2.*."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-592",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-592 Stored XSS"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\")",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T22:22:20.763Z",
        "orgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
        "shortName": "drupal"
      },
      "references": [
        {
          "url": "https://www.drupal.org/sa-core-2026-012"
        }
      ],
      "title": "Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-012"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
    "assignerShortName": "drupal",
    "cveId": "CVE-2026-55805",
    "datePublished": "2026-08-25T22:22:20.763Z",
    "dateReserved": "2026-06-17T14:59:52.673Z",
    "dateUpdated": "2026-08-25T22:22:20.763Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-16638 (GCVE-0-2026-16638)

Vulnerability from cvelistv5 – Published: 2026-08-25 22:22 – Updated: 2026-08-25 22:22

Title

Media Folders - Moderately critical - Cross site scripting - SA-CONTRIB-2026-080

Summary

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Media Folders allows Stored XSS. This issue affects Media Folders versions: from 0.0.0 to 1.0.8.

Severity

No CVSS data available.

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")

Assigner

drupal mitre root

References

1 reference

URL	Tags
https://www.drupal.org/sa-contrib-2026-080

Impacted products

1 product

Vendor	Product	Version
Drupal	Media Folders	Affected: 0.0.0 , < 1.0.8 (semver)

Date Public

2026-07-22 17:52

Credits

Drew Webber (mcdruid) JoÃ£o Mauricio (jmauricio) Juraj Nemec (poker10)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://www.drupal.org/project/media_folders",
          "product": "Media Folders",
          "repo": "https://git.drupalcode.org/project/media_folders",
          "vendor": "Drupal",
          "versions": [
            {
              "lessThan": "1.0.8",
              "status": "affected",
              "version": "0.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Drew Webber (mcdruid)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Jo\u00c3\u00a3o Mauricio (jmauricio)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Juraj Nemec (poker10)"
        }
      ],
      "datePublic": "2026-07-22T17:52:45.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal Media Folders allows Stored XSS. This issue affects Media Folders versions: from 0.0.0 to 1.0.8."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-592",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-592 Stored XSS"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\")",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T22:22:17.992Z",
        "orgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
        "shortName": "drupal"
      },
      "references": [
        {
          "url": "https://www.drupal.org/sa-contrib-2026-080"
        }
      ],
      "title": "Media Folders - Moderately critical - Cross site scripting - SA-CONTRIB-2026-080"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
    "assignerShortName": "drupal",
    "cveId": "CVE-2026-16638",
    "datePublished": "2026-08-25T22:22:17.992Z",
    "dateReserved": "2026-07-22T17:06:41.039Z",
    "dateUpdated": "2026-08-25T22:22:17.992Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-16639 (GCVE-0-2026-16639)

Vulnerability from cvelistv5 – Published: 2026-08-25 22:22 – Updated: 2026-08-25 22:22

Title

Internationalization Single Sign-On - Critical - Access bypass - SA-CONTRIB-2026-081

Summary

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Internationalization Single Sign-On allows Authentication Bypass. This issue affects Internationalization Single Sign-On versions: from 0.0.0 to 1.8.0.

Severity

No CVSS data available.

CWE

CWE-288 - Authentication Bypass Using an Alternate Path or Channel

Assigner

drupal mitre root

References

1 reference

URL	Tags
https://www.drupal.org/sa-contrib-2026-081

Impacted products

1 product

Vendor	Product	Version
Drupal	Internationalization Single Sign-On	Affected: 0.0.0 , < 1.8.0 (semver)

Date Public

2026-07-22 17:53

Credits

Drew Webber (mcdruid) Florent Torregrosa (grimreaper) Drew Webber (mcdruid) Bram Driesen (bramdriesen) Greg Knaddison (greggles) Drew Webber (mcdruid) Juraj Nemec (poker10)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://www.drupal.org/project/i18n_sso",
          "product": "Internationalization Single Sign-On",
          "repo": "https://git.drupalcode.org/project/i18n_sso",
          "vendor": "Drupal",
          "versions": [
            {
              "lessThan": "1.8.0",
              "status": "affected",
              "version": "0.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Drew Webber (mcdruid)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Florent Torregrosa (grimreaper)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Drew Webber (mcdruid)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Bram Driesen (bramdriesen)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Greg Knaddison (greggles)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Drew Webber (mcdruid)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Juraj Nemec (poker10)"
        }
      ],
      "datePublic": "2026-07-22T17:53:35.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Internationalization Single Sign-On allows Authentication Bypass. This issue affects Internationalization Single Sign-On versions: from 0.0.0 to 1.8.0."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-115",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-115 Authentication Bypass"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-288",
              "description": "CWE-288 Authentication Bypass Using an Alternate Path or Channel",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T22:22:12.799Z",
        "orgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
        "shortName": "drupal"
      },
      "references": [
        {
          "url": "https://www.drupal.org/sa-contrib-2026-081"
        }
      ],
      "title": "Internationalization Single Sign-On - Critical - Access bypass - SA-CONTRIB-2026-081"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
    "assignerShortName": "drupal",
    "cveId": "CVE-2026-16639",
    "datePublished": "2026-08-25T22:22:12.799Z",
    "dateReserved": "2026-07-22T17:06:41.738Z",
    "dateUpdated": "2026-08-25T22:22:12.799Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-16640 (GCVE-0-2026-16640)

Vulnerability from cvelistv5 – Published: 2026-08-25 22:22 – Updated: 2026-08-25 22:22

Title

Search API Autocomplete - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-082

Summary

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Search API Autocomplete allows Reflected XSS. This issue affects Search API Autocomplete versions: from 0.0.0 to 1.12.0.

Severity

No CVSS data available.

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")

Assigner

drupal mitre root

References

1 reference

URL	Tags
https://www.drupal.org/sa-contrib-2026-082

Impacted products

1 product

Vendor	Product	Version
Drupal	Search API Autocomplete	Affected: 0.0.0 , < 1.12.0 (semver)

Date Public

2026-07-22 17:55

Credits

Elar Lang (elarlang) Thomas Seiber (drunken monkey) Elar Lang (elarlang) Greg Knaddison (greggles) Lee Rowlands (larowlan) Drew Webber (mcdruid) Juraj Nemec (poker10)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://www.drupal.org/project/search_api_autocomplete",
          "product": "Search API Autocomplete",
          "repo": "https://git.drupalcode.org/project/search_api_autocomplete",
          "vendor": "Drupal",
          "versions": [
            {
              "lessThan": "1.12.0",
              "status": "affected",
              "version": "0.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Elar Lang (elarlang)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Thomas Seiber (drunken monkey)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Elar Lang (elarlang)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Greg Knaddison (greggles)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Lee Rowlands (larowlan)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Drew Webber (mcdruid)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Juraj Nemec (poker10)"
        }
      ],
      "datePublic": "2026-07-22T17:55:04.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal Search API Autocomplete allows Reflected XSS. This issue affects Search API Autocomplete versions: from 0.0.0 to 1.12.0."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-591",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-591 Reflected XSS"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\")",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T22:22:09.308Z",
        "orgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
        "shortName": "drupal"
      },
      "references": [
        {
          "url": "https://www.drupal.org/sa-contrib-2026-082"
        }
      ],
      "title": "Search API Autocomplete - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-082"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
    "assignerShortName": "drupal",
    "cveId": "CVE-2026-16640",
    "datePublished": "2026-08-25T22:22:09.308Z",
    "dateReserved": "2026-07-22T17:06:42.610Z",
    "dateUpdated": "2026-08-25T22:22:09.308Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-16646 (GCVE-0-2026-16646)

Vulnerability from cvelistv5 – Published: 2026-08-25 22:22 – Updated: 2026-08-25 22:22

Title

PanKM - Critical - Unsupported - SA-CONTRIB-2026-083

Summary

Vulnerability in Drupal PanKM. This issue affects PanKM versions: *.*.

Severity

No CVSS data available.

Assigner

drupal mitre root

References

1 reference

URL	Tags
https://www.drupal.org/sa-contrib-2026-083

Impacted products

1 product

Vendor	Product	Version
Drupal	PanKM	Affected: . (semver)

Date Public

2026-07-22 17:55

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://www.drupal.org/project/pankm",
          "product": "PanKM",
          "repo": "https://git.drupalcode.org/project/pankm",
          "vendor": "Drupal",
          "versions": [
            {
              "status": "affected",
              "version": "*.*",
              "versionType": "semver"
            }
          ]
        }
      ],
      "datePublic": "2026-07-22T17:55:59.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Vulnerability in Drupal PanKM. This issue affects PanKM versions: *.*."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T22:22:05.938Z",
        "orgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
        "shortName": "drupal"
      },
      "references": [
        {
          "url": "https://www.drupal.org/sa-contrib-2026-083"
        }
      ],
      "title": "PanKM - Critical - Unsupported - SA-CONTRIB-2026-083"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
    "assignerShortName": "drupal",
    "cveId": "CVE-2026-16646",
    "datePublished": "2026-08-25T22:22:05.938Z",
    "dateReserved": "2026-07-22T17:06:47.500Z",
    "dateUpdated": "2026-08-25T22:22:05.938Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-16641 (GCVE-0-2026-16641)

Vulnerability from cvelistv5 – Published: 2026-08-25 22:22 – Updated: 2026-08-25 22:22

Title

Commerce Elavon - Critical - Unsupported - SA-CONTRIB-2026-084

Summary

Vulnerability in Drupal Commerce Elavon. This issue affects Commerce Elavon versions: *.*.

