Vulnerability-Lookup

Search criteria

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2026-55805 (GCVE-0-2026-55805)

Vulnerability from nvd – Published: 2026-08-25 22:22 – Updated: 2026-08-25 22:22

Title

Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-012

Summary

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Stored XSS. This issue affects Drupal core versions: from 0.0.0 to 10.6.13, from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, from 0.0.0 to 11.0.*, from 0.0.0 to 11.1.*, from 0.0.0 to 11.2.*.

Severity

No CVSS data available.

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")

Assigner

drupal mitre root

References

1 reference

URL	Tags
https://www.drupal.org/sa-core-2026-012

Impacted products

1 product

Vendor	Product	Version
Drupal	Drupal core	Affected: 0.0.0 , < 10.6.13 (semver) Affected: 11.3.0 , < 11.3.14 (semver) Affected: 11.4.0 , < 11.4.4 (semver) Affected: 0.0.0 , < 11.0.* (semver) Affected: 0.0.0 , < 11.1.* (semver) Affected: 0.0.0 , < 11.2.* (semver)

Date Public

2026-07-15 19:52

Credits

haii haii (hai27ii2o) danielveza Lee Rowlands (larowlan) Mingsong (mingsong) James Gilliland (neclimdul) Greg Knaddison (greggles) Lee Rowlands (larowlan) Dave Long (longwave) Jess (xjm)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://www.drupal.org/project/drupal",
          "product": "Drupal core",
          "repo": "https://git.drupalcode.org/project/drupal",
          "vendor": "Drupal",
          "versions": [
            {
              "lessThan": "10.6.13",
              "status": "affected",
              "version": "0.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.3.14",
              "status": "affected",
              "version": "11.3.0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.4.4",
              "status": "affected",
              "version": "11.4.0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.0.*",
              "status": "affected",
              "version": "0.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.1.*",
              "status": "affected",
              "version": "0.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.2.*",
              "status": "affected",
              "version": "0.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "haii haii (hai27ii2o)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "danielveza"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Lee Rowlands (larowlan)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Mingsong  (mingsong)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "James Gilliland (neclimdul)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Greg Knaddison (greggles)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Lee Rowlands (larowlan)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Dave Long (longwave)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Jess  (xjm)"
        }
      ],
      "datePublic": "2026-07-15T19:52:26.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal Drupal core allows Stored XSS. This issue affects Drupal core versions: from 0.0.0 to 10.6.13, from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, from 0.0.0 to 11.0.*, from 0.0.0 to 11.1.*, from 0.0.0 to 11.2.*."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-592",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-592 Stored XSS"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\")",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T22:22:20.763Z",
        "orgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
        "shortName": "drupal"
      },
      "references": [
        {
          "url": "https://www.drupal.org/sa-core-2026-012"
        }
      ],
      "title": "Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-012"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
    "assignerShortName": "drupal",
    "cveId": "CVE-2026-55805",
    "datePublished": "2026-08-25T22:22:20.763Z",
    "dateReserved": "2026-06-17T14:59:52.673Z",
    "dateUpdated": "2026-08-25T22:22:20.763Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-18985 (GCVE-0-2026-18985)

Vulnerability from nvd – Published: 2026-08-25 22:19 – Updated: 2026-08-25 22:19

Title

Edit in-place field - Moderately critical - Access bypass - SA-CONTRIB-2026-093

Summary

Incorrect Authorization vulnerability in Drupal Edit in-place field allows Forceful Browsing. This issue affects Edit in-place field versions: from 0.0.0 to 2.1.1.

Severity

No CVSS data available.

CWE

CWE-863 - Incorrect Authorization

Assigner

drupal mitre root

References

1 reference

URL	Tags
https://www.drupal.org/sa-contrib-2026-093

Impacted products

1 product

Vendor	Product	Version
Drupal	Edit in-place field	Affected: 0.0.0 , < 2.1.1 (semver)

Date Public

2026-08-05 17:58

Credits

Drew Webber (mcdruid) BÃ¡lint Nagy (nagy.balint) Neil Drumm (drumm) Greg Knaddison (greggles)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://www.drupal.org/project/edit_in_place_field",
          "product": "Edit in-place field",
          "repo": "https://git.drupalcode.org/project/edit_in_place_field",
          "vendor": "Drupal",
          "versions": [
            {
              "lessThan": "2.1.1",
              "status": "affected",
              "version": "0.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Drew Webber (mcdruid)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "B\u00c3\u00a1lint Nagy (nagy.balint)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Neil Drumm (drumm)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Greg Knaddison (greggles)"
        }
      ],
      "datePublic": "2026-08-05T17:58:38.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Incorrect Authorization vulnerability in Drupal Edit in-place field allows Forceful Browsing. This issue affects Edit in-place field versions: from 0.0.0 to 2.1.1."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-87",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-87 Forceful Browsing"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863 Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T22:19:31.812Z",
        "orgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
        "shortName": "drupal"
      },
      "references": [
        {
          "url": "https://www.drupal.org/sa-contrib-2026-093"
        }
      ],
      "title": "Edit in-place field - Moderately critical - Access bypass - SA-CONTRIB-2026-093"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
    "assignerShortName": "drupal",
    "cveId": "CVE-2026-18985",
    "datePublished": "2026-08-25T22:19:31.812Z",
    "dateReserved": "2026-08-05T17:35:21.263Z",
    "dateUpdated": "2026-08-25T22:19:31.812Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-18261 (GCVE-0-2026-18261)

Vulnerability from nvd – Published: 2026-08-25 22:21 – Updated: 2026-08-25 22:21

Title

Powerful Surveys - Critical - Unsupported - SA-CONTRIB-2026-092

Summary

Vulnerability in Drupal Powerful Surveys. This issue affects Powerful Surveys versions: *.*.

Severity

No CVSS data available.

Assigner

drupal mitre root

References

1 reference

URL	Tags
https://www.drupal.org/sa-contrib-2026-092

Impacted products

1 product

Vendor	Product	Version
Drupal	Powerful Surveys	Affected: . (semver)

Date Public

2026-07-29 17:12

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://www.drupal.org/project/powerful_surveys",
          "product": "Powerful Surveys",
          "repo": "https://git.drupalcode.org/project/powerful_surveys",
          "vendor": "Drupal",
          "versions": [
            {
              "status": "affected",
              "version": "*.*",
              "versionType": "semver"
            }
          ]
        }
      ],
      "datePublic": "2026-07-29T17:12:05.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Vulnerability in Drupal Powerful Surveys. This issue affects Powerful Surveys versions: *.*."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T22:21:28.297Z",
        "orgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
        "shortName": "drupal"
      },
      "references": [
        {
          "url": "https://www.drupal.org/sa-contrib-2026-092"
        }
      ],
      "title": "Powerful Surveys - Critical - Unsupported - SA-CONTRIB-2026-092"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
    "assignerShortName": "drupal",
    "cveId": "CVE-2026-18261",
    "datePublished": "2026-08-25T22:21:28.297Z",
    "dateReserved": "2026-07-29T16:42:38.736Z",
    "dateUpdated": "2026-08-25T22:21:28.297Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-18260 (GCVE-0-2026-18260)

Vulnerability from nvd – Published: 2026-08-25 22:21 – Updated: 2026-08-25 22:21

Title

Disable Login Page - Critical - Unsupported - SA-CONTRIB-2026-091

Summary

Vulnerability in Drupal Disable Login Page. This issue affects Disable Login Page versions: *.*.

Severity

No CVSS data available.

Assigner

drupal mitre root

References

1 reference

URL	Tags
https://www.drupal.org/sa-contrib-2026-091

Impacted products

1 product

Vendor	Product	Version
Drupal	Disable Login Page	Affected: . (semver)

Date Public

2026-07-29 17:11

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://www.drupal.org/project/disable_login",
          "product": "Disable Login Page",
          "repo": "https://git.drupalcode.org/project/disable_login",
          "vendor": "Drupal",
          "versions": [
            {
              "status": "affected",
              "version": "*.*",
              "versionType": "semver"
            }
          ]
        }
      ],
      "datePublic": "2026-07-29T17:11:14.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Vulnerability in Drupal Disable Login Page. This issue affects Disable Login Page versions: *.*."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T22:21:34.604Z",
        "orgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
        "shortName": "drupal"
      },
      "references": [
        {
          "url": "https://www.drupal.org/sa-contrib-2026-091"
        }
      ],
      "title": "Disable Login Page - Critical - Unsupported - SA-CONTRIB-2026-091"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
    "assignerShortName": "drupal",
    "cveId": "CVE-2026-18260",
    "datePublished": "2026-08-25T22:21:34.604Z",
    "dateReserved": "2026-07-29T16:42:37.743Z",
    "dateUpdated": "2026-08-25T22:21:34.604Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-18259 (GCVE-0-2026-18259)

Vulnerability from nvd – Published: 2026-08-25 22:21 – Updated: 2026-08-25 22:21

Title

Token Content Access - Moderately critical - Access bypass - SA-CONTRIB-2026-090

Summary

Observable Timing Discrepancy vulnerability in Drupal Token Content Access allows Brute Force. This issue affects Token Content Access versions: from 0.0.0 to 3.1.2.

