Skip to content
OpenAdvisories
Medium WID-SEC-2026-1533 4 CVEs

Drupal Extensions: Mehrere Schwachstellen

Published May 14, 2026 · Updated May 19, 2026 · Revision 2 · de-DE

Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Drupal ausnutzen, um Informationen offenzulegen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren oder Cross-Site-Scripting-Angriffe durchzuführen.

Product

Drupal ist ein freies Content-Management-System, basierend auf der Scriptsprache PHP und einer SQL-Datenbank. Über zahlreiche Extensions kann der Funktionsumfang der Core-Installation individuell erweitert werden.

Vulnerabilities 4

  • Critical 9.8
    CVE-2026-8495

    Date iCal - Critical - Information disclosure - SA-CONTRIB-2026-037

    Missing Authorization vulnerability in Drupal Date iCal allows Forceful Browsing. This issue affects Date iCal: from 0.0.0 before 4.0.15.

    Drupal Date iCal drupal/date_ical Packagist
  • Medium 5.4
    CVE-2026-8493

    Colorbox Inline - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-036

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Colorbox Inline allows Cross-Site Scripting (XSS). This issue affects Colorbox Inline: from 0.0.0 before 2.1.1.

    Drupal Colorbox Inline drupal/colorbox_inline Packagist
  • Low 3.7
    CVE-2026-8491

    Node View Permissions - Moderately critical - Access bypass - SA-CONTRIB-2026-034

    Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal Node View Permissions allows Forceful Browsing. This issue affects Node View Permissions: from 0.0.0 before 1.7.0, from 2.0.0 before 2.0.1.

    Drupal Node View Permissions drupal/node_view_permissions Packagist
  • Low 2.7
    CVE-2026-8492

    Translate Drupal with GTranslate - Less critical - DOM clobbering / link manipulation - SA-CONTRIB-2026-035

    Modification of Assumed-Immutable Data (MAID) vulnerability in Drupal Translate Drupal with GTranslate allows Resource Location Spoofing. This issue affects Translate Drupal with GTranslate: from 0.0.0 before 3.0.5.

    Drupal Translate Drupal with GTranslate drupal/gtranslate Web / CMS Packagist

Revision history

  1. #2

    Referenz(en) aufgenommen: EUVD-2026-30992, EUVD-2026-30990, EUVD-2026-30989, EUVD-2026-30991

  2. #1

    Initiale Fassung

References