Severity

No CVSS data available.

Assigner

drupal mitre root

References

1 reference

URL	Tags
https://www.drupal.org/sa-contrib-2026-084

Impacted products

1 product

Vendor	Product	Version
Drupal	Commerce Elavon	Affected: . (semver)

Date Public

2026-07-22 17:57

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://www.drupal.org/project/commerce_elavon",
          "product": "Commerce Elavon",
          "repo": "https://git.drupalcode.org/project/commerce_elavon",
          "vendor": "Drupal",
          "versions": [
            {
              "status": "affected",
              "version": "*.*",
              "versionType": "semver"
            }
          ]
        }
      ],
      "datePublic": "2026-07-22T17:57:03.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Vulnerability in Drupal Commerce Elavon. This issue affects Commerce Elavon versions: *.*."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T22:22:02.591Z",
        "orgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
        "shortName": "drupal"
      },
      "references": [
        {
          "url": "https://www.drupal.org/sa-contrib-2026-084"
        }
      ],
      "title": "Commerce Elavon - Critical - Unsupported - SA-CONTRIB-2026-084"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
    "assignerShortName": "drupal",
    "cveId": "CVE-2026-16641",
    "datePublished": "2026-08-25T22:22:02.591Z",
    "dateReserved": "2026-07-22T17:06:43.440Z",
    "dateUpdated": "2026-08-25T22:22:02.591Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-16642 (GCVE-0-2026-16642)

Vulnerability from cvelistv5 – Published: 2026-08-25 22:21 – Updated: 2026-08-25 22:21

Title

Email Login OTP - Critical - Unsupported - SA-CONTRIB-2026-085

Summary

Vulnerability in Drupal Email Login OTP. This issue affects Email Login OTP versions: *.*.

Severity

No CVSS data available.

Assigner

drupal mitre root

References

1 reference

URL	Tags
https://www.drupal.org/sa-contrib-2026-085

Impacted products

1 product

Vendor	Product	Version
Drupal	Email Login OTP	Affected: . (semver)

Date Public

2026-07-22 17:57

Credits

Pierre Rudloff (prudloff)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://www.drupal.org/project/email_login_otp",
          "product": "Email Login OTP",
          "repo": "https://git.drupalcode.org/project/email_login_otp",
          "vendor": "Drupal",
          "versions": [
            {
              "status": "affected",
              "version": "*.*",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Pierre Rudloff (prudloff)"
        }
      ],
      "datePublic": "2026-07-22T17:57:50.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Vulnerability in Drupal Email Login OTP. This issue affects Email Login OTP versions: *.*."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T22:21:59.242Z",
        "orgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
        "shortName": "drupal"
      },
      "references": [
        {
          "url": "https://www.drupal.org/sa-contrib-2026-085"
        }
      ],
      "title": "Email Login OTP - Critical - Unsupported - SA-CONTRIB-2026-085"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
    "assignerShortName": "drupal",
    "cveId": "CVE-2026-16642",
    "datePublished": "2026-08-25T22:21:59.242Z",
    "dateReserved": "2026-07-22T17:06:44.287Z",
    "dateUpdated": "2026-08-25T22:21:59.242Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-16643 (GCVE-0-2026-16643)

Vulnerability from cvelistv5 – Published: 2026-08-25 22:21 – Updated: 2026-08-25 22:21

Title

Lunr exposed filters - Critical - Unsupported - SA-CONTRIB-2026-086

Summary

Vulnerability in Drupal Lunr exposed filters. This issue affects Lunr exposed filters versions: *.*.

Severity

No CVSS data available.

Assigner

drupal mitre root

References

1 reference

URL	Tags
https://www.drupal.org/sa-contrib-2026-086

Impacted products

1 product

Vendor	Product	Version
Drupal	Lunr exposed filters	Affected: . (semver)

Date Public

2026-07-22 17:59

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://www.drupal.org/project/lunr_filters",
          "product": "Lunr exposed filters",
          "repo": "https://git.drupalcode.org/project/lunr_filters",
          "vendor": "Drupal",
          "versions": [
            {
              "status": "affected",
              "version": "*.*",
              "versionType": "semver"
            }
          ]
        }
      ],
      "datePublic": "2026-07-22T17:59:05.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Vulnerability in Drupal Lunr exposed filters. This issue affects Lunr exposed filters versions: *.*."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T22:21:55.035Z",
        "orgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
        "shortName": "drupal"
      },
      "references": [
        {
          "url": "https://www.drupal.org/sa-contrib-2026-086"
        }
      ],
      "title": "Lunr exposed filters - Critical - Unsupported  - SA-CONTRIB-2026-086"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
    "assignerShortName": "drupal",
    "cveId": "CVE-2026-16643",
    "datePublished": "2026-08-25T22:21:55.035Z",
    "dateReserved": "2026-07-22T17:06:45.088Z",
    "dateUpdated": "2026-08-25T22:21:55.035Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-16644 (GCVE-0-2026-16644)

Vulnerability from cvelistv5 – Published: 2026-08-25 22:21 – Updated: 2026-08-25 22:21

Title

Webform REST - Moderately critical - Access bypass - SA-CONTRIB-2026-087

Summary

Incorrect Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. This issue affects Webform REST versions: from 0.0.0 to 4.1.0.

Severity

No CVSS data available.

CWE

CWE-863 - Incorrect Authorization

Assigner

drupal mitre root

References

1 reference

URL	Tags
https://www.drupal.org/sa-contrib-2026-087

Impacted products

1 product

Vendor	Product	Version
Drupal	Webform REST	Affected: 0.0.0 , < 4.1.0 (semver)

Date Public

2026-07-22 18:00

Credits

Giuseppe (giuseppe87) Dan Chadwick (danchadwick) Giuseppe (giuseppe87) Jacob Rockowitz (jrockowitz) Liam Morland (liam morland) Nelson Alves (nsalves) Anna Kalata (akalata) cilefen (cilefen) Greg Knaddison (greggles) Michael Hess (mlhess) Juraj Nemec (poker10)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://www.drupal.org/project/webform_rest",
          "product": "Webform REST",
          "repo": "https://git.drupalcode.org/project/webform_rest",
          "vendor": "Drupal",
          "versions": [
            {
              "lessThan": "4.1.0",
              "status": "affected",
              "version": "0.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Giuseppe  (giuseppe87)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Dan Chadwick (danchadwick)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Giuseppe  (giuseppe87)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Jacob Rockowitz (jrockowitz)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Liam Morland (liam morland)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Nelson Alves (nsalves)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Anna Kalata (akalata)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "cilefen  (cilefen)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Greg Knaddison (greggles)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Michael Hess (mlhess)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Juraj Nemec (poker10)"
        }
      ],
      "datePublic": "2026-07-22T18:00:53.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Incorrect Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. This issue affects Webform REST versions: from 0.0.0 to 4.1.0."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-87",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-87 Forceful Browsing"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863 Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T22:21:51.345Z",
        "orgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
        "shortName": "drupal"
      },
      "references": [
        {
          "url": "https://www.drupal.org/sa-contrib-2026-087"
        }
      ],
      "title": "Webform REST - Moderately critical - Access bypass - SA-CONTRIB-2026-087"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
    "assignerShortName": "drupal",
    "cveId": "CVE-2026-16644",
    "datePublished": "2026-08-25T22:21:51.345Z",
    "dateReserved": "2026-07-22T17:06:45.880Z",
    "dateUpdated": "2026-08-25T22:21:51.345Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-16645 (GCVE-0-2026-16645)

Vulnerability from cvelistv5 – Published: 2026-08-25 22:21 – Updated: 2026-08-25 22:21

Title

PhotoSwipe - Responsive JavaScript Modal Image Gallery - Moderately critical - Access bypass - SA-CONTRIB-2026-088

Summary

Missing Authorization vulnerability in Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery allows Forceful Browsing. This issue affects PhotoSwipe - Responsive JavaScript Modal Image Gallery versions: from 0.0.0 to 3.2.0.

Severity

No CVSS data available.

