Drupal
Monthly
Insecure Storage of Sensitive Information vulnerability in Drupal AI (Artificial Intelligence) allows Retrieve Embedded Sensitive Data. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2.
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Cross-Site Scripting (XSS). This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2.
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Stored XSS. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2.
External Control of File Name or Path vulnerability in Drupal Single Content Sync allows Path Traversal. This issue affects Single Content Sync versions: from 0.0.0 to 1.4.19.
Deserialization of Untrusted Data vulnerability in Drupal Single Content Sync allows Object Injection. This issue affects Single Content Sync versions: from 0.0.0 to 1.4.19.
Vulnerability in Drupal CacheFlush. This issue affects CacheFlush versions: *.*.
Vulnerability in Drupal PayUmoney for Drupal Commerce. This issue affects PayUmoney for Drupal Commerce versions: *.*.
Vulnerability in Drupal GroupEx PRO ( Daxko ) integration. This issue affects GroupEx PRO ( Daxko ) integration versions: *.*.
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal CAPTCHA allows Functionality Bypass. This issue affects CAPTCHA versions: from 0.0.0 to 1.18.0, from 2.0.0 to 2.0.11.
Incorrect Authorization vulnerability in Drupal Fasttoggle allows Forceful Browsing. This issue affects Fasttoggle versions: from 0.0.0 to 4.1.1.
Cross-Site Request Forgery (CSRF) vulnerability in Drupal Fasttoggle allows Cross Site Request Forgery. This issue affects Fasttoggle versions: from 0.0.0 to 4.1.1.
Incorrect Permission Assignment for Critical Resource vulnerability in Drupal S3 File System allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects S3 File System versions: from 0.0.0 to 3.12.0.
Incorrect Authorization vulnerability in Drupal Bulk Update User Roles allows Forceful Browsing. This issue affects Bulk Update User Roles versions: from 0.0.0 to 1.0.5.
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal OAuth Login - OAuth OIDC SSO allows Authentication Bypass. This issue affects OAuth Login - OAuth OIDC SSO versions: from 0.0.0 to 3.1.1.
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Signature pad widget allows Stored XSS. This issue affects Signature pad widget versions: from 0.0.0 to 1.15.0.
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Stage File Proxy allows Cross-Site Scripting (XSS). This issue affects Stage File Proxy versions: from 0.0.0 to 3.1.7, from 4.0.0 to 4.0.1.
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal OpenID Connect Client allows Authentication Bypass. This issue affects OpenID Connect Client versions: from 0.0.0 to 2.3.1.
Incorrect Authorization vulnerability in Drupal Field Permissions allows Forceful Browsing. This issue affects Field Permissions versions: from 0.0.0 to 1.6.0.
Incorrect Authorization vulnerability in Drupal Field Permissions allows Forceful Browsing. This issue affects Field Permissions versions: from 0.0.0 to 1.6.0.
Missing Authorization vulnerability in Drupal OAuth2 Token Manager allows Forceful Browsing. This issue affects OAuth2 Token Manager versions: from 0.0.0 to 1.2.0.
Insecure Storage of Sensitive Information vulnerability in Drupal Content Sync (content-sync.io) allows Retrieve Embedded Sensitive Data. This issue affects Content Sync (content-sync.io) versions: from 0.0.0 to 3.2.2.
Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Media Alias Display allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Media Alias Display versions: from 0.0.0 to 2.1.3, from 3.0.0 to 3.0.3.
Drupal Advanced Search 0.0.0 through 2.4.5 fails to enforce an authorization check on a search-related resource, allowing remote clients to use forceful browsing and obtain limited confidentiality and integrity impact without affecting availability. The vendor-assigned CVSS 3.1 score is 4.2 (AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N), and exposure requires the contrib module to be installed and enabled. A vendor patch is available and no public exploit identified at time of analysis.
Stored cross-site scripting in the Drupal AI (Artificial Intelligence) contrib module affects versions 0.0.0 through 1.3.13 and 1.4.0 through 1.4.8, allowing an authenticated user with a privileged Drupal account to store input that is later rendered to another user. The vendor CVSS 3.1 vector (AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N, base 3.1) requires victim interaction and a high-privilege account, keeping impact to low confidentiality and integrity effects. No public exploit was identified at time of analysis, and a vendor patch is available via Drupal SA-CONTRIB-2026-119.
The Drupal AI (Artificial Intelligence) contrib module performs insufficient authorization checks on at least one of its endpoints, allowing forceful browsing - an authenticated user can reach a resource or route directly by URL that the module never gates behind an access check. Versions 0.0.0 through 1.3.13 and 1.4.0 through 1.4.8 are affected; exploitation requires a valid account with at least low privileges (PR:L) and cannot be performed anonymously, with impact limited to partial confidentiality and integrity and no availability effect (CVSS 4.6). There is no CISA KEV listing and no public exploit identified at time of analysis, and the vendor has published a security advisory with a fix.
Missing authorization in the Drupal AI Translate contrib module allows forceful browsing, so a user who already holds a low-privilege authenticated account on an affected site can reach AI Translate functionality or resources that should be gated behind stricter permissions. The issue affects the 0.0.0 through 1.3.2 and 1.4.0 through 1.4.1 version ranges and is rated moderate (CVSS 4.6, low confidentiality and integrity impact, no availability impact); only Drupal sites with this contrib module installed are exposed. Vendor patches are available at 1.3.2 and 1.4.1 per the Drupal advisory, no public exploit code has been identified at time of analysis, and the prioritisation signal places it in the this-month remediation window rather than an emergency one.
Missing authorization in the Drupal contributed module Calculate Working Days (versions 0.0.0 through 2.0.3, fixed in 2.0.3) lets unauthenticated remote requests reach routes or pages that should be gated by a permission check, a forceful-browsing style access-control bypass scored CVSS 5.3. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) exploitation requires no authentication or user interaction, but the impact is limited to a Low integrity effect with no confidentiality or availability consequences, and only sites that have installed and enabled this specific contributed module in a pre-2.0.3 release are exposed. No public exploit has been identified at time of analysis, there is no CISA KEV listing, EPSS is 0.14% (3rd percentile), and SSVC records exploitation as none with partial technical impact.
Stored cross-site scripting in the Drupal contributed 'Component blocks' module (versions 0.0.0 through 1.2.6) lets an authenticated user who holds permission to create or edit component blocks persist malicious script that executes in the browser of any user viewing the poisoned block, including administrators. Rated CVSS 4.6 with a PR:L/UI:R profile, so exploitation needs both a block-authoring account and a victim who loads the rendered content; Drupal core and sites without the module are unaffected. No public exploit code or active exploitation has been identified at time of analysis, and EPSS is 0.16% (5th percentile), consistent with a low-to-moderate real-world priority and a 'this month' patch cadence rather than an emergency.
Authentication bypass in the Drupal contrib module Email Verification / SMS Verification / OTP Verification (versions 0.0.0 through below 2.4.0) allows remote, unauthenticated attackers to skip the verification step the module is meant to enforce, with CVSS 3.1 scored 6.5 (AV:N/AC:L/PR:N/UI:N, C:L/I:L/A:N). Only Drupal sites that actually install and enable this contrib module - and rely on it as an access or action gate - are exposed, and the realistic impact is bounded to bypassing that check rather than full site compromise. No public exploit has been identified at time of analysis, CISA KEV does not list the issue, SSVC rates exploitation as none with partial technical impact, and EPSS is 0.19% (8th percentile), so the available decision signals converge on a this-month, non-emergency remediation priority. A vendor patch is available.
Reflected cross-site scripting (CVSS 5.4) affects the Drupal contrib module 'Email Verification / SMS Verification / OTP Verification' in all versions from 0.0.0 through 2.4.0, allowing an attacker who convinces a victim to open a crafted URL to execute script in that victim's browser session on the Drupal site. No authentication is required of the attacker, but exploitation depends on victim interaction (UI:R) and the specific reflecting parameter is not described in the available sources. No public exploit code or active exploitation is known, EPSS is low at 0.16% (5th percentile), and the vendor has released a patch in version 2.4.0.
Missing authorization in the Islandora digital repository framework for Drupal (versions 0.0.0 through 2.19.0) lets unauthenticated, network-positioned attackers reach protected resources by requesting their paths directly - a forceful browsing bypass of access control. Impact is limited to low-severity confidentiality disclosure with no integrity or availability effect, and the trigger specifics (which endpoints or object states bypass the check) are not described in the available sources. No public exploit code and no active exploitation are confirmed; EPSS is 0.14% (3rd percentile), CISA SSVC records Exploitation: none and Automatable: no, and the vendor has released a fix, so priority is monitoring rather than emergency response.
Unauthenticated forceful browsing in the Drupal contrib module Jsonapi Role Access allows remote attackers to reach JSON:API resources that the module is supposed to restrict by role, with low confidentiality and low integrity impact and no availability effect. Sites are affected only if they run this specific contrib module at a version below the fixed release and have Drupal's JSON:API functionality active; the CVSS vector (AV:N/AC:L/PR:N/UI:N) means no credentials or user interaction are needed once the module is present. Severity is moderate (6.5) and urgency is limited: EPSS is 0.14% (3rd percentile), there is no KEV entry, and no public exploit identified at time of analysis; a vendor patch is available and the priority label is this_month.
Path traversal (CWE-22) in the Drupal contributed module Media Library Importer affects versions from 0.0.0 through 2.1.6, allowing an authenticated user with access to the module's media-import functionality to write or read files outside the intended restricted directory, with limited confidentiality and integrity impact and no availability effect. The CVSS 3.1 base score is 5.4 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N), so exploitation requires a low-privileged account and is not possible anonymously. No active exploitation has been observed (CISA SSVC Exploitation: none, EPSS 0.16%), and no public exploit code is identified in the available sources; default Drupal installations are unaffected because the module is a non-core add-on that must be explicitly installed.
Signature spoofing in the Drupal Monobank payment API module (versions 0.0.0 through the 1.0.3 range boundary) allows a remote, unauthenticated actor to submit a payment notification/callback whose cryptographic signature the module fails to verify properly, so a forged payment confirmation can be accepted as genuine. Impact is limited to integrity (CVSS 3.7, C:N/I:L/A:N) with no confidentiality or availability effect, and only sites that have the contrib module installed and active as a payment integration are exposed. Exploitation status is low-risk: no CISA KEV listing, EPSS 0.10% (1st percentile), a public PoC reference exists but is not verified as working exploit code, the vendor has released a fixed release, and the independent assessment rates all decision signals as a low real-world priority (monitor).
