Drupal
Monthly
Unauthenticated forceful browsing in Drupal's Digital Signage Framework (versions 0.0.0 through 2.6.0) exposes restricted module endpoints without any authorization check, allowing remote attackers to read content or configuration data that Drupal's permission system was intended to protect. The root cause is CWE-862 (Missing Authorization) - affected URL routes are served without verifying the requester's Drupal role or permission grants. Drupal issued SA-contrib-2026-109 and released version 2.6.1 as the fix; no active exploitation or public proof-of-concept code has been identified at time of analysis.
Unauthenticated information disclosure in DXPR Builder, a Drupal page-building and AI editing module, exposes sensitive data through forceful browsing against insufficiently protected endpoints. All releases from 0.0.0 through 2.8.0 are affected; version 2.8.1 is the patched release per Drupal security advisory SA-CONTRIB-2026-112. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Incorrect authorization in the Drupal Entity API contributed module (versions prior to 1.8.0) enables forceful browsing, allowing unauthenticated remote attackers to access restricted entity resources by directly requesting entity URLs that bypass access control checks. All Drupal installations running Entity API 0.0.0 through 1.7.x are affected; a patched release (1.8.0) has been issued by Drupal security. No public exploit code or active exploitation has been identified at time of analysis.
Missing authorization checks in the Drupal Entity PDF contributed module (versions through 2.1.4) expose a Forceful Browsing path that allows any authenticated site user to retrieve PDF renderings of Drupal entities beyond their access rights. The flaw, rooted in CWE-862, means the module generates and serves PDFs without verifying whether the requesting account has view permission on the underlying entity - effectively making every entity accessible to any logged-in user. A vendor patch is available via Drupal security advisory SA-Contrib-2026-114, and no public exploit or active exploitation has been identified at time of analysis.
LDAP injection in the Drupal LDAP / Active Directory Integration module (versions below 2.2.1) allows unauthenticated remote attackers to manipulate LDAP query structure by submitting unsanitized input containing LDAP special characters. The primary confirmed impact is partial confidentiality loss — directory enumeration or partial authentication bypass — with no integrity or availability impact per the CVSS vector. No public exploit code or CISA KEV listing has been identified at time of analysis, though the unauthenticated network-accessible attack vector makes it straightforward to attempt against exposed instances.
Stored cross-site scripting in the Drupal Monster Menus contrib module (versions 0.0.0 through 9.5.3) allows malicious script payloads to be persistently injected into navigation or menu rendering contexts, executing in the browsers of subsequent authenticated visitors. The CVSS scope-change flag (S:C) confirms the attack crosses session boundaries, enabling session hijacking, credential theft, or further lateral movement within the Drupal application. No public exploit code has been identified at time of analysis, and Drupal's security team has released an advisory (SA-CONTRIB-2026-116) with a patch.
Stored cross-site scripting in the Drupal Slick Carousel contributed module (all releases before 2.1.0) allows injection of persistent malicious scripts into carousel-rendered content. Any authenticated user or visitor who loads a page containing the compromised carousel triggers script execution in their browser, potentially exposing session tokens and enabling unauthorized actions performed under the victim's identity. The Drupal Security Team has released a patch via sa-contrib-2026-117; no public exploit code or confirmed active exploitation has been identified at time of analysis.
Forceful Browsing in Drupal Core across multiple active and end-of-life release branches (10.x through 10.6.13, 11.3.x through 11.3.14, 11.4.x through 11.4.4, and all 11.0.x-11.2.x) allows unauthenticated remote attackers to bypass authorization and directly access protected resources due to missing authorization checks (CWE-862). The CVSS vector (AV:N/AC:H/PR:N/UI:R) indicates network-reachable exploitation but with high complexity and required user interaction, limiting opportunistic mass attacks. No active exploitation is confirmed - EPSS stands at 0.13% (3rd percentile) and CISA SSVC rates exploitation as none and not automatable - but a vendor patch is available via SA-CORE-2026-010.
Cross-site scripting in Drupal Core across all maintained 11.x release branches allows network-accessible unauthenticated attackers to inject malicious scripts into rendered web pages, with impact occurring in victims' browser contexts upon user interaction. High attack complexity (AC:H) constrains opportunistic exploitation, and all signals - EPSS at 0.15% (4th percentile), SSVC exploitation status of none, no KEV listing, and no public exploit code - converge on a low-urgency posture. Vendor patches are available for the 11.3.x and 11.4.x branches via Drupal SA-CORE-2026-011, while Drupal 11.2.x and earlier receive no fix as an end-of-life branch.
Stored XSS in Drupal Core allows authenticated low-privileged users to inject persistent malicious scripts that execute in the browsers of other site visitors, including administrators. The vulnerability spans multiple Drupal release trains - 10.x through 10.6.x, and all 11.0.*, 11.1.*, and 11.2.* branches - and is addressed in patched releases 10.6.13, 11.3.14, and 11.4.4 per the vendor advisory SA-core-2026-012. No public exploit code has been identified at time of analysis, and CISA SSVC classifies exploitation as none with non-automatable attack paths, placing this at moderate real-world priority despite scope change in the CVSS vector.
Stored XSS in the Drupal Media Folders contributed module (versions 0.0.0 through 1.0.8) allows network-accessible injection of persistent malicious scripts that execute in the browsers of users who subsequently view affected media folder pages. The CVSS scope change (S:C) confirms the payload crosses the application security boundary into the victim's browser session, enabling session hijacking or privilege escalation against authenticated users including administrators. No active exploitation has been confirmed - no CISA KEV listing, no public exploit code, and an EPSS of 0.15% (4th percentile) - and a vendor patch is available via Drupal security advisory SA-contrib-2026-080.
Reflected XSS in the Drupal Search API Autocomplete contributed module (versions 0.0.0 through 1.12.0) allows remote unauthenticated attackers to inject and execute arbitrary JavaScript in the context of victims' browsers when they are socially engineered into clicking a crafted URL. The CVSS scope change (S:C) confirms the injected script executes outside the application's security zone - in the victim's browser - enabling session token theft or authenticated action hijacking. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor patch is available via Drupal Security Advisory SA-CONTRIB-2026-082.
Missing authentication on a critical function in the Drupal PanKM contributed module allows a network-accessible, high-privilege attacker-given required user interaction-to bypass module authorization controls and achieve high confidentiality and integrity impact against all currently released versions. All known PanKM releases are affected (CPE wildcard cpe:2.3:a:drupal:pankm:*:*:*:*:*:*:*:*), with the Drupal security team (sa-contrib-2026-083) confirming the issue. No public exploit code has been identified at time of analysis, and SSVC confirms exploitation status as none.
Improper input validation in the Drupal contributed module Email Login OTP (all released versions) exposes sites to high confidentiality and integrity impacts under specific conditions involving high-privilege access and user interaction. The vulnerability, tracked under CWE-20, could allow a privileged actor to manipulate OTP-related input handling in ways that compromise authentication integrity or expose sensitive login-flow data. No active exploitation has been confirmed (EPSS 0.14%, 4th percentile; SSVC exploitation status: none), and the Drupal security team has published advisory SA-CONTRIB-2026-085 addressing the issue.
Improper input validation in the Drupal Lunr Exposed Filters contributed module (all versions) can yield high confidentiality and integrity impact under a restrictive set of preconditions. The CVSS vector (AV:N/AC:H/PR:H/UI:R) constrains exploitation to attackers already holding high-privilege Drupal access who can also induce user interaction, making opportunistic or mass exploitation implausible. No public exploit code exists and EPSS sits at 0.14% (4th percentile), consistent with no observed exploitation pressure at time of analysis.
Improper input validation in the Drupal Development Environment contributed module (all versions, CPE cpe:2.3:a:drupal:development_environment) allows a highly privileged, authenticated network attacker - with user interaction - to compromise both confidentiality and integrity of the affected system. The CVSS vector (AV:N/AC:H/PR:H/UI:R) constrains real-world impact significantly: exploitation requires administrative credentials, a complex attack scenario, and victim interaction. EPSS stands at 0.14% (4th percentile), no public exploit code has been identified, and no CISA KEV listing exists at time of analysis.
Improper input validation in the Drupal 'Disable Login Page' contrib module (all versions) enables a network-delivered attack that can achieve high confidentiality and integrity compromise within a Drupal site. Exploitation is substantially constrained by the requirement for high-privilege (administrator-level) access, high attack complexity, and mandatory user interaction - making this a meaningful internal-threat or privilege-abuse scenario rather than an opportunistic remote attack. No public exploit code has been identified and no CISA KEV listing exists; the EPSS score of 0.14% (4th percentile) confirms negligible observed exploitation activity at time of analysis.
Improper input validation in the Powerful Surveys contributed module for Drupal exposes all published versions to confidentiality and integrity compromise under a constrained set of conditions requiring high privileges and user interaction. The flaw, classified under CWE-20, allows a high-privileged authenticated attacker - under high-complexity conditions with mandatory user interaction - to bypass input validation controls and potentially disclose or manipulate survey data. No public exploit exists and EPSS stands at 0.14% (4th percentile), indicating negligible observed exploitation pressure despite the High C and I impact ratings.
Improper input validation in the Drupal Composer contributed module (SA-contrib-2026-046) exposes sites to confidentiality and integrity compromise when exploited by a highly privileged attacker over the network under specific conditions. The vulnerability, classified as CWE-20, affects all tracked versions of the module and carries a CVSS 3.1 score of 5.9 (Medium), with both high confidentiality and high integrity impact despite no availability impact. No public exploit code exists and no active exploitation has been identified; EPSS stands at 0.15% (5th percentile), and CISA has not added this to KEV.
Improper restriction of excessive authentication attempts (CWE-307) in the Drupal contributed module 'Brute force attack protection' allows a network-based attacker with high privileges to bypass the module's core protective controls, resulting in high confidentiality and integrity impact. All released versions of the module (*.*) are affected, as confirmed by Drupal security advisory SA-contrib-2026-047. No public exploit code has been identified and EPSS places this at the 5th percentile, indicating minimal observed exploitation activity at time of analysis.
Authentication bypass in the Drupal Clean RESTful contributed module (cpe:2.3:a:drupal:clean_restful:*:*:*:*:*:*:*:*) enables network-reachable attackers with high existing privileges to circumvent authentication controls exposed via the module's REST API endpoints, resulting in high confidentiality and integrity impact against the Drupal application. All versioned releases of the module are affected per the wildcard CPE. No public exploit code has been identified at time of analysis, and CISA has not added this vulnerability to the Known Exploited Vulnerabilities catalog, though SSVC rates the technical impact as total.
High-privilege network exploitation of the Drupal Raw Formatter [Meta Tag Formatter] contributed module leads to high confidentiality and integrity impact across all released versions. The vulnerability requires an authenticated user with elevated Drupal permissions and high attack complexity (PR:H, AC:H per CVSS), significantly narrowing the realistic attack surface despite the notable C:H/I:H impact rating. No public exploit has been identified at time of analysis, EPSS sits at 0.24% (15th percentile), and SSVC confirms exploitation status as none - consistent with a narrow, privilege-dependent flaw in a niche contrib module rather than a broadly weaponizable issue.