Severity

No CVSS data available.

CWE

CWE-208 - Observable Timing Discrepancy

Assigner

drupal mitre root

References

1 reference

URL	Tags
https://www.drupal.org/sa-contrib-2026-090

Impacted products

1 product

Vendor	Product	Version
Drupal	Token Content Access	Affected: 0.0.0 , < 3.1.2 (semver)

Date Public

2026-07-29 17:08

Credits

Robin (robincs) Kyrylo Loboda (lobodakyrylo) Bram Driesen (bramdriesen) cilefen (cilefen) Greg Knaddison (greggles) Juraj Nemec (poker10) Swan Kalata (akalata)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://www.drupal.org/project/tca",
          "product": "Token Content Access",
          "repo": "https://git.drupalcode.org/project/tca",
          "vendor": "Drupal",
          "versions": [
            {
              "lessThan": "3.1.2",
              "status": "affected",
              "version": "0.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Robin  (robincs)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Kyrylo Loboda (lobodakyrylo)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Bram Driesen (bramdriesen)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "cilefen  (cilefen)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Greg Knaddison (greggles)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Juraj Nemec (poker10)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Swan Kalata (akalata)"
        }
      ],
      "datePublic": "2026-07-29T17:08:33.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Observable Timing Discrepancy vulnerability in Drupal Token Content Access allows Brute Force. This issue affects Token Content Access versions: from 0.0.0 to 3.1.2."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-112",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-112 Brute Force"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-208",
              "description": "CWE-208 Observable Timing Discrepancy",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T22:21:39.663Z",
        "orgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
        "shortName": "drupal"
      },
      "references": [
        {
          "url": "https://www.drupal.org/sa-contrib-2026-090"
        }
      ],
      "title": "Token Content Access - Moderately critical - Access bypass - SA-CONTRIB-2026-090"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
    "assignerShortName": "drupal",
    "cveId": "CVE-2026-18259",
    "datePublished": "2026-08-25T22:21:39.663Z",
    "dateReserved": "2026-07-29T16:42:36.967Z",
    "dateUpdated": "2026-08-25T22:21:39.663Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-16646 (GCVE-0-2026-16646)

Vulnerability from nvd – Published: 2026-08-25 22:22 – Updated: 2026-08-25 22:22

Title

PanKM - Critical - Unsupported - SA-CONTRIB-2026-083

Summary

Vulnerability in Drupal PanKM. This issue affects PanKM versions: *.*.

Severity

No CVSS data available.

Assigner

drupal mitre root

References

1 reference

URL	Tags
https://www.drupal.org/sa-contrib-2026-083

Impacted products

1 product

Vendor	Product	Version
Drupal	PanKM	Affected: . (semver)

Date Public

2026-07-22 17:55

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://www.drupal.org/project/pankm",
          "product": "PanKM",
          "repo": "https://git.drupalcode.org/project/pankm",
          "vendor": "Drupal",
          "versions": [
            {
              "status": "affected",
              "version": "*.*",
              "versionType": "semver"
            }
          ]
        }
      ],
      "datePublic": "2026-07-22T17:55:59.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Vulnerability in Drupal PanKM. This issue affects PanKM versions: *.*."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T22:22:05.938Z",
        "orgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
        "shortName": "drupal"
      },
      "references": [
        {
          "url": "https://www.drupal.org/sa-contrib-2026-083"
        }
      ],
      "title": "PanKM - Critical - Unsupported - SA-CONTRIB-2026-083"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
    "assignerShortName": "drupal",
    "cveId": "CVE-2026-16646",
    "datePublished": "2026-08-25T22:22:05.938Z",
    "dateReserved": "2026-07-22T17:06:47.500Z",
    "dateUpdated": "2026-08-25T22:22:05.938Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-16645 (GCVE-0-2026-16645)

Vulnerability from nvd – Published: 2026-08-25 22:21 – Updated: 2026-08-25 22:21

Title

PhotoSwipe - Responsive JavaScript Modal Image Gallery - Moderately critical - Access bypass - SA-CONTRIB-2026-088

Summary

Missing Authorization vulnerability in Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery allows Forceful Browsing. This issue affects PhotoSwipe - Responsive JavaScript Modal Image Gallery versions: from 0.0.0 to 3.2.0.

Severity

No CVSS data available.

CWE

CWE-862 - Missing Authorization

Assigner

drupal mitre root

References

1 reference

URL	Tags
https://www.drupal.org/sa-contrib-2026-088

Impacted products

1 product

Vendor	Product	Version
Drupal	PhotoSwipe - Responsive JavaScript Modal Image Gallery	Affected: 0.0.0 , < 3.2.0 (semver)

Date Public

2026-07-22 18:01

Credits

Aleksi Peebles (aleksip) Aleksi Peebles (aleksip) Julian Pustkuchen (anybody) Joshua Sedler (grevil) cilefen (cilefen) Damien McKenna (damienmckenna) Neil Drumm (drumm) Greg Knaddison (greggles) Juraj Nemec (poker10)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://www.drupal.org/project/photoswipe",
          "product": "PhotoSwipe - Responsive JavaScript Modal Image Gallery",
          "repo": "https://git.drupalcode.org/project/photoswipe",
          "vendor": "Drupal",
          "versions": [
            {
              "lessThan": "3.2.0",
              "status": "affected",
              "version": "0.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Aleksi Peebles (aleksip)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Aleksi Peebles (aleksip)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Julian Pustkuchen (anybody)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Joshua Sedler (grevil)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "cilefen  (cilefen)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Damien McKenna (damienmckenna)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Neil Drumm (drumm)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Greg Knaddison (greggles)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Juraj Nemec (poker10)"
        }
      ],
      "datePublic": "2026-07-22T18:01:57.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Missing Authorization vulnerability in Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery allows Forceful Browsing. This issue affects PhotoSwipe - Responsive JavaScript Modal Image Gallery versions: from 0.0.0 to 3.2.0."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-87",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-87 Forceful Browsing"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T22:21:47.480Z",
        "orgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
        "shortName": "drupal"
      },
      "references": [
        {
          "url": "https://www.drupal.org/sa-contrib-2026-088"
        }
      ],
      "title": "PhotoSwipe - Responsive JavaScript Modal Image Gallery - Moderately critical - Access bypass - SA-CONTRIB-2026-088"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
    "assignerShortName": "drupal",
    "cveId": "CVE-2026-16645",
    "datePublished": "2026-08-25T22:21:47.480Z",
    "dateReserved": "2026-07-22T17:06:46.782Z",
    "dateUpdated": "2026-08-25T22:21:47.480Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-16644 (GCVE-0-2026-16644)

Vulnerability from nvd – Published: 2026-08-25 22:21 – Updated: 2026-08-25 22:21

Title

Webform REST - Moderately critical - Access bypass - SA-CONTRIB-2026-087

Summary

Incorrect Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. This issue affects Webform REST versions: from 0.0.0 to 4.1.0.

Severity

No CVSS data available.