Missing authorization in Drupal's Webform Submissions Delete contributed module, versions 0.0.0 through 1.2.0, allows remote attackers to delete stored webform submissions by directly requesting the deletion route, affecting integrity only. The module must be installed and enabled on a site holding submissions; the CVSS vector is AV:N/AC:L/PR:N/UI:N with I:L, though the supplied sources do not explicitly confirm whether anonymous or low-privileged access suffices. No public exploit has been identified at time of analysis, EPSS is 0.19% (8th percentile), a vendor patch is available, and the priority is this_month rather than emergency.
SQL injection (CWE-89, base CVSS 6.5) in the amazee.ai Private AI Provider Drupal contrib module lets an attacker inject into SQL statements executed by the module's database layer, with high confidentiality impact and limited integrity impact in the assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N). Every site running the module in versions 0.0.0 through 1.3.7, or 1.4.0 through 1.4.3, is affected; exposure is bounded because this is a contrib module that most Drupal installations do not deploy. No confirmed active exploitation (not in CISA KEV) and no public exploit code were identified at time of analysis, and EPSS is low at 0.17% (6th percentile), but the vendor has published a security advisory and a patched release, and the standard Drupal contrib upgrade path applies. Note the published CVE vector scores PR:N while the independent assessment scores PR:L, so the privilege level an attacker needs is not consistently confirmed across sources.
Open redirect in the Drupal Central Authentication System (CAS) Server contrib module lets remote, unauthenticated attackers craft CAS URLs that send victims to an untrusted site, which can be used to fake the source of data and support phishing. Affected deployments are the 0.x-2.0.x branch before 2.0.4 and the 2.1.x branch from 2.1.0 through 2.1.2; the reporter scored it 6.5, but exploitation depends on a victim following the crafted URL. No public exploit was identified at time of analysis, EPSS is 0.18% (7th percentile), and vendor patches are available in 2.0.4 and 2.1.3.
Stored cross-site scripting in the Drupal Feed Block contrib module (versions before 2.0.2 on the 2.x line and before 3.0.2 on the 3.x line) allows an authenticated user who can supply or configure content rendered by the block to persist a script payload that executes in another user's browser when the affected block is rendered on a page. Impact is bounded to low confidentiality and low integrity in the victim's browser context, with no availability impact, and only sites running the Feed Block module are affected - sites without it are not exposed. Vendor patches are available (2.0.2 and 3.0.2), EPSS is very low at 0.16% (5th percentile), and no public exploit has been identified at time of analysis; this is a low-to-moderate priority, scheduled-patching item rather than an emergency.
The Drupal contrib module Key auth (versions 0.0.0 through 2.2.4) can store sensitive authentication data in the web browser cache because of missing or incorrect cache-control handling, a CWE-525 weakness that also reflects incorrectly configured access-control levels in the module. Low-privilege authenticated users (CVSS PR:L) could recover that cached material over the network, yielding limited confidentiality and integrity impact for a base score of 5.4. Patch data shows a vendor fix is available, EPSS is only 0.15% (4th percentile) and there is no KEV listing; no public exploit identified at time of analysis, and the priority label is this_month rather than immediate action.
Stored cross-site scripting in the Drupal SafeDelete contributed module (versions 0.0.0 through 1.0.88) allows a low-privileged authenticated user to persist malicious markup that executes in the browser of a second user - typically an administrator or content reviewer - who later loads the page where the unneutralized input is rendered. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N) rates this 4.6, a moderate severity: exploitation requires an authenticated account able to write into the affected SafeDelete field plus victim interaction, which meaningfully lowers real-world risk below what the network vector alone suggests. No public exploit code has been identified at time of analysis and EPSS is 0.16% (5th percentile); the vendor has published a security advisory and a fix is available.
Capture-replay of a valid SAML assertion can bypass authentication in the Drupal SAML SSO - Service Provider module for versions 0.0.0 through 3.2.0, allowing an attacker who has obtained a legitimate SAML response to replay it and gain limited access. The issue is low severity (CVSS 3.1 base score 3.1) and the available signals point to low real-world urgency: EPSS is 0.19%, no CISA KEV status is indicated in the supplied data, and no public exploit was identified at time of analysis. A vendor patch is available in 3.2.0.
Server-side request forgery in the Drupal SAML SSO - Service Provider module affects versions 0.0.0 through 3.2.0 and allows a highly privileged account that can influence the module's SAML/IdP configuration to make the Drupal server send requests to attacker-influenced destinations. Impact is limited to low confidentiality and low integrity with no availability effect, and exploitation also requires high attack complexity. EPSS is 0.15% (4th percentile), no public exploit identified at time of analysis, and the priority is monitor.
Authenticated low-privileged users can read restricted taxonomy term glossary content on Drupal sites running the Taxonomy Term Glossary contrib module before 4.6.0, because directly requested glossary resources lack authorization checks. The issue is CWE-862 missing authorization, rated CVSS 3.1 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), so exploitation needs a valid account and affects confidentiality only. EPSS is 0.15% (4th percentile); no public exploit identified at time of analysis, no CISA KEV entry is indicated, and a vendor patch is available.
Script injection in the Drupal Webform contributed module (versions 0.0.0 through 6.2.12 and 6.3.0 through 6.3.1) lets an actor who already holds high Webform privileges place malicious script that executes in another user's browser when that user interacts with the affected page. The injection point is a webform element or configuration setting that the available sources do not identify, and successful exploitation requires both the elevated privilege and victim interaction, keeping confidentiality and integrity impact low and scope unchanged. This is a low-severity issue: EPSS is 0.17% (6th percentile), it is not in CISA KEV, no public exploit code is confirmed, and the vendor has published a patch; the current priority decision is monitor.
Cross-site scripting in the Drupal Webform contributed module allows an authenticated low-privileged user to inject script that runs when another user interacts with the generated page, affecting Webform releases below 6.2.12 in the 6.2.x branch and below 6.3.1 in the 6.3.x branch. The provided data shows no public exploit identified at time of analysis, EPSS at 0.21% (10th percentile), and no confirmed CISA KEV listing; exploitation requires a victim to interact with the malicious page.
Cross-site scripting in the Drupal Webform contributed module lets an authenticated low-privilege user supply input that Webform renders into a generated page without neutralization, so the payload executes in the browser of any user who later loads that page, scoped to the victim's own session (CVSS 3.1 base 4.6, S:U, C:L/I:L/A:N). Drupal sites running Webform before 6.2.12, or 6.3.0 before 6.3.1, are affected; exploitation requires a low-privileged account (PR:L) plus victim interaction (UI:R), which are the principal limiters on real-world exploitability. EPSS is 0.20% (10th percentile), no public exploit identified at time of analysis, no CISA KEV entry, and a vendor patch is available, so the vuln.today decision label is this_month.
Cross-site scripting in Drupal Webform allows a low-privileged authenticated user to place unneutralized input that executes in another user's browser when the affected content is rendered. The published affected ranges cover Webform 0.0.0 to 6.2.12 and 6.3.0 to 6.3.1, with CVSS 4.6 (PR:L/UI:R) limiting impact to the victim's browser context; 6.2.12 and 6.3.1+ are treated as not affected in the independent assessment, so the boundary should be confirmed against the vendor advisory. No public exploit is identified at time of analysis, EPSS is 0.17%, CISA KEV does not list it, and the priority is moderate rather than emergency.
Cross-site scripting in the Drupal Webform contrib module allows injected markup to execute in a victim's browser session when a crafted form or submission view is loaded, with impact bounded to low confidentiality and low integrity and no availability effect. Sites running Webform releases from 0.0.0 through 6.2.12 or from 6.3.0 through 6.3.1 are affected; deployments already on a fixed release are not exposed. Exploitation requires victim interaction and the vendor vector rates attack complexity high, no public exploit has been identified at time of analysis, EPSS is only 0.17% (5th percentile), and CISA KEV does not list the issue; a vendor patch is available and the aggregate priority is this_month rather than act-now.
Stored cross-site scripting in the Drupal Webform contributed module lets an authenticated user who holds Webform authoring privileges (creating or editing webforms, elements, or related configuration) embed a persistent script payload that executes when a higher-trust user, such as a site administrator, views the affected page. The flaw is a CWE-267 privilege-definition problem: a role is permitted an unsafe action it should not be, and exploitation additionally requires victim user interaction (CVSS:3.1/AV:N/AC:L/PR:L/UI:R), with impact limited to Low confidentiality and integrity and no availability effect. Affected releases are Webform 0.0.0 through 6.2.12 and 6.3.0 through 6.3.1; EPSS is 0.19% (8th percentile), there is no CISA KEV listing, and the vendor has released a patch, so this rates as a moderate-priority issue rather than an emergency.
Stored cross-site scripting in the Drupal Webform contrib module (versions 0.0.0 through 6.2.11 and 6.3.0) lets a low-privilege authenticated user inject HTML that Drupal Webform later renders without neutralization. The payload only executes when a separate victim loads the affected page, so impact is limited to the victim's browser session with unchanged scope and no availability effect; CVSS is 4.6 and EPSS is low at 0.20% (10th percentile). No public exploit code or active exploitation is confirmed, and vendor patches are available in 6.2.12 and 6.3.1.
Server-side request forgery in the Drupal Webform contributed module (versions 0.0.0 through 6.2.12 and 6.3.0 through 6.3.1) lets a user who holds a low-privileged authenticated account on the Drupal site cause the module to issue requests from the server, with limited confidentiality and integrity impact. Exploitation requires a valid account (CVSS PR:L) but no user interaction and no special complexity, so the practical barrier is simply having a foothold login on the site. The vendor has released a patch per the Drupal advisory, EPSS is low at roughly 0.20% (9th percentile), and no public exploit has been identified at time of analysis; the priority is a routine this-month remediation rather than an emergency response.