Cross-site scripting (XSS) in Drupal Core affects a broad swath of the 10.x and 11.x release lines, enabling an authenticated low-privileged attacker to inject malicious client-side script that executes in the browser of a victim who interacts with the crafted content. The CVSS scope-change indicator (S:C) confirms the impact escapes the originating component into the victim's browser context, enabling session hijacking or privilege escalation against higher-privileged users. No public exploit code has been identified and EPSS sits at 0.15% (5th percentile), indicating low automated exploitation probability at time of analysis, though the wide deployment footprint of Drupal still makes patching urgent.
Server-Side Request Forgery in Drupal Core allows authenticated low-privilege users to coerce the application server into issuing unauthorized HTTP requests to internal or restricted network destinations. All active 10.6.x and 11.x release branches are affected, along with end-of-life 11.0.x and 11.1.x branches, covering a broad swath of production Drupal deployments. No public exploit code has been identified and EPSS sits at the 3rd percentile, but the large Drupal deployment footprint elevates aggregate exposure even at low per-instance exploitation probability.
Open redirect in Drupal Core across multiple major release branches enables phishing and content spoofing attacks by forwarding victims from a trusted Drupal domain to an attacker-controlled site via crafted URLs. The exposure spans the 10.x and 11.x release trains, creating a broad attack surface across the Drupal install base. EPSS probability sits at 0.13% (3rd percentile) and the vulnerability is absent from CISA KEV, indicating low observed exploitation to date despite the wide version coverage.
Object injection in Drupal Core through improperly controlled modification of dynamically-determined object attributes (CWE-915) exposes sites to high-severity confidentiality and integrity compromise when triggered by an authenticated user with high privileges. Affected branches include the entire 10.x line before 10.5.12 and 10.6.11, the fully unsupported 11.0.x and 11.1.x trees, and the 11.2.x and 11.3.x lines before 11.2.14 and 11.3.12 respectively. No active exploitation is confirmed (not in CISA KEV) and EPSS sits at just 0.16% (6th percentile), making this a patch-priority rather than emergency-response scenario.
Object injection via a mass assignment flaw in Drupal Core enables an authenticated administrator to manipulate dynamically-determined PHP object attributes, potentially compromising confidentiality and data integrity of the application. Affected versions span multiple active and end-of-life branches: 10.5.x through 10.5.12, 10.6.0 through 10.6.11, 11.2.0 through 11.2.14, 11.3.0 through 11.3.12, and the entirely unsupported 11.0.x and 11.1.x branches. No public exploit code is identified at time of analysis, and EPSS at 0.16% (6th percentile) signals very low observed exploitation activity despite the C:H/I:H impact potential.
Stored Cross-Site Scripting in the Drupal AI SEO/GEO Analyzer contrib module (versions 0.0.0 through pre-1.1.3) enables authenticated low-privilege users to persist malicious JavaScript payloads that execute in the browser context of other users - including administrators - who subsequently view the affected content. The scope change (S:C in the CVSS vector) confirms cross-context execution, enabling session hijacking, credential theft, or unauthorized DOM manipulation against victim users. EPSS probability stands at 0.25% (17th percentile) and no active exploitation has been reported in CISA KEV, indicating limited real-world threat at this time. A vendor-released patch is available via the Drupal security advisory SA-contrib-2026-076.
Stored XSS in the Drupal UI Patterns (SDC in Drupal UI) contributed module allows a low-privileged authenticated attacker to inject persistent malicious scripts into web pages, which execute in the browsers of other users - including administrators - who view the affected content. Versions 2.0.0 through 2.0.17 of the module are affected, with a patch available from the Drupal security team. No public exploit identified at time of analysis, and the EPSS score of 0.25% (17th percentile) signals minimal observed exploitation pressure, though the stored nature of the XSS and potential to target privileged users elevates practical risk for sites using this module.
Object injection in the Drupal ECA (Event - Condition - Action) contributed module exposes sites running affected versions to limited confidentiality and integrity compromise by authenticated low-privileged users. The vulnerability stems from improperly controlled modification of dynamically-determined object attributes (CWE-915, a mass-assignment class of flaw), allowing a crafted request to inject object properties and influence internal application logic within ECA's event-driven workflow engine. No confirmed active exploitation exists, and EPSS at 0.20% (10th percentile) reflects low observed threat pressure across the landscape, though a vendor patch has been issued per the Drupal security advisory.
Cross-site scripting in Drupal's Siteimprove Analytics contributed module (all versions before 2.0.1) allows an authenticated low-privileged attacker to inject malicious scripts that execute in a victim user's browser session. The CVSS scope change (S:C) indicates the attack crosses the application trust boundary, enabling potential session hijacking or privilege escalation against higher-privileged users such as administrators who view attacker-controlled content. No public exploit code exists and EPSS of 0.19% (8th percentile) confirms low real-world exploitation probability; no active exploitation has been identified at time of analysis.
Cross-Site Request Forgery in the Drupal Ray Enterprise Translation contrib module lets a remote attacker forge state-changing requests that are executed with the privileges of an authenticated victim (typically a site administrator), potentially altering translation configuration and integrations. It affects module versions below 4.0.4, below 4.1.4, and below 11.0.4, and carries a vendor CVSS of 8.8. No public exploit has been identified at time of analysis and the EPSS score is very low (0.12%, 2nd percentile), indicating no observed exploitation activity.
Brute-force credential attacks against Drupal sites running the Login Disable contrib module (versions 0.0.0 through 2.1.4) are enabled by the module's failure to restrict excessive authentication attempts (CWE-307). The module, intended to provide administrators with login-gating controls, paradoxically omits rate-limiting enforcement, allowing a low-privileged attacker to enumerate or compromise user credentials via automated requests. EPSS is low (0.21%, 12th percentile) and no active exploitation is confirmed in CISA KEV, but the network-accessible attack vector and low complexity keep this relevant for sites where the module is deployed.
Cross-site scripting in the Drupal Colorbox module allows an authenticated low-privileged attacker to inject malicious scripts that execute in the browser context of other users. The CVSS scope-change indicator (S:C) confirms this is likely stored XSS, where crafted input persists and executes when victims visit affected pages. No active exploitation is confirmed - EPSS sits at 0.20% (10th percentile) and the vulnerability is not listed in the CISA KEV catalog - but a vendor patch is available via Drupal security advisory SA-CONTRIB-2026-069.
Missing Authorization (CWE-862) in the Drupal FlowDrop contributed module allows authenticated low-privilege users to perform Forceful Browsing - directly accessing protected URLs without proper permission checks being enforced. All FlowDrop releases from 0.0.0 up to 1.6.0 are affected; a successful attacker can read or modify content and workflow data beyond their authorized scope. No public exploit has been identified and EPSS sits at 0.18% (8th percentile), indicating negligible observed exploitation probability at time of analysis; the vulnerability is not listed in CISA KEV.
Missing authorization in the FlowDrop Drupal contributed module (versions prior to 1.6.0) enables authenticated low-privilege users to perform forceful browsing, accessing URLs and resources that should be restricted to higher-privilege roles. The vulnerability stems from CWE-862, where authorization checks are absent or bypassed on protected endpoints within the module. No public exploit code or CISA KEV listing exists at time of analysis; the EPSS score of 0.18% (8th percentile) reflects low observed exploitation probability, but the low attack complexity and network accessibility make it a meaningful risk on multi-tenant or public Drupal sites with the module installed.
Cross-site scripting in the Drupal Canvas contributed module enables remote attackers to inject and execute malicious scripts in the browsers of Drupal site visitors. Affecting multiple version branches - 0.0.0 through 1.4.2, 1.5.0 through 1.5.2, 1.6.0 through 1.6.1, and 1.7.0 through 1.7.1 - the flaw (CWE-79) stems from insufficient sanitization of user-supplied input before rendering it in generated web pages. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog; the EPSS score of 0.20% (10th percentile) reflects minimal current exploitation activity.
Cross-site scripting in the Drupal Canvas contributed module allows unauthenticated remote attackers to inject and execute malicious scripts in victims' browsers across multiple version branches (0.0.0-1.4.2, 1.5.0-1.5.2, 1.6.0-1.6.1, 1.7.0-1.7.1). The scope-changed CVSS vector (S:C) confirms the attack escapes the server context and executes within the victim's browser environment, enabling session theft, credential harvesting, or unauthorized actions on behalf of the victim. No public exploit or CISA KEV listing has been identified, and EPSS at 0.20% (10th percentile) reflects minimal observed exploitation activity at time of analysis.
Cross-Site Request Forgery in the Drupal Salesforce Suite contrib module (all versions from 0.0.0 up to and including 5.1.3) lets an attacker forge state-changing requests that are executed with the privileges of an authenticated Drupal user who is tricked into loading attacker-controlled content. The Drupal security team (SA-CONTRIB-2026-063) rates it critical, and a fixed release is available; no public exploit code has been identified and EPSS is very low (0.10%, 1st percentile), indicating no observed exploitation activity. Note that the published CVSS vector (UI:N) is atypical for CSRF, which normally depends on victim interaction, so the real-world impact profile should be verified against the vendor advisory.
SQL injection in the Drupal Geolocation Field contributed module exposes sites to unauthenticated database read and partial write access across all module versions prior to 3.15.0. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms the attack requires no authentication and no user interaction, making it remotely triggerable against any publicly reachable Drupal installation running the affected module. Impact is bounded by C:L/I:L/A:N - partial data disclosure and modification without availability disruption or full database takeover. No active exploitation has been confirmed (no CISA KEV listing), and EPSS sits at a low 0.16% (5th percentile), indicating minimal current attacker interest. A vendor patch is available.
Missing authorization in the Drupal Paragraphs contributed module (all versions through 1.20.x) enables unauthenticated remote attackers to perform forceful browsing - directly accessing paragraph entity URLs or endpoints without passing any authorization check. The CVSS vector (PR:N/AC:L/AV:N) confirms exploitation requires no credentials against default-configured Drupal sites running the affected module. Despite an automatable attack surface, SSVC rates exploitation as none, EPSS sits at 0.13% (3rd percentile), and no active exploitation is confirmed; a vendor patch is available via Drupal SA-contrib-2026-061.
Forceful Browsing via missing authorization (CWE-862) in the Drupal Paragraphs contributed module allows remote unauthenticated users to access paragraph entities they are not authorized to view or modify, bypassing the CMS access control layer entirely. All Paragraphs releases from 0.0.0 up to but not including 1.21.0 are affected, per vendor advisory SA-CONTRIB-2026-060. Despite being automatable per SSVC analysis and network-exploitable with no privileges required, real-world exploitation risk is low: EPSS sits at 0.13% (3rd percentile), no public exploit code has been identified, and CISA has not added this to KEV.