CWE

CWE-862 - Missing Authorization

Assigner

drupal mitre root

References

1 reference

URL	Tags
https://www.drupal.org/sa-contrib-2026-088

Impacted products

1 product

Vendor	Product	Version
Drupal	PhotoSwipe - Responsive JavaScript Modal Image Gallery	Affected: 0.0.0 , < 3.2.0 (semver)

Date Public

2026-07-22 18:01

Credits

Aleksi Peebles (aleksip) Aleksi Peebles (aleksip) Julian Pustkuchen (anybody) Joshua Sedler (grevil) cilefen (cilefen) Damien McKenna (damienmckenna) Neil Drumm (drumm) Greg Knaddison (greggles) Juraj Nemec (poker10)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://www.drupal.org/project/photoswipe",
          "product": "PhotoSwipe - Responsive JavaScript Modal Image Gallery",
          "repo": "https://git.drupalcode.org/project/photoswipe",
          "vendor": "Drupal",
          "versions": [
            {
              "lessThan": "3.2.0",
              "status": "affected",
              "version": "0.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Aleksi Peebles (aleksip)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Aleksi Peebles (aleksip)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Julian Pustkuchen (anybody)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Joshua Sedler (grevil)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "cilefen  (cilefen)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Damien McKenna (damienmckenna)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Neil Drumm (drumm)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Greg Knaddison (greggles)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Juraj Nemec (poker10)"
        }
      ],
      "datePublic": "2026-07-22T18:01:57.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Missing Authorization vulnerability in Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery allows Forceful Browsing. This issue affects PhotoSwipe - Responsive JavaScript Modal Image Gallery versions: from 0.0.0 to 3.2.0."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-87",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-87 Forceful Browsing"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T22:21:47.480Z",
        "orgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
        "shortName": "drupal"
      },
      "references": [
        {
          "url": "https://www.drupal.org/sa-contrib-2026-088"
        }
      ],
      "title": "PhotoSwipe - Responsive JavaScript Modal Image Gallery - Moderately critical - Access bypass - SA-CONTRIB-2026-088"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
    "assignerShortName": "drupal",
    "cveId": "CVE-2026-16645",
    "datePublished": "2026-08-25T22:21:47.480Z",
    "dateReserved": "2026-07-22T17:06:46.782Z",
    "dateUpdated": "2026-08-25T22:21:47.480Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-15088 (GCVE-0-2026-15088)

Vulnerability from cvelistv5 – Published: 2026-08-25 22:21 – Updated: 2026-08-25 22:21

Title

Development Environment - Critical - Unsupported - SA-CONTRIB-2026-089

Summary

Vulnerability in Drupal Development Environment. This issue affects Development Environment versions: *.*.

Severity

No CVSS data available.

Assigner

drupal mitre root

References

1 reference

URL	Tags
https://www.drupal.org/sa-contrib-2026-089

Impacted products

1 product

Vendor	Product	Version
Drupal	Development Environment	Affected: . (semver)

Date Public

2026-07-22 18:02

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://www.drupal.org/project/development_environment",
          "product": "Development Environment",
          "repo": "https://git.drupalcode.org/project/development_environment",
          "vendor": "Drupal",
          "versions": [
            {
              "status": "affected",
              "version": "*.*",
              "versionType": "semver"
            }
          ]
        }
      ],
      "datePublic": "2026-07-22T18:02:41.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Vulnerability in Drupal Development Environment. This issue affects Development Environment versions: *.*."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T22:21:43.754Z",
        "orgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
        "shortName": "drupal"
      },
      "references": [
        {
          "url": "https://www.drupal.org/sa-contrib-2026-089"
        }
      ],
      "title": "Development Environment - Critical - Unsupported - SA-CONTRIB-2026-089"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
    "assignerShortName": "drupal",
    "cveId": "CVE-2026-15088",
    "datePublished": "2026-08-25T22:21:43.754Z",
    "dateReserved": "2026-07-08T15:45:02.189Z",
    "dateUpdated": "2026-08-25T22:21:43.754Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-18259 (GCVE-0-2026-18259)

Vulnerability from cvelistv5 – Published: 2026-08-25 22:21 – Updated: 2026-08-25 22:21

Title

Token Content Access - Moderately critical - Access bypass - SA-CONTRIB-2026-090

Summary

Observable Timing Discrepancy vulnerability in Drupal Token Content Access allows Brute Force. This issue affects Token Content Access versions: from 0.0.0 to 3.1.2.

Severity

No CVSS data available.

CWE

CWE-208 - Observable Timing Discrepancy

Assigner

drupal mitre root

References

1 reference

URL	Tags
https://www.drupal.org/sa-contrib-2026-090

Impacted products

1 product

Vendor	Product	Version
Drupal	Token Content Access	Affected: 0.0.0 , < 3.1.2 (semver)

Date Public

2026-07-29 17:08

Credits

Robin (robincs) Kyrylo Loboda (lobodakyrylo) Bram Driesen (bramdriesen) cilefen (cilefen) Greg Knaddison (greggles) Juraj Nemec (poker10) Swan Kalata (akalata)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://www.drupal.org/project/tca",
          "product": "Token Content Access",
          "repo": "https://git.drupalcode.org/project/tca",
          "vendor": "Drupal",
          "versions": [
            {
              "lessThan": "3.1.2",
              "status": "affected",
              "version": "0.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Robin  (robincs)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Kyrylo Loboda (lobodakyrylo)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Bram Driesen (bramdriesen)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "cilefen  (cilefen)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Greg Knaddison (greggles)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Juraj Nemec (poker10)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Swan Kalata (akalata)"
        }
      ],
      "datePublic": "2026-07-29T17:08:33.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Observable Timing Discrepancy vulnerability in Drupal Token Content Access allows Brute Force. This issue affects Token Content Access versions: from 0.0.0 to 3.1.2."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-112",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-112 Brute Force"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-208",
              "description": "CWE-208 Observable Timing Discrepancy",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T22:21:39.663Z",
        "orgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
        "shortName": "drupal"
      },
      "references": [
        {
          "url": "https://www.drupal.org/sa-contrib-2026-090"
        }
      ],
      "title": "Token Content Access - Moderately critical - Access bypass - SA-CONTRIB-2026-090"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
    "assignerShortName": "drupal",
    "cveId": "CVE-2026-18259",
    "datePublished": "2026-08-25T22:21:39.663Z",
    "dateReserved": "2026-07-29T16:42:36.967Z",
    "dateUpdated": "2026-08-25T22:21:39.663Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-18260 (GCVE-0-2026-18260)

Vulnerability from cvelistv5 – Published: 2026-08-25 22:21 – Updated: 2026-08-25 22:21

Title

Disable Login Page - Critical - Unsupported - SA-CONTRIB-2026-091

Summary

Vulnerability in Drupal Disable Login Page. This issue affects Disable Login Page versions: *.*.

Severity

No CVSS data available.

Assigner

drupal mitre root

References

1 reference

URL	Tags
https://www.drupal.org/sa-contrib-2026-091

Impacted products

1 product

Vendor	Product	Version
Drupal	Disable Login Page	Affected: . (semver)

Date Public

2026-07-29 17:11

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://www.drupal.org/project/disable_login",
          "product": "Disable Login Page",
          "repo": "https://git.drupalcode.org/project/disable_login",
          "vendor": "Drupal",
          "versions": [
            {
              "status": "affected",
              "version": "*.*",
              "versionType": "semver"
            }
          ]
        }
      ],
      "datePublic": "2026-07-29T17:11:14.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Vulnerability in Drupal Disable Login Page. This issue affects Disable Login Page versions: *.*."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T22:21:34.604Z",
        "orgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
        "shortName": "drupal"
      },
      "references": [
        {
          "url": "https://www.drupal.org/sa-contrib-2026-091"
        }
      ],
      "title": "Disable Login Page - Critical - Unsupported - SA-CONTRIB-2026-091"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
    "assignerShortName": "drupal",
    "cveId": "CVE-2026-18260",
    "datePublished": "2026-08-25T22:21:34.604Z",
    "dateReserved": "2026-07-29T16:42:37.743Z",
    "dateUpdated": "2026-08-25T22:21:34.604Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-18261 (GCVE-0-2026-18261)

Vulnerability from cvelistv5 – Published: 2026-08-25 22:21 – Updated: 2026-08-25 22:21

Title

Powerful Surveys - Critical - Unsupported - SA-CONTRIB-2026-092

Summary

Vulnerability in Drupal Powerful Surveys. This issue affects Powerful Surveys versions: *.*.

Severity

No CVSS data available.