Drupal's Webform contributed module can retain sensitive submitted form data in the browser cache, leaving it recoverable by a later user of the same browser profile on versions prior to 6.2.12 and 6.3.1. Exploitation requires a low-privileged authenticated user (PR:L) to reach Webform-rendered content whose access-control and cache-control settings are misconfigured, and the assessed vector rates attack complexity as high with only limited confidentiality impact (CVSS 3.1 base score 3.1). There is no CISA KEV listing and no public exploit identified at time of analysis; EPSS is 0.19% (8th percentile) and the vuln.today priority is monitor, consistent with a low-severity, low-urgency disclosure.
Stored cross-site scripting in the Drupal Webform contributed module allows an authenticated user holding a Webform-related permission to persist content that Webform later renders to other users, so a reviewer or administrator viewing that content may have script execute in their session. The flaw is a CWE-267 'privilege defined with unsafe actions' problem - a role is granted a capability whose resulting actions are not safely constrained - and it affects Webform 0.0.0 through 6.2.12 and 6.3.0 through 6.3.1, with sites on the fixed releases not exposed. Severity is moderate (CVSS 5.4; the independent assessment raises scope to changed, S:C) with a low EPSS of 0.18% (7th percentile), no CISA KEV listing, and no public exploit identified at time of analysis; the vendor reports a patch is available and the priority decision is this_month. Authentication requirements are confirmed from the CVSS vector (PR:L, low-privileged authenticated), and because the payload is stored, a second victim user must subsequently view the affected content for execution.
Forceful browsing in the Drupal contributed Webform module lets a low-privileged authenticated user reach webform resources that are not protected by sufficiently granular access checks, yielding partial confidentiality and integrity impact with no availability effect. The flaw affects Webform releases from 0.0.0 through 6.2.12 and 6.3.0 through 6.3.1 (EUVD narrows the ranges to before 6.2.12 and before 6.3.1), and is scored 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) per the vendor/NVD vector. Exploitation requires a valid low-privileged account on the target site, no user interaction, and network reachability; EPSS is low at 0.20% (9th percentile), there is no CISA KEV listing, and no public exploit code was identified at time of analysis, with priority classified as this_month.
Incorrect authorization in Drupal Webform allows forceful browsing; all signals point to low real-world priority. Affected releases are the supplied 0.0.0-6.2.12 and 6.3.0-6.3.1 ranges, with the independent assessment identifying 6.2.12 and 6.3.1+ as not affected, and successful exploitation is limited to low confidentiality and integrity impact. No public exploit was identified at time of analysis, EPSS is 0.18% (7th percentile), and the vendor patch is available; the supplied vendor vector requires high privileges and high attack complexity, while the independent reassessment lowers those requirements to low privileges and low complexity.
Unauthenticated remote attackers can bypass access controls in the Drupal Webform contributed module to read data that should be restricted, affecting versions 0.0.0 through 6.2.12 and 6.3.0 through 6.3.1. Rated CVSS 5.3 with low confidentiality impact only, the flaw cannot modify or delete content and does not affect availability, so exposure is limited to unauthorized disclosure via direct requests to access-controlled Webform resources. No public exploit code or active exploitation is confirmed at time of analysis, and EPSS sits at 0.20% (9th percentile), consistent with a moderate rather than urgent patching priority.
Functionality misuse in the Drupal Webform contributed module (versions 0.0.0 through 6.2.12 and 6.3.0 through 6.3.1) lets remote, unauthenticated attackers circumvent interaction-frequency controls such as submission or rate limits on affected forms. The assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, score 5.3) limits impact to low integrity misuse with no confidentiality or availability effect, and exploitation requires that a deployed site actually use the affected frequency-control feature; the precise trigger is not described in the available sources. No public exploit is identified at time of analysis, EPSS is 0.15% (4th percentile), the vuln.today priority label is this_month, and a vendor patch is available.
Stored cross-site scripting in the Drupal contributed Webform module (versions 0.0.0 through 6.2.12 and 6.3.0 through 6.3.1) allows an authenticated user who can submit or configure webform content to persist malicious markup that executes in the browser of another user who later views it. Per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N), exploitation needs a low-privileged Drupal account plus a victim - typically an administrator or form reviewer - opening the stored content, so impact is limited to the victim's session context in the affected site. Severity is medium (vendor CVSS 4.6), EPSS is 0.17% (6th percentile), no public exploit was identified at time of analysis, and a vendor patch is available per Drupal security advisory SA-CONTRIB-2026-172, placing remediation in a this-month window rather than an emergency response.
An incorrect authorization check in the Drupal Webform module (versions 0.0.0 through 6.2.12 and 6.3.0 through 6.3.1) lets an authenticated low-privilege user reach a Webform resource by requesting its URL directly, bypassing intended access control and exposing limited confidential data. Only sites running the vulnerable module are affected; the CVSS score is 4.3 with confidentiality-only impact and no integrity or availability effect. There is no public exploit identified at time of analysis, EPSS is low at 0.18% (7th percentile), and the vendor has released fixed versions. This is a moderate-severity information-exposure issue, not an emergency.
Unauthenticated remote attackers can bypass authorization checks in the Drupal Webform contributed module and reach resources they are not entitled to via forceful browsing, with the impact confined to limited confidentiality exposure (C:L; no integrity or availability effect). Sites are affected if they run Webform releases inside the ranges listed by the vendor and EUVD (0.0.0 through 6.2.12, and 6.3.0 through 6.3.1); the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N puts the score at 5.3, meaning no credentials or user interaction are needed against a default install. Exploitation pressure is currently low - EPSS 0.20 percent (9th percentile), no CISA KEV entry, and no public exploit identified at time of analysis - and a vendor patch is available, so this is a moderate-severity information-exposure issue to schedule rather than an emergency.
Improper certificate validation in the Drupal Cloud module (versions 0.0.0 through 7.0.1, fixed in 7.0.1) lets an attacker who already occupies an adversary-in-the-middle position on the network path have a forged or untrusted certificate accepted, yielding limited confidentiality and integrity impact without authentication or user interaction (CVSS 4.8, AC:H, PR:N, UI:N). The MitM prerequisite is the main limiting factor: an off-path remote attacker cannot trigger the flaw. No public exploit has been identified at time of analysis, the issue is not in CISA KEV, and EPSS is low at 0.09% (percentile 0%), so it is rated a moderate-severity, lower-priority item scheduled for this month.
OS command injection (CWE-78) in the Drupal 'Cloud' contributed module affects versions 0.0.0 through 7.0.1 and allows an authenticated, low-privileged user to execute arbitrary OS commands, with high impact on confidentiality and integrity and no assessed availability impact. Exploitation requires user interaction and high attack complexity, so successful attacks depend on conditions beyond the attacker's direct control; the module is not part of Drupal core, so sites that do not run it are unaffected. EPSS is low (0.63%, 50th percentile), no CISA KEV listing or public exploit was identified at time of analysis, and the vendor has released a fixed version (7.0.1).
Cross-site request forgery in the Drupal Project Browser contributed module (affected ranges 0.0.0 through 2.0.2 and 2.1.0 through 2.1.4) lets an attacker riding an already-authenticated administrator's browser session submit forged requests against the site, with low confidentiality and integrity impact. Exploitation depends on luring a logged-in victim into interacting with attacker-controlled content while the session is live, so the vendor-assessed vector is AV:N/AC:H/PR:N/UI:R with a 4.2 base score, and EPSS is only 0.10% (1st percentile). There is no CISA KEV entry and no public exploit identified at time of analysis; vendor-released fixes exist in Project Browser 2.0.3 and 2.1.5, making this a low-to-moderate priority item to fold into the normal monthly patch cycle rather than an emergency.
Object injection in Drupal Commerce Decoupled Checkout before 1.8.0 can let remote, unauthenticated attackers manipulate dynamically determined object attributes when a victim interacts with the crafted request, with impact limited to integrity. The vendor has released 1.8.0 as the fix. No public exploit was identified at time of analysis, and EPSS is 0.42% (35th percentile).
Mermaid Diagram Field 1.0.4 to 1.0.9, a contributed Drupal module, contains an access-control gap (CWE-863) that lets a user who already holds a valid low-privileged account reach Mermaid diagram field content they are not permitted to view by requesting it directly (forceful browsing). The result is limited confidentiality exposure of diagram content only - integrity and availability are unaffected - and the CVSS vector (AV:N/AC:L/PR:L/UI:R, CVSS 3.5) models both an authenticated attacker and a user-interaction component. No public exploit code has been identified at time of analysis, EPSS is 0.18% (7th percentile), and the case is not in CISA KEV; the vuln.today decision label is monitor, consistent with a low real-world priority.
An authentication bypass in the contributed Drupal module 'REST & JSON API Authentication' (versions 0.0.0 through 3.2.0) allows remote attackers to reach REST/JSON API functionality that should be gated behind the module's authentication, with low confidentiality and integrity impact and no availability impact. Only Drupal sites that have deliberately installed and enabled this optional contrib module - and exposed its API endpoints over the network - are in scope; Drupal core and sites without the module are unaffected. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N for a base score of 6.5, EPSS is 0.18% (7th percentile) and there is no CISA KEV listing, so this is a moderate-priority item; no public exploit code has been identified at time of analysis. A vendor fix is available per the Drupal advisory, and the item is prioritized as 'this_month'.
Authentication bypass in the Drupal contributed module Stop Administrator Login 1.0 through 1.6 lets an authenticated high-privilege user reach a protected login path through an alternate route that the module does not cover, yielding partial confidentiality and integrity impact. The vendor has released a patch referenced by Drupal SA-CONTRIB-2026-183, EPSS is 0.18% (7th percentile), and no public exploit has been identified at time of analysis. Consistent with the CVSS 3.8 score and monitor priority, real-world risk is low and exploitation requires existing high-privilege access.
Cross-site request forgery in the Drupal Tawk.to Live Chat module (versions 0.0.0 through 3.0.4) lets an unauthenticated remote attacker induce a logged-in, privileged Drupal user to submit unintended requests, with limited confidentiality and integrity impact. The attacker needs no account of their own, but exploitation requires an active victim session and user interaction (UI:R). EPSS is 0.10%, no public exploit was identified at the time of analysis, and a vendor patch is available via Drupal SA-CONTRIB-2026-184.