Missing authorization controls in Drupal WissKI versions prior to 4.2.0 enable unauthenticated remote attackers to perform forceful browsing - directly accessing restricted resources by guessing or enumerating URLs without undergoing proper authorization checks. The affected versions span the entire release history from 0.0.0 through 4.2.0, making all prior deployments vulnerable. SSVC assessment confirms no active exploitation at time of analysis, and the EPSS score of 0.13% (3rd percentile) suggests very low real-world exploitation probability despite the automatable nature of the attack.
Incorrect Authorization (CWE-863) in the Drupal Commerce Realex / Global Payments module exposes protected payment and order resources to forceful browsing, allowing unauthenticated remote attackers to access endpoints that should require authorization. All module versions from 0.0.0 through 3.0.2 (exclusive) are affected on Drupal Commerce deployments. No public exploit code has been identified and SSVC confirms no active exploitation at time of analysis, though the nature of a payment gateway module means successful access could expose order or transaction data.
Incorrect Authorization (CWE-863) in the Drupal AI Agents contributed module enables Forceful Browsing, allowing network-reachable attackers to access restricted AI agent resources without proper permission checks. Three distinct release branches are affected: 0.0.0-1.1.4, 1.2.0-1.2.5, and 1.3.0-1.3.1. CISA SSVC classifies exploitation as none with partial technical impact, EPSS sits at the 4th percentile, and no public exploit has been identified at time of analysis - signals that collectively indicate limited immediate real-world risk despite the network-accessible attack vector.
Missing authorization controls in the Drupal AI Agents contrib module expose protected resources to forceful browsing by authenticated low-privilege users. Affected installations span three version branches - 0.0.0 through 1.1.3, 1.2.0 through 1.2.4, and 1.3.0 - across the Drupal ecosystem. No public exploit has been identified and CISA has not added this to KEV; EPSS at 0.14% (4th percentile) and SSVC's 'none' exploitation status confirm minimal real-world threat at time of analysis.
Forceful browsing exposure in Drupal's AI (Artificial Intelligence) contributed module permits high-privileged authenticated users to access protected resources without proper authorization checks, affecting versions 0.0.0-1.2.17, 1.3.0-1.3.8, and 1.4.0-1.4.3. The vulnerability stems from CWE-862 (Missing Authorization), where path-level access controls are not enforced on certain AI module endpoints, allowing an authenticated user with high privileges to traverse to unauthorized resources. No public exploit code exists, EPSS sits at 0.14% (4th percentile), and CISA SSVC confirms no active exploitation, placing this firmly in the low-urgency tier despite its network-accessible attack vector.
Cross-site scripting in the Drupal AI (Artificial Intelligence) contributed module exposes sites to session hijacking and malicious content injection when users interact with unsanitized AI-generated or AI-related output rendered in the browser. The module fails to properly neutralize user-controlled or AI-sourced input before including it in generated web pages, allowing an unauthenticated remote attacker to craft a payload that executes in a victim's browser upon interaction. No active exploitation is confirmed (not in CISA KEV) and EPSS is very low at 0.16% (6th percentile), though the network-accessible, no-privilege attack surface warrants prompt patching on internet-facing Drupal deployments.
Server-Side Request Forgery in the Drupal OpenAI Provider module enables authenticated administrators to force the server to issue HTTP requests to attacker-controlled destinations, potentially reaching internal network resources beyond the intended API boundary. Affected versions span 0.0.0 through 1.1.1 and 1.2.0 through 1.2.2; a vendor patch is available via Drupal security advisory SA-CONTRIB-2026-053. No public exploit code exists, EPSS sits at 0.14% (4th percentile), and SSVC confirms exploitation status as none - all signals converge on a low operational priority despite the network-accessible attack vector.
Incorrect authorization in the Drupal Advanced Content Feedback (admin_feedback) contributed module allows authenticated low-privilege users to perform forceful browsing, accessing restricted feedback resources without proper authorization checks. All module releases from 0.0.0 up to (but not including) 2.8.0 are affected. No public exploit code exists and no active exploitation has been identified; EPSS sits at the 4th percentile, consistent with the SSVC assessment of zero current exploitation.
Stored XSS in the Drupal contributed module Advanced Content Feedback (admin_feedback) affects all releases from 0.0.0 up to 2.8.0, enabling a remote unauthenticated attacker to inject persistent malicious scripts that execute in the browsers of users who subsequently view affected pages. The scope change (S:C) in the CVSS vector indicates the injected payload escapes the application's security context and operates in the victim's browser, potentially enabling session hijacking or unauthorized actions on behalf of privileged users. No public exploit code has been identified and CISA has not added this to KEV; EPSS at 0.16% (6th percentile) and SSVC's 'exploitation: none' classification confirm this is a low-urgency finding with no evidence of active targeting.
Missing Authorization in Drupal's Examples for Developers module (versions 0.0.0 through 4.0.5) permits forceful browsing by an already highly-privileged authenticated attacker, exposing restricted paths with limited confidentiality and integrity impact. All available signals converge on minimal real-world risk: CVSS scores 3.3 (Low), EPSS sits at 0.14% (4th percentile), SSVC reports no known exploitation and non-automatable attack conditions, and neither active exploitation nor public proof-of-concept code has been identified. A vendor patch is available at version 4.0.6.
Stored cross-site scripting in the Drupal Tagify contributed module allows low-privileged authenticated users to inject persistent malicious scripts that execute in the browsers of subsequent page visitors, including administrators. All Tagify module versions prior to 1.2.52 are affected. No public exploit code has been identified and EPSS sits at the 6th percentile, but the stored nature of the XSS elevates impact relative to reflected variants since payloads persist across all future viewers of the poisoned content.
Reflected XSS in the Anti-Spam by CleanTalk Drupal contributed module (versions 0.0.0 through 9.7.1) allows remote unauthenticated attackers to inject and execute malicious JavaScript in a victim's browser by tricking them into visiting a crafted URL. The CVSS Changed scope (S:C) confirms the payload executes in the browser's security context, enabling session theft, credential harvesting, or UI redirection against authenticated Drupal users. No public exploit code and no active exploitation have been identified; EPSS at 0.16% (6th percentile) indicates negligible observed exploitation probability at time of analysis.
Stored cross-site scripting in Drupal Commerce Core 3.3.0 through 3.3.5 allows an authenticated low-privilege attacker to inject persistent malicious scripts that execute in other users' browsers when affected pages are viewed. The scope change (S:C in the CVSS vector) confirms the payload breaks out of the application's security context into the victim's browser environment, enabling session hijacking or unauthorized UI manipulation. No active exploitation or public exploit code has been identified; EPSS of 0.16% (6th percentile) reflects low real-world exploitation probability at time of analysis.
Cross-site scripting in the Drupal Colorbox Inline contributed module (versions 0.0.0 through before 2.1.1) allows an authenticated low-privileged attacker to inject malicious script into web page output, which executes in a victim's browser when they interact with the affected content. The changed-scope CVSS vector (S:C) confirms the classic XSS pattern where attacker-controlled content runs in a different security context than the origin. No public exploit code exists and no active exploitation has been identified; EPSS at 0.03% (8th percentile) confirms this is not a currently targeted vulnerability.
Resource Location Spoofing in the Drupal 'Translate Drupal with GTranslate' module (versions 0.0.0 through before 3.0.5) allows a high-privileged authenticated attacker to modify data the module treats as immutable, enabling redirection of translation resource locations. Exploitation requires network access but demands administrator-level privileges, yielding only low integrity impact with no confidentiality or availability consequences. No public exploit code exists and EPSS sits at 0.02% (5th percentile), indicating negligible exploitation interest at this time.
Forceful browsing in the Drupal Node View Permissions module exposes restricted node content to unauthenticated network attackers under high-complexity conditions. Affected are all installations running versions 0.0.0-1.7.0 (branch 1.x) and 2.0.0-2.0.1 (branch 2.x) of the module. The vulnerability is classified as information disclosure only - no integrity or availability impact - and carries a CVSS 3.7 (Low) score; no public exploit code exists and no confirmed active exploitation has been reported (not in CISA KEV), with EPSS placing exploitation probability at 0.01%.
Cross-site scripting in the Drupal Obfuscate contributed module (versions 0.0.0 through before 2.0.2) allows remote unauthenticated attackers to inject malicious scripts into pages rendered for other users, with impact scoped across security boundaries (S:C). The vulnerability stems from improper neutralization of input during web page generation, enabling session hijacking or UI redress attacks against users who view attacker-controlled content processed by the module. No public exploit has been identified at time of analysis, and EPSS at 0.03% (8th percentile) reflects low current exploitation probability.
Cross-site scripting in Drupal core 11.3.0 through 11.3.6 enables unauthenticated remote attackers to inject malicious scripts into web pages rendered by the application, which execute in victims' browsers upon user interaction. The CVSS Changed scope (S:C) indicator confirms the exploit crosses trust boundaries - attacker-controlled input rendered in the victim's browser context can compromise session tokens or trigger unauthorized actions. With EPSS at 0.03% (8th percentile) and no CISA KEV listing, widespread exploitation is not currently observed; a vendor patch is available in 11.3.7.
Object injection in Drupal Core across branches 8.0.0 through 11.3.x allows a network-accessible, highly privileged authenticated user to manipulate dynamically-determined object attributes, with potential full compromise of confidentiality, integrity, and availability. The CVSS vector (AV:N/AC:H/PR:H) confirms this is a network-reachable flaw but imposes steep prerequisites: administrator-level access and high attack complexity. No public exploit code or confirmed active exploitation has been identified at time of analysis.
Cross-site scripting in Drupal Core exposes a broad range of Drupal installations - spanning major versions 8 through 11 - to client-side script injection exploitable by unauthenticated remote attackers who can induce user interaction. The Changed scope (S:C) in the CVSS vector confirms the injected script executes in the context of a victim's browser session, enabling session hijacking, credential theft, or malicious redirects against authenticated users including administrators. No public exploit code has been identified at time of analysis, and the EPSS score of 0.03% (8th percentile) signals low near-term exploitation probability, though the breadth of affected versions across three major release lines increases the aggregate attack surface.
Reflected or stored cross-site scripting in Drupal's Orejime cookie consent module (versions 0.0.0 through 2.0.15) allows unauthenticated remote attackers to inject malicious scripts that execute in a victim's browser upon page load or link interaction. The changed scope (S:C) in the CVSS vector indicates the injected script executes in a security context beyond the originating page - consistent with a consent banner or cookie-preference widget that renders across site sections. No public exploit code has been identified at time of analysis, and EPSS is 0.03% (8th percentile), placing this in the low-exploitation-probability tier despite being network-accessible with no authentication required.
The Drupal 7 Internationalization (i18n) module's i18n_node submodule allows authenticated users holding both 'Translate content' and 'Administer content translations' permissions to bypass access controls and view unpublished node titles and IDs through the translation user interface and autocomplete functionality. Affected versions range from 7.x-1.0 through 7.x-1.35. No public exploit code or active exploitation has been confirmed at the time of analysis.
