Skip to content
OpenAdvisories
Medium WID-SEC-2026-1799 4 CVEs

Drupal Erweiterungen: Mehrere Schwachstellen

Published Jun 4, 2026 · Updated Jul 19, 2026 · Revision 3 · de-DE

Platform: Linux Platform: Windows

Summary

Ein entfernter Angreifer kann mehrere Schwachstellen in verschiedenen Drupal Erweiterungen ausnutzen, um Daten zu manipulieren oder offenzulegen, sowie um Cross-Site Scripting Angriffe durchzuführen.

Product

Drupal ist ein freies Content-Management-System, basierend auf der Scriptsprache PHP und einer SQL-Datenbank. Über zahlreiche Extensions kann der Funktionsumfang der Core-Installation individuell erweitert werden.

Vulnerabilities 4

  • Critical 9.8
    CVE-2026-10768 Scanner template

    LocalGov Workflows - Moderately critical - Information disclosure - SA-CONTRIB-2026-039

    Missing Authorization vulnerability in Drupal LocalGov Workflows allows Forceful Browsing. This issue affects LocalGov Workflows versions: from 0.0.0 to 1.6.0.

    Drupal LocalGov Workflows drupal/localgov_workflows Packagist
  • Medium 6.1
    CVE-2026-10770

    Anti-Spam by CleanTalk - Moderately critical - Cross site scripting - SA-CONTRIB-2026-042

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Anti-Spam by CleanTalk allows Reflected XSS. This issue affects Anti-Spam by CleanTalk versions: from 0.0.0 to 9.7.1.

    Drupal Anti-Spam by CleanTalk drupal/cleantalk Packagist
  • Medium 5.4
    CVE-2026-10769

    Commerce Core - Moderately critical - Cross site scripting - SA-CONTRIB-2026-041

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Commerce Core allows Stored XSS. This issue affects Commerce Core versions: from 3.3.0 to 3.3.6.

    Drupal Commerce Core drupal/commerce Packagist
  • Medium 4.3
    CVE-2026-49977

    tarteaucitron.js: data-cookie attribute can be used to delete arbitrary cookies

    tarteaucitron.js is a compliant and accessible cookie banner. Prior to 1.33.0, tarteaucitron.cookie.purge() is called on any element with the purgeBtn class and does not check whether the element is a legitimate tarteaucitron button or whether the cookie corr…

    amauric tarteaucitron.js tarteaucitronjs npm

Revision history

  1. #3

    Referenz(en) aufgenommen: EUVD-2026-45318

  2. #2

    Referenz(en) aufgenommen: EUVD-2026-43048, EUVD-2026-43115, EUVD-2026-43114

  3. #1

    Initiale Fassung

References