CWE

CWE-863 - Incorrect Authorization

Assigner

drupal mitre root

References

1 reference

URL	Tags
https://www.drupal.org/sa-contrib-2026-087

Impacted products

1 product

Vendor	Product	Version
Drupal	Webform REST	Affected: 0.0.0 , < 4.1.0 (semver)

Date Public

2026-07-22 18:00

Credits

Giuseppe (giuseppe87) Dan Chadwick (danchadwick) Giuseppe (giuseppe87) Jacob Rockowitz (jrockowitz) Liam Morland (liam morland) Nelson Alves (nsalves) Anna Kalata (akalata) cilefen (cilefen) Greg Knaddison (greggles) Michael Hess (mlhess) Juraj Nemec (poker10)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://www.drupal.org/project/webform_rest",
          "product": "Webform REST",
          "repo": "https://git.drupalcode.org/project/webform_rest",
          "vendor": "Drupal",
          "versions": [
            {
              "lessThan": "4.1.0",
              "status": "affected",
              "version": "0.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Giuseppe  (giuseppe87)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Dan Chadwick (danchadwick)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Giuseppe  (giuseppe87)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Jacob Rockowitz (jrockowitz)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Liam Morland (liam morland)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Nelson Alves (nsalves)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Anna Kalata (akalata)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "cilefen  (cilefen)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Greg Knaddison (greggles)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Michael Hess (mlhess)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Juraj Nemec (poker10)"
        }
      ],
      "datePublic": "2026-07-22T18:00:53.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Incorrect Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. This issue affects Webform REST versions: from 0.0.0 to 4.1.0."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-87",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-87 Forceful Browsing"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863 Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T22:21:51.345Z",
        "orgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
        "shortName": "drupal"
      },
      "references": [
        {
          "url": "https://www.drupal.org/sa-contrib-2026-087"
        }
      ],
      "title": "Webform REST - Moderately critical - Access bypass - SA-CONTRIB-2026-087"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
    "assignerShortName": "drupal",
    "cveId": "CVE-2026-16644",
    "datePublished": "2026-08-25T22:21:51.345Z",
    "dateReserved": "2026-07-22T17:06:45.880Z",
    "dateUpdated": "2026-08-25T22:21:51.345Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-16643 (GCVE-0-2026-16643)

Vulnerability from nvd – Published: 2026-08-25 22:21 – Updated: 2026-08-25 22:21

Title

Lunr exposed filters - Critical - Unsupported - SA-CONTRIB-2026-086

Summary

Vulnerability in Drupal Lunr exposed filters. This issue affects Lunr exposed filters versions: *.*.

Severity

No CVSS data available.

Assigner

drupal mitre root

References

1 reference

URL	Tags
https://www.drupal.org/sa-contrib-2026-086

Impacted products

1 product

Vendor	Product	Version
Drupal	Lunr exposed filters	Affected: . (semver)

Date Public

2026-07-22 17:59

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://www.drupal.org/project/lunr_filters",
          "product": "Lunr exposed filters",
          "repo": "https://git.drupalcode.org/project/lunr_filters",
          "vendor": "Drupal",
          "versions": [
            {
              "status": "affected",
              "version": "*.*",
              "versionType": "semver"
            }
          ]
        }
      ],
      "datePublic": "2026-07-22T17:59:05.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Vulnerability in Drupal Lunr exposed filters. This issue affects Lunr exposed filters versions: *.*."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T22:21:55.035Z",
        "orgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
        "shortName": "drupal"
      },
      "references": [
        {
          "url": "https://www.drupal.org/sa-contrib-2026-086"
        }
      ],
      "title": "Lunr exposed filters - Critical - Unsupported  - SA-CONTRIB-2026-086"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
    "assignerShortName": "drupal",
    "cveId": "CVE-2026-16643",
    "datePublished": "2026-08-25T22:21:55.035Z",
    "dateReserved": "2026-07-22T17:06:45.088Z",
    "dateUpdated": "2026-08-25T22:21:55.035Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-16642 (GCVE-0-2026-16642)

Vulnerability from nvd – Published: 2026-08-25 22:21 – Updated: 2026-08-25 22:21

Title

Email Login OTP - Critical - Unsupported - SA-CONTRIB-2026-085

Summary

Vulnerability in Drupal Email Login OTP. This issue affects Email Login OTP versions: *.*.

Severity

No CVSS data available.

Assigner

drupal mitre root

References

1 reference

URL	Tags
https://www.drupal.org/sa-contrib-2026-085

Impacted products

1 product

Vendor	Product	Version
Drupal	Email Login OTP	Affected: . (semver)

Date Public

2026-07-22 17:57

Credits

Pierre Rudloff (prudloff)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://www.drupal.org/project/email_login_otp",
          "product": "Email Login OTP",
          "repo": "https://git.drupalcode.org/project/email_login_otp",
          "vendor": "Drupal",
          "versions": [
            {
              "status": "affected",
              "version": "*.*",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Pierre Rudloff (prudloff)"
        }
      ],
      "datePublic": "2026-07-22T17:57:50.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Vulnerability in Drupal Email Login OTP. This issue affects Email Login OTP versions: *.*."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T22:21:59.242Z",
        "orgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
        "shortName": "drupal"
      },
      "references": [
        {
          "url": "https://www.drupal.org/sa-contrib-2026-085"
        }
      ],
      "title": "Email Login OTP - Critical - Unsupported - SA-CONTRIB-2026-085"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
    "assignerShortName": "drupal",
    "cveId": "CVE-2026-16642",
    "datePublished": "2026-08-25T22:21:59.242Z",
    "dateReserved": "2026-07-22T17:06:44.287Z",
    "dateUpdated": "2026-08-25T22:21:59.242Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-16641 (GCVE-0-2026-16641)

Vulnerability from nvd – Published: 2026-08-25 22:22 – Updated: 2026-08-25 22:22

Title

Commerce Elavon - Critical - Unsupported - SA-CONTRIB-2026-084

Summary

Vulnerability in Drupal Commerce Elavon. This issue affects Commerce Elavon versions: *.*.

Severity

No CVSS data available.

Assigner

drupal mitre root

References

1 reference

URL	Tags
https://www.drupal.org/sa-contrib-2026-084

Impacted products

1 product

Vendor	Product	Version
Drupal	Commerce Elavon	Affected: . (semver)

Date Public

2026-07-22 17:57

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://www.drupal.org/project/commerce_elavon",
          "product": "Commerce Elavon",
          "repo": "https://git.drupalcode.org/project/commerce_elavon",
          "vendor": "Drupal",
          "versions": [
            {
              "status": "affected",
              "version": "*.*",
              "versionType": "semver"
            }
          ]
        }
      ],
      "datePublic": "2026-07-22T17:57:03.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Vulnerability in Drupal Commerce Elavon. This issue affects Commerce Elavon versions: *.*."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T22:22:02.591Z",
        "orgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
        "shortName": "drupal"
      },
      "references": [
        {
          "url": "https://www.drupal.org/sa-contrib-2026-084"
        }
      ],
      "title": "Commerce Elavon - Critical - Unsupported - SA-CONTRIB-2026-084"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
    "assignerShortName": "drupal",
    "cveId": "CVE-2026-16641",
    "datePublished": "2026-08-25T22:22:02.591Z",
    "dateReserved": "2026-07-22T17:06:43.440Z",
    "dateUpdated": "2026-08-25T22:22:02.591Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-16640 (GCVE-0-2026-16640)

Vulnerability from nvd – Published: 2026-08-25 22:22 – Updated: 2026-08-25 22:22

Title

Search API Autocomplete - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-082

Summary

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Search API Autocomplete allows Reflected XSS. This issue affects Search API Autocomplete versions: from 0.0.0 to 1.12.0.

Severity

No CVSS data available.

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")

Assigner

drupal mitre root

References

1 reference

URL	Tags
https://www.drupal.org/sa-contrib-2026-082

Impacted products

1 product

Vendor	Product	Version
Drupal	Search API Autocomplete	Affected: 0.0.0 , < 1.12.0 (semver)

Date Public

2026-07-22 17:55

Credits

Elar Lang (elarlang) Thomas Seiber (drunken monkey) Elar Lang (elarlang) Greg Knaddison (greggles) Lee Rowlands (larowlan) Drew Webber (mcdruid) Juraj Nemec (poker10)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://www.drupal.org/project/search_api_autocomplete",
          "product": "Search API Autocomplete",
          "repo": "https://git.drupalcode.org/project/search_api_autocomplete",
          "vendor": "Drupal",
          "versions": [
            {
              "lessThan": "1.12.0",
              "status": "affected",
              "version": "0.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Elar Lang (elarlang)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Thomas Seiber (drunken monkey)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Elar Lang (elarlang)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Greg Knaddison (greggles)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Lee Rowlands (larowlan)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Drew Webber (mcdruid)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Juraj Nemec (poker10)"
        }
      ],
      "datePublic": "2026-07-22T17:55:04.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal Search API Autocomplete allows Reflected XSS. This issue affects Search API Autocomplete versions: from 0.0.0 to 1.12.0."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-591",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-591 Reflected XSS"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\")",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T22:22:09.308Z",
        "orgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
        "shortName": "drupal"
      },
      "references": [
        {
          "url": "https://www.drupal.org/sa-contrib-2026-082"
        }
      ],
      "title": "Search API Autocomplete - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-082"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
    "assignerShortName": "drupal",
    "cveId": "CVE-2026-16640",
    "datePublished": "2026-08-25T22:22:09.308Z",
    "dateReserved": "2026-07-22T17:06:42.610Z",
    "dateUpdated": "2026-08-25T22:22:09.308Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-16639 (GCVE-0-2026-16639)

Vulnerability from nvd – Published: 2026-08-25 22:22 – Updated: 2026-08-25 22:22

Title

Internationalization Single Sign-On - Critical - Access bypass - SA-CONTRIB-2026-081

Summary

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Internationalization Single Sign-On allows Authentication Bypass. This issue affects Internationalization Single Sign-On versions: from 0.0.0 to 1.8.0.