Drupal File (Field) Paths module 7.x prior to 7.1.3 allows authenticated users to disclose other users' private files through filename-collision uploads that manipulate file URI processing, causing hook_node_insert() consumers such as email attachment modules to access incorrect file URIs and bypass access controls on sensitive files. The vulnerability affects the Drupal File (Field) Paths package as confirmed via CPE cpe:2.3:a:drupal:drupal_file_(field)_paths:*:*:*:*:*:*:*:*. No public exploit code or active exploitation data has been identified at the time of analysis.
Drupal Automated Logout module contains a Cross-Site Request Forgery (CSRF) vulnerability that allows unauthenticated remote attackers to perform unauthorized actions on behalf of authenticated users by crafting malicious requests. The vulnerability affects Automated Logout versions prior to 1.7.0 and versions 2.0.0 through 2.0.1, with patched versions available at 1.7.0 and 2.0.2 respectively. No public exploit code or active exploitation has been identified at the time of analysis.
Improper case sensitivity handling in the Drupal OpenID Connect / OAuth client module versions prior to 1.5.0 allows privilege escalation through authentication bypass mechanisms. Authenticated or remote attackers can exploit case-sensitivity weaknesses in identity claim validation to assume elevated permissions within Drupal systems relying on this module for federated authentication. The vulnerability affects all versions from 0.0.0 through 1.5.0, and vendor-released patch version 1.5.0 is available.
Drupal OpenID Connect / OAuth client versions before 1.5.0 contain an authentication bypass vulnerability that allows attackers to circumvent authentication mechanisms through an alternate path or channel. The vulnerability affects all versions from 0.0.0 through 1.4.x, enabling remote attackers to gain unauthorized access without proper credentials. No CVSS score, EPSS data, or confirmed active exploitation status is currently available; however, the vulnerability's authentication bypass nature and wide version range suggest significant real-world risk to Drupal installations relying on OpenID Connect or OAuth authentication.
The Drupal OpenID Connect / OAuth client module versions prior to 1.5.0 contains a Server-Side Request Forgery (SSRF) vulnerability that allows remote attackers to make arbitrary HTTP requests from the affected server. This vulnerability affects all installations running OpenID Connect / OAuth client versions 0.0.0 through 1.5.0, and attackers can leverage the SSRF to access internal services, retrieve sensitive metadata, or interact with backend systems not directly accessible from the internet. No public exploit code or active exploitation has been confirmed at the time of analysis, though the vulnerability affects a widely-deployed Drupal authentication module.
Drupal Google Analytics GA4 module versions before 1.1.14 contain a cross-site scripting (XSS) vulnerability through improper input neutralization during web page generation, allowing attackers to inject and execute arbitrary JavaScript in user browsers. Remote attackers can craft malicious requests that persist within analytics data or configuration, affecting all users of sites running vulnerable versions. The vulnerability is documented in Drupal's security advisory SA-CONTRIB-2026-024 and has been assigned EUVD-2026-16383; no public exploit code or active exploitation has been confirmed at the time of this analysis.
Cross-site scripting (XSS) in Drupal Calculation Fields module versions prior to 1.0.4 permits remote attackers to inject arbitrary JavaScript into dynamically generated web pages, enabling session hijacking, credential theft, and malware distribution against users viewing affected pages. The vulnerability stems from improper input neutralization during calculation field rendering, affecting all installations running Calculation Fields 0.0.0 through 1.0.3. No public exploit code or active exploitation has been confirmed at time of analysis.
Drupal AJAX Dashboard versions before 3.1.0 fail to enforce authentication on critical AJAX endpoints, allowing unauthenticated remote attackers to bypass access controls and invoke privileged dashboard functions. The vulnerability affects all versions from 0.0.0 through 3.1.0 (exclusive) and is categorized as a Missing Authentication for Critical Function (CWE-306). No public exploit code or active exploitation via CISA KEV has been confirmed at time of analysis, but the authentication bypass nature of this defect presents significant risk to installations relying on dashboard security.
Forceful browsing attacks in Drupal File Access Fix (deprecated) versions below 1.2.0 allow unauthenticated remote attackers to bypass file access controls and retrieve unauthorized files through direct path enumeration. The vulnerability stems from incorrect authorization validation in the deprecated module (cpe:2.3:a:drupal:file_access_fix_(deprecated):*:*:*:*:*:*:*:*), affecting all versions from 0.0.0 through 1.1.x. No public exploit code or active exploitation has been identified at time of analysis, but the deprecated status and widespread use of Drupal installations increase real-world risk exposure.
Forceful browsing via incorrect authorization in Drupal File Access Fix (deprecated) module versions prior to 1.2.0 allows unauthenticated remote attackers to access files without proper access control checks. The vulnerability stems from CWE-863 (Incorrect Authorization) and affects all versions from 0.0.0 through 1.2.0. No public exploit code or active exploitation has been confirmed at the time of analysis, but the straightforward nature of authorization bypass attacks in file access contexts presents moderate real-world risk to installations still running deprecated versions of this module.
The Drupal Responsive Favicons module contains an improper input neutralization vulnerability that allows attackers to inject malicious JavaScript code into web pages (Cross-Site Scripting/XSS). All versions from 0.0.0 up to and including 2.0.1 are affected, with the vulnerability classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). While no CVSS score or EPSS probability metric is currently available, the vulnerability is documented in the official Drupal security advisory (SA-CONTRIB-2026-019) and has been assigned EUVD-2026-15479, indicating this is a confirmed security flaw requiring immediate patching.
A Cross-Site Scripting (XSS) vulnerability exists in the Drupal SAML SSO - Service Provider module due to improper neutralization of user input during web page generation. All versions prior to 3.1.3 are affected, allowing attackers to inject malicious scripts that execute in the browsers of users interacting with SAML authentication flows. The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), and while no CVSS score or EPSS data is currently available, the nature of XSS in authentication modules represents a significant risk to credential theft and session hijacking.
A Server-Side Request Forgery (SSRF) vulnerability exists in Drupal Canvas versions prior to 1.1.1, allowing attackers to manipulate the server into making unauthorized requests to internal or external resources. This vulnerability affects all Drupal Canvas installations from version 0.0.0 through 1.1.0, enabling attackers to access sensitive internal services, bypass network segmentation, or exfiltrate data. No CVSS score, EPSS data, or public proof-of-concept information is currently available, though the vulnerability has been formally documented by the Drupal security team.
A Cross-Site Scripting (XSS) vulnerability exists in Drupal Islandora due to improper neutralization of user input during web page generation. All versions of Islandora from 0.0.0 through 2.17.4 are affected, allowing attackers to inject and execute malicious JavaScript in the context of affected users' browsers. Exploitation enables session hijacking, credential theft, malware distribution, and defacement of the repository interface.
The Drupal CAPTCHA module contains an authentication bypass vulnerability (CWE-288) that allows attackers to circumvent CAPTCHA protection through an alternate path or channel, enabling functionality bypass. This vulnerability affects CAPTCHA versions 0.0.0 through 1.16.x and 2.0.0 through 2.0.9, allowing attackers to bypass CAPTCHA challenges intended to prevent automated abuse. While no CVSS score or EPSS data is currently available, the presence of an official Drupal security advisory and specific patched versions indicates active remediation efforts by the vendor.
A Cross-Site Scripting (XSS) vulnerability exists in the Drupal Anti-Spam by CleanTalk module due to improper neutralization of user input during web page generation. All versions from 0.0.0 through 9.6.x are affected, with a patch available in version 9.7.0 or later. Attackers can inject malicious scripts that execute in the context of authenticated users' browsers, potentially leading to session hijacking, credential theft, or defacement of Drupal sites.
A Cross-Site Scripting (XSS) vulnerability exists in Drupal Tagify module versions prior to 1.2.49, stemming from improper neutralization of user input during web page generation. An attacker can inject malicious scripts that execute in the context of other users' browsers, potentially leading to session hijacking, credential theft, or malware distribution. This vulnerability affects all Tagify installations from version 0.0.0 through 1.2.48, and patch availability has been confirmed through the Drupal security advisory.
A Cross-Site Request Forgery (CSRF) vulnerability exists in the Drupal Theme Negotiation by Rules module, affecting all versions from 0.0.0 before 1.2.1. An attacker can exploit this flaw to perform unauthorized actions on behalf of authenticated users by crafting malicious requests that bypass CSRF protections in the theme negotiation functionality. The vulnerability has been officially documented by the Drupal security team via SA-contrib-2026-012, and users of this contrib module should prioritize patching to version 1.2.1 or later.
An incorrect authorization vulnerability exists in the Drupal Material Icons module that allows attackers to bypass authentication controls and access restricted resources through forceful browsing (CWE-863). The vulnerability affects Material Icons versions 0.0.0 through 2.0.3, enabling unauthenticated or low-privileged users to enumerate and access icon resources that should be restricted. No CVSS score, EPSS data, or known exploits in the wild have been disclosed at this time, but the vulnerability has been formally documented by the Drupal security team with a dedicated security advisory.
A Cross-Site Scripting (XSS) vulnerability exists in the Drupal UI Icons module due to improper neutralization of user input during web page generation. This vulnerability affects UI Icons versions 0.0.0 through 1.0.0 and versions 1.1.0 through 1.1.0, allowing attackers to inject malicious scripts that execute in the context of victim browsers. No CVSS score, EPSS data, or confirmed KEV status is currently available; however, the XSS classification and Drupal reporting indicate this requires prompt patching to versions 1.0.1 or 1.1.1.
A Cross-Site Scripting (XSS) vulnerability exists in Drupal Quick Edit due to improper neutralization of user input during web page generation. This vulnerability affects Quick Edit versions 0.0.0 through 1.0.4 and versions 2.0.0 through 2.0.0, allowing attackers to inject malicious scripts that execute in the context of authenticated users' browsers. The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation) and has been disclosed by the Drupal security team with patches available for affected versions.
The Drupal Login Disable module contains an authentication bypass vulnerability (CWE-288) that allows attackers to circumvent login restrictions through an alternate authentication path or channel. This affects Login Disable versions prior to 2.1.3, enabling attackers to bypass intended functionality that disables user logins. While CVSS and EPSS scores are not available from public sources, the vulnerability has been formally documented by the Drupal security team, indicating a substantive security concern that requires patching.
Central Authentication System Server versions up to 2.0.3 contains a security vulnerability (CVSS 4.2).
Improper authorization controls in Drupal Canvas versions before 1.0.4 enable attackers to bypass access restrictions and enumerate or access restricted resources through direct browsing. The vulnerability requires specific conditions to exploit (high attack complexity) but affects all unauthenticated users with network access. Currently, no patch is publicly available and exploitation activity has not been confirmed.
The Microsoft Entra ID SSO Login module for Drupal before version 1.0.4 contains an authentication bypass vulnerability that allows unauthenticated attackers to escalate privileges through an alternate authentication channel. An attacker can exploit this flaw to gain unauthorized access with elevated permissions on affected Drupal installations. No patch is currently available, and the vulnerability has low exploit probability (EPSS 0.1%).
At Internet Piano Analytics versions up to 1.0.1 is affected by cross-site scripting (xss) (CVSS 4.8).