Privilege escalation in the Drupal contributed module Editoria11y Accessibility Checker lets an account that already holds the module-granted permission perform actions beyond what that permission should allow, affecting integrity only. Sites running any release from 0.0.0 through 2.2.23 or from 3.0.0 through 3.0.9 with the module installed and enabled are exposed, but the CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) confirms the attacker must first hold an authenticated account carrying that specific permission. Exploitation is not confirmed as active - the issue is not in CISA KEV, no public exploit code is identified at time of analysis, and EPSS is only 0.13% (3rd percentile), which matches the this_month, medium-severity, low-priority rating rather than an emergency.
Template injection (CWE-1336) in the Drupal AI CKEditor module affects versions 0.0.0 through 1.4.3, allowing an authenticated Drupal user who can use the module's features to inject unneutralized template syntax that is later evaluated by a template engine, producing limited code injection. Successful exploitation requires the victim to interact with crafted content (CVSS PR:L/UI:R), and impact is confined to low confidentiality and integrity effects within the unchanged component scope. No public exploit code or active exploitation has been reported, and availability of an updated release (1.4.3) keeps priority at monitor level.
Excessive resource allocation in the Drupal contributed Combined image style module, affecting versions 0.0.0 through 1.0.7, can let remote unauthenticated requests that depend on user interaction drive resource consumption and degrade availability (CVSS 4.3, CWE-770). Only Drupal sites with this non-core module installed and enabled are exposed, and confidentiality and integrity are unaffected. This is a low-to-moderate priority issue rather than an emergency, and no public exploit was identified at time of analysis.
Missing authorization in the Drupal CSS Usage Analyzer module (versions 1.0.0 through 1.0.2) allows unauthenticated remote attackers to perform forceful browsing against an internet-reachable Drupal site where the module is installed and enabled. The issue is CWE-862 with low confidentiality and integrity impact and no availability impact, rated CVSS 5.4 (moderate); the exact resource or path involved is not described in the available sources. Vendor patching is available per Drupal SA-2026-189, and no public exploit was identified at time of analysis.
Missing authorization in the Drupal Smart Content contrib module (affected range 0.0.0 through the 3.2.1 boundary) lets an unauthenticated remote attacker perform forceful browsing to reach a restricted resource, with low confidentiality and integrity impact and no availability effect. The flaw is CWE-862, and the specific endpoint, feature, or route involved is not described in the available sources. No public exploit identified at time of analysis and there is no CISA KEV entry; the vendor has released a patch and the priority signal is this_month (moderate, not urgent).
Stored cross-site scripting in the Drupal contributed module Diba carousel slider (versions 0.0.0 through 3.0.2) allows an authenticated user who can create or edit content rendered by the module to persist a script payload that executes in the browser of another user who views the affected page. Per the CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N), the attacker must already hold content-authoring privileges and a separate victim must interact with the page, and the resulting impact is limited to the victim's browser session with no availability effect. No public exploit code or active exploitation has been identified at time of analysis, and the vendor has released a fix; the priority signal places remediation in the current monthly maintenance cycle rather than an emergency response.
The Drupal contributed module 'Disable Login Page' fails to fully suppress access to Drupal's login interface, allowing its security control to be bypassed via an alternate path or channel (CWE-288). Affected versions span 0.0.0 through 1.1.4 (exclusive), targeting Drupal sites that rely on this module to hide their login page - typically to enforce SSO or obscure attack surface. The vendor-assessed CVSS vector (PR:H, S:C, C:L) indicates scope change into Drupal core's login component, with low confidentiality exposure and no patch-related active exploitation identified; EPSS at 0.19% (9th percentile) reflects negligible current threat activity.
Stored cross-site scripting in the Drupal Entity Browser contributed module (versions prior to 2.16.0) allows a high-privileged authenticated attacker to inject persistent malicious script payloads that execute in victims' browsers when affected pages are loaded. The scope change (S:C in the CVSS vector) confirms the injected script crosses into the victim's browser context, enabling session hijacking or credential theft against users who view affected content. No public exploit code or active exploitation has been identified; the vendor (Drupal Security Team) has released a patched version and published advisory SA-CONTRIB-2026-094.
Incorrect Authorization (CWE-863) in the Drupal Diff contributed module allows unauthenticated remote users to perform Forceful Browsing against revision comparison endpoints that should be access-controlled, resulting in limited confidentiality exposure of content diff data. Affected versions span Diff 0.0.0-<2.0.1 and 2.1.0-<2.1.1; a vendor-released patch is available via Drupal Security Advisory SA-Contrib-2026-096. No public exploit code or CISA KEV listing has been identified at time of analysis.
Server-Side Request Forgery in Drupal's Entity Share Websub contributed module (versions 0.0.0 through < 1.1.2) allows unauthenticated remote attackers to induce the Drupal server to issue outbound HTTP requests to attacker-controlled targets, including internal network resources and cloud metadata endpoints. The vulnerability is rated CVSS 5.3 Medium with limited confidentiality impact and no integrity or availability impact. No active exploitation or public proof-of-concept has been identified; a vendor patch is available via Drupal Security Advisory SA-CONTRIB-2026-097.
Privilege escalation in Drupal's External Authentication contributed module (versions 0.0.0 through <2.0.13) allows low-privileged network users to gain elevated Drupal permissions by exploiting improper case-sensitivity handling during identity resolution. The module fails to normalize case in username or identity attribute comparisons against existing Drupal accounts, meaning an attacker can present a case-variant identity (e.g., 'Admin' for a privileged 'admin' account) and be mapped to a higher-privileged user. A vendor-released patch is available at version 2.0.13 per Drupal security advisory SA-CONTRIB-2026-098, and no public exploit code has been identified at time of analysis.
Incorrect authorization in the Drupal Quick Tabs contributed module (all versions prior to 4.3.1) permits unauthenticated remote users to perform forceful browsing against tab-rendered content that should be access-restricted. The CVSS 5.3 Medium score reflects a confidentiality-only impact - no integrity or availability compromise is possible - and actual risk scales with whether the affected site uses Quick Tabs to surface access-controlled content such as private nodes or role-restricted views. No public exploit has been identified at time of analysis; a patched release (4.3.1) is available via Drupal's security advisory SA-CONTRIB-2026-099.
Buffer overflow (CWE-119) in the Drupal Gammu SMS Daemon contributed module exposes high-privilege authenticated administrators to memory corruption that yields both confidentiality and integrity compromise. The vulnerability affects all released versions of the module (*.* wildcard CPE), with no patched release confirmed in the provided data. No public exploit code or CISA KEV listing has been identified at time of analysis, and the high attack complexity combined with the requirement for elevated Drupal privileges substantially limits opportunistic exploitation.
Buffer overflow in the Drupal Gammu SMS Daemon contributed module exposes sites to memory corruption with high confidentiality and integrity impact. The vulnerability (CWE-119) requires network-reachable access by a highly privileged user under specific conditions, limiting its practical reach but making it serious when those conditions are met. No public exploit code has been identified at time of analysis, and the Drupal security team has issued advisory SA-contrib-2026-100.
Buffer overflow (CWE-119) in the Drupal Gammu SMS Daemon contributed module allows a highly privileged, authenticated attacker to achieve high confidentiality and integrity impact against affected Drupal installations. The CVSS vector (PR:H, AC:H) constrains real-world exploitability significantly, requiring both administrative access and complex attack conditions. No active exploitation has been identified; all tracked versions of the module are reported as affected with no specific patched release confirmed in available data.
Improper input validation (CWE-20) in the Drupal Link Content Parser contributed module exposes sites to both confidentiality and integrity compromise under high-complexity, high-privilege conditions. All published versions of the module are affected per CPE cpe:2.3:a:drupal:link_content_parser:*:*:*:*:*:*:*:*, with Drupal's security team confirming the issue via advisory SA-contrib-2026-101. No public exploit has been identified at time of analysis, and the CVSS score of 5.9 reflects strong mitigating factors - specifically the requirement for administrator-level authentication and high attack complexity.
Cross-site scripting in the Drupal Address Suggestion contributed module allows an authenticated administrator to inject persistent malicious JavaScript into pages served to other users. Affected versions span all releases from 0.0.0 through 1.0.24; version 1.0.25 resolves the issue per Drupal security advisory SA-CONTRIB-2026-103. No public exploit code or CISA KEV listing has been identified at time of analysis, and the high-privilege requirement substantially limits the realistic attacker pool.
Incorrect authorization enforcement in Drupal's Blazy lazy-loading module (all versions before 3.0.18) enables unauthenticated remote users to perform forceful browsing - directly requesting URLs of media assets that Drupal's access controls are intended to restrict. The module fails to apply proper authorization checks when serving lazily-loaded resources, exposing low-level confidentiality impact (C:L) with no integrity or availability consequence. No active exploitation has been confirmed and no public proof-of-concept has been identified; a vendor patch is available at version 3.0.18 per advisory SA-CONTRIB-2026-104.
Authentication bypass in the Drupal CAPTCHA Protected Page contributed module (versions before 1.0.2) allows unauthenticated network attackers to access pages that should be gated behind a CAPTCHA challenge by using an alternate access path or channel that circumvents the protection logic. The confidentiality impact is limited - only the content of the CAPTCHA-protected pages is exposed, and the CVSS high-complexity rating indicates the bypass requires specific conditions to execute. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog. A vendor patch is available at version 1.0.2.
Drupal's Commerce CyberSource payment integration module (all versions prior to 1.10.0) contains a timing side-channel vulnerability (CWE-208) that enables brute-force attacks against authentication or token-validation operations. Remote unauthenticated attackers can exploit measurable differences in response timing to iteratively confirm the validity of credentials or secrets, achieving limited integrity impact. Vendor-released patch version 1.10.0 is available via the Drupal security advisory sa-contrib-2026-106; no public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation in Drupal's Content Moderation Notifications module (all versions before 3.9.0) stems from unsafe privilege definitions (CWE-267) embedded in the module's moderation workflow handling. An already-highly-privileged Drupal user can exploit improperly scoped permissions granted by the module to perform actions or access content beyond their intended role boundary within Drupal's RBAC model. No active exploitation (CISA KEV) or public proof-of-concept has been identified; a vendor patch at version 3.9.0 is available per Drupal security advisory SA-CONTRIB-2026-107.
Forceful browsing via missing authorization in the Drupal Data field contributed module (versions up to 2.0.13) exposes field data to unauthenticated network access. The module fails to enforce access control checks before serving field content, allowing an attacker to directly request protected data resources by crafting or guessing their URLs. A vendor patch is available; no public exploit or active exploitation has been identified at time of analysis.