Severity

No CVSS data available.

CWE

CWE-288 - Authentication Bypass Using an Alternate Path or Channel

Assigner

drupal mitre root

References

1 reference

URL	Tags
https://www.drupal.org/sa-contrib-2026-081

Impacted products

1 product

Vendor	Product	Version
Drupal	Internationalization Single Sign-On	Affected: 0.0.0 , < 1.8.0 (semver)

Date Public

2026-07-22 17:53

Credits

Drew Webber (mcdruid) Florent Torregrosa (grimreaper) Drew Webber (mcdruid) Bram Driesen (bramdriesen) Greg Knaddison (greggles) Drew Webber (mcdruid) Juraj Nemec (poker10)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://www.drupal.org/project/i18n_sso",
          "product": "Internationalization Single Sign-On",
          "repo": "https://git.drupalcode.org/project/i18n_sso",
          "vendor": "Drupal",
          "versions": [
            {
              "lessThan": "1.8.0",
              "status": "affected",
              "version": "0.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Drew Webber (mcdruid)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Florent Torregrosa (grimreaper)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Drew Webber (mcdruid)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Bram Driesen (bramdriesen)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Greg Knaddison (greggles)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Drew Webber (mcdruid)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Juraj Nemec (poker10)"
        }
      ],
      "datePublic": "2026-07-22T17:53:35.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Internationalization Single Sign-On allows Authentication Bypass. This issue affects Internationalization Single Sign-On versions: from 0.0.0 to 1.8.0."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-115",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-115 Authentication Bypass"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-288",
              "description": "CWE-288 Authentication Bypass Using an Alternate Path or Channel",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T22:22:12.799Z",
        "orgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
        "shortName": "drupal"
      },
      "references": [
        {
          "url": "https://www.drupal.org/sa-contrib-2026-081"
        }
      ],
      "title": "Internationalization Single Sign-On - Critical - Access bypass - SA-CONTRIB-2026-081"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
    "assignerShortName": "drupal",
    "cveId": "CVE-2026-16639",
    "datePublished": "2026-08-25T22:22:12.799Z",
    "dateReserved": "2026-07-22T17:06:41.738Z",
    "dateUpdated": "2026-08-25T22:22:12.799Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-16638 (GCVE-0-2026-16638)

Vulnerability from nvd – Published: 2026-08-25 22:22 – Updated: 2026-08-25 22:22

Title

Media Folders - Moderately critical - Cross site scripting - SA-CONTRIB-2026-080

Summary

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Media Folders allows Stored XSS. This issue affects Media Folders versions: from 0.0.0 to 1.0.8.

Severity

No CVSS data available.

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")

Assigner

drupal mitre root

References

1 reference

URL	Tags
https://www.drupal.org/sa-contrib-2026-080

Impacted products

1 product

Vendor	Product	Version
Drupal	Media Folders	Affected: 0.0.0 , < 1.0.8 (semver)

Date Public

2026-07-22 17:52

Credits

Drew Webber (mcdruid) JoÃ£o Mauricio (jmauricio) Juraj Nemec (poker10)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://www.drupal.org/project/media_folders",
          "product": "Media Folders",
          "repo": "https://git.drupalcode.org/project/media_folders",
          "vendor": "Drupal",
          "versions": [
            {
              "lessThan": "1.0.8",
              "status": "affected",
              "version": "0.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Drew Webber (mcdruid)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Jo\u00c3\u00a3o Mauricio (jmauricio)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Juraj Nemec (poker10)"
        }
      ],
      "datePublic": "2026-07-22T17:52:45.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal Media Folders allows Stored XSS. This issue affects Media Folders versions: from 0.0.0 to 1.0.8."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-592",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-592 Stored XSS"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\")",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T22:22:17.992Z",
        "orgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
        "shortName": "drupal"
      },
      "references": [
        {
          "url": "https://www.drupal.org/sa-contrib-2026-080"
        }
      ],
      "title": "Media Folders - Moderately critical - Cross site scripting - SA-CONTRIB-2026-080"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
    "assignerShortName": "drupal",
    "cveId": "CVE-2026-16638",
    "datePublished": "2026-08-25T22:22:17.992Z",
    "dateReserved": "2026-07-22T17:06:41.039Z",
    "dateUpdated": "2026-08-25T22:22:17.992Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-15917 (GCVE-0-2026-15917)

Vulnerability from nvd – Published: 2026-08-25 22:22 – Updated: 2026-08-25 22:22

Title

Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-011

Summary

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Drupal core versions: from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, from 0.0.0 to 11.2.*.

Severity

No CVSS data available.

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")

Assigner

drupal mitre root

References

1 reference

URL	Tags
https://www.drupal.org/sa-core-2026-011

Impacted products

1 product

Vendor	Product	Version
Drupal	Drupal core	Affected: 11.3.0 , < 11.3.14 (semver) Affected: 11.4.0 , < 11.4.4 (semver) Affected: 0.0.0 , < 11.2.* (semver)

Date Public

2026-07-15 19:51

Credits

Pierre Rudloff (prudloff) Shawn Duncan (fathershawn) Pierre Rudloff (prudloff) catch (catch) Lee Rowlands (larowlan) Dave Long (longwave) Jess (xjm)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://www.drupal.org/project/drupal",
          "product": "Drupal core",
          "repo": "https://git.drupalcode.org/project/drupal",
          "vendor": "Drupal",
          "versions": [
            {
              "lessThan": "11.3.14",
              "status": "affected",
              "version": "11.3.0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.4.4",
              "status": "affected",
              "version": "11.4.0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.2.*",
              "status": "affected",
              "version": "0.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Pierre Rudloff (prudloff)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Shawn Duncan (fathershawn)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Pierre Rudloff (prudloff)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "catch (catch)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Lee Rowlands (larowlan)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Dave Long (longwave)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Jess  (xjm)"
        }
      ],
      "datePublic": "2026-07-15T19:51:57.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Drupal core versions: from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, from 0.0.0 to 11.2.*."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-63",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-63 Cross-Site Scripting (XSS)"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\")",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T22:22:23.680Z",
        "orgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
        "shortName": "drupal"
      },
      "references": [
        {
          "url": "https://www.drupal.org/sa-core-2026-011"
        }
      ],
      "title": "Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-011"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
    "assignerShortName": "drupal",
    "cveId": "CVE-2026-15917",
    "datePublished": "2026-08-25T22:22:23.680Z",
    "dateReserved": "2026-07-15T19:41:26.226Z",
    "dateUpdated": "2026-08-25T22:22:23.680Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-15916 (GCVE-0-2026-15916)

Vulnerability from nvd – Published: 2026-08-25 22:22 – Updated: 2026-08-25 22:22

Title

Drupal core - Moderately critical - Information disclosure - SA-CORE-2026-010

Summary

Missing Authorization vulnerability in Drupal Drupal core allows Forceful Browsing. This issue affects Drupal core versions: from 0.0.0 to 10.6.13, from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, from 0.0.0 to 11.0.*, from 0.0.0 to 11.1.*, from 0.0.0 to 11.2.*.

Severity

No CVSS data available.