Unauthenticated forceful browsing in Drupal's Digital Signage Framework (versions 0.0.0 through 2.6.0) exposes restricted module endpoints without any authorization check, allowing remote attackers to read content or configuration data that Drupal's permission system was intended to protect. The root cause is CWE-862 (Missing Authorization) - affected URL routes are served without verifying the requester's Drupal role or permission grants. Drupal issued SA-contrib-2026-109 and released version 2.6.1 as the fix; no active exploitation or public proof-of-concept code has been identified at time of analysis.
Unauthenticated information disclosure in DXPR Builder, a Drupal page-building and AI editing module, exposes sensitive data through forceful browsing against insufficiently protected endpoints. All releases from 0.0.0 through 2.8.0 are affected; version 2.8.1 is the patched release per Drupal security advisory SA-CONTRIB-2026-112. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Incorrect authorization in the Drupal Entity API contributed module (versions prior to 1.8.0) enables forceful browsing, allowing unauthenticated remote attackers to access restricted entity resources by directly requesting entity URLs that bypass access control checks. All Drupal installations running Entity API 0.0.0 through 1.7.x are affected; a patched release (1.8.0) has been issued by Drupal security. No public exploit code or active exploitation has been identified at time of analysis.
Missing authorization checks in the Drupal Entity PDF contributed module (versions through 2.1.4) expose a Forceful Browsing path that allows any authenticated site user to retrieve PDF renderings of Drupal entities beyond their access rights. The flaw, rooted in CWE-862, means the module generates and serves PDFs without verifying whether the requesting account has view permission on the underlying entity - effectively making every entity accessible to any logged-in user. A vendor patch is available via Drupal security advisory SA-Contrib-2026-114, and no public exploit or active exploitation has been identified at time of analysis.
LDAP injection in the Drupal LDAP / Active Directory Integration module (versions below 2.2.1) allows unauthenticated remote attackers to manipulate LDAP query structure by submitting unsanitized input containing LDAP special characters. The primary confirmed impact is partial confidentiality loss — directory enumeration or partial authentication bypass — with no integrity or availability impact per the CVSS vector. No public exploit code or CISA KEV listing has been identified at time of analysis, though the unauthenticated network-accessible attack vector makes it straightforward to attempt against exposed instances.
Stored cross-site scripting in the Drupal Monster Menus contrib module (versions 0.0.0 through 9.5.3) allows malicious script payloads to be persistently injected into navigation or menu rendering contexts, executing in the browsers of subsequent authenticated visitors. The CVSS scope-change flag (S:C) confirms the attack crosses session boundaries, enabling session hijacking, credential theft, or further lateral movement within the Drupal application. No public exploit code has been identified at time of analysis, and Drupal's security team has released an advisory (SA-CONTRIB-2026-116) with a patch.
Stored cross-site scripting in the Drupal Slick Carousel contributed module (all releases before 2.1.0) allows injection of persistent malicious scripts into carousel-rendered content. Any authenticated user or visitor who loads a page containing the compromised carousel triggers script execution in their browser, potentially exposing session tokens and enabling unauthorized actions performed under the victim's identity. The Drupal Security Team has released a patch via sa-contrib-2026-117; no public exploit code or confirmed active exploitation has been identified at time of analysis.
Forceful Browsing in Drupal Core across multiple active and end-of-life release branches (10.x through 10.6.13, 11.3.x through 11.3.14, 11.4.x through 11.4.4, and all 11.0.x-11.2.x) allows unauthenticated remote attackers to bypass authorization and directly access protected resources due to missing authorization checks (CWE-862). The CVSS vector (AV:N/AC:H/PR:N/UI:R) indicates network-reachable exploitation but with high complexity and required user interaction, limiting opportunistic mass attacks. No active exploitation is confirmed - EPSS stands at 0.13% (3rd percentile) and CISA SSVC rates exploitation as none and not automatable - but a vendor patch is available via SA-CORE-2026-010.
Cross-site scripting in Drupal Core across all maintained 11.x release branches allows network-accessible unauthenticated attackers to inject malicious scripts into rendered web pages, with impact occurring in victims' browser contexts upon user interaction. High attack complexity (AC:H) constrains opportunistic exploitation, and all signals - EPSS at 0.15% (4th percentile), SSVC exploitation status of none, no KEV listing, and no public exploit code - converge on a low-urgency posture. Vendor patches are available for the 11.3.x and 11.4.x branches via Drupal SA-CORE-2026-011, while Drupal 11.2.x and earlier receive no fix as an end-of-life branch.
Stored XSS in Drupal Core allows authenticated low-privileged users to inject persistent malicious scripts that execute in the browsers of other site visitors, including administrators. The vulnerability spans multiple Drupal release trains - 10.x through 10.6.x, and all 11.0.*, 11.1.*, and 11.2.* branches - and is addressed in patched releases 10.6.13, 11.3.14, and 11.4.4 per the vendor advisory SA-core-2026-012. No public exploit code has been identified at time of analysis, and CISA SSVC classifies exploitation as none with non-automatable attack paths, placing this at moderate real-world priority despite scope change in the CVSS vector.
Stored XSS in the Drupal Media Folders contributed module (versions 0.0.0 through 1.0.8) allows network-accessible injection of persistent malicious scripts that execute in the browsers of users who subsequently view affected media folder pages. The CVSS scope change (S:C) confirms the payload crosses the application security boundary into the victim's browser session, enabling session hijacking or privilege escalation against authenticated users including administrators. No active exploitation has been confirmed - no CISA KEV listing, no public exploit code, and an EPSS of 0.15% (4th percentile) - and a vendor patch is available via Drupal security advisory SA-contrib-2026-080.
Reflected XSS in the Drupal Search API Autocomplete contributed module (versions 0.0.0 through 1.12.0) allows remote unauthenticated attackers to inject and execute arbitrary JavaScript in the context of victims' browsers when they are socially engineered into clicking a crafted URL. The CVSS scope change (S:C) confirms the injected script executes outside the application's security zone - in the victim's browser - enabling session token theft or authenticated action hijacking. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor patch is available via Drupal Security Advisory SA-CONTRIB-2026-082.
Missing authentication on a critical function in the Drupal PanKM contributed module allows a network-accessible, high-privilege attacker-given required user interaction-to bypass module authorization controls and achieve high confidentiality and integrity impact against all currently released versions. All known PanKM releases are affected (CPE wildcard cpe:2.3:a:drupal:pankm:*:*:*:*:*:*:*:*), with the Drupal security team (sa-contrib-2026-083) confirming the issue. No public exploit code has been identified at time of analysis, and SSVC confirms exploitation status as none.
Improper input validation in the Drupal contributed module Email Login OTP (all released versions) exposes sites to high confidentiality and integrity impacts under specific conditions involving high-privilege access and user interaction. The vulnerability, tracked under CWE-20, could allow a privileged actor to manipulate OTP-related input handling in ways that compromise authentication integrity or expose sensitive login-flow data. No active exploitation has been confirmed (EPSS 0.14%, 4th percentile; SSVC exploitation status: none), and the Drupal security team has published advisory SA-CONTRIB-2026-085 addressing the issue.
Improper input validation in the Drupal Lunr Exposed Filters contributed module (all versions) can yield high confidentiality and integrity impact under a restrictive set of preconditions. The CVSS vector (AV:N/AC:H/PR:H/UI:R) constrains exploitation to attackers already holding high-privilege Drupal access who can also induce user interaction, making opportunistic or mass exploitation implausible. No public exploit code exists and EPSS sits at 0.14% (4th percentile), consistent with no observed exploitation pressure at time of analysis.
Improper input validation in the Drupal Development Environment contributed module (all versions, CPE cpe:2.3:a:drupal:development_environment) allows a highly privileged, authenticated network attacker - with user interaction - to compromise both confidentiality and integrity of the affected system. The CVSS vector (AV:N/AC:H/PR:H/UI:R) constrains real-world impact significantly: exploitation requires administrative credentials, a complex attack scenario, and victim interaction. EPSS stands at 0.14% (4th percentile), no public exploit code has been identified, and no CISA KEV listing exists at time of analysis.
Improper input validation in the Drupal 'Disable Login Page' contrib module (all versions) enables a network-delivered attack that can achieve high confidentiality and integrity compromise within a Drupal site. Exploitation is substantially constrained by the requirement for high-privilege (administrator-level) access, high attack complexity, and mandatory user interaction - making this a meaningful internal-threat or privilege-abuse scenario rather than an opportunistic remote attack. No public exploit code has been identified and no CISA KEV listing exists; the EPSS score of 0.14% (4th percentile) confirms negligible observed exploitation activity at time of analysis.
Improper input validation in the Powerful Surveys contributed module for Drupal exposes all published versions to confidentiality and integrity compromise under a constrained set of conditions requiring high privileges and user interaction. The flaw, classified under CWE-20, allows a high-privileged authenticated attacker - under high-complexity conditions with mandatory user interaction - to bypass input validation controls and potentially disclose or manipulate survey data. No public exploit exists and EPSS stands at 0.14% (4th percentile), indicating negligible observed exploitation pressure despite the High C and I impact ratings.
Improper input validation in the Drupal Composer contributed module (SA-contrib-2026-046) exposes sites to confidentiality and integrity compromise when exploited by a highly privileged attacker over the network under specific conditions. The vulnerability, classified as CWE-20, affects all tracked versions of the module and carries a CVSS 3.1 score of 5.9 (Medium), with both high confidentiality and high integrity impact despite no availability impact. No public exploit code exists and no active exploitation has been identified; EPSS stands at 0.15% (5th percentile), and CISA has not added this to KEV.
Improper restriction of excessive authentication attempts (CWE-307) in the Drupal contributed module 'Brute force attack protection' allows a network-based attacker with high privileges to bypass the module's core protective controls, resulting in high confidentiality and integrity impact. All released versions of the module (*.*) are affected, as confirmed by Drupal security advisory SA-contrib-2026-047. No public exploit code has been identified and EPSS places this at the 5th percentile, indicating minimal observed exploitation activity at time of analysis.
Authentication bypass in the Drupal Clean RESTful contributed module (cpe:2.3:a:drupal:clean_restful:*:*:*:*:*:*:*:*) enables network-reachable attackers with high existing privileges to circumvent authentication controls exposed via the module's REST API endpoints, resulting in high confidentiality and integrity impact against the Drupal application. All versioned releases of the module are affected per the wildcard CPE. No public exploit code has been identified at time of analysis, and CISA has not added this vulnerability to the Known Exploited Vulnerabilities catalog, though SSVC rates the technical impact as total.
High-privilege network exploitation of the Drupal Raw Formatter [Meta Tag Formatter] contributed module leads to high confidentiality and integrity impact across all released versions. The vulnerability requires an authenticated user with elevated Drupal permissions and high attack complexity (PR:H, AC:H per CVSS), significantly narrowing the realistic attack surface despite the notable C:H/I:H impact rating. No public exploit has been identified at time of analysis, EPSS sits at 0.24% (15th percentile), and SSVC confirms exploitation status as none - consistent with a narrow, privilege-dependent flaw in a niche contrib module rather than a broadly weaponizable issue.