Insecure Storage of Sensitive Information vulnerability in Drupal AI (Artificial Intelligence) allows Retrieve Embedded Sensitive Data. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2.
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Cross-Site Scripting (XSS). This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2.
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Stored XSS. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2.
External Control of File Name or Path vulnerability in Drupal Single Content Sync allows Path Traversal. This issue affects Single Content Sync versions: from 0.0.0 to 1.4.19.
Deserialization of Untrusted Data vulnerability in Drupal Single Content Sync allows Object Injection. This issue affects Single Content Sync versions: from 0.0.0 to 1.4.19.
Vulnerability in Drupal CacheFlush. This issue affects CacheFlush versions: *.*.
Vulnerability in Drupal PayUmoney for Drupal Commerce. This issue affects PayUmoney for Drupal Commerce versions: *.*.
Vulnerability in Drupal GroupEx PRO ( Daxko ) integration. This issue affects GroupEx PRO ( Daxko ) integration versions: *.*.
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal CAPTCHA allows Functionality Bypass. This issue affects CAPTCHA versions: from 0.0.0 to 1.18.0, from 2.0.0 to 2.0.11.
Incorrect Authorization vulnerability in Drupal Fasttoggle allows Forceful Browsing. This issue affects Fasttoggle versions: from 0.0.0 to 4.1.1.
Cross-Site Request Forgery (CSRF) vulnerability in Drupal Fasttoggle allows Cross Site Request Forgery. This issue affects Fasttoggle versions: from 0.0.0 to 4.1.1.
Incorrect Permission Assignment for Critical Resource vulnerability in Drupal S3 File System allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects S3 File System versions: from 0.0.0 to 3.12.0.
Incorrect Authorization vulnerability in Drupal Bulk Update User Roles allows Forceful Browsing. This issue affects Bulk Update User Roles versions: from 0.0.0 to 1.0.5.
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal OAuth Login - OAuth OIDC SSO allows Authentication Bypass. This issue affects OAuth Login - OAuth OIDC SSO versions: from 0.0.0 to 3.1.1.
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Signature pad widget allows Stored XSS. This issue affects Signature pad widget versions: from 0.0.0 to 1.15.0.
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Stage File Proxy allows Cross-Site Scripting (XSS). This issue affects Stage File Proxy versions: from 0.0.0 to 3.1.7, from 4.0.0 to 4.0.1.
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal OpenID Connect Client allows Authentication Bypass. This issue affects OpenID Connect Client versions: from 0.0.0 to 2.3.1.
Incorrect Authorization vulnerability in Drupal Field Permissions allows Forceful Browsing. This issue affects Field Permissions versions: from 0.0.0 to 1.6.0.
Incorrect Authorization vulnerability in Drupal Field Permissions allows Forceful Browsing. This issue affects Field Permissions versions: from 0.0.0 to 1.6.0.
Missing Authorization vulnerability in Drupal OAuth2 Token Manager allows Forceful Browsing. This issue affects OAuth2 Token Manager versions: from 0.0.0 to 1.2.0.
Insecure Storage of Sensitive Information vulnerability in Drupal Content Sync (content-sync.io) allows Retrieve Embedded Sensitive Data. This issue affects Content Sync (content-sync.io) versions: from 0.0.0 to 3.2.2.
Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Media Alias Display allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Media Alias Display versions: from 0.0.0 to 2.1.3, from 3.0.0 to 3.0.3.
Drupal Advanced Search 0.0.0 through 2.4.5 fails to enforce an authorization check on a search-related resource, allowing remote clients to use forceful browsing and obtain limited confidentiality and integrity impact without affecting availability. The vendor-assigned CVSS 3.1 score is 4.2 (AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N), and exposure requires the contrib module to be installed and enabled. A vendor patch is available and no public exploit identified at time of analysis.
Stored cross-site scripting in the Drupal AI (Artificial Intelligence) contrib module affects versions 0.0.0 through 1.3.13 and 1.4.0 through 1.4.8, allowing an authenticated user with a privileged Drupal account to store input that is later rendered to another user. The vendor CVSS 3.1 vector (AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N, base 3.1) requires victim interaction and a high-privilege account, keeping impact to low confidentiality and integrity effects. No public exploit was identified at time of analysis, and a vendor patch is available via Drupal SA-CONTRIB-2026-119.
The Drupal AI (Artificial Intelligence) contrib module performs insufficient authorization checks on at least one of its endpoints, allowing forceful browsing - an authenticated user can reach a resource or route directly by URL that the module never gates behind an access check. Versions 0.0.0 through 1.3.13 and 1.4.0 through 1.4.8 are affected; exploitation requires a valid account with at least low privileges (PR:L) and cannot be performed anonymously, with impact limited to partial confidentiality and integrity and no availability effect (CVSS 4.6). There is no CISA KEV listing and no public exploit identified at time of analysis, and the vendor has published a security advisory with a fix.
Missing authorization in the Drupal AI Translate contrib module allows forceful browsing, so a user who already holds a low-privilege authenticated account on an affected site can reach AI Translate functionality or resources that should be gated behind stricter permissions. The issue affects the 0.0.0 through 1.3.2 and 1.4.0 through 1.4.1 version ranges and is rated moderate (CVSS 4.6, low confidentiality and integrity impact, no availability impact); only Drupal sites with this contrib module installed are exposed. Vendor patches are available at 1.3.2 and 1.4.1 per the Drupal advisory, no public exploit code has been identified at time of analysis, and the prioritisation signal places it in the this-month remediation window rather than an emergency one.
Missing authorization in the Drupal contributed module Calculate Working Days (versions 0.0.0 through 2.0.3, fixed in 2.0.3) lets unauthenticated remote requests reach routes or pages that should be gated by a permission check, a forceful-browsing style access-control bypass scored CVSS 5.3. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) exploitation requires no authentication or user interaction, but the impact is limited to a Low integrity effect with no confidentiality or availability consequences, and only sites that have installed and enabled this specific contributed module in a pre-2.0.3 release are exposed. No public exploit has been identified at time of analysis, there is no CISA KEV listing, EPSS is 0.14% (3rd percentile), and SSVC records exploitation as none with partial technical impact.
Stored cross-site scripting in the Drupal contributed 'Component blocks' module (versions 0.0.0 through 1.2.6) lets an authenticated user who holds permission to create or edit component blocks persist malicious script that executes in the browser of any user viewing the poisoned block, including administrators. Rated CVSS 4.6 with a PR:L/UI:R profile, so exploitation needs both a block-authoring account and a victim who loads the rendered content; Drupal core and sites without the module are unaffected. No public exploit code or active exploitation has been identified at time of analysis, and EPSS is 0.16% (5th percentile), consistent with a low-to-moderate real-world priority and a 'this month' patch cadence rather than an emergency.
Authentication bypass in the Drupal contrib module Email Verification / SMS Verification / OTP Verification (versions 0.0.0 through below 2.4.0) allows remote, unauthenticated attackers to skip the verification step the module is meant to enforce, with CVSS 3.1 scored 6.5 (AV:N/AC:L/PR:N/UI:N, C:L/I:L/A:N). Only Drupal sites that actually install and enable this contrib module - and rely on it as an access or action gate - are exposed, and the realistic impact is bounded to bypassing that check rather than full site compromise. No public exploit has been identified at time of analysis, CISA KEV does not list the issue, SSVC rates exploitation as none with partial technical impact, and EPSS is 0.19% (8th percentile), so the available decision signals converge on a this-month, non-emergency remediation priority. A vendor patch is available.
Reflected cross-site scripting (CVSS 5.4) affects the Drupal contrib module 'Email Verification / SMS Verification / OTP Verification' in all versions from 0.0.0 through 2.4.0, allowing an attacker who convinces a victim to open a crafted URL to execute script in that victim's browser session on the Drupal site. No authentication is required of the attacker, but exploitation depends on victim interaction (UI:R) and the specific reflecting parameter is not described in the available sources. No public exploit code or active exploitation is known, EPSS is low at 0.16% (5th percentile), and the vendor has released a patch in version 2.4.0.
Missing authorization in the Islandora digital repository framework for Drupal (versions 0.0.0 through 2.19.0) lets unauthenticated, network-positioned attackers reach protected resources by requesting their paths directly - a forceful browsing bypass of access control. Impact is limited to low-severity confidentiality disclosure with no integrity or availability effect, and the trigger specifics (which endpoints or object states bypass the check) are not described in the available sources. No public exploit code and no active exploitation are confirmed; EPSS is 0.14% (3rd percentile), CISA SSVC records Exploitation: none and Automatable: no, and the vendor has released a fix, so priority is monitoring rather than emergency response.
Unauthenticated forceful browsing in the Drupal contrib module Jsonapi Role Access allows remote attackers to reach JSON:API resources that the module is supposed to restrict by role, with low confidentiality and low integrity impact and no availability effect. Sites are affected only if they run this specific contrib module at a version below the fixed release and have Drupal's JSON:API functionality active; the CVSS vector (AV:N/AC:L/PR:N/UI:N) means no credentials or user interaction are needed once the module is present. Severity is moderate (6.5) and urgency is limited: EPSS is 0.14% (3rd percentile), there is no KEV entry, and no public exploit identified at time of analysis; a vendor patch is available and the priority label is this_month.
Path traversal (CWE-22) in the Drupal contributed module Media Library Importer affects versions from 0.0.0 through 2.1.6, allowing an authenticated user with access to the module's media-import functionality to write or read files outside the intended restricted directory, with limited confidentiality and integrity impact and no availability effect. The CVSS 3.1 base score is 5.4 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N), so exploitation requires a low-privileged account and is not possible anonymously. No active exploitation has been observed (CISA SSVC Exploitation: none, EPSS 0.16%), and no public exploit code is identified in the available sources; default Drupal installations are unaffected because the module is a non-core add-on that must be explicitly installed.
Signature spoofing in the Drupal Monobank payment API module (versions 0.0.0 through the 1.0.3 range boundary) allows a remote, unauthenticated actor to submit a payment notification/callback whose cryptographic signature the module fails to verify properly, so a forged payment confirmation can be accepted as genuine. Impact is limited to integrity (CVSS 3.7, C:N/I:L/A:N) with no confidentiality or availability effect, and only sites that have the contrib module installed and active as a payment integration are exposed. Exploitation status is low-risk: no CISA KEV listing, EPSS 0.10% (1st percentile), a public PoC reference exists but is not verified as working exploit code, the vendor has released a fixed release, and the independent assessment rates all decision signals as a low real-world priority (monitor).
