Orphans Media
Monthly
The Orphans Media contributed module for Drupal is affected across all versions ('*.*') by a high-complexity flaw that a highly privileged authenticated user could leverage to compromise confidentiality and integrity; the module's function, trigger, and fix are documented in Drupal advisory SA-contrib-2026-196 rather than the CVE record. EPSS is negligible (0.14%, 3rd percentile) and there is no KEV entry or public exploit reference, so this is a moderate, non-emergency issue (CVSS 5.9, decision label 'this_month') whose real exposure is limited to sites that installed this contrib module and grant administrative-level accounts. The vulnerability yields no availability impact (C:N? no - A:N), and exploitation depends on conditions outside the attacker's control (AC:H).
The Orphans Media contributed module for Drupal is affected across all versions ('*.*') by a high-complexity flaw that a highly privileged authenticated user could leverage to compromise confidentiality and integrity; the module's function, trigger, and fix are documented in Drupal advisory SA-contrib-2026-196 rather than the CVE record. EPSS is negligible (0.14%, 3rd percentile) and there is no KEV entry or public exploit reference, so this is a moderate, non-emergency issue (CVSS 5.9, decision label 'this_month') whose real exposure is limited to sites that installed this contrib module and grant administrative-level accounts. The vulnerability yields no availability impact (C:N? no - A:N), and exploitation depends on conditions outside the attacker's control (AC:H).