Cross-site scripting (XSS) in Drupal Core affects a broad swath of the 10.x and 11.x release lines, enabling an authenticated low-privileged attacker to inject malicious client-side script that executes in the browser of a victim who interacts with the crafted content. The CVSS scope-change indicator (S:C) confirms the impact escapes the originating component into the victim's browser context, enabling session hijacking or privilege escalation against higher-privileged users. No public exploit code has been identified and EPSS sits at 0.15% (5th percentile), indicating low automated exploitation probability at time of analysis, though the wide deployment footprint of Drupal still makes patching urgent.
Server-Side Request Forgery in Drupal Core allows authenticated low-privilege users to coerce the application server into issuing unauthorized HTTP requests to internal or restricted network destinations. All active 10.6.x and 11.x release branches are affected, along with end-of-life 11.0.x and 11.1.x branches, covering a broad swath of production Drupal deployments. No public exploit code has been identified and EPSS sits at the 3rd percentile, but the large Drupal deployment footprint elevates aggregate exposure even at low per-instance exploitation probability.
Open redirect in Drupal Core across multiple major release branches enables phishing and content spoofing attacks by forwarding victims from a trusted Drupal domain to an attacker-controlled site via crafted URLs. The exposure spans the 10.x and 11.x release trains, creating a broad attack surface across the Drupal install base. EPSS probability sits at 0.13% (3rd percentile) and the vulnerability is absent from CISA KEV, indicating low observed exploitation to date despite the wide version coverage.
Object injection in Drupal Core through improperly controlled modification of dynamically-determined object attributes (CWE-915) exposes sites to high-severity confidentiality and integrity compromise when triggered by an authenticated user with high privileges. Affected branches include the entire 10.x line before 10.5.12 and 10.6.11, the fully unsupported 11.0.x and 11.1.x trees, and the 11.2.x and 11.3.x lines before 11.2.14 and 11.3.12 respectively. No active exploitation is confirmed (not in CISA KEV) and EPSS sits at just 0.16% (6th percentile), making this a patch-priority rather than emergency-response scenario.
Object injection via a mass assignment flaw in Drupal Core enables an authenticated administrator to manipulate dynamically-determined PHP object attributes, potentially compromising confidentiality and data integrity of the application. Affected versions span multiple active and end-of-life branches: 10.5.x through 10.5.12, 10.6.0 through 10.6.11, 11.2.0 through 11.2.14, 11.3.0 through 11.3.12, and the entirely unsupported 11.0.x and 11.1.x branches. No public exploit code is identified at time of analysis, and EPSS at 0.16% (6th percentile) signals very low observed exploitation activity despite the C:H/I:H impact potential.
Stored Cross-Site Scripting in the Drupal AI SEO/GEO Analyzer contrib module (versions 0.0.0 through pre-1.1.3) enables authenticated low-privilege users to persist malicious JavaScript payloads that execute in the browser context of other users - including administrators - who subsequently view the affected content. The scope change (S:C in the CVSS vector) confirms cross-context execution, enabling session hijacking, credential theft, or unauthorized DOM manipulation against victim users. EPSS probability stands at 0.25% (17th percentile) and no active exploitation has been reported in CISA KEV, indicating limited real-world threat at this time. A vendor-released patch is available via the Drupal security advisory SA-contrib-2026-076.
Stored XSS in the Drupal UI Patterns (SDC in Drupal UI) contributed module allows a low-privileged authenticated attacker to inject persistent malicious scripts into web pages, which execute in the browsers of other users - including administrators - who view the affected content. Versions 2.0.0 through 2.0.17 of the module are affected, with a patch available from the Drupal security team. No public exploit identified at time of analysis, and the EPSS score of 0.25% (17th percentile) signals minimal observed exploitation pressure, though the stored nature of the XSS and potential to target privileged users elevates practical risk for sites using this module.
Object injection in the Drupal ECA (Event - Condition - Action) contributed module exposes sites running affected versions to limited confidentiality and integrity compromise by authenticated low-privileged users. The vulnerability stems from improperly controlled modification of dynamically-determined object attributes (CWE-915, a mass-assignment class of flaw), allowing a crafted request to inject object properties and influence internal application logic within ECA's event-driven workflow engine. No confirmed active exploitation exists, and EPSS at 0.20% (10th percentile) reflects low observed threat pressure across the landscape, though a vendor patch has been issued per the Drupal security advisory.
Cross-site scripting in Drupal's Siteimprove Analytics contributed module (all versions before 2.0.1) allows an authenticated low-privileged attacker to inject malicious scripts that execute in a victim user's browser session. The CVSS scope change (S:C) indicates the attack crosses the application trust boundary, enabling potential session hijacking or privilege escalation against higher-privileged users such as administrators who view attacker-controlled content. No public exploit code exists and EPSS of 0.19% (8th percentile) confirms low real-world exploitation probability; no active exploitation has been identified at time of analysis.
Cross-Site Request Forgery in the Drupal Ray Enterprise Translation contrib module lets a remote attacker forge state-changing requests that are executed with the privileges of an authenticated victim (typically a site administrator), potentially altering translation configuration and integrations. It affects module versions below 4.0.4, below 4.1.4, and below 11.0.4, and carries a vendor CVSS of 8.8. No public exploit has been identified at time of analysis and the EPSS score is very low (0.12%, 2nd percentile), indicating no observed exploitation activity.
Brute-force credential attacks against Drupal sites running the Login Disable contrib module (versions 0.0.0 through 2.1.4) are enabled by the module's failure to restrict excessive authentication attempts (CWE-307). The module, intended to provide administrators with login-gating controls, paradoxically omits rate-limiting enforcement, allowing a low-privileged attacker to enumerate or compromise user credentials via automated requests. EPSS is low (0.21%, 12th percentile) and no active exploitation is confirmed in CISA KEV, but the network-accessible attack vector and low complexity keep this relevant for sites where the module is deployed.
Cross-site scripting in the Drupal Colorbox module allows an authenticated low-privileged attacker to inject malicious scripts that execute in the browser context of other users. The CVSS scope-change indicator (S:C) confirms this is likely stored XSS, where crafted input persists and executes when victims visit affected pages. No active exploitation is confirmed - EPSS sits at 0.20% (10th percentile) and the vulnerability is not listed in the CISA KEV catalog - but a vendor patch is available via Drupal security advisory SA-CONTRIB-2026-069.
Missing Authorization (CWE-862) in the Drupal FlowDrop contributed module allows authenticated low-privilege users to perform Forceful Browsing - directly accessing protected URLs without proper permission checks being enforced. All FlowDrop releases from 0.0.0 up to 1.6.0 are affected; a successful attacker can read or modify content and workflow data beyond their authorized scope. No public exploit has been identified and EPSS sits at 0.18% (8th percentile), indicating negligible observed exploitation probability at time of analysis; the vulnerability is not listed in CISA KEV.
Missing authorization in the FlowDrop Drupal contributed module (versions prior to 1.6.0) enables authenticated low-privilege users to perform forceful browsing, accessing URLs and resources that should be restricted to higher-privilege roles. The vulnerability stems from CWE-862, where authorization checks are absent or bypassed on protected endpoints within the module. No public exploit code or CISA KEV listing exists at time of analysis; the EPSS score of 0.18% (8th percentile) reflects low observed exploitation probability, but the low attack complexity and network accessibility make it a meaningful risk on multi-tenant or public Drupal sites with the module installed.
Cross-site scripting in the Drupal Canvas contributed module enables remote attackers to inject and execute malicious scripts in the browsers of Drupal site visitors. Affecting multiple version branches - 0.0.0 through 1.4.2, 1.5.0 through 1.5.2, 1.6.0 through 1.6.1, and 1.7.0 through 1.7.1 - the flaw (CWE-79) stems from insufficient sanitization of user-supplied input before rendering it in generated web pages. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog; the EPSS score of 0.20% (10th percentile) reflects minimal current exploitation activity.
Cross-site scripting in the Drupal Canvas contributed module allows unauthenticated remote attackers to inject and execute malicious scripts in victims' browsers across multiple version branches (0.0.0-1.4.2, 1.5.0-1.5.2, 1.6.0-1.6.1, 1.7.0-1.7.1). The scope-changed CVSS vector (S:C) confirms the attack escapes the server context and executes within the victim's browser environment, enabling session theft, credential harvesting, or unauthorized actions on behalf of the victim. No public exploit or CISA KEV listing has been identified, and EPSS at 0.20% (10th percentile) reflects minimal observed exploitation activity at time of analysis.
Cross-Site Request Forgery in the Drupal Salesforce Suite contrib module (all versions from 0.0.0 up to and including 5.1.3) lets an attacker forge state-changing requests that are executed with the privileges of an authenticated Drupal user who is tricked into loading attacker-controlled content. The Drupal security team (SA-CONTRIB-2026-063) rates it critical, and a fixed release is available; no public exploit code has been identified and EPSS is very low (0.10%, 1st percentile), indicating no observed exploitation activity. Note that the published CVSS vector (UI:N) is atypical for CSRF, which normally depends on victim interaction, so the real-world impact profile should be verified against the vendor advisory.
SQL injection in the Drupal Geolocation Field contributed module exposes sites to unauthenticated database read and partial write access across all module versions prior to 3.15.0. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms the attack requires no authentication and no user interaction, making it remotely triggerable against any publicly reachable Drupal installation running the affected module. Impact is bounded by C:L/I:L/A:N - partial data disclosure and modification without availability disruption or full database takeover. No active exploitation has been confirmed (no CISA KEV listing), and EPSS sits at a low 0.16% (5th percentile), indicating minimal current attacker interest. A vendor patch is available.
Missing authorization in the Drupal Paragraphs contributed module (all versions through 1.20.x) enables unauthenticated remote attackers to perform forceful browsing - directly accessing paragraph entity URLs or endpoints without passing any authorization check. The CVSS vector (PR:N/AC:L/AV:N) confirms exploitation requires no credentials against default-configured Drupal sites running the affected module. Despite an automatable attack surface, SSVC rates exploitation as none, EPSS sits at 0.13% (3rd percentile), and no active exploitation is confirmed; a vendor patch is available via Drupal SA-contrib-2026-061.
Forceful Browsing via missing authorization (CWE-862) in the Drupal Paragraphs contributed module allows remote unauthenticated users to access paragraph entities they are not authorized to view or modify, bypassing the CMS access control layer entirely. All Paragraphs releases from 0.0.0 up to but not including 1.21.0 are affected, per vendor advisory SA-CONTRIB-2026-060. Despite being automatable per SSVC analysis and network-exploitable with no privileges required, real-world exploitation risk is low: EPSS sits at 0.13% (3rd percentile), no public exploit code has been identified, and CISA has not added this to KEV.