CWE

CWE-862 - Missing Authorization

Assigner

drupal mitre root

References

1 reference

URL	Tags
https://www.drupal.org/sa-core-2026-010

Impacted products

1 product

Vendor	Product	Version
Drupal	Drupal core	Affected: 0.0.0 , < 10.6.13 (semver) Affected: 11.3.0 , < 11.3.14 (semver) Affected: 11.4.0 , < 11.4.4 (semver) Affected: 0.0.0 , < 11.0.* (semver) Affected: 0.0.0 , < 11.1.* (semver) Affected: 0.0.0 , < 11.2.* (semver)

Date Public

2026-07-15 19:50

Credits

offensive-ai Benji Fisher (benjifisher) Kim Pepper (kim.pepper) Mohit Aghera (mohit_aghera) Benji Fisher (benjifisher) catch (catch) Lee Rowlands (larowlan) Juraj Nemec (poker10) Jess (xjm)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://www.drupal.org/project/drupal",
          "product": "Drupal core",
          "repo": "https://git.drupalcode.org/project/drupal",
          "vendor": "Drupal",
          "versions": [
            {
              "lessThan": "10.6.13",
              "status": "affected",
              "version": "0.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.3.14",
              "status": "affected",
              "version": "11.3.0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.4.4",
              "status": "affected",
              "version": "11.4.0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.0.*",
              "status": "affected",
              "version": "0.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.1.*",
              "status": "affected",
              "version": "0.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.2.*",
              "status": "affected",
              "version": "0.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "offensive-ai"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Benji Fisher (benjifisher)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Kim Pepper (kim.pepper)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Mohit Aghera (mohit_aghera)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Benji Fisher (benjifisher)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "catch (catch)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Lee Rowlands (larowlan)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Juraj Nemec (poker10)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Jess  (xjm)"
        }
      ],
      "datePublic": "2026-07-15T19:50:24.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Missing Authorization vulnerability in Drupal Drupal core allows Forceful Browsing. This issue affects Drupal core versions: from 0.0.0 to 10.6.13, from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, from 0.0.0 to 11.0.*, from 0.0.0 to 11.1.*, from 0.0.0 to 11.2.*."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-87",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-87 Forceful Browsing"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T22:22:27.131Z",
        "orgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
        "shortName": "drupal"
      },
      "references": [
        {
          "url": "https://www.drupal.org/sa-core-2026-010"
        }
      ],
      "title": "Drupal core - Moderately critical - Information disclosure - SA-CORE-2026-010"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
    "assignerShortName": "drupal",
    "cveId": "CVE-2026-15916",
    "datePublished": "2026-08-25T22:22:27.131Z",
    "dateReserved": "2026-07-15T19:41:24.786Z",
    "dateUpdated": "2026-08-25T22:22:27.131Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-15088 (GCVE-0-2026-15088)

Vulnerability from nvd – Published: 2026-08-25 22:21 – Updated: 2026-08-25 22:21

Title

Development Environment - Critical - Unsupported - SA-CONTRIB-2026-089

Summary

Vulnerability in Drupal Development Environment. This issue affects Development Environment versions: *.*.

Severity

No CVSS data available.

Assigner

drupal mitre root

References

1 reference

URL	Tags
https://www.drupal.org/sa-contrib-2026-089

Impacted products

1 product

Vendor	Product	Version
Drupal	Development Environment	Affected: . (semver)

Date Public

2026-07-22 18:02

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://www.drupal.org/project/development_environment",
          "product": "Development Environment",
          "repo": "https://git.drupalcode.org/project/development_environment",
          "vendor": "Drupal",
          "versions": [
            {
              "status": "affected",
              "version": "*.*",
              "versionType": "semver"
            }
          ]
        }
      ],
      "datePublic": "2026-07-22T18:02:41.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Vulnerability in Drupal Development Environment. This issue affects Development Environment versions: *.*."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T22:21:43.754Z",
        "orgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
        "shortName": "drupal"
      },
      "references": [
        {
          "url": "https://www.drupal.org/sa-contrib-2026-089"
        }
      ],
      "title": "Development Environment - Critical - Unsupported - SA-CONTRIB-2026-089"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
    "assignerShortName": "drupal",
    "cveId": "CVE-2026-15088",
    "datePublished": "2026-08-25T22:21:43.754Z",
    "dateReserved": "2026-07-08T15:45:02.189Z",
    "dateUpdated": "2026-08-25T22:21:43.754Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-15916 (GCVE-0-2026-15916)

Vulnerability from cvelistv5 – Published: 2026-08-25 22:22 – Updated: 2026-08-25 22:22

Title

Drupal core - Moderately critical - Information disclosure - SA-CORE-2026-010

Summary

Missing Authorization vulnerability in Drupal Drupal core allows Forceful Browsing. This issue affects Drupal core versions: from 0.0.0 to 10.6.13, from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, from 0.0.0 to 11.0.*, from 0.0.0 to 11.1.*, from 0.0.0 to 11.2.*.

Severity

No CVSS data available.

CWE

CWE-862 - Missing Authorization

Assigner

drupal mitre root

References

1 reference

URL	Tags
https://www.drupal.org/sa-core-2026-010

Impacted products

1 product

Vendor	Product	Version
Drupal	Drupal core	Affected: 0.0.0 , < 10.6.13 (semver) Affected: 11.3.0 , < 11.3.14 (semver) Affected: 11.4.0 , < 11.4.4 (semver) Affected: 0.0.0 , < 11.0.* (semver) Affected: 0.0.0 , < 11.1.* (semver) Affected: 0.0.0 , < 11.2.* (semver)

Date Public

2026-07-15 19:50

Credits

offensive-ai Benji Fisher (benjifisher) Kim Pepper (kim.pepper) Mohit Aghera (mohit_aghera) Benji Fisher (benjifisher) catch (catch) Lee Rowlands (larowlan) Juraj Nemec (poker10) Jess (xjm)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://www.drupal.org/project/drupal",
          "product": "Drupal core",
          "repo": "https://git.drupalcode.org/project/drupal",
          "vendor": "Drupal",
          "versions": [
            {
              "lessThan": "10.6.13",
              "status": "affected",
              "version": "0.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.3.14",
              "status": "affected",
              "version": "11.3.0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.4.4",
              "status": "affected",
              "version": "11.4.0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.0.*",
              "status": "affected",
              "version": "0.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.1.*",
              "status": "affected",
              "version": "0.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.2.*",
              "status": "affected",
              "version": "0.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "offensive-ai"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Benji Fisher (benjifisher)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Kim Pepper (kim.pepper)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Mohit Aghera (mohit_aghera)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Benji Fisher (benjifisher)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "catch (catch)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Lee Rowlands (larowlan)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Juraj Nemec (poker10)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Jess  (xjm)"
        }
      ],
      "datePublic": "2026-07-15T19:50:24.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Missing Authorization vulnerability in Drupal Drupal core allows Forceful Browsing. This issue affects Drupal core versions: from 0.0.0 to 10.6.13, from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, from 0.0.0 to 11.0.*, from 0.0.0 to 11.1.*, from 0.0.0 to 11.2.*."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-87",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-87 Forceful Browsing"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T22:22:27.131Z",
        "orgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
        "shortName": "drupal"
      },
      "references": [
        {
          "url": "https://www.drupal.org/sa-core-2026-010"
        }
      ],
      "title": "Drupal core - Moderately critical - Information disclosure - SA-CORE-2026-010"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
    "assignerShortName": "drupal",
    "cveId": "CVE-2026-15916",
    "datePublished": "2026-08-25T22:22:27.131Z",
    "dateReserved": "2026-07-15T19:41:24.786Z",
    "dateUpdated": "2026-08-25T22:22:27.131Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-15917 (GCVE-0-2026-15917)

Vulnerability from cvelistv5 – Published: 2026-08-25 22:22 – Updated: 2026-08-25 22:22

Title

Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-011

Summary

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Drupal core versions: from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, from 0.0.0 to 11.2.*.

Severity

No CVSS data available.

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")

Assigner

drupal mitre root

References

1 reference

URL	Tags
https://www.drupal.org/sa-core-2026-011

Impacted products

1 product

Vendor	Product	Version
Drupal	Drupal core	Affected: 11.3.0 , < 11.3.14 (semver) Affected: 11.4.0 , < 11.4.4 (semver) Affected: 0.0.0 , < 11.2.* (semver)

Date Public

2026-07-15 19:51

Credits

Pierre Rudloff (prudloff) Shawn Duncan (fathershawn) Pierre Rudloff (prudloff) catch (catch) Lee Rowlands (larowlan) Dave Long (longwave) Jess (xjm)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://www.drupal.org/project/drupal",
          "product": "Drupal core",
          "repo": "https://git.drupalcode.org/project/drupal",
          "vendor": "Drupal",
          "versions": [
            {
              "lessThan": "11.3.14",
              "status": "affected",
              "version": "11.3.0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.4.4",
              "status": "affected",
              "version": "11.4.0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.2.*",
              "status": "affected",
              "version": "0.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Pierre Rudloff (prudloff)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Shawn Duncan (fathershawn)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Pierre Rudloff (prudloff)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "catch (catch)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Lee Rowlands (larowlan)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Dave Long (longwave)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Jess  (xjm)"
        }
      ],
      "datePublic": "2026-07-15T19:51:57.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Drupal core versions: from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, from 0.0.0 to 11.2.*."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-63",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-63 Cross-Site Scripting (XSS)"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\")",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T22:22:23.680Z",
        "orgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
        "shortName": "drupal"
      },
      "references": [
        {
          "url": "https://www.drupal.org/sa-core-2026-011"
        }
      ],
      "title": "Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-011"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
    "assignerShortName": "drupal",
    "cveId": "CVE-2026-15917",
    "datePublished": "2026-08-25T22:22:23.680Z",
    "dateReserved": "2026-07-15T19:41:26.226Z",
    "dateUpdated": "2026-08-25T22:22:23.680Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-55805 (GCVE-0-2026-55805)

Vulnerability from cvelistv5 – Published: 2026-08-25 22:22 – Updated: 2026-08-25 22:22

Title

Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-012

Summary

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Stored XSS. This issue affects Drupal core versions: from 0.0.0 to 10.6.13, from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, from 0.0.0 to 11.0.*, from 0.0.0 to 11.1.*, from 0.0.0 to 11.2.*.