Assigner

drupal mitre root

References

1 reference

URL	Tags
https://www.drupal.org/sa-contrib-2026-092

Impacted products

1 product

Vendor	Product	Version
Drupal	Powerful Surveys	Affected: . (semver)

Date Public

2026-07-29 17:12

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://www.drupal.org/project/powerful_surveys",
          "product": "Powerful Surveys",
          "repo": "https://git.drupalcode.org/project/powerful_surveys",
          "vendor": "Drupal",
          "versions": [
            {
              "status": "affected",
              "version": "*.*",
              "versionType": "semver"
            }
          ]
        }
      ],
      "datePublic": "2026-07-29T17:12:05.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Vulnerability in Drupal Powerful Surveys. This issue affects Powerful Surveys versions: *.*."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T22:21:28.297Z",
        "orgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
        "shortName": "drupal"
      },
      "references": [
        {
          "url": "https://www.drupal.org/sa-contrib-2026-092"
        }
      ],
      "title": "Powerful Surveys - Critical - Unsupported - SA-CONTRIB-2026-092"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
    "assignerShortName": "drupal",
    "cveId": "CVE-2026-18261",
    "datePublished": "2026-08-25T22:21:28.297Z",
    "dateReserved": "2026-07-29T16:42:38.736Z",
    "dateUpdated": "2026-08-25T22:21:28.297Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-18985 (GCVE-0-2026-18985)

Vulnerability from cvelistv5 – Published: 2026-08-25 22:19 – Updated: 2026-08-25 22:19

Title

Edit in-place field - Moderately critical - Access bypass - SA-CONTRIB-2026-093

Summary

Incorrect Authorization vulnerability in Drupal Edit in-place field allows Forceful Browsing. This issue affects Edit in-place field versions: from 0.0.0 to 2.1.1.

Severity

No CVSS data available.

CWE

CWE-863 - Incorrect Authorization

Assigner

drupal mitre root

References

1 reference

URL	Tags
https://www.drupal.org/sa-contrib-2026-093

Impacted products

1 product

Vendor	Product	Version
Drupal	Edit in-place field	Affected: 0.0.0 , < 2.1.1 (semver)

Date Public

2026-08-05 17:58

Credits

Drew Webber (mcdruid) BÃ¡lint Nagy (nagy.balint) Neil Drumm (drumm) Greg Knaddison (greggles)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://www.drupal.org/project/edit_in_place_field",
          "product": "Edit in-place field",
          "repo": "https://git.drupalcode.org/project/edit_in_place_field",
          "vendor": "Drupal",
          "versions": [
            {
              "lessThan": "2.1.1",
              "status": "affected",
              "version": "0.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Drew Webber (mcdruid)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "B\u00c3\u00a1lint Nagy (nagy.balint)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Neil Drumm (drumm)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Greg Knaddison (greggles)"
        }
      ],
      "datePublic": "2026-08-05T17:58:38.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Incorrect Authorization vulnerability in Drupal Edit in-place field allows Forceful Browsing. This issue affects Edit in-place field versions: from 0.0.0 to 2.1.1."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-87",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-87 Forceful Browsing"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863 Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T22:19:31.812Z",
        "orgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
        "shortName": "drupal"
      },
      "references": [
        {
          "url": "https://www.drupal.org/sa-contrib-2026-093"
        }
      ],
      "title": "Edit in-place field - Moderately critical - Access bypass - SA-CONTRIB-2026-093"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
    "assignerShortName": "drupal",
    "cveId": "CVE-2026-18985",
    "datePublished": "2026-08-25T22:19:31.812Z",
    "dateReserved": "2026-08-05T17:35:21.263Z",
    "dateUpdated": "2026-08-25T22:19:31.812Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-11913 (GCVE-0-2026-11913)

Vulnerability from cvelistv5 – Published: 2026-07-10 22:00 – Updated: 2026-07-13 18:51

Title

Mother May I - Critical - Unsupported - SA-CONTRIB-2026-045

Summary

vulnerability in Drupal Mother May I allows . This issue affects Mother May I versions: *.*.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-13 18:51 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

drupal mitre root

References

1 reference

URL	Tags
https://www.drupal.org/sa-contrib-2026-045

Impacted products

1 product

Vendor	Product	Version
Drupal	Mother May I	Affected: . (semver)

Date Public

2026-06-10 17:08

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-11913",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-13T18:51:37.001868Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-79",
                "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-13T18:51:40.699Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://www.drupal.org/project/mothermayi",
          "product": "Mother May I",
          "repo": "https://git.drupalcode.org/project/mothermayi",
          "vendor": "Drupal",
          "versions": [
            {
              "status": "affected",
              "version": "*.*",
              "versionType": "semver"
            }
          ]
        }
      ],
      "datePublic": "2026-06-10T17:08:53.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "vulnerability in Drupal Mother May I allows . This issue affects Mother May I versions: *.*."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-10T22:00:08.662Z",
        "orgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
        "shortName": "drupal"
      },
      "references": [
        {
          "url": "https://www.drupal.org/sa-contrib-2026-045"
        }
      ],
      "title": "Mother May I - Critical - Unsupported - SA-CONTRIB-2026-045"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
    "assignerShortName": "drupal",
    "cveId": "CVE-2026-11913",
    "datePublished": "2026-07-10T22:00:08.662Z",
    "dateReserved": "2026-06-10T16:43:04.126Z",
    "dateUpdated": "2026-07-13T18:51:40.699Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-11914 (GCVE-0-2026-11914)

Vulnerability from cvelistv5 – Published: 2026-07-10 21:59 – Updated: 2026-07-13 19:05

Title

Composer - Critical - Unsupported - SA-CONTRIB-2026-046

Summary

vulnerability in Drupal Composer allows . This issue affects Composer versions: *.*.

Severity

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-13 19:04 UTC

CWE

CWE-20 - Improper Input Validation

Assigner

drupal mitre root

References

1 reference

URL	Tags
https://www.drupal.org/sa-contrib-2026-046

Impacted products

1 product

Vendor	Product	Version
Drupal	Composer	Affected: . (semver)

Date Public

2026-06-10 17:09

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 5.9,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "HIGH",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-11914",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-13T19:04:04.700848Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-20",
                "description": "CWE-20 Improper Input Validation",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-13T19:05:09.292Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://www.drupal.org/project/composer",
          "product": "Composer",
          "repo": "https://git.drupalcode.org/project/composer",
          "vendor": "Drupal",
          "versions": [
            {
              "status": "affected",
              "version": "*.*",
              "versionType": "semver"
            }
          ]
        }
      ],
      "datePublic": "2026-06-10T17:09:45.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "vulnerability in Drupal Composer allows . This issue affects Composer versions: *.*."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-10T21:59:28.008Z",
        "orgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
        "shortName": "drupal"
      },
      "references": [
        {
          "url": "https://www.drupal.org/sa-contrib-2026-046"
        }
      ],
      "title": "Composer - Critical - Unsupported - SA-CONTRIB-2026-046"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
    "assignerShortName": "drupal",
    "cveId": "CVE-2026-11914",
    "datePublished": "2026-07-10T21:59:28.008Z",
    "dateReserved": "2026-06-10T16:43:05.303Z",
    "dateUpdated": "2026-07-13T19:05:09.292Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-11915 (GCVE-0-2026-11915)

Vulnerability from cvelistv5 – Published: 2026-07-10 21:58 – Updated: 2026-07-13 19:06

Title

Brute force attack protection - Critical - Unsupported - SA-CONTRIB-2026-047

Summary

vulnerability in Drupal Brute force attack protection allows . This issue affects Brute force attack protection versions: *.*.

Severity

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-13 19:05 UTC

CWE

CWE-307 - Improper Restriction of Excessive Authentication Attempts

Assigner

drupal mitre root

References

1 reference

URL	Tags
https://www.drupal.org/sa-contrib-2026-047

Impacted products

1 product

Vendor	Product	Version
Drupal	Brute force attack protection	Affected: . (semver)

Date Public

2026-06-10 17:10

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 5.9,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "HIGH",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-11915",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-13T19:05:41.121175Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-307",
                "description": "CWE-307 Improper Restriction of Excessive Authentication Attempts",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-13T19:06:23.066Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://www.drupal.org/project/bfap_sb",
          "product": "Brute force attack protection",
          "repo": "https://git.drupalcode.org/project/bfap_sb",
          "vendor": "Drupal",
          "versions": [
            {
              "status": "affected",
              "version": "*.*",
              "versionType": "semver"
            }
          ]
        }
      ],
      "datePublic": "2026-06-10T17:10:26.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "vulnerability in Drupal Brute force attack protection allows . This issue affects Brute force attack protection versions: *.*."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-10T21:58:18.624Z",
        "orgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
        "shortName": "drupal"
      },
      "references": [
        {
          "url": "https://www.drupal.org/sa-contrib-2026-047"
        }
      ],
      "title": "Brute force attack protection - Critical - Unsupported - SA-CONTRIB-2026-047"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
    "assignerShortName": "drupal",
    "cveId": "CVE-2026-11915",
    "datePublished": "2026-07-10T21:58:18.624Z",
    "dateReserved": "2026-06-10T16:43:06.497Z",
    "dateUpdated": "2026-07-13T19:06:23.066Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-15087 (GCVE-0-2026-15087)

Vulnerability from cvelistv5 – Published: 2026-07-10 21:57 – Updated: 2026-07-13 19:07

Title

Clean RESTful - Critical - Unsupported - SA-CONTRIB-2026-078

Summary

vulnerability in Drupal Clean RESTful allows . This issue affects Clean RESTful versions: *.*.