Missing authorization in Drupal's Webform Submissions Delete contributed module, versions 0.0.0 through 1.2.0, allows remote attackers to delete stored webform submissions by directly requesting the deletion route, affecting integrity only. The module must be installed and enabled on a site holding submissions; the CVSS vector is AV:N/AC:L/PR:N/UI:N with I:L, though the supplied sources do not explicitly confirm whether anonymous or low-privileged access suffices. No public exploit has been identified at time of analysis, EPSS is 0.19% (8th percentile), a vendor patch is available, and the priority is this_month rather than emergency.
SQL injection (CWE-89, base CVSS 6.5) in the amazee.ai Private AI Provider Drupal contrib module lets an attacker inject into SQL statements executed by the module's database layer, with high confidentiality impact and limited integrity impact in the assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N). Every site running the module in versions 0.0.0 through 1.3.7, or 1.4.0 through 1.4.3, is affected; exposure is bounded because this is a contrib module that most Drupal installations do not deploy. No confirmed active exploitation (not in CISA KEV) and no public exploit code were identified at time of analysis, and EPSS is low at 0.17% (6th percentile), but the vendor has published a security advisory and a patched release, and the standard Drupal contrib upgrade path applies. Note the published CVE vector scores PR:N while the independent assessment scores PR:L, so the privilege level an attacker needs is not consistently confirmed across sources.
Open redirect in the Drupal Central Authentication System (CAS) Server contrib module lets remote, unauthenticated attackers craft CAS URLs that send victims to an untrusted site, which can be used to fake the source of data and support phishing. Affected deployments are the 0.x-2.0.x branch before 2.0.4 and the 2.1.x branch from 2.1.0 through 2.1.2; the reporter scored it 6.5, but exploitation depends on a victim following the crafted URL. No public exploit was identified at time of analysis, EPSS is 0.18% (7th percentile), and vendor patches are available in 2.0.4 and 2.1.3.
Stored cross-site scripting in the Drupal Feed Block contrib module (versions before 2.0.2 on the 2.x line and before 3.0.2 on the 3.x line) allows an authenticated user who can supply or configure content rendered by the block to persist a script payload that executes in another user's browser when the affected block is rendered on a page. Impact is bounded to low confidentiality and low integrity in the victim's browser context, with no availability impact, and only sites running the Feed Block module are affected - sites without it are not exposed. Vendor patches are available (2.0.2 and 3.0.2), EPSS is very low at 0.16% (5th percentile), and no public exploit has been identified at time of analysis; this is a low-to-moderate priority, scheduled-patching item rather than an emergency.
The Drupal contrib module Key auth (versions 0.0.0 through 2.2.4) can store sensitive authentication data in the web browser cache because of missing or incorrect cache-control handling, a CWE-525 weakness that also reflects incorrectly configured access-control levels in the module. Low-privilege authenticated users (CVSS PR:L) could recover that cached material over the network, yielding limited confidentiality and integrity impact for a base score of 5.4. Patch data shows a vendor fix is available, EPSS is only 0.15% (4th percentile) and there is no KEV listing; no public exploit identified at time of analysis, and the priority label is this_month rather than immediate action.
Stored cross-site scripting in the Drupal SafeDelete contributed module (versions 0.0.0 through 1.0.88) allows a low-privileged authenticated user to persist malicious markup that executes in the browser of a second user - typically an administrator or content reviewer - who later loads the page where the unneutralized input is rendered. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N) rates this 4.6, a moderate severity: exploitation requires an authenticated account able to write into the affected SafeDelete field plus victim interaction, which meaningfully lowers real-world risk below what the network vector alone suggests. No public exploit code has been identified at time of analysis and EPSS is 0.16% (5th percentile); the vendor has published a security advisory and a fix is available.
Capture-replay of a valid SAML assertion can bypass authentication in the Drupal SAML SSO - Service Provider module for versions 0.0.0 through 3.2.0, allowing an attacker who has obtained a legitimate SAML response to replay it and gain limited access. The issue is low severity (CVSS 3.1 base score 3.1) and the available signals point to low real-world urgency: EPSS is 0.19%, no CISA KEV status is indicated in the supplied data, and no public exploit was identified at time of analysis. A vendor patch is available in 3.2.0.
Server-side request forgery in the Drupal SAML SSO - Service Provider module affects versions 0.0.0 through 3.2.0 and allows a highly privileged account that can influence the module's SAML/IdP configuration to make the Drupal server send requests to attacker-influenced destinations. Impact is limited to low confidentiality and low integrity with no availability effect, and exploitation also requires high attack complexity. EPSS is 0.15% (4th percentile), no public exploit identified at time of analysis, and the priority is monitor.
Authenticated low-privileged users can read restricted taxonomy term glossary content on Drupal sites running the Taxonomy Term Glossary contrib module before 4.6.0, because directly requested glossary resources lack authorization checks. The issue is CWE-862 missing authorization, rated CVSS 3.1 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), so exploitation needs a valid account and affects confidentiality only. EPSS is 0.15% (4th percentile); no public exploit identified at time of analysis, no CISA KEV entry is indicated, and a vendor patch is available.
Script injection in the Drupal Webform contributed module (versions 0.0.0 through 6.2.12 and 6.3.0 through 6.3.1) lets an actor who already holds high Webform privileges place malicious script that executes in another user's browser when that user interacts with the affected page. The injection point is a webform element or configuration setting that the available sources do not identify, and successful exploitation requires both the elevated privilege and victim interaction, keeping confidentiality and integrity impact low and scope unchanged. This is a low-severity issue: EPSS is 0.17% (6th percentile), it is not in CISA KEV, no public exploit code is confirmed, and the vendor has published a patch; the current priority decision is monitor.
Cross-site scripting in the Drupal Webform contributed module allows an authenticated low-privileged user to inject script that runs when another user interacts with the generated page, affecting Webform releases below 6.2.12 in the 6.2.x branch and below 6.3.1 in the 6.3.x branch. The provided data shows no public exploit identified at time of analysis, EPSS at 0.21% (10th percentile), and no confirmed CISA KEV listing; exploitation requires a victim to interact with the malicious page.
Cross-site scripting in the Drupal Webform contributed module lets an authenticated low-privilege user supply input that Webform renders into a generated page without neutralization, so the payload executes in the browser of any user who later loads that page, scoped to the victim's own session (CVSS 3.1 base 4.6, S:U, C:L/I:L/A:N). Drupal sites running Webform before 6.2.12, or 6.3.0 before 6.3.1, are affected; exploitation requires a low-privileged account (PR:L) plus victim interaction (UI:R), which are the principal limiters on real-world exploitability. EPSS is 0.20% (10th percentile), no public exploit identified at time of analysis, no CISA KEV entry, and a vendor patch is available, so the vuln.today decision label is this_month.
Cross-site scripting in Drupal Webform allows a low-privileged authenticated user to place unneutralized input that executes in another user's browser when the affected content is rendered. The published affected ranges cover Webform 0.0.0 to 6.2.12 and 6.3.0 to 6.3.1, with CVSS 4.6 (PR:L/UI:R) limiting impact to the victim's browser context; 6.2.12 and 6.3.1+ are treated as not affected in the independent assessment, so the boundary should be confirmed against the vendor advisory. No public exploit is identified at time of analysis, EPSS is 0.17%, CISA KEV does not list it, and the priority is moderate rather than emergency.
Cross-site scripting in the Drupal Webform contrib module allows injected markup to execute in a victim's browser session when a crafted form or submission view is loaded, with impact bounded to low confidentiality and low integrity and no availability effect. Sites running Webform releases from 0.0.0 through 6.2.12 or from 6.3.0 through 6.3.1 are affected; deployments already on a fixed release are not exposed. Exploitation requires victim interaction and the vendor vector rates attack complexity high, no public exploit has been identified at time of analysis, EPSS is only 0.17% (5th percentile), and CISA KEV does not list the issue; a vendor patch is available and the aggregate priority is this_month rather than act-now.
Stored cross-site scripting in the Drupal Webform contributed module lets an authenticated user who holds Webform authoring privileges (creating or editing webforms, elements, or related configuration) embed a persistent script payload that executes when a higher-trust user, such as a site administrator, views the affected page. The flaw is a CWE-267 privilege-definition problem: a role is permitted an unsafe action it should not be, and exploitation additionally requires victim user interaction (CVSS:3.1/AV:N/AC:L/PR:L/UI:R), with impact limited to Low confidentiality and integrity and no availability effect. Affected releases are Webform 0.0.0 through 6.2.12 and 6.3.0 through 6.3.1; EPSS is 0.19% (8th percentile), there is no CISA KEV listing, and the vendor has released a patch, so this rates as a moderate-priority issue rather than an emergency.
Stored cross-site scripting in the Drupal Webform contrib module (versions 0.0.0 through 6.2.11 and 6.3.0) lets a low-privilege authenticated user inject HTML that Drupal Webform later renders without neutralization. The payload only executes when a separate victim loads the affected page, so impact is limited to the victim's browser session with unchanged scope and no availability effect; CVSS is 4.6 and EPSS is low at 0.20% (10th percentile). No public exploit code or active exploitation is confirmed, and vendor patches are available in 6.2.12 and 6.3.1.
Server-side request forgery in the Drupal Webform contributed module (versions 0.0.0 through 6.2.12 and 6.3.0 through 6.3.1) lets a user who holds a low-privileged authenticated account on the Drupal site cause the module to issue requests from the server, with limited confidentiality and integrity impact. Exploitation requires a valid account (CVSS PR:L) but no user interaction and no special complexity, so the practical barrier is simply having a foothold login on the site. The vendor has released a patch per the Drupal advisory, EPSS is low at roughly 0.20% (9th percentile), and no public exploit has been identified at time of analysis; the priority is a routine this-month remediation rather than an emergency response.