Severity

No CVSS data available.

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")

Assigner

drupal mitre root

References

1 reference

URL	Tags
https://www.drupal.org/sa-core-2026-012

Impacted products

1 product

Vendor	Product	Version
Drupal	Drupal core	Affected: 0.0.0 , < 10.6.13 (semver) Affected: 11.3.0 , < 11.3.14 (semver) Affected: 11.4.0 , < 11.4.4 (semver) Affected: 0.0.0 , < 11.0.* (semver) Affected: 0.0.0 , < 11.1.* (semver) Affected: 0.0.0 , < 11.2.* (semver)

Date Public

2026-07-15 19:52

Credits

haii haii (hai27ii2o) danielveza Lee Rowlands (larowlan) Mingsong (mingsong) James Gilliland (neclimdul) Greg Knaddison (greggles) Lee Rowlands (larowlan) Dave Long (longwave) Jess (xjm)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://www.drupal.org/project/drupal",
          "product": "Drupal core",
          "repo": "https://git.drupalcode.org/project/drupal",
          "vendor": "Drupal",
          "versions": [
            {
              "lessThan": "10.6.13",
              "status": "affected",
              "version": "0.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.3.14",
              "status": "affected",
              "version": "11.3.0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.4.4",
              "status": "affected",
              "version": "11.4.0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.0.*",
              "status": "affected",
              "version": "0.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.1.*",
              "status": "affected",
              "version": "0.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.2.*",
              "status": "affected",
              "version": "0.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "haii haii (hai27ii2o)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "danielveza"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Lee Rowlands (larowlan)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Mingsong  (mingsong)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "James Gilliland (neclimdul)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Greg Knaddison (greggles)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Lee Rowlands (larowlan)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Dave Long (longwave)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Jess  (xjm)"
        }
      ],
      "datePublic": "2026-07-15T19:52:26.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal Drupal core allows Stored XSS. This issue affects Drupal core versions: from 0.0.0 to 10.6.13, from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, from 0.0.0 to 11.0.*, from 0.0.0 to 11.1.*, from 0.0.0 to 11.2.*."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-592",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-592 Stored XSS"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\")",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T22:22:20.763Z",
        "orgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
        "shortName": "drupal"
      },
      "references": [
        {
          "url": "https://www.drupal.org/sa-core-2026-012"
        }
      ],
      "title": "Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-012"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
    "assignerShortName": "drupal",
    "cveId": "CVE-2026-55805",
    "datePublished": "2026-08-25T22:22:20.763Z",
    "dateReserved": "2026-06-17T14:59:52.673Z",
    "dateUpdated": "2026-08-25T22:22:20.763Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-16638 (GCVE-0-2026-16638)

Vulnerability from cvelistv5 – Published: 2026-08-25 22:22 – Updated: 2026-08-25 22:22

Title

Media Folders - Moderately critical - Cross site scripting - SA-CONTRIB-2026-080

Summary

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Media Folders allows Stored XSS. This issue affects Media Folders versions: from 0.0.0 to 1.0.8.

Severity

No CVSS data available.

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")

Assigner

drupal mitre root

References

1 reference

URL	Tags
https://www.drupal.org/sa-contrib-2026-080

Impacted products

1 product

Vendor	Product	Version
Drupal	Media Folders	Affected: 0.0.0 , < 1.0.8 (semver)

Date Public

2026-07-22 17:52

Credits

Drew Webber (mcdruid) JoÃ£o Mauricio (jmauricio) Juraj Nemec (poker10)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://www.drupal.org/project/media_folders",
          "product": "Media Folders",
          "repo": "https://git.drupalcode.org/project/media_folders",
          "vendor": "Drupal",
          "versions": [
            {
              "lessThan": "1.0.8",
              "status": "affected",
              "version": "0.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Drew Webber (mcdruid)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Jo\u00c3\u00a3o Mauricio (jmauricio)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Juraj Nemec (poker10)"
        }
      ],
      "datePublic": "2026-07-22T17:52:45.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal Media Folders allows Stored XSS. This issue affects Media Folders versions: from 0.0.0 to 1.0.8."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-592",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-592 Stored XSS"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\")",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T22:22:17.992Z",
        "orgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
        "shortName": "drupal"
      },
      "references": [
        {
          "url": "https://www.drupal.org/sa-contrib-2026-080"
        }
      ],
      "title": "Media Folders - Moderately critical - Cross site scripting - SA-CONTRIB-2026-080"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
    "assignerShortName": "drupal",
    "cveId": "CVE-2026-16638",
    "datePublished": "2026-08-25T22:22:17.992Z",
    "dateReserved": "2026-07-22T17:06:41.039Z",
    "dateUpdated": "2026-08-25T22:22:17.992Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-16639 (GCVE-0-2026-16639)

Vulnerability from cvelistv5 – Published: 2026-08-25 22:22 – Updated: 2026-08-25 22:22

Title

Internationalization Single Sign-On - Critical - Access bypass - SA-CONTRIB-2026-081

Summary

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Internationalization Single Sign-On allows Authentication Bypass. This issue affects Internationalization Single Sign-On versions: from 0.0.0 to 1.8.0.

Severity

No CVSS data available.

CWE

CWE-288 - Authentication Bypass Using an Alternate Path or Channel

Assigner

drupal mitre root

References

1 reference

URL	Tags
https://www.drupal.org/sa-contrib-2026-081

Impacted products

1 product

Vendor	Product	Version
Drupal	Internationalization Single Sign-On	Affected: 0.0.0 , < 1.8.0 (semver)

Date Public

2026-07-22 17:53

Credits

Drew Webber (mcdruid) Florent Torregrosa (grimreaper) Drew Webber (mcdruid) Bram Driesen (bramdriesen) Greg Knaddison (greggles) Drew Webber (mcdruid) Juraj Nemec (poker10)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://www.drupal.org/project/i18n_sso",
          "product": "Internationalization Single Sign-On",
          "repo": "https://git.drupalcode.org/project/i18n_sso",
          "vendor": "Drupal",
          "versions": [
            {
              "lessThan": "1.8.0",
              "status": "affected",
              "version": "0.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Drew Webber (mcdruid)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Florent Torregrosa (grimreaper)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Drew Webber (mcdruid)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Bram Driesen (bramdriesen)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Greg Knaddison (greggles)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Drew Webber (mcdruid)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Juraj Nemec (poker10)"
        }
      ],
      "datePublic": "2026-07-22T17:53:35.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Internationalization Single Sign-On allows Authentication Bypass. This issue affects Internationalization Single Sign-On versions: from 0.0.0 to 1.8.0."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-115",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-115 Authentication Bypass"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-288",
              "description": "CWE-288 Authentication Bypass Using an Alternate Path or Channel",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T22:22:12.799Z",
        "orgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
        "shortName": "drupal"
      },
      "references": [
        {
          "url": "https://www.drupal.org/sa-contrib-2026-081"
        }
      ],
      "title": "Internationalization Single Sign-On - Critical - Access bypass - SA-CONTRIB-2026-081"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
    "assignerShortName": "drupal",
    "cveId": "CVE-2026-16639",
    "datePublished": "2026-08-25T22:22:12.799Z",
    "dateReserved": "2026-07-22T17:06:41.738Z",
    "dateUpdated": "2026-08-25T22:22:12.799Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-16640 (GCVE-0-2026-16640)

Vulnerability from cvelistv5 – Published: 2026-08-25 22:22 – Updated: 2026-08-25 22:22

Title

Search API Autocomplete - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-082

Summary

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Search API Autocomplete allows Reflected XSS. This issue affects Search API Autocomplete versions: from 0.0.0 to 1.12.0.

Severity

No CVSS data available.