Severity

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-13 19:07 UTC

CWE

CWE-287 - Improper Authentication

Assigner

drupal mitre root

References

1 reference

URL	Tags
https://www.drupal.org/sa-contrib-2026-078

Impacted products

1 product

Vendor	Product	Version
Drupal	Clean RESTful	Affected: . (semver)

Date Public

2026-07-08 17:19

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 5.9,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "HIGH",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-15087",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-13T19:07:02.850111Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-287",
                "description": "CWE-287 Improper Authentication",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-13T19:07:49.334Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://www.drupal.org/project/clean_node_api",
          "product": "Clean RESTful",
          "repo": "https://git.drupalcode.org/project/clean_node_api",
          "vendor": "Drupal",
          "versions": [
            {
              "status": "affected",
              "version": "*.*",
              "versionType": "semver"
            }
          ]
        }
      ],
      "datePublic": "2026-07-08T17:19:42.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "vulnerability in Drupal Clean RESTful allows . This issue affects Clean RESTful versions: *.*."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-10T21:57:28.467Z",
        "orgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
        "shortName": "drupal"
      },
      "references": [
        {
          "url": "https://www.drupal.org/sa-contrib-2026-078"
        }
      ],
      "title": "Clean RESTful - Critical - Unsupported - SA-CONTRIB-2026-078"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
    "assignerShortName": "drupal",
    "cveId": "CVE-2026-15087",
    "datePublished": "2026-07-10T21:57:28.467Z",
    "dateReserved": "2026-07-08T15:45:01.154Z",
    "dateUpdated": "2026-07-13T19:07:49.334Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-15086 (GCVE-0-2026-15086)

Vulnerability from cvelistv5 – Published: 2026-07-10 21:57 – Updated: 2026-07-13 19:09

Title

Raw Formatter [Meta Tag Formatter] - Critical - Unsupported - SA-CONTRIB-2026-077

Summary

vulnerability in Drupal Raw Formatter [Meta Tag Formatter] allows . This issue affects Raw Formatter [Meta Tag Formatter] versions: *.*.

Severity

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-13 19:09 UTC

CWE

CWE-noinfo Not enough information

Assigner

drupal mitre root

References

1 reference

URL	Tags
https://www.drupal.org/sa-contrib-2026-077

Impacted products

1 product

Vendor	Product	Version
Drupal	Raw Formatter [Meta Tag Formatter]	Affected: . (semver)

Date Public

2026-07-08 17:19

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 5.9,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "HIGH",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-15086",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-13T19:09:02.163093Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "description": "CWE-noinfo Not enough information",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-13T19:09:51.778Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://www.drupal.org/project/raw_formatter",
          "product": "Raw Formatter [Meta Tag Formatter]",
          "repo": "https://git.drupalcode.org/project/raw_formatter",
          "vendor": "Drupal",
          "versions": [
            {
              "status": "affected",
              "version": "*.*",
              "versionType": "semver"
            }
          ]
        }
      ],
      "datePublic": "2026-07-08T17:19:33.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "vulnerability in Drupal Raw Formatter [Meta Tag Formatter] allows . This issue affects Raw Formatter [Meta Tag Formatter] versions: *.*."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-10T21:57:19.321Z",
        "orgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
        "shortName": "drupal"
      },
      "references": [
        {
          "url": "https://www.drupal.org/sa-contrib-2026-077"
        }
      ],
      "title": "Raw Formatter [Meta Tag Formatter] - Critical - Unsupported - SA-CONTRIB-2026-077"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
    "assignerShortName": "drupal",
    "cveId": "CVE-2026-15086",
    "datePublished": "2026-07-10T21:57:19.321Z",
    "dateReserved": "2026-07-08T15:45:00.086Z",
    "dateUpdated": "2026-07-13T19:09:51.778Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-15089 (GCVE-0-2026-15089)

Vulnerability from cvelistv5 – Published: 2026-07-10 21:54 – Updated: 2026-08-25 22:22

Title

Commerce guest registration - Critical - Unsupported - SA-CONTRIB-2026-079

Summary

Vulnerability in Drupal Commerce guest registration. This issue affects Commerce guest registration versions: *.*.

Severity

9.1 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-13 18:52 UTC

CWE

CWE-287 - Improper Authentication

Assigner

drupal mitre root

References

1 reference

URL	Tags
https://www.drupal.org/sa-contrib-2026-079

Impacted products

1 product

Vendor	Product	Version
Drupal	Commerce guest registration	Affected: . (semver)

Date Public

2026-07-08 17:20

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 9.1,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-15089",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-13T18:52:13.389688Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-287",
                "description": "CWE-287 Improper Authentication",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-13T18:52:33.757Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://www.drupal.org/project/commerce_guest_registration",
          "product": "Commerce guest registration",
          "repo": "https://git.drupalcode.org/project/commerce_guest_registration",
          "vendor": "Drupal",
          "versions": [
            {
              "status": "affected",
              "version": "*.*",
              "versionType": "semver"
            }
          ]
        }
      ],
      "datePublic": "2026-07-08T17:20:24.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Vulnerability in Drupal Commerce guest registration. This issue affects Commerce guest registration versions: *.*."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T22:22:30.542Z",
        "orgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
        "shortName": "drupal"
      },
      "references": [
        {
          "url": "https://www.drupal.org/sa-contrib-2026-079"
        }
      ],
      "title": "Commerce guest registration - Critical - Unsupported - SA-CONTRIB-2026-079"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
    "assignerShortName": "drupal",
    "cveId": "CVE-2026-15089",
    "datePublished": "2026-07-10T21:54:42.802Z",
    "dateReserved": "2026-07-08T15:45:03.255Z",
    "dateUpdated": "2026-08-25T22:22:30.542Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-55808 (GCVE-0-2026-55808)

Vulnerability from cvelistv5 – Published: 2026-07-10 21:46 – Updated: 2026-07-13 18:18

Title

Drupal core - Moderately critical - Improper validation - SA-CORE-2026-009

Summary

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Drupal core versions: from 0.0.0 to 10.5.12, from 10.6.0 to 10.6.11, from 11.2.0 to 11.2.14, from 11.3.0 to 11.3.12, from 0.0.0 to 11.0.*, from 0.0.0 to 11.1.*.

Severity

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-13 18:18 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")

Assigner

drupal mitre root

References

1 reference

URL	Tags
https://www.drupal.org/sa-core-2026-009

Impacted products

1 product

Vendor	Product	Version
Drupal	Drupal core	Affected: 0.0.0 , < 10.5.12 (semver) Affected: 10.6.0 , < 10.6.11 (semver) Affected: 11.2.0 , < 11.2.14 (semver) Affected: 11.3.0 , < 11.3.12 (semver) Affected: 0.0.0 , < 11.0.* (semver) Affected: 0.0.0 , < 11.1.* (semver)

Date Public

2026-06-17 18:58

Credits

cantina_security BjÃ¶rn Brala (bbrala) Kim Pepper (kim.pepper) Lee Rowlands (larowlan) Damien McKenna (damienmckenna) Greg Knaddison (greggles) Lee Rowlands (larowlan) Dave Long (longwave) Juraj Nemec (poker10) Jess (xjm)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 5.4,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "LOW",
              "scope": "CHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-55808",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-13T18:18:38.616632Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-13T18:18:56.714Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://www.drupal.org/project/drupal",
          "product": "Drupal core",
          "repo": "https://git.drupalcode.org/project/drupal",
          "vendor": "Drupal",
          "versions": [
            {
              "lessThan": "10.5.12",
              "status": "affected",
              "version": "0.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "10.6.11",
              "status": "affected",
              "version": "10.6.0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.2.14",
              "status": "affected",
              "version": "11.2.0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.3.12",
              "status": "affected",
              "version": "11.3.0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.0.*",
              "status": "affected",
              "version": "0.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.1.*",
              "status": "affected",
              "version": "0.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "cantina_security"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Bj\u00c3\u00b6rn Brala (bbrala)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Kim Pepper (kim.pepper)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Lee Rowlands (larowlan)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Damien McKenna (damienmckenna)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Greg Knaddison (greggles)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Lee Rowlands (larowlan)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Dave Long (longwave)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Juraj Nemec (poker10)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Jess  (xjm)"
        }
      ],
      "datePublic": "2026-06-17T18:58:02.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Drupal core versions: from 0.0.0 to 10.5.12, from 10.6.0 to 10.6.11, from 11.2.0 to 11.2.14, from 11.3.0 to 11.3.12, from 0.0.0 to 11.0.*, from 0.0.0 to 11.1.*."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-63",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-63 Cross-Site Scripting (XSS)"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\")",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-10T21:46:43.600Z",
        "orgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
        "shortName": "drupal"
      },
      "references": [
        {
          "url": "https://www.drupal.org/sa-core-2026-009"
        }
      ],
      "title": "Drupal core - Moderately critical - Improper validation - SA-CORE-2026-009"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
    "assignerShortName": "drupal",
    "cveId": "CVE-2026-55808",
    "datePublished": "2026-07-10T21:46:43.600Z",
    "dateReserved": "2026-06-17T14:59:52.673Z",
    "dateUpdated": "2026-07-13T18:18:56.714Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-55807 (GCVE-0-2026-55807)

Vulnerability from cvelistv5 – Published: 2026-07-10 21:46 – Updated: 2026-07-13 18:20

Title

Drupal core - Moderately critical - Server-side request forgery - SA-CORE-2026-008

Summary

Server-Side Request Forgery (SSRF) vulnerability in Drupal Drupal core allows Server Side Request Forgery. This issue affects Drupal core versions: from 0.0.0 to 10.5.12, from 10.6.0 to 10.6.11, from 11.2.0 to 11.2.14, from 11.3.0 to 11.3.12, from 0.0.0 to 11.0.*, from 0.0.0 to 11.1.*.