Drupal's Webform contributed module can retain sensitive submitted form data in the browser cache, leaving it recoverable by a later user of the same browser profile on versions prior to 6.2.12 and 6.3.1. Exploitation requires a low-privileged authenticated user (PR:L) to reach Webform-rendered content whose access-control and cache-control settings are misconfigured, and the assessed vector rates attack complexity as high with only limited confidentiality impact (CVSS 3.1 base score 3.1). There is no CISA KEV listing and no public exploit identified at time of analysis; EPSS is 0.19% (8th percentile) and the vuln.today priority is monitor, consistent with a low-severity, low-urgency disclosure.
Stored cross-site scripting in the Drupal Webform contributed module allows an authenticated user holding a Webform-related permission to persist content that Webform later renders to other users, so a reviewer or administrator viewing that content may have script execute in their session. The flaw is a CWE-267 'privilege defined with unsafe actions' problem - a role is granted a capability whose resulting actions are not safely constrained - and it affects Webform 0.0.0 through 6.2.12 and 6.3.0 through 6.3.1, with sites on the fixed releases not exposed. Severity is moderate (CVSS 5.4; the independent assessment raises scope to changed, S:C) with a low EPSS of 0.18% (7th percentile), no CISA KEV listing, and no public exploit identified at time of analysis; the vendor reports a patch is available and the priority decision is this_month. Authentication requirements are confirmed from the CVSS vector (PR:L, low-privileged authenticated), and because the payload is stored, a second victim user must subsequently view the affected content for execution.
Forceful browsing in the Drupal contributed Webform module lets a low-privileged authenticated user reach webform resources that are not protected by sufficiently granular access checks, yielding partial confidentiality and integrity impact with no availability effect. The flaw affects Webform releases from 0.0.0 through 6.2.12 and 6.3.0 through 6.3.1 (EUVD narrows the ranges to before 6.2.12 and before 6.3.1), and is scored 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) per the vendor/NVD vector. Exploitation requires a valid low-privileged account on the target site, no user interaction, and network reachability; EPSS is low at 0.20% (9th percentile), there is no CISA KEV listing, and no public exploit code was identified at time of analysis, with priority classified as this_month.
Incorrect authorization in Drupal Webform allows forceful browsing; all signals point to low real-world priority. Affected releases are the supplied 0.0.0-6.2.12 and 6.3.0-6.3.1 ranges, with the independent assessment identifying 6.2.12 and 6.3.1+ as not affected, and successful exploitation is limited to low confidentiality and integrity impact. No public exploit was identified at time of analysis, EPSS is 0.18% (7th percentile), and the vendor patch is available; the supplied vendor vector requires high privileges and high attack complexity, while the independent reassessment lowers those requirements to low privileges and low complexity.
Unauthenticated remote attackers can bypass access controls in the Drupal Webform contributed module to read data that should be restricted, affecting versions 0.0.0 through 6.2.12 and 6.3.0 through 6.3.1. Rated CVSS 5.3 with low confidentiality impact only, the flaw cannot modify or delete content and does not affect availability, so exposure is limited to unauthorized disclosure via direct requests to access-controlled Webform resources. No public exploit code or active exploitation is confirmed at time of analysis, and EPSS sits at 0.20% (9th percentile), consistent with a moderate rather than urgent patching priority.
Functionality misuse in the Drupal Webform contributed module (versions 0.0.0 through 6.2.12 and 6.3.0 through 6.3.1) lets remote, unauthenticated attackers circumvent interaction-frequency controls such as submission or rate limits on affected forms. The assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, score 5.3) limits impact to low integrity misuse with no confidentiality or availability effect, and exploitation requires that a deployed site actually use the affected frequency-control feature; the precise trigger is not described in the available sources. No public exploit is identified at time of analysis, EPSS is 0.15% (4th percentile), the vuln.today priority label is this_month, and a vendor patch is available.
Stored cross-site scripting in the Drupal contributed Webform module (versions 0.0.0 through 6.2.12 and 6.3.0 through 6.3.1) allows an authenticated user who can submit or configure webform content to persist malicious markup that executes in the browser of another user who later views it. Per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N), exploitation needs a low-privileged Drupal account plus a victim - typically an administrator or form reviewer - opening the stored content, so impact is limited to the victim's session context in the affected site. Severity is medium (vendor CVSS 4.6), EPSS is 0.17% (6th percentile), no public exploit was identified at time of analysis, and a vendor patch is available per Drupal security advisory SA-CONTRIB-2026-172, placing remediation in a this-month window rather than an emergency response.
An incorrect authorization check in the Drupal Webform module (versions 0.0.0 through 6.2.12 and 6.3.0 through 6.3.1) lets an authenticated low-privilege user reach a Webform resource by requesting its URL directly, bypassing intended access control and exposing limited confidential data. Only sites running the vulnerable module are affected; the CVSS score is 4.3 with confidentiality-only impact and no integrity or availability effect. There is no public exploit identified at time of analysis, EPSS is low at 0.18% (7th percentile), and the vendor has released fixed versions. This is a moderate-severity information-exposure issue, not an emergency.
Unauthenticated remote attackers can bypass authorization checks in the Drupal Webform contributed module and reach resources they are not entitled to via forceful browsing, with the impact confined to limited confidentiality exposure (C:L; no integrity or availability effect). Sites are affected if they run Webform releases inside the ranges listed by the vendor and EUVD (0.0.0 through 6.2.12, and 6.3.0 through 6.3.1); the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N puts the score at 5.3, meaning no credentials or user interaction are needed against a default install. Exploitation pressure is currently low - EPSS 0.20 percent (9th percentile), no CISA KEV entry, and no public exploit identified at time of analysis - and a vendor patch is available, so this is a moderate-severity information-exposure issue to schedule rather than an emergency.
Improper certificate validation in the Drupal Cloud module (versions 0.0.0 through 7.0.1, fixed in 7.0.1) lets an attacker who already occupies an adversary-in-the-middle position on the network path have a forged or untrusted certificate accepted, yielding limited confidentiality and integrity impact without authentication or user interaction (CVSS 4.8, AC:H, PR:N, UI:N). The MitM prerequisite is the main limiting factor: an off-path remote attacker cannot trigger the flaw. No public exploit has been identified at time of analysis, the issue is not in CISA KEV, and EPSS is low at 0.09% (percentile 0%), so it is rated a moderate-severity, lower-priority item scheduled for this month.
OS command injection (CWE-78) in the Drupal 'Cloud' contributed module affects versions 0.0.0 through 7.0.1 and allows an authenticated, low-privileged user to execute arbitrary OS commands, with high impact on confidentiality and integrity and no assessed availability impact. Exploitation requires user interaction and high attack complexity, so successful attacks depend on conditions beyond the attacker's direct control; the module is not part of Drupal core, so sites that do not run it are unaffected. EPSS is low (0.63%, 50th percentile), no CISA KEV listing or public exploit was identified at time of analysis, and the vendor has released a fixed version (7.0.1).
Cross-site request forgery in the Drupal Project Browser contributed module (affected ranges 0.0.0 through 2.0.2 and 2.1.0 through 2.1.4) lets an attacker riding an already-authenticated administrator's browser session submit forged requests against the site, with low confidentiality and integrity impact. Exploitation depends on luring a logged-in victim into interacting with attacker-controlled content while the session is live, so the vendor-assessed vector is AV:N/AC:H/PR:N/UI:R with a 4.2 base score, and EPSS is only 0.10% (1st percentile). There is no CISA KEV entry and no public exploit identified at time of analysis; vendor-released fixes exist in Project Browser 2.0.3 and 2.1.5, making this a low-to-moderate priority item to fold into the normal monthly patch cycle rather than an emergency.
Object injection in Drupal Commerce Decoupled Checkout before 1.8.0 can let remote, unauthenticated attackers manipulate dynamically determined object attributes when a victim interacts with the crafted request, with impact limited to integrity. The vendor has released 1.8.0 as the fix. No public exploit was identified at time of analysis, and EPSS is 0.42% (35th percentile).
Mermaid Diagram Field 1.0.4 to 1.0.9, a contributed Drupal module, contains an access-control gap (CWE-863) that lets a user who already holds a valid low-privileged account reach Mermaid diagram field content they are not permitted to view by requesting it directly (forceful browsing). The result is limited confidentiality exposure of diagram content only - integrity and availability are unaffected - and the CVSS vector (AV:N/AC:L/PR:L/UI:R, CVSS 3.5) models both an authenticated attacker and a user-interaction component. No public exploit code has been identified at time of analysis, EPSS is 0.18% (7th percentile), and the case is not in CISA KEV; the vuln.today decision label is monitor, consistent with a low real-world priority.
An authentication bypass in the contributed Drupal module 'REST & JSON API Authentication' (versions 0.0.0 through 3.2.0) allows remote attackers to reach REST/JSON API functionality that should be gated behind the module's authentication, with low confidentiality and integrity impact and no availability impact. Only Drupal sites that have deliberately installed and enabled this optional contrib module - and exposed its API endpoints over the network - are in scope; Drupal core and sites without the module are unaffected. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N for a base score of 6.5, EPSS is 0.18% (7th percentile) and there is no CISA KEV listing, so this is a moderate-priority item; no public exploit code has been identified at time of analysis. A vendor fix is available per the Drupal advisory, and the item is prioritized as 'this_month'.
Authentication bypass in the Drupal contributed module Stop Administrator Login 1.0 through 1.6 lets an authenticated high-privilege user reach a protected login path through an alternate route that the module does not cover, yielding partial confidentiality and integrity impact. The vendor has released a patch referenced by Drupal SA-CONTRIB-2026-183, EPSS is 0.18% (7th percentile), and no public exploit has been identified at time of analysis. Consistent with the CVSS 3.8 score and monitor priority, real-world risk is low and exploitation requires existing high-privilege access.
Cross-site request forgery in the Drupal Tawk.to Live Chat module (versions 0.0.0 through 3.0.4) lets an unauthenticated remote attacker induce a logged-in, privileged Drupal user to submit unintended requests, with limited confidentiality and integrity impact. The attacker needs no account of their own, but exploitation requires an active victim session and user interaction (UI:R). EPSS is 0.10%, no public exploit was identified at the time of analysis, and a vendor patch is available via Drupal SA-CONTRIB-2026-184.
Privilege escalation in the Drupal contributed module Editoria11y Accessibility Checker lets an account that already holds the module-granted permission perform actions beyond what that permission should allow, affecting integrity only. Sites running any release from 0.0.0 through 2.2.23 or from 3.0.0 through 3.0.9 with the module installed and enabled are exposed, but the CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) confirms the attacker must first hold an authenticated account carrying that specific permission. Exploitation is not confirmed as active - the issue is not in CISA KEV, no public exploit code is identified at time of analysis, and EPSS is only 0.13% (3rd percentile), which matches the this_month, medium-severity, low-priority rating rather than an emergency.