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")

Assigner

drupal mitre root

References

1 reference

URL	Tags
https://www.drupal.org/sa-contrib-2026-082

Impacted products

1 product

Vendor	Product	Version
Drupal	Search API Autocomplete	Affected: 0.0.0 , < 1.12.0 (semver)

Date Public

2026-07-22 17:55

Credits

Elar Lang (elarlang) Thomas Seiber (drunken monkey) Elar Lang (elarlang) Greg Knaddison (greggles) Lee Rowlands (larowlan) Drew Webber (mcdruid) Juraj Nemec (poker10)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://www.drupal.org/project/search_api_autocomplete",
          "product": "Search API Autocomplete",
          "repo": "https://git.drupalcode.org/project/search_api_autocomplete",
          "vendor": "Drupal",
          "versions": [
            {
              "lessThan": "1.12.0",
              "status": "affected",
              "version": "0.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Elar Lang (elarlang)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Thomas Seiber (drunken monkey)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Elar Lang (elarlang)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Greg Knaddison (greggles)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Lee Rowlands (larowlan)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Drew Webber (mcdruid)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Juraj Nemec (poker10)"
        }
      ],
      "datePublic": "2026-07-22T17:55:04.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal Search API Autocomplete allows Reflected XSS. This issue affects Search API Autocomplete versions: from 0.0.0 to 1.12.0."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-591",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-591 Reflected XSS"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\")",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T22:22:09.308Z",
        "orgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
        "shortName": "drupal"
      },
      "references": [
        {
          "url": "https://www.drupal.org/sa-contrib-2026-082"
        }
      ],
      "title": "Search API Autocomplete - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-082"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
    "assignerShortName": "drupal",
    "cveId": "CVE-2026-16640",
    "datePublished": "2026-08-25T22:22:09.308Z",
    "dateReserved": "2026-07-22T17:06:42.610Z",
    "dateUpdated": "2026-08-25T22:22:09.308Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-16646 (GCVE-0-2026-16646)

Vulnerability from cvelistv5 – Published: 2026-08-25 22:22 – Updated: 2026-08-25 22:22

Title

PanKM - Critical - Unsupported - SA-CONTRIB-2026-083

Summary

Vulnerability in Drupal PanKM. This issue affects PanKM versions: *.*.

Severity

No CVSS data available.

Assigner

drupal mitre root

References

1 reference

URL	Tags
https://www.drupal.org/sa-contrib-2026-083

Impacted products

1 product

Vendor	Product	Version
Drupal	PanKM	Affected: . (semver)

Date Public

2026-07-22 17:55

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://www.drupal.org/project/pankm",
          "product": "PanKM",
          "repo": "https://git.drupalcode.org/project/pankm",
          "vendor": "Drupal",
          "versions": [
            {
              "status": "affected",
              "version": "*.*",
              "versionType": "semver"
            }
          ]
        }
      ],
      "datePublic": "2026-07-22T17:55:59.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Vulnerability in Drupal PanKM. This issue affects PanKM versions: *.*."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T22:22:05.938Z",
        "orgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
        "shortName": "drupal"
      },
      "references": [
        {
          "url": "https://www.drupal.org/sa-contrib-2026-083"
        }
      ],
      "title": "PanKM - Critical - Unsupported - SA-CONTRIB-2026-083"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
    "assignerShortName": "drupal",
    "cveId": "CVE-2026-16646",
    "datePublished": "2026-08-25T22:22:05.938Z",
    "dateReserved": "2026-07-22T17:06:47.500Z",
    "dateUpdated": "2026-08-25T22:22:05.938Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-16641 (GCVE-0-2026-16641)

Vulnerability from cvelistv5 – Published: 2026-08-25 22:22 – Updated: 2026-08-25 22:22

Title

Commerce Elavon - Critical - Unsupported - SA-CONTRIB-2026-084

Summary

Vulnerability in Drupal Commerce Elavon. This issue affects Commerce Elavon versions: *.*.

Severity

No CVSS data available.

Assigner

drupal mitre root

References

1 reference

URL	Tags
https://www.drupal.org/sa-contrib-2026-084

Impacted products

1 product

Vendor	Product	Version
Drupal	Commerce Elavon	Affected: . (semver)

Date Public

2026-07-22 17:57

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://www.drupal.org/project/commerce_elavon",
          "product": "Commerce Elavon",
          "repo": "https://git.drupalcode.org/project/commerce_elavon",
          "vendor": "Drupal",
          "versions": [
            {
              "status": "affected",
              "version": "*.*",
              "versionType": "semver"
            }
          ]
        }
      ],
      "datePublic": "2026-07-22T17:57:03.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Vulnerability in Drupal Commerce Elavon. This issue affects Commerce Elavon versions: *.*."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T22:22:02.591Z",
        "orgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
        "shortName": "drupal"
      },
      "references": [
        {
          "url": "https://www.drupal.org/sa-contrib-2026-084"
        }
      ],
      "title": "Commerce Elavon - Critical - Unsupported - SA-CONTRIB-2026-084"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
    "assignerShortName": "drupal",
    "cveId": "CVE-2026-16641",
    "datePublished": "2026-08-25T22:22:02.591Z",
    "dateReserved": "2026-07-22T17:06:43.440Z",
    "dateUpdated": "2026-08-25T22:22:02.591Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-16642 (GCVE-0-2026-16642)

Vulnerability from cvelistv5 – Published: 2026-08-25 22:21 – Updated: 2026-08-25 22:21

Title

Email Login OTP - Critical - Unsupported - SA-CONTRIB-2026-085

Summary

Vulnerability in Drupal Email Login OTP. This issue affects Email Login OTP versions: *.*.

Severity

No CVSS data available.

Assigner

drupal mitre root

References

1 reference

URL	Tags
https://www.drupal.org/sa-contrib-2026-085

Impacted products

1 product

Vendor	Product	Version
Drupal	Email Login OTP	Affected: . (semver)

Date Public

2026-07-22 17:57

Credits

Pierre Rudloff (prudloff)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://www.drupal.org/project/email_login_otp",
          "product": "Email Login OTP",
          "repo": "https://git.drupalcode.org/project/email_login_otp",
          "vendor": "Drupal",
          "versions": [
            {
              "status": "affected",
              "version": "*.*",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Pierre Rudloff (prudloff)"
        }
      ],
      "datePublic": "2026-07-22T17:57:50.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Vulnerability in Drupal Email Login OTP. This issue affects Email Login OTP versions: *.*."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T22:21:59.242Z",
        "orgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
        "shortName": "drupal"
      },
      "references": [
        {
          "url": "https://www.drupal.org/sa-contrib-2026-085"
        }
      ],
      "title": "Email Login OTP - Critical - Unsupported - SA-CONTRIB-2026-085"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
    "assignerShortName": "drupal",
    "cveId": "CVE-2026-16642",
    "datePublished": "2026-08-25T22:21:59.242Z",
    "dateReserved": "2026-07-22T17:06:44.287Z",
    "dateUpdated": "2026-08-25T22:21:59.242Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-16643 (GCVE-0-2026-16643)

Vulnerability from cvelistv5 – Published: 2026-08-25 22:21 – Updated: 2026-08-25 22:21

Title

Lunr exposed filters - Critical - Unsupported - SA-CONTRIB-2026-086

Summary

Vulnerability in Drupal Lunr exposed filters. This issue affects Lunr exposed filters versions: *.*.

Severity

No CVSS data available.

Assigner

drupal mitre root

References

1 reference

URL	Tags
https://www.drupal.org/sa-contrib-2026-086

Impacted products

1 product

Vendor	Product	Version
Drupal	Lunr exposed filters	Affected: . (semver)

Date Public

2026-07-22 17:59

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://www.drupal.org/project/lunr_filters",
          "product": "Lunr exposed filters",
          "repo": "https://git.drupalcode.org/project/lunr_filters",
          "vendor": "Drupal",
          "versions": [
            {
              "status": "affected",
              "version": "*.*",
              "versionType": "semver"
            }
          ]
        }
      ],
      "datePublic": "2026-07-22T17:59:05.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Vulnerability in Drupal Lunr exposed filters. This issue affects Lunr exposed filters versions: *.*."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T22:21:55.035Z",
        "orgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
        "shortName": "drupal"
      },
      "references": [
        {
          "url": "https://www.drupal.org/sa-contrib-2026-086"
        }
      ],
      "title": "Lunr exposed filters - Critical - Unsupported  - SA-CONTRIB-2026-086"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
    "assignerShortName": "drupal",
    "cveId": "CVE-2026-16643",
    "datePublished": "2026-08-25T22:21:55.035Z",
    "dateReserved": "2026-07-22T17:06:45.088Z",
    "dateUpdated": "2026-08-25T22:21:55.035Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-16644 (GCVE-0-2026-16644)

Vulnerability from cvelistv5 – Published: 2026-08-25 22:21 – Updated: 2026-08-25 22:21

Title

Webform REST - Moderately critical - Access bypass - SA-CONTRIB-2026-087

Summary

Incorrect Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. This issue affects Webform REST versions: from 0.0.0 to 4.1.0.

Severity

No CVSS data available.