Severity

3.1 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-13 18:20 UTC

CWE

CWE-918 - Server-Side Request Forgery (SSRF)

Assigner

drupal mitre root

References

1 reference

URL	Tags
https://www.drupal.org/sa-core-2026-008

Impacted products

1 product

Vendor	Product	Version
Drupal	Drupal core	Affected: 0.0.0 , < 10.5.12 (semver) Affected: 10.6.0 , < 10.6.11 (semver) Affected: 11.2.0 , < 11.2.14 (semver) Affected: 11.3.0 , < 11.3.12 (semver) Affected: 0.0.0 , < 11.0.* (semver) Affected: 0.0.0 , < 11.1.* (semver)

Date Public

2026-06-17 18:57

Credits

Hamed Kohi (0xhamy) assaf alassaf (ama62) Albert Skibinski (askibinski) Jon Minder (ayalon) Lautaro Casanova (betah4k) Gabe Sullice (gabesullice) John Morahan (john morahan) Michael Winser (michaelwinser) nbanderson offensive-ai Francesco Placella (plach) quynh ho (qquynh) Himanshu Anand (unknownhad) Lee Rowlands (larowlan) Dave Long (longwave) Drew Webber (mcdruid) Adam G-H (phenaproxima) Sean Blommaert (seanb) Benji Fisher (benjifisher) cilefen (cilefen) Damien McKenna (damienmckenna) Mori Sugimoto (dokumori) Greg Knaddison (greggles) Lee Rowlands (larowlan) Dave Long (longwave) Drew Webber (mcdruid) James Gilliland (neclimdul) Juraj Nemec (poker10) Jess (xjm)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 3.1,
              "baseSeverity": "LOW",
              "confidentialityImpact": "LOW",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-55807",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-13T18:20:00.967168Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-13T18:20:30.331Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://www.drupal.org/project/drupal",
          "product": "Drupal core",
          "repo": "https://git.drupalcode.org/project/drupal",
          "vendor": "Drupal",
          "versions": [
            {
              "lessThan": "10.5.12",
              "status": "affected",
              "version": "0.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "10.6.11",
              "status": "affected",
              "version": "10.6.0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.2.14",
              "status": "affected",
              "version": "11.2.0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.3.12",
              "status": "affected",
              "version": "11.3.0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.0.*",
              "status": "affected",
              "version": "0.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.1.*",
              "status": "affected",
              "version": "0.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Hamed Kohi (0xhamy)"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "assaf alassaf (ama62)"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Albert Skibinski (askibinski)"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Jon Minder (ayalon)"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Lautaro Casanova (betah4k)"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Gabe Sullice (gabesullice)"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "John Morahan (john morahan)"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Michael Winser (michaelwinser)"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "nbanderson"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "offensive-ai"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Francesco Placella (plach)"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "quynh ho (qquynh)"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Himanshu Anand (unknownhad)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Lee Rowlands (larowlan)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Dave Long (longwave)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Drew Webber (mcdruid)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Adam G-H (phenaproxima)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Sean Blommaert (seanb)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Benji Fisher (benjifisher)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "cilefen  (cilefen)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Damien McKenna (damienmckenna)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Mori Sugimoto (dokumori)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Greg Knaddison (greggles)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Lee Rowlands (larowlan)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Dave Long (longwave)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Drew Webber (mcdruid)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "James Gilliland (neclimdul)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Juraj Nemec (poker10)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Jess  (xjm)"
        }
      ],
      "datePublic": "2026-06-17T18:57:49.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Server-Side Request Forgery (SSRF) vulnerability in Drupal Drupal core allows Server Side Request Forgery. This issue affects Drupal core versions: from 0.0.0 to 10.5.12, from 10.6.0 to 10.6.11, from 11.2.0 to 11.2.14, from 11.3.0 to 11.3.12, from 0.0.0 to 11.0.*, from 0.0.0 to 11.1.*."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-664",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-664 Server Side Request Forgery"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918 Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-10T21:46:40.786Z",
        "orgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
        "shortName": "drupal"
      },
      "references": [
        {
          "url": "https://www.drupal.org/sa-core-2026-008"
        }
      ],
      "title": "Drupal core - Moderately critical - Server-side request forgery - SA-CORE-2026-008"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
    "assignerShortName": "drupal",
    "cveId": "CVE-2026-55807",
    "datePublished": "2026-07-10T21:46:40.786Z",
    "dateReserved": "2026-06-17T14:59:52.673Z",
    "dateUpdated": "2026-07-13T18:20:30.331Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-55806 (GCVE-0-2026-55806)

Vulnerability from cvelistv5 – Published: 2026-07-10 21:46 – Updated: 2026-07-13 18:22

Title

Drupal core - Less critical - Cache poisoning and open redirect - SA-CORE-2026-007

Summary

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal Drupal core allows Content Spoofing. This issue affects Drupal core versions: from 0.0.0 to 10.5.12, from 10.6.0 to 10.6.11, from 11.2.0 to 11.2.14, from 11.3.0 to 11.3.12, from 0.0.0 to 11.0.*, from 0.0.0 to 11.1.*.

Severity

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-13 18:21 UTC

CWE

CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')

Assigner

drupal mitre root

References

1 reference

URL	Tags
https://www.drupal.org/sa-core-2026-007

Impacted products

1 product

Vendor	Product	Version
Drupal	Drupal core	Affected: 0.0.0 , < 10.5.12 (semver) Affected: 10.6.0 , < 10.6.11 (semver) Affected: 11.2.0 , < 11.2.14 (semver) Affected: 11.3.0 , < 11.3.12 (semver) Affected: 0.0.0 , < 11.0.* (semver) Affected: 0.0.0 , < 11.1.* (semver)

Date Public

2026-06-17 18:57

Credits

Melih Acikoz Michael Winser (michaelwinser) Willem Drupal enthousiast (willempje2) Lee Rowlands (larowlan) catch (catch) cilefen (cilefen) Greg Knaddison (greggles) Lee Rowlands (larowlan) Dave Long (longwave) James Gilliland (neclimdul) Juraj Nemec (poker10) Jess (xjm)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 5.9,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-55806",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-13T18:21:46.004176Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-13T18:22:03.916Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://www.drupal.org/project/drupal",
          "product": "Drupal core",
          "repo": "https://git.drupalcode.org/project/drupal",
          "vendor": "Drupal",
          "versions": [
            {
              "lessThan": "10.5.12",
              "status": "affected",
              "version": "0.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "10.6.11",
              "status": "affected",
              "version": "10.6.0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.2.14",
              "status": "affected",
              "version": "11.2.0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.3.12",
              "status": "affected",
              "version": "11.3.0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.0.*",
              "status": "affected",
              "version": "0.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.1.*",
              "status": "affected",
              "version": "0.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Melih Acikoz"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Michael Winser (michaelwinser)"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Willem Drupal enthousiast (willempje2)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Lee Rowlands (larowlan)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "catch (catch)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "cilefen  (cilefen)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Greg Knaddison (greggles)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Lee Rowlands (larowlan)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Dave Long (longwave)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "James Gilliland (neclimdul)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Juraj Nemec (poker10)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Jess  (xjm)"
        }
      ],
      "datePublic": "2026-06-17T18:57:37.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027) vulnerability in Drupal Drupal core allows Content Spoofing. This issue affects Drupal core versions: from 0.0.0 to 10.5.12, from 10.6.0 to 10.6.11, from 11.2.0 to 11.2.14, from 11.3.0 to 11.3.12, from 0.0.0 to 11.0.*, from 0.0.0 to 11.1.*."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-148",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-148 Content Spoofing"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-601",
              "description": "CWE-601 URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-10T21:46:39.920Z",
        "orgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
        "shortName": "drupal"
      },
      "references": [
        {
          "url": "https://www.drupal.org/sa-core-2026-007"
        }
      ],
      "title": "Drupal core - Less critical - Cache poisoning and open redirect - SA-CORE-2026-007"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
    "assignerShortName": "drupal",
    "cveId": "CVE-2026-55806",
    "datePublished": "2026-07-10T21:46:39.920Z",
    "dateReserved": "2026-06-17T14:59:52.673Z",
    "dateUpdated": "2026-07-13T18:22:03.916Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-55804 (GCVE-0-2026-55804)

Vulnerability from cvelistv5 – Published: 2026-07-10 21:46 – Updated: 2026-07-13 18:23

Title

Drupal core - Moderately critical - Gadget chain - SA-CORE-2026-006

Summary

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection. This issue affects Drupal core versions: from 0.0.0 to 10.5.12, from 10.6.0 to 10.6.11, from 11.2.0 to 11.2.14, from 11.3.0 to 11.3.12, from 0.0.0 to 11.0.*, from 0.0.0 to 11.1.*.