Template injection (CWE-1336) in the Drupal AI CKEditor module affects versions 0.0.0 through 1.4.3, allowing an authenticated Drupal user who can use the module's features to inject unneutralized template syntax that is later evaluated by a template engine, producing limited code injection. Successful exploitation requires the victim to interact with crafted content (CVSS PR:L/UI:R), and impact is confined to low confidentiality and integrity effects within the unchanged component scope. No public exploit code or active exploitation has been reported, and availability of an updated release (1.4.3) keeps priority at monitor level.
Excessive resource allocation in the Drupal contributed Combined image style module, affecting versions 0.0.0 through 1.0.7, can let remote unauthenticated requests that depend on user interaction drive resource consumption and degrade availability (CVSS 4.3, CWE-770). Only Drupal sites with this non-core module installed and enabled are exposed, and confidentiality and integrity are unaffected. This is a low-to-moderate priority issue rather than an emergency, and no public exploit was identified at time of analysis.
Missing authorization in the Drupal CSS Usage Analyzer module (versions 1.0.0 through 1.0.2) allows unauthenticated remote attackers to perform forceful browsing against an internet-reachable Drupal site where the module is installed and enabled. The issue is CWE-862 with low confidentiality and integrity impact and no availability impact, rated CVSS 5.4 (moderate); the exact resource or path involved is not described in the available sources. Vendor patching is available per Drupal SA-2026-189, and no public exploit was identified at time of analysis.
Missing authorization in the Drupal Smart Content contrib module (affected range 0.0.0 through the 3.2.1 boundary) lets an unauthenticated remote attacker perform forceful browsing to reach a restricted resource, with low confidentiality and integrity impact and no availability effect. The flaw is CWE-862, and the specific endpoint, feature, or route involved is not described in the available sources. No public exploit identified at time of analysis and there is no CISA KEV entry; the vendor has released a patch and the priority signal is this_month (moderate, not urgent).
Stored cross-site scripting in the Drupal contributed module Diba carousel slider (versions 0.0.0 through 3.0.2) allows an authenticated user who can create or edit content rendered by the module to persist a script payload that executes in the browser of another user who views the affected page. Per the CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N), the attacker must already hold content-authoring privileges and a separate victim must interact with the page, and the resulting impact is limited to the victim's browser session with no availability effect. No public exploit code or active exploitation has been identified at time of analysis, and the vendor has released a fix; the priority signal places remediation in the current monthly maintenance cycle rather than an emergency response.
The Drupal contributed module 'Disable Login Page' fails to fully suppress access to Drupal's login interface, allowing its security control to be bypassed via an alternate path or channel (CWE-288). Affected versions span 0.0.0 through 1.1.4 (exclusive), targeting Drupal sites that rely on this module to hide their login page - typically to enforce SSO or obscure attack surface. The vendor-assessed CVSS vector (PR:H, S:C, C:L) indicates scope change into Drupal core's login component, with low confidentiality exposure and no patch-related active exploitation identified; EPSS at 0.19% (9th percentile) reflects negligible current threat activity.
Stored cross-site scripting in the Drupal Entity Browser contributed module (versions prior to 2.16.0) allows a high-privileged authenticated attacker to inject persistent malicious script payloads that execute in victims' browsers when affected pages are loaded. The scope change (S:C in the CVSS vector) confirms the injected script crosses into the victim's browser context, enabling session hijacking or credential theft against users who view affected content. No public exploit code or active exploitation has been identified; the vendor (Drupal Security Team) has released a patched version and published advisory SA-CONTRIB-2026-094.
Incorrect Authorization (CWE-863) in the Drupal Diff contributed module allows unauthenticated remote users to perform Forceful Browsing against revision comparison endpoints that should be access-controlled, resulting in limited confidentiality exposure of content diff data. Affected versions span Diff 0.0.0-<2.0.1 and 2.1.0-<2.1.1; a vendor-released patch is available via Drupal Security Advisory SA-Contrib-2026-096. No public exploit code or CISA KEV listing has been identified at time of analysis.
Server-Side Request Forgery in Drupal's Entity Share Websub contributed module (versions 0.0.0 through < 1.1.2) allows unauthenticated remote attackers to induce the Drupal server to issue outbound HTTP requests to attacker-controlled targets, including internal network resources and cloud metadata endpoints. The vulnerability is rated CVSS 5.3 Medium with limited confidentiality impact and no integrity or availability impact. No active exploitation or public proof-of-concept has been identified; a vendor patch is available via Drupal Security Advisory SA-CONTRIB-2026-097.
Privilege escalation in Drupal's External Authentication contributed module (versions 0.0.0 through <2.0.13) allows low-privileged network users to gain elevated Drupal permissions by exploiting improper case-sensitivity handling during identity resolution. The module fails to normalize case in username or identity attribute comparisons against existing Drupal accounts, meaning an attacker can present a case-variant identity (e.g., 'Admin' for a privileged 'admin' account) and be mapped to a higher-privileged user. A vendor-released patch is available at version 2.0.13 per Drupal security advisory SA-CONTRIB-2026-098, and no public exploit code has been identified at time of analysis.
Incorrect authorization in the Drupal Quick Tabs contributed module (all versions prior to 4.3.1) permits unauthenticated remote users to perform forceful browsing against tab-rendered content that should be access-restricted. The CVSS 5.3 Medium score reflects a confidentiality-only impact - no integrity or availability compromise is possible - and actual risk scales with whether the affected site uses Quick Tabs to surface access-controlled content such as private nodes or role-restricted views. No public exploit has been identified at time of analysis; a patched release (4.3.1) is available via Drupal's security advisory SA-CONTRIB-2026-099.
Buffer overflow (CWE-119) in the Drupal Gammu SMS Daemon contributed module exposes high-privilege authenticated administrators to memory corruption that yields both confidentiality and integrity compromise. The vulnerability affects all released versions of the module (*.* wildcard CPE), with no patched release confirmed in the provided data. No public exploit code or CISA KEV listing has been identified at time of analysis, and the high attack complexity combined with the requirement for elevated Drupal privileges substantially limits opportunistic exploitation.
Buffer overflow in the Drupal Gammu SMS Daemon contributed module exposes sites to memory corruption with high confidentiality and integrity impact. The vulnerability (CWE-119) requires network-reachable access by a highly privileged user under specific conditions, limiting its practical reach but making it serious when those conditions are met. No public exploit code has been identified at time of analysis, and the Drupal security team has issued advisory SA-contrib-2026-100.
Buffer overflow (CWE-119) in the Drupal Gammu SMS Daemon contributed module allows a highly privileged, authenticated attacker to achieve high confidentiality and integrity impact against affected Drupal installations. The CVSS vector (PR:H, AC:H) constrains real-world exploitability significantly, requiring both administrative access and complex attack conditions. No active exploitation has been identified; all tracked versions of the module are reported as affected with no specific patched release confirmed in available data.
Improper input validation (CWE-20) in the Drupal Link Content Parser contributed module exposes sites to both confidentiality and integrity compromise under high-complexity, high-privilege conditions. All published versions of the module are affected per CPE cpe:2.3:a:drupal:link_content_parser:*:*:*:*:*:*:*:*, with Drupal's security team confirming the issue via advisory SA-contrib-2026-101. No public exploit has been identified at time of analysis, and the CVSS score of 5.9 reflects strong mitigating factors - specifically the requirement for administrator-level authentication and high attack complexity.
Cross-site scripting in the Drupal Address Suggestion contributed module allows an authenticated administrator to inject persistent malicious JavaScript into pages served to other users. Affected versions span all releases from 0.0.0 through 1.0.24; version 1.0.25 resolves the issue per Drupal security advisory SA-CONTRIB-2026-103. No public exploit code or CISA KEV listing has been identified at time of analysis, and the high-privilege requirement substantially limits the realistic attacker pool.
Incorrect authorization enforcement in Drupal's Blazy lazy-loading module (all versions before 3.0.18) enables unauthenticated remote users to perform forceful browsing - directly requesting URLs of media assets that Drupal's access controls are intended to restrict. The module fails to apply proper authorization checks when serving lazily-loaded resources, exposing low-level confidentiality impact (C:L) with no integrity or availability consequence. No active exploitation has been confirmed and no public proof-of-concept has been identified; a vendor patch is available at version 3.0.18 per advisory SA-CONTRIB-2026-104.
Authentication bypass in the Drupal CAPTCHA Protected Page contributed module (versions before 1.0.2) allows unauthenticated network attackers to access pages that should be gated behind a CAPTCHA challenge by using an alternate access path or channel that circumvents the protection logic. The confidentiality impact is limited - only the content of the CAPTCHA-protected pages is exposed, and the CVSS high-complexity rating indicates the bypass requires specific conditions to execute. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog. A vendor patch is available at version 1.0.2.
Drupal's Commerce CyberSource payment integration module (all versions prior to 1.10.0) contains a timing side-channel vulnerability (CWE-208) that enables brute-force attacks against authentication or token-validation operations. Remote unauthenticated attackers can exploit measurable differences in response timing to iteratively confirm the validity of credentials or secrets, achieving limited integrity impact. Vendor-released patch version 1.10.0 is available via the Drupal security advisory sa-contrib-2026-106; no public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation in Drupal's Content Moderation Notifications module (all versions before 3.9.0) stems from unsafe privilege definitions (CWE-267) embedded in the module's moderation workflow handling. An already-highly-privileged Drupal user can exploit improperly scoped permissions granted by the module to perform actions or access content beyond their intended role boundary within Drupal's RBAC model. No active exploitation (CISA KEV) or public proof-of-concept has been identified; a vendor patch at version 3.9.0 is available per Drupal security advisory SA-CONTRIB-2026-107.
Forceful browsing via missing authorization in the Drupal Data field contributed module (versions up to 2.0.13) exposes field data to unauthenticated network access. The module fails to enforce access control checks before serving field content, allowing an attacker to directly request protected data resources by crafting or guessing their URLs. A vendor patch is available; no public exploit or active exploitation has been identified at time of analysis.