CWE

CWE-863 - Incorrect Authorization

Assigner

drupal mitre root

References

1 reference

URL	Tags
https://www.drupal.org/sa-contrib-2026-087

Impacted products

1 product

Vendor	Product	Version
Drupal	Webform REST	Affected: 0.0.0 , < 4.1.0 (semver)

Date Public

2026-07-22 18:00

Credits

Giuseppe (giuseppe87) Dan Chadwick (danchadwick) Giuseppe (giuseppe87) Jacob Rockowitz (jrockowitz) Liam Morland (liam morland) Nelson Alves (nsalves) Anna Kalata (akalata) cilefen (cilefen) Greg Knaddison (greggles) Michael Hess (mlhess) Juraj Nemec (poker10)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://www.drupal.org/project/webform_rest",
          "product": "Webform REST",
          "repo": "https://git.drupalcode.org/project/webform_rest",
          "vendor": "Drupal",
          "versions": [
            {
              "lessThan": "4.1.0",
              "status": "affected",
              "version": "0.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Giuseppe  (giuseppe87)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Dan Chadwick (danchadwick)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Giuseppe  (giuseppe87)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Jacob Rockowitz (jrockowitz)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Liam Morland (liam morland)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Nelson Alves (nsalves)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Anna Kalata (akalata)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "cilefen  (cilefen)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Greg Knaddison (greggles)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Michael Hess (mlhess)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Juraj Nemec (poker10)"
        }
      ],
      "datePublic": "2026-07-22T18:00:53.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Incorrect Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. This issue affects Webform REST versions: from 0.0.0 to 4.1.0."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-87",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-87 Forceful Browsing"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863 Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T22:21:51.345Z",
        "orgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
        "shortName": "drupal"
      },
      "references": [
        {
          "url": "https://www.drupal.org/sa-contrib-2026-087"
        }
      ],
      "title": "Webform REST - Moderately critical - Access bypass - SA-CONTRIB-2026-087"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
    "assignerShortName": "drupal",
    "cveId": "CVE-2026-16644",
    "datePublished": "2026-08-25T22:21:51.345Z",
    "dateReserved": "2026-07-22T17:06:45.880Z",
    "dateUpdated": "2026-08-25T22:21:51.345Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-16645 (GCVE-0-2026-16645)

Vulnerability from cvelistv5 – Published: 2026-08-25 22:21 – Updated: 2026-08-25 22:21

Title

PhotoSwipe - Responsive JavaScript Modal Image Gallery - Moderately critical - Access bypass - SA-CONTRIB-2026-088

Summary

Missing Authorization vulnerability in Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery allows Forceful Browsing. This issue affects PhotoSwipe - Responsive JavaScript Modal Image Gallery versions: from 0.0.0 to 3.2.0.

Severity

No CVSS data available.

CWE

CWE-862 - Missing Authorization

Assigner

drupal mitre root

References

1 reference

URL	Tags
https://www.drupal.org/sa-contrib-2026-088

Impacted products

1 product

Vendor	Product	Version
Drupal	PhotoSwipe - Responsive JavaScript Modal Image Gallery	Affected: 0.0.0 , < 3.2.0 (semver)

Date Public

2026-07-22 18:01

Credits

Aleksi Peebles (aleksip) Aleksi Peebles (aleksip) Julian Pustkuchen (anybody) Joshua Sedler (grevil) cilefen (cilefen) Damien McKenna (damienmckenna) Neil Drumm (drumm) Greg Knaddison (greggles) Juraj Nemec (poker10)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://www.drupal.org/project/photoswipe",
          "product": "PhotoSwipe - Responsive JavaScript Modal Image Gallery",
          "repo": "https://git.drupalcode.org/project/photoswipe",
          "vendor": "Drupal",
          "versions": [
            {
              "lessThan": "3.2.0",
              "status": "affected",
              "version": "0.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Aleksi Peebles (aleksip)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Aleksi Peebles (aleksip)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Julian Pustkuchen (anybody)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Joshua Sedler (grevil)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "cilefen  (cilefen)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Damien McKenna (damienmckenna)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Neil Drumm (drumm)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Greg Knaddison (greggles)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Juraj Nemec (poker10)"
        }
      ],
      "datePublic": "2026-07-22T18:01:57.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Missing Authorization vulnerability in Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery allows Forceful Browsing. This issue affects PhotoSwipe - Responsive JavaScript Modal Image Gallery versions: from 0.0.0 to 3.2.0."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-87",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-87 Forceful Browsing"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T22:21:47.480Z",
        "orgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
        "shortName": "drupal"
      },
      "references": [
        {
          "url": "https://www.drupal.org/sa-contrib-2026-088"
        }
      ],
      "title": "PhotoSwipe - Responsive JavaScript Modal Image Gallery - Moderately critical - Access bypass - SA-CONTRIB-2026-088"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
    "assignerShortName": "drupal",
    "cveId": "CVE-2026-16645",
    "datePublished": "2026-08-25T22:21:47.480Z",
    "dateReserved": "2026-07-22T17:06:46.782Z",
    "dateUpdated": "2026-08-25T22:21:47.480Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-15088 (GCVE-0-2026-15088)

Vulnerability from cvelistv5 – Published: 2026-08-25 22:21 – Updated: 2026-08-25 22:21

Title

Development Environment - Critical - Unsupported - SA-CONTRIB-2026-089

Summary

Vulnerability in Drupal Development Environment. This issue affects Development Environment versions: *.*.

Severity

No CVSS data available.

Assigner

drupal mitre root

References

1 reference

URL	Tags
https://www.drupal.org/sa-contrib-2026-089

Impacted products

1 product

Vendor	Product	Version
Drupal	Development Environment	Affected: . (semver)

Date Public

2026-07-22 18:02

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://www.drupal.org/project/development_environment",
          "product": "Development Environment",
          "repo": "https://git.drupalcode.org/project/development_environment",
          "vendor": "Drupal",
          "versions": [
            {
              "status": "affected",
              "version": "*.*",
              "versionType": "semver"
            }
          ]
        }
      ],
      "datePublic": "2026-07-22T18:02:41.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Vulnerability in Drupal Development Environment. This issue affects Development Environment versions: *.*."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T22:21:43.754Z",
        "orgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
        "shortName": "drupal"
      },
      "references": [
        {
          "url": "https://www.drupal.org/sa-contrib-2026-089"
        }
      ],
      "title": "Development Environment - Critical - Unsupported - SA-CONTRIB-2026-089"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
    "assignerShortName": "drupal",
    "cveId": "CVE-2026-15088",
    "datePublished": "2026-08-25T22:21:43.754Z",
    "dateReserved": "2026-07-08T15:45:02.189Z",
    "dateUpdated": "2026-08-25T22:21:43.754Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Find a vulnerability

Search criteria

1562 vulnerabilities by Drupal

CVE-2026-55805 (GCVE-0-2026-55805)

CVE-2026-18985 (GCVE-0-2026-18985)

CVE-2026-18261 (GCVE-0-2026-18261)

CVE-2026-18260 (GCVE-0-2026-18260)

CVE-2026-18259 (GCVE-0-2026-18259)

CVE-2026-16646 (GCVE-0-2026-16646)

CVE-2026-16645 (GCVE-0-2026-16645)

CVE-2026-16644 (GCVE-0-2026-16644)

CVE-2026-16643 (GCVE-0-2026-16643)

CVE-2026-16642 (GCVE-0-2026-16642)

CVE-2026-16641 (GCVE-0-2026-16641)

CVE-2026-16640 (GCVE-0-2026-16640)

CVE-2026-16639 (GCVE-0-2026-16639)

CVE-2026-16638 (GCVE-0-2026-16638)

CVE-2026-15917 (GCVE-0-2026-15917)

CVE-2026-15916 (GCVE-0-2026-15916)

CVE-2026-15088 (GCVE-0-2026-15088)

CVE-2026-15916 (GCVE-0-2026-15916)

CVE-2026-15917 (GCVE-0-2026-15917)

CVE-2026-55805 (GCVE-0-2026-55805)

CVE-2026-16638 (GCVE-0-2026-16638)

CVE-2026-16639 (GCVE-0-2026-16639)

CVE-2026-16640 (GCVE-0-2026-16640)

CVE-2026-16646 (GCVE-0-2026-16646)

CVE-2026-16641 (GCVE-0-2026-16641)

CVE-2026-16642 (GCVE-0-2026-16642)

CVE-2026-16643 (GCVE-0-2026-16643)

CVE-2026-16644 (GCVE-0-2026-16644)

CVE-2026-16645 (GCVE-0-2026-16645)

CVE-2026-15088 (GCVE-0-2026-15088)