Severity

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-13 18:23 UTC

CWE

CWE-915 - Improperly Controlled Modification of Dynamically-Determined Object Attributes

Assigner

drupal mitre root

References

1 reference

URL	Tags
https://www.drupal.org/sa-core-2026-006

Impacted products

1 product

Vendor	Product	Version
Drupal	Drupal core	Affected: 0.0.0 , < 10.5.12 (semver) Affected: 10.6.0 , < 10.6.11 (semver) Affected: 11.2.0 , < 11.2.14 (semver) Affected: 11.3.0 , < 11.3.12 (semver) Affected: 0.0.0 , < 11.0.* (semver) Affected: 0.0.0 , < 11.1.* (semver)

Date Public

2026-06-17 18:57

Credits

Michael Maturi (michaelmaturi) Lee Rowlands (larowlan) Drew Webber (mcdruid) Mohit Aghera (mohit_aghera) Anna Kalata (akalata) Benji Fisher (benjifisher) cilefen (cilefen) Greg Knaddison (greggles) Lee Rowlands (larowlan) Dave Long (longwave) Drew Webber (mcdruid) Juraj Nemec (poker10) Jess (xjm)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 5.9,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "HIGH",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-55804",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-13T18:23:03.385832Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-13T18:23:35.057Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://www.drupal.org/project/drupal",
          "product": "Drupal core",
          "repo": "https://git.drupalcode.org/project/drupal",
          "vendor": "Drupal",
          "versions": [
            {
              "lessThan": "10.5.12",
              "status": "affected",
              "version": "0.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "10.6.11",
              "status": "affected",
              "version": "10.6.0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.2.14",
              "status": "affected",
              "version": "11.2.0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.3.12",
              "status": "affected",
              "version": "11.3.0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.0.*",
              "status": "affected",
              "version": "0.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.1.*",
              "status": "affected",
              "version": "0.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Michael Maturi (michaelmaturi)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Lee Rowlands (larowlan)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Drew Webber (mcdruid)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Mohit Aghera (mohit_aghera)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Anna Kalata (akalata)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Benji Fisher (benjifisher)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "cilefen  (cilefen)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Greg Knaddison (greggles)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Lee Rowlands (larowlan)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Dave Long (longwave)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Drew Webber (mcdruid)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Juraj Nemec (poker10)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Jess  (xjm)"
        }
      ],
      "datePublic": "2026-06-17T18:57:02.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection. This issue affects Drupal core versions: from 0.0.0 to 10.5.12, from 10.6.0 to 10.6.11, from 11.2.0 to 11.2.14, from 11.3.0 to 11.3.12, from 0.0.0 to 11.0.*, from 0.0.0 to 11.1.*."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-586",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-586 Object Injection"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-915",
              "description": "CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-10T21:46:39.054Z",
        "orgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
        "shortName": "drupal"
      },
      "references": [
        {
          "url": "https://www.drupal.org/sa-core-2026-006"
        }
      ],
      "title": "Drupal core - Moderately critical - Gadget chain - SA-CORE-2026-006"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
    "assignerShortName": "drupal",
    "cveId": "CVE-2026-55804",
    "datePublished": "2026-07-10T21:46:39.054Z",
    "dateReserved": "2026-06-17T14:59:52.673Z",
    "dateUpdated": "2026-07-13T18:23:35.057Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-55803 (GCVE-0-2026-55803)

Vulnerability from cvelistv5 – Published: 2026-07-10 21:46 – Updated: 2026-07-13 18:24

Title

Drupal core - Critical - PHP object injection - SA-CORE-2026-005

Summary

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection. This issue affects Drupal core versions: from 0.0.0 to 10.5.12, from 10.6.0 to 10.6.11, from 11.2.0 to 11.2.14, from 11.3.0 to 11.3.12, from 0.0.0 to 11.0.*, from 0.0.0 to 11.1.*.

Severity

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-13 18:23 UTC

CWE

CWE-915 - Improperly Controlled Modification of Dynamically-Determined Object Attributes

Assigner

drupal mitre root

References

1 reference

URL	Tags
https://www.drupal.org/sa-core-2026-005

Impacted products

1 product

Vendor	Product	Version
Drupal	Drupal core	Affected: 0.0.0 , < 10.5.12 (semver) Affected: 10.6.0 , < 10.6.11 (semver) Affected: 11.2.0 , < 11.2.14 (semver) Affected: 11.3.0 , < 11.3.12 (semver) Affected: 0.0.0 , < 11.0.* (semver) Affected: 0.0.0 , < 11.1.* (semver)

Date Public

2026-06-17 18:56

Credits

Michael Maturi (michaelmaturi) BjÃ¶rn Brala (bbrala) Sascha Grossenbacher (berdir) Lee Rowlands (larowlan) Dave Long (longwave) Drew Webber (mcdruid) Anna Kalata (akalata) Benji Fisher (benjifisher) Damien McKenna (damienmckenna) David Strauss (david strauss) Neil Drumm (drumm) Greg Knaddison (greggles) Tim Hestenes Lehnen (hestenet) Lee Rowlands (larowlan) Dave Long (longwave) Drew Webber (mcdruid) Juraj Nemec (poker10) Ra MÃ¤nd (ram4nd) Jess (xjm)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 5.9,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "HIGH",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-55803",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-13T18:23:53.103260Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-13T18:24:17.938Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://www.drupal.org/project/drupal",
          "product": "Drupal core",
          "repo": "https://git.drupalcode.org/project/drupal",
          "vendor": "Drupal",
          "versions": [
            {
              "lessThan": "10.5.12",
              "status": "affected",
              "version": "0.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "10.6.11",
              "status": "affected",
              "version": "10.6.0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.2.14",
              "status": "affected",
              "version": "11.2.0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.3.12",
              "status": "affected",
              "version": "11.3.0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.0.*",
              "status": "affected",
              "version": "0.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.1.*",
              "status": "affected",
              "version": "0.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Michael Maturi (michaelmaturi)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Bj\u00c3\u00b6rn Brala (bbrala)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Sascha Grossenbacher (berdir)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Lee Rowlands (larowlan)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Dave Long (longwave)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Drew Webber (mcdruid)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Anna Kalata (akalata)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Benji Fisher (benjifisher)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Damien McKenna (damienmckenna)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "David Strauss (david strauss)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Neil Drumm (drumm)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Greg Knaddison (greggles)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Tim Hestenes Lehnen (hestenet)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Lee Rowlands (larowlan)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Dave Long (longwave)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Drew Webber (mcdruid)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Juraj Nemec (poker10)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Ra M\u00c3\u00a4nd (ram4nd)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Jess  (xjm)"
        }
      ],
      "datePublic": "2026-06-17T18:56:50.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection. This issue affects Drupal core versions: from 0.0.0 to 10.5.12, from 10.6.0 to 10.6.11, from 11.2.0 to 11.2.14, from 11.3.0 to 11.3.12, from 0.0.0 to 11.0.*, from 0.0.0 to 11.1.*."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-586",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-586 Object Injection"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-915",
              "description": "CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-10T21:46:38.051Z",
        "orgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
        "shortName": "drupal"
      },
      "references": [
        {
          "url": "https://www.drupal.org/sa-core-2026-005"
        }
      ],
      "title": "Drupal core - Critical - PHP object injection - SA-CORE-2026-005"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
    "assignerShortName": "drupal",
    "cveId": "CVE-2026-55803",
    "datePublished": "2026-07-10T21:46:38.051Z",
    "dateReserved": "2026-06-17T14:59:52.673Z",
    "dateUpdated": "2026-07-13T18:24:17.938Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-15085 (GCVE-0-2026-15085)

Vulnerability from cvelistv5 – Published: 2026-07-10 21:46 – Updated: 2026-07-13 18:25

Title

AI SEO/GEO Analyzer - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-076

Summary

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI SEO/GEO Analyzer allows Stored XSS. This issue affects AI SEO/GEO Analyzer versions: from 0.0.0 to 1.1.3.