Missing authorization controls in Drupal WissKI versions prior to 4.2.0 enable unauthenticated remote attackers to perform forceful browsing - directly accessing restricted resources by guessing or enumerating URLs without undergoing proper authorization checks. The affected versions span the entire release history from 0.0.0 through 4.2.0, making all prior deployments vulnerable. SSVC assessment confirms no active exploitation at time of analysis, and the EPSS score of 0.13% (3rd percentile) suggests very low real-world exploitation probability despite the automatable nature of the attack.
Incorrect Authorization (CWE-863) in the Drupal Commerce Realex / Global Payments module exposes protected payment and order resources to forceful browsing, allowing unauthenticated remote attackers to access endpoints that should require authorization. All module versions from 0.0.0 through 3.0.2 (exclusive) are affected on Drupal Commerce deployments. No public exploit code has been identified and SSVC confirms no active exploitation at time of analysis, though the nature of a payment gateway module means successful access could expose order or transaction data.
Incorrect Authorization (CWE-863) in the Drupal AI Agents contributed module enables Forceful Browsing, allowing network-reachable attackers to access restricted AI agent resources without proper permission checks. Three distinct release branches are affected: 0.0.0-1.1.4, 1.2.0-1.2.5, and 1.3.0-1.3.1. CISA SSVC classifies exploitation as none with partial technical impact, EPSS sits at the 4th percentile, and no public exploit has been identified at time of analysis - signals that collectively indicate limited immediate real-world risk despite the network-accessible attack vector.
Missing authorization controls in the Drupal AI Agents contrib module expose protected resources to forceful browsing by authenticated low-privilege users. Affected installations span three version branches - 0.0.0 through 1.1.3, 1.2.0 through 1.2.4, and 1.3.0 - across the Drupal ecosystem. No public exploit has been identified and CISA has not added this to KEV; EPSS at 0.14% (4th percentile) and SSVC's 'none' exploitation status confirm minimal real-world threat at time of analysis.
Forceful browsing exposure in Drupal's AI (Artificial Intelligence) contributed module permits high-privileged authenticated users to access protected resources without proper authorization checks, affecting versions 0.0.0-1.2.17, 1.3.0-1.3.8, and 1.4.0-1.4.3. The vulnerability stems from CWE-862 (Missing Authorization), where path-level access controls are not enforced on certain AI module endpoints, allowing an authenticated user with high privileges to traverse to unauthorized resources. No public exploit code exists, EPSS sits at 0.14% (4th percentile), and CISA SSVC confirms no active exploitation, placing this firmly in the low-urgency tier despite its network-accessible attack vector.
Cross-site scripting in the Drupal AI (Artificial Intelligence) contributed module exposes sites to session hijacking and malicious content injection when users interact with unsanitized AI-generated or AI-related output rendered in the browser. The module fails to properly neutralize user-controlled or AI-sourced input before including it in generated web pages, allowing an unauthenticated remote attacker to craft a payload that executes in a victim's browser upon interaction. No active exploitation is confirmed (not in CISA KEV) and EPSS is very low at 0.16% (6th percentile), though the network-accessible, no-privilege attack surface warrants prompt patching on internet-facing Drupal deployments.
Server-Side Request Forgery in the Drupal OpenAI Provider module enables authenticated administrators to force the server to issue HTTP requests to attacker-controlled destinations, potentially reaching internal network resources beyond the intended API boundary. Affected versions span 0.0.0 through 1.1.1 and 1.2.0 through 1.2.2; a vendor patch is available via Drupal security advisory SA-CONTRIB-2026-053. No public exploit code exists, EPSS sits at 0.14% (4th percentile), and SSVC confirms exploitation status as none - all signals converge on a low operational priority despite the network-accessible attack vector.
Incorrect authorization in the Drupal Advanced Content Feedback (admin_feedback) contributed module allows authenticated low-privilege users to perform forceful browsing, accessing restricted feedback resources without proper authorization checks. All module releases from 0.0.0 up to (but not including) 2.8.0 are affected. No public exploit code exists and no active exploitation has been identified; EPSS sits at the 4th percentile, consistent with the SSVC assessment of zero current exploitation.
Stored XSS in the Drupal contributed module Advanced Content Feedback (admin_feedback) affects all releases from 0.0.0 up to 2.8.0, enabling a remote unauthenticated attacker to inject persistent malicious scripts that execute in the browsers of users who subsequently view affected pages. The scope change (S:C) in the CVSS vector indicates the injected payload escapes the application's security context and operates in the victim's browser, potentially enabling session hijacking or unauthorized actions on behalf of privileged users. No public exploit code has been identified and CISA has not added this to KEV; EPSS at 0.16% (6th percentile) and SSVC's 'exploitation: none' classification confirm this is a low-urgency finding with no evidence of active targeting.
Missing Authorization in Drupal's Examples for Developers module (versions 0.0.0 through 4.0.5) permits forceful browsing by an already highly-privileged authenticated attacker, exposing restricted paths with limited confidentiality and integrity impact. All available signals converge on minimal real-world risk: CVSS scores 3.3 (Low), EPSS sits at 0.14% (4th percentile), SSVC reports no known exploitation and non-automatable attack conditions, and neither active exploitation nor public proof-of-concept code has been identified. A vendor patch is available at version 4.0.6.
Stored cross-site scripting in the Drupal Tagify contributed module allows low-privileged authenticated users to inject persistent malicious scripts that execute in the browsers of subsequent page visitors, including administrators. All Tagify module versions prior to 1.2.52 are affected. No public exploit code has been identified and EPSS sits at the 6th percentile, but the stored nature of the XSS elevates impact relative to reflected variants since payloads persist across all future viewers of the poisoned content.
Reflected XSS in the Anti-Spam by CleanTalk Drupal contributed module (versions 0.0.0 through 9.7.1) allows remote unauthenticated attackers to inject and execute malicious JavaScript in a victim's browser by tricking them into visiting a crafted URL. The CVSS Changed scope (S:C) confirms the payload executes in the browser's security context, enabling session theft, credential harvesting, or UI redirection against authenticated Drupal users. No public exploit code and no active exploitation have been identified; EPSS at 0.16% (6th percentile) indicates negligible observed exploitation probability at time of analysis.
Stored cross-site scripting in Drupal Commerce Core 3.3.0 through 3.3.5 allows an authenticated low-privilege attacker to inject persistent malicious scripts that execute in other users' browsers when affected pages are viewed. The scope change (S:C in the CVSS vector) confirms the payload breaks out of the application's security context into the victim's browser environment, enabling session hijacking or unauthorized UI manipulation. No active exploitation or public exploit code has been identified; EPSS of 0.16% (6th percentile) reflects low real-world exploitation probability at time of analysis.
Cross-site scripting in the Drupal Colorbox Inline contributed module (versions 0.0.0 through before 2.1.1) allows an authenticated low-privileged attacker to inject malicious script into web page output, which executes in a victim's browser when they interact with the affected content. The changed-scope CVSS vector (S:C) confirms the classic XSS pattern where attacker-controlled content runs in a different security context than the origin. No public exploit code exists and no active exploitation has been identified; EPSS at 0.03% (8th percentile) confirms this is not a currently targeted vulnerability.
Resource Location Spoofing in the Drupal 'Translate Drupal with GTranslate' module (versions 0.0.0 through before 3.0.5) allows a high-privileged authenticated attacker to modify data the module treats as immutable, enabling redirection of translation resource locations. Exploitation requires network access but demands administrator-level privileges, yielding only low integrity impact with no confidentiality or availability consequences. No public exploit code exists and EPSS sits at 0.02% (5th percentile), indicating negligible exploitation interest at this time.
Forceful browsing in the Drupal Node View Permissions module exposes restricted node content to unauthenticated network attackers under high-complexity conditions. Affected are all installations running versions 0.0.0-1.7.0 (branch 1.x) and 2.0.0-2.0.1 (branch 2.x) of the module. The vulnerability is classified as information disclosure only - no integrity or availability impact - and carries a CVSS 3.7 (Low) score; no public exploit code exists and no confirmed active exploitation has been reported (not in CISA KEV), with EPSS placing exploitation probability at 0.01%.
Cross-site scripting in the Drupal Obfuscate contributed module (versions 0.0.0 through before 2.0.2) allows remote unauthenticated attackers to inject malicious scripts into pages rendered for other users, with impact scoped across security boundaries (S:C). The vulnerability stems from improper neutralization of input during web page generation, enabling session hijacking or UI redress attacks against users who view attacker-controlled content processed by the module. No public exploit has been identified at time of analysis, and EPSS at 0.03% (8th percentile) reflects low current exploitation probability.
Cross-site scripting in Drupal core 11.3.0 through 11.3.6 enables unauthenticated remote attackers to inject malicious scripts into web pages rendered by the application, which execute in victims' browsers upon user interaction. The CVSS Changed scope (S:C) indicator confirms the exploit crosses trust boundaries - attacker-controlled input rendered in the victim's browser context can compromise session tokens or trigger unauthorized actions. With EPSS at 0.03% (8th percentile) and no CISA KEV listing, widespread exploitation is not currently observed; a vendor patch is available in 11.3.7.
Object injection in Drupal Core across branches 8.0.0 through 11.3.x allows a network-accessible, highly privileged authenticated user to manipulate dynamically-determined object attributes, with potential full compromise of confidentiality, integrity, and availability. The CVSS vector (AV:N/AC:H/PR:H) confirms this is a network-reachable flaw but imposes steep prerequisites: administrator-level access and high attack complexity. No public exploit code or confirmed active exploitation has been identified at time of analysis.
Cross-site scripting in Drupal Core exposes a broad range of Drupal installations - spanning major versions 8 through 11 - to client-side script injection exploitable by unauthenticated remote attackers who can induce user interaction. The Changed scope (S:C) in the CVSS vector confirms the injected script executes in the context of a victim's browser session, enabling session hijacking, credential theft, or malicious redirects against authenticated users including administrators. No public exploit code has been identified at time of analysis, and the EPSS score of 0.03% (8th percentile) signals low near-term exploitation probability, though the breadth of affected versions across three major release lines increases the aggregate attack surface.
Reflected or stored cross-site scripting in Drupal's Orejime cookie consent module (versions 0.0.0 through 2.0.15) allows unauthenticated remote attackers to inject malicious scripts that execute in a victim's browser upon page load or link interaction. The changed scope (S:C) in the CVSS vector indicates the injected script executes in a security context beyond the originating page - consistent with a consent banner or cookie-preference widget that renders across site sections. No public exploit code has been identified at time of analysis, and EPSS is 0.03% (8th percentile), placing this in the low-exploitation-probability tier despite being network-accessible with no authentication required.
The Drupal 7 Internationalization (i18n) module's i18n_node submodule allows authenticated users holding both 'Translate content' and 'Administer content translations' permissions to bypass access controls and view unpublished node titles and IDs through the translation user interface and autocomplete functionality. Affected versions range from 7.x-1.0 through 7.x-1.35. No public exploit code or active exploitation has been confirmed at the time of analysis.
