https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 23 Oct 2026 00:01:03 +0000 https://db.gcve.eu/vuln/drupal-contrib-2026-153 <p><strong>Affected:</strong> Packagist:https://packages.drupal.org/8: drupal/ultimate_table_field</p> <p>The Ultimate Table Field module enables you to store table data in a field and edit each table cell through a dialog, using cell field plugins such as text, link, and file.</p> <p>The module doesn&#39;t sufficiently protect the route that opens the cell editor dialog. The route is accessible to anonymous users, who can open the dialog for any cell type. The dialog allows uploading files to the server location.</p> <p>This vulnerability is partially mitigated by the fact that only files with the `pdf`, `doc` and `docx` extensions are accepted.</p> <p><strong>Affected:</strong> Packagist:https://packages.drupal.org/8: drupal/ultimate_table_field</p> <p>The Ultimate Table Field module enables you to store table data in a field and edit each table cell through a dialog, using cell field plugins such as text, link, and file.</p> <p>The module doesn&#39;t sufficiently protect the route that opens the cell editor dialog. The route is accessible to anonymous users, who can open the dialog for any cell type. The dialog allows uploading files to the server location.</p> <p>This vulnerability is partially mitigated by the fact that only files with the `pdf`, `doc` and `docx` extensions are accepted.</p> https://db.gcve.eu/vuln/drupal-contrib-2026-153 https://db.gcve.eu/vuln/fkie_cve-2026-87955 <p>Missing Authorization vulnerability in Drupal Ultimate Table Field allows Forceful Browsing. This issue affects Ultimate Table Field versions: from 0.0.0 to 1.1.1, from 2.0.0 to 2.0.1.</p> <p>Missing Authorization vulnerability in Drupal Ultimate Table Field allows Forceful Browsing. This issue affects Ultimate Table Field versions: from 0.0.0 to 1.1.1, from 2.0.0 to 2.0.1.</p> https://db.gcve.eu/vuln/fkie_cve-2026-87955 https://db.gcve.eu/vuln/ghsa-7r58-7q87-mv6m <p>Missing Authorization vulnerability in Drupal Ultimate Table Field allows Forceful Browsing. This issue affects Ultimate Table Field versions: from 0.0.0 to 1.1.1, from 2.0.0 to 2.0.1.</p> <p>Missing Authorization vulnerability in Drupal Ultimate Table Field allows Forceful Browsing. This issue affects Ultimate Table Field versions: from 0.0.0 to 1.1.1, from 2.0.0 to 2.0.1.</p> https://db.gcve.eu/vuln/ghsa-7r58-7q87-mv6m https://db.gcve.eu/vuln/wid-sec-w-2026-3284 <p>Ein Angreifer kann mehrere Schwachstellen in Drupal ausnutzen, um Datenbankinhalte zu manipulieren oder auszulesen, Zugriffsbeschränkungen und Authentifizierungsmechanismen zu umgehen, vertrauliche Informationen offenzulegen, Cross Site Scripting Angriffe auszuführen, Benutzer auf manipulierte Webseiten umzuleiten, SAML-Authentifizierungen zu beeinflussen oder wiederzuverwenden, interne Ressourcen über SSRF anzusprechen sowie unberechtigt Dateien auf den Server hochzuladen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in Drupal ausnutzen, um Datenbankinhalte zu manipulieren oder auszulesen, Zugriffsbeschränkungen und Authentifizierungsmechanismen zu umgehen, vertrauliche Informationen offenzulegen, Cross Site Scripting Angriffe auszuführen, Benutzer auf manipulierte Webseiten umzuleiten, SAML-Authentifizierungen zu beeinflussen oder wiederzuverwenden, interne Ressourcen über SSRF anzusprechen sowie unberechtigt Dateien auf den Server hochzuladen.</p> https://db.gcve.eu/vuln/wid-sec-w-2026-3284