Severity

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-13 18:24 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")

Assigner

drupal mitre root

References

1 reference

URL	Tags
https://www.drupal.org/sa-contrib-2026-076

Impacted products

1 product

Vendor	Product	Version
Drupal	AI SEO/GEO Analyzer	Affected: 0.0.0 , < 1.1.3 (semver)

Date Public

2026-07-08 17:18

Credits

Drew Webber (mcdruid) Juhani VÃ¤Ã¤tÃ¤jÃ¤ (j-vee) Greg Knaddison (greggles) Drew Webber (mcdruid)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 5.4,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "LOW",
              "scope": "CHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-15085",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-13T18:24:39.532853Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-13T18:25:09.171Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://www.drupal.org/project/ai_seo",
          "product": "AI SEO/GEO Analyzer",
          "repo": "https://git.drupalcode.org/project/ai_seo",
          "vendor": "Drupal",
          "versions": [
            {
              "lessThan": "1.1.3",
              "status": "affected",
              "version": "0.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Drew Webber (mcdruid)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Juhani V\u00c3\u00a4\u00c3\u00a4t\u00c3\u00a4j\u00c3\u00a4 (j-vee)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Greg Knaddison (greggles)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Drew Webber (mcdruid)"
        }
      ],
      "datePublic": "2026-07-08T17:18:39.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal AI SEO/GEO Analyzer allows Stored XSS. This issue affects AI SEO/GEO Analyzer versions: from 0.0.0 to 1.1.3."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-592",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-592 Stored XSS"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\")",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-10T21:46:35.632Z",
        "orgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
        "shortName": "drupal"
      },
      "references": [
        {
          "url": "https://www.drupal.org/sa-contrib-2026-076"
        }
      ],
      "title": "AI SEO/GEO Analyzer - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-076"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
    "assignerShortName": "drupal",
    "cveId": "CVE-2026-15085",
    "datePublished": "2026-07-10T21:46:35.632Z",
    "dateReserved": "2026-07-08T15:44:59.219Z",
    "dateUpdated": "2026-07-13T18:25:09.171Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-15084 (GCVE-0-2026-15084)

Vulnerability from cvelistv5 – Published: 2026-07-10 21:46 – Updated: 2026-07-13 18:14

Title

UI Patterns (SDC in Drupal UI) - Moderately critical - Cross site scripting - SA-CONTRIB-2026-075

Summary

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal UI Patterns (SDC in Drupal UI) allows Stored XSS. This issue affects UI Patterns (SDC in Drupal UI) versions: from 2.0.0 to 2.0.17.

Severity

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-13 18:14 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")

Assigner

drupal mitre root

References

1 reference

URL	Tags
https://www.drupal.org/sa-contrib-2026-075

Impacted products

1 product

Vendor	Product	Version
Drupal	UI Patterns (SDC in Drupal UI)	Affected: 2.0.0 , < 2.0.17 (semver)

Date Public

2026-07-08 17:17

Credits

HervÃ© Donner (herved) Florent Torregrosa (grimreaper) HervÃ© Donner (herved) Mikael Meulle (just_like_good_vibes) Pierre Dureau (pdureau) Neil Drumm (drumm) Greg Knaddison (greggles) Juraj Nemec (poker10) Dave Long (longwave)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 5.4,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "LOW",
              "scope": "CHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-15084",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-13T18:14:35.644001Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-13T18:14:56.574Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://www.drupal.org/project/ui_patterns",
          "product": "UI Patterns (SDC in Drupal UI)",
          "repo": "https://git.drupalcode.org/project/ui_patterns",
          "vendor": "Drupal",
          "versions": [
            {
              "lessThan": "2.0.17",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Herv\u00c3\u00a9 Donner (herved)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Florent Torregrosa (grimreaper)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Herv\u00c3\u00a9 Donner (herved)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Mikael Meulle (just_like_good_vibes)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Pierre Dureau (pdureau)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Neil Drumm (drumm)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Greg Knaddison (greggles)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Juraj Nemec (poker10)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Dave Long (longwave)"
        }
      ],
      "datePublic": "2026-07-08T17:17:41.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal UI Patterns (SDC in Drupal UI) allows Stored XSS. This issue affects UI Patterns (SDC in Drupal UI) versions: from 2.0.0 to 2.0.17."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-592",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-592 Stored XSS"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\")",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-10T21:46:34.771Z",
        "orgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
        "shortName": "drupal"
      },
      "references": [
        {
          "url": "https://www.drupal.org/sa-contrib-2026-075"
        }
      ],
      "title": "UI Patterns (SDC in Drupal UI) - Moderately critical - Cross site scripting - SA-CONTRIB-2026-075"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
    "assignerShortName": "drupal",
    "cveId": "CVE-2026-15084",
    "datePublished": "2026-07-10T21:46:34.771Z",
    "dateReserved": "2026-07-08T15:44:58.126Z",
    "dateUpdated": "2026-07-13T18:14:56.574Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

381 vulnerabilities

CVE-2026-15916 (GCVE-0-2026-15916)

CVE-2026-15917 (GCVE-0-2026-15917)

CVE-2026-55805 (GCVE-0-2026-55805)

CVE-2026-16638 (GCVE-0-2026-16638)

CVE-2026-16639 (GCVE-0-2026-16639)

CVE-2026-16640 (GCVE-0-2026-16640)

CVE-2026-16646 (GCVE-0-2026-16646)

CVE-2026-16641 (GCVE-0-2026-16641)

CVE-2026-16642 (GCVE-0-2026-16642)

CVE-2026-16643 (GCVE-0-2026-16643)

CVE-2026-16644 (GCVE-0-2026-16644)

CVE-2026-16645 (GCVE-0-2026-16645)

CVE-2026-15088 (GCVE-0-2026-15088)

CVE-2026-18259 (GCVE-0-2026-18259)

CVE-2026-18260 (GCVE-0-2026-18260)

CVE-2026-18261 (GCVE-0-2026-18261)

CVE-2026-18985 (GCVE-0-2026-18985)

CVE-2026-11913 (GCVE-0-2026-11913)

CVE-2026-11914 (GCVE-0-2026-11914)

CVE-2026-11915 (GCVE-0-2026-11915)

CVE-2026-15087 (GCVE-0-2026-15087)

CVE-2026-15086 (GCVE-0-2026-15086)

CVE-2026-15089 (GCVE-0-2026-15089)

CVE-2026-55808 (GCVE-0-2026-55808)

CVE-2026-55807 (GCVE-0-2026-55807)

CVE-2026-55806 (GCVE-0-2026-55806)

CVE-2026-55804 (GCVE-0-2026-55804)

CVE-2026-55803 (GCVE-0-2026-55803)

CVE-2026-15085 (GCVE-0-2026-15085)

CVE-2026-15084 (GCVE-0-2026-15084)

Find a vulnerability

Search criteria ⓘ Use this form to refine search results. Full-text search supports keyword queries with ranking and filtering. You can combine vendor, product, and sources to narrow results. Enable “Apply ordering” to sort by date instead of relevance.

381 vulnerabilities

CVE-2026-15916 (GCVE-0-2026-15916)

CVE-2026-15917 (GCVE-0-2026-15917)

CVE-2026-55805 (GCVE-0-2026-55805)

CVE-2026-16638 (GCVE-0-2026-16638)

CVE-2026-16639 (GCVE-0-2026-16639)

CVE-2026-16640 (GCVE-0-2026-16640)

CVE-2026-16646 (GCVE-0-2026-16646)

CVE-2026-16641 (GCVE-0-2026-16641)

CVE-2026-16642 (GCVE-0-2026-16642)

CVE-2026-16643 (GCVE-0-2026-16643)

CVE-2026-16644 (GCVE-0-2026-16644)

CVE-2026-16645 (GCVE-0-2026-16645)

CVE-2026-15088 (GCVE-0-2026-15088)

CVE-2026-18259 (GCVE-0-2026-18259)

CVE-2026-18260 (GCVE-0-2026-18260)

CVE-2026-18261 (GCVE-0-2026-18261)

CVE-2026-18985 (GCVE-0-2026-18985)

CVE-2026-11913 (GCVE-0-2026-11913)

CVE-2026-11914 (GCVE-0-2026-11914)

CVE-2026-11915 (GCVE-0-2026-11915)

CVE-2026-15087 (GCVE-0-2026-15087)

CVE-2026-15086 (GCVE-0-2026-15086)

CVE-2026-15089 (GCVE-0-2026-15089)

CVE-2026-55808 (GCVE-0-2026-55808)

CVE-2026-55807 (GCVE-0-2026-55807)

CVE-2026-55806 (GCVE-0-2026-55806)

CVE-2026-55804 (GCVE-0-2026-55804)

CVE-2026-55803 (GCVE-0-2026-55803)

CVE-2026-15085 (GCVE-0-2026-15085)

CVE-2026-15084 (GCVE-0-2026-15084)

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.