Drupal File (Field) Paths module 7.x prior to 7.1.3 allows authenticated users to disclose other users' private files through filename-collision uploads that manipulate file URI processing, causing hook_node_insert() consumers such as email attachment modules to access incorrect file URIs and bypass access controls on sensitive files. The vulnerability affects the Drupal File (Field) Paths package as confirmed via CPE cpe:2.3:a:drupal:drupal_file_(field)_paths:*:*:*:*:*:*:*:*. No public exploit code or active exploitation data has been identified at the time of analysis.
Drupal Automated Logout module contains a Cross-Site Request Forgery (CSRF) vulnerability that allows unauthenticated remote attackers to perform unauthorized actions on behalf of authenticated users by crafting malicious requests. The vulnerability affects Automated Logout versions prior to 1.7.0 and versions 2.0.0 through 2.0.1, with patched versions available at 1.7.0 and 2.0.2 respectively. No public exploit code or active exploitation has been identified at the time of analysis.
Improper case sensitivity handling in the Drupal OpenID Connect / OAuth client module versions prior to 1.5.0 allows privilege escalation through authentication bypass mechanisms. Authenticated or remote attackers can exploit case-sensitivity weaknesses in identity claim validation to assume elevated permissions within Drupal systems relying on this module for federated authentication. The vulnerability affects all versions from 0.0.0 through 1.5.0, and vendor-released patch version 1.5.0 is available.
Drupal OpenID Connect / OAuth client versions before 1.5.0 contain an authentication bypass vulnerability that allows attackers to circumvent authentication mechanisms through an alternate path or channel. The vulnerability affects all versions from 0.0.0 through 1.4.x, enabling remote attackers to gain unauthorized access without proper credentials. No CVSS score, EPSS data, or confirmed active exploitation status is currently available; however, the vulnerability's authentication bypass nature and wide version range suggest significant real-world risk to Drupal installations relying on OpenID Connect or OAuth authentication.
The Drupal OpenID Connect / OAuth client module versions prior to 1.5.0 contains a Server-Side Request Forgery (SSRF) vulnerability that allows remote attackers to make arbitrary HTTP requests from the affected server. This vulnerability affects all installations running OpenID Connect / OAuth client versions 0.0.0 through 1.5.0, and attackers can leverage the SSRF to access internal services, retrieve sensitive metadata, or interact with backend systems not directly accessible from the internet. No public exploit code or active exploitation has been confirmed at the time of analysis, though the vulnerability affects a widely-deployed Drupal authentication module.
Drupal Google Analytics GA4 module versions before 1.1.14 contain a cross-site scripting (XSS) vulnerability through improper input neutralization during web page generation, allowing attackers to inject and execute arbitrary JavaScript in user browsers. Remote attackers can craft malicious requests that persist within analytics data or configuration, affecting all users of sites running vulnerable versions. The vulnerability is documented in Drupal's security advisory SA-CONTRIB-2026-024 and has been assigned EUVD-2026-16383; no public exploit code or active exploitation has been confirmed at the time of this analysis.
Cross-site scripting (XSS) in Drupal Calculation Fields module versions prior to 1.0.4 permits remote attackers to inject arbitrary JavaScript into dynamically generated web pages, enabling session hijacking, credential theft, and malware distribution against users viewing affected pages. The vulnerability stems from improper input neutralization during calculation field rendering, affecting all installations running Calculation Fields 0.0.0 through 1.0.3. No public exploit code or active exploitation has been confirmed at time of analysis.
Drupal AJAX Dashboard versions before 3.1.0 fail to enforce authentication on critical AJAX endpoints, allowing unauthenticated remote attackers to bypass access controls and invoke privileged dashboard functions. The vulnerability affects all versions from 0.0.0 through 3.1.0 (exclusive) and is categorized as a Missing Authentication for Critical Function (CWE-306). No public exploit code or active exploitation via CISA KEV has been confirmed at time of analysis, but the authentication bypass nature of this defect presents significant risk to installations relying on dashboard security.
Forceful browsing attacks in Drupal File Access Fix (deprecated) versions below 1.2.0 allow unauthenticated remote attackers to bypass file access controls and retrieve unauthorized files through direct path enumeration. The vulnerability stems from incorrect authorization validation in the deprecated module (cpe:2.3:a:drupal:file_access_fix_(deprecated):*:*:*:*:*:*:*:*), affecting all versions from 0.0.0 through 1.1.x. No public exploit code or active exploitation has been identified at time of analysis, but the deprecated status and widespread use of Drupal installations increase real-world risk exposure.
Forceful browsing via incorrect authorization in Drupal File Access Fix (deprecated) module versions prior to 1.2.0 allows unauthenticated remote attackers to access files without proper access control checks. The vulnerability stems from CWE-863 (Incorrect Authorization) and affects all versions from 0.0.0 through 1.2.0. No public exploit code or active exploitation has been confirmed at the time of analysis, but the straightforward nature of authorization bypass attacks in file access contexts presents moderate real-world risk to installations still running deprecated versions of this module.
The Drupal Responsive Favicons module contains an improper input neutralization vulnerability that allows attackers to inject malicious JavaScript code into web pages (Cross-Site Scripting/XSS). All versions from 0.0.0 up to and including 2.0.1 are affected, with the vulnerability classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). While no CVSS score or EPSS probability metric is currently available, the vulnerability is documented in the official Drupal security advisory (SA-CONTRIB-2026-019) and has been assigned EUVD-2026-15479, indicating this is a confirmed security flaw requiring immediate patching.
A Cross-Site Scripting (XSS) vulnerability exists in the Drupal SAML SSO - Service Provider module due to improper neutralization of user input during web page generation. All versions prior to 3.1.3 are affected, allowing attackers to inject malicious scripts that execute in the browsers of users interacting with SAML authentication flows. The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), and while no CVSS score or EPSS data is currently available, the nature of XSS in authentication modules represents a significant risk to credential theft and session hijacking.
A Server-Side Request Forgery (SSRF) vulnerability exists in Drupal Canvas versions prior to 1.1.1, allowing attackers to manipulate the server into making unauthorized requests to internal or external resources. This vulnerability affects all Drupal Canvas installations from version 0.0.0 through 1.1.0, enabling attackers to access sensitive internal services, bypass network segmentation, or exfiltrate data. No CVSS score, EPSS data, or public proof-of-concept information is currently available, though the vulnerability has been formally documented by the Drupal security team.
A Cross-Site Scripting (XSS) vulnerability exists in Drupal Islandora due to improper neutralization of user input during web page generation. All versions of Islandora from 0.0.0 through 2.17.4 are affected, allowing attackers to inject and execute malicious JavaScript in the context of affected users' browsers. Exploitation enables session hijacking, credential theft, malware distribution, and defacement of the repository interface.
The Drupal CAPTCHA module contains an authentication bypass vulnerability (CWE-288) that allows attackers to circumvent CAPTCHA protection through an alternate path or channel, enabling functionality bypass. This vulnerability affects CAPTCHA versions 0.0.0 through 1.16.x and 2.0.0 through 2.0.9, allowing attackers to bypass CAPTCHA challenges intended to prevent automated abuse. While no CVSS score or EPSS data is currently available, the presence of an official Drupal security advisory and specific patched versions indicates active remediation efforts by the vendor.
A Cross-Site Scripting (XSS) vulnerability exists in the Drupal Anti-Spam by CleanTalk module due to improper neutralization of user input during web page generation. All versions from 0.0.0 through 9.6.x are affected, with a patch available in version 9.7.0 or later. Attackers can inject malicious scripts that execute in the context of authenticated users' browsers, potentially leading to session hijacking, credential theft, or defacement of Drupal sites.
A Cross-Site Scripting (XSS) vulnerability exists in Drupal Tagify module versions prior to 1.2.49, stemming from improper neutralization of user input during web page generation. An attacker can inject malicious scripts that execute in the context of other users' browsers, potentially leading to session hijacking, credential theft, or malware distribution. This vulnerability affects all Tagify installations from version 0.0.0 through 1.2.48, and patch availability has been confirmed through the Drupal security advisory.
A Cross-Site Request Forgery (CSRF) vulnerability exists in the Drupal Theme Negotiation by Rules module, affecting all versions from 0.0.0 before 1.2.1. An attacker can exploit this flaw to perform unauthorized actions on behalf of authenticated users by crafting malicious requests that bypass CSRF protections in the theme negotiation functionality. The vulnerability has been officially documented by the Drupal security team via SA-contrib-2026-012, and users of this contrib module should prioritize patching to version 1.2.1 or later.
An incorrect authorization vulnerability exists in the Drupal Material Icons module that allows attackers to bypass authentication controls and access restricted resources through forceful browsing (CWE-863). The vulnerability affects Material Icons versions 0.0.0 through 2.0.3, enabling unauthenticated or low-privileged users to enumerate and access icon resources that should be restricted. No CVSS score, EPSS data, or known exploits in the wild have been disclosed at this time, but the vulnerability has been formally documented by the Drupal security team with a dedicated security advisory.
A Cross-Site Scripting (XSS) vulnerability exists in the Drupal UI Icons module due to improper neutralization of user input during web page generation. This vulnerability affects UI Icons versions 0.0.0 through 1.0.0 and versions 1.1.0 through 1.1.0, allowing attackers to inject malicious scripts that execute in the context of victim browsers. No CVSS score, EPSS data, or confirmed KEV status is currently available; however, the XSS classification and Drupal reporting indicate this requires prompt patching to versions 1.0.1 or 1.1.1.
A Cross-Site Scripting (XSS) vulnerability exists in Drupal Quick Edit due to improper neutralization of user input during web page generation. This vulnerability affects Quick Edit versions 0.0.0 through 1.0.4 and versions 2.0.0 through 2.0.0, allowing attackers to inject malicious scripts that execute in the context of authenticated users' browsers. The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation) and has been disclosed by the Drupal security team with patches available for affected versions.
The Drupal Login Disable module contains an authentication bypass vulnerability (CWE-288) that allows attackers to circumvent login restrictions through an alternate authentication path or channel. This affects Login Disable versions prior to 2.1.3, enabling attackers to bypass intended functionality that disables user logins. While CVSS and EPSS scores are not available from public sources, the vulnerability has been formally documented by the Drupal security team, indicating a substantive security concern that requires patching.
Central Authentication System Server versions up to 2.0.3 contains a security vulnerability (CVSS 4.2).
Improper authorization controls in Drupal Canvas versions before 1.0.4 enable attackers to bypass access restrictions and enumerate or access restricted resources through direct browsing. The vulnerability requires specific conditions to exploit (high attack complexity) but affects all unauthenticated users with network access. Currently, no patch is publicly available and exploitation activity has not been confirmed.
The Microsoft Entra ID SSO Login module for Drupal before version 1.0.4 contains an authentication bypass vulnerability that allows unauthenticated attackers to escalate privileges through an alternate authentication channel. An attacker can exploit this flaw to gain unauthorized access with elevated permissions on affected Drupal installations. No patch is currently available, and the vulnerability has low exploit probability (EPSS 0.1%).
At Internet Piano Analytics versions up to 1.0.1 is affected by cross-site scripting (xss) (CVSS 4.8).