Medium WID-SEC-2026-2474 10 CVEs

Drupal Module: Mehrere Schwachstellen

Published Jul 22, 2026 · Updated Aug 25, 2026 · Revision 2 · de-DE

Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Drupal ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen und weitere, nicht näher spezifizierte Angriffe durchzuführen.

Product

Drupal ist ein freies Content-Management-System, basierend auf der Scriptsprache PHP und einer SQL-Datenbank. Über zahlreiche Extensions kann der Funktionsumfang der Core-Installation individuell erweitert werden.

Vulnerabilities 10

Critical 9.8

CVE-2026-16639

Internationalization Single Sign-On - Critical - Access bypass - SA-CONTRIB-2026-081

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Internationalization Single Sign-On allows Authentication Bypass. This issue affects Internationalization Single Sign-On versions: from 0.0.0 to 1.8.0.

Drupal Internationalization Single Sign-On drupal/i18n_sso Packagist

Aug 25, 2026
Critical 9.8

CVE-2026-16641

Commerce Elavon - Critical - Unsupported - SA-CONTRIB-2026-084

Vulnerability in Drupal Commerce Elavon. This issue affects Commerce Elavon versions: *.*.

Drupal Commerce Elavon drupal/commerce_elavon Packagist

Aug 25, 2026
Critical 9.1

CVE-2026-16644

Webform REST - Moderately critical - Access bypass - SA-CONTRIB-2026-087

Incorrect Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. This issue affects Webform REST versions: from 0.0.0 to 4.1.0.

Drupal Webform REST drupal/webform_rest Packagist

Aug 25, 2026
Critical 9.1

CVE-2026-16645

PhotoSwipe - Responsive JavaScript Modal Image Gallery - Moderately critical - Access bypass - SA-CONTRIB-2026-088

Missing Authorization vulnerability in Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery allows Forceful Browsing. This issue affects PhotoSwipe - Responsive JavaScript Modal Image Gallery versions: from 0.0.0 to 3.2.0.

Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery drupal/photoswipe Packagist

Aug 25, 2026
Medium 6.1

CVE-2026-16638

Media Folders - Moderately critical - Cross site scripting - SA-CONTRIB-2026-080

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Media Folders allows Stored XSS. This issue affects Media Folders versions: from 0.0.0 to 1.0.8.

Drupal Media Folders drupal/media_folders Packagist

Aug 25, 2026
Medium 6.1

CVE-2026-16640

Search API Autocomplete - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-082

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Search API Autocomplete allows Reflected XSS. This issue affects Search API Autocomplete versions: from 0.0.0 to 1.12.0.

Drupal Search API Autocomplete drupal/search_api_autocomplete Packagist

Aug 25, 2026
Medium 5.7

CVE-2026-15088

Development Environment - Critical - Unsupported - SA-CONTRIB-2026-089

Vulnerability in Drupal Development Environment. This issue affects Development Environment versions: *.*.

Drupal Development Environment drupal/development_environment Packagist

Aug 25, 2026
Medium 5.7

CVE-2026-16642

Email Login OTP - Critical - Unsupported - SA-CONTRIB-2026-085

Vulnerability in Drupal Email Login OTP. This issue affects Email Login OTP versions: *.*.

Drupal Email Login OTP drupal/email_login_otp Packagist

Aug 25, 2026
Medium 5.7

CVE-2026-16643

Lunr exposed filters - Critical - Unsupported - SA-CONTRIB-2026-086

Vulnerability in Drupal Lunr exposed filters. This issue affects Lunr exposed filters versions: *.*.

Drupal Lunr exposed filters drupal/lunr_filters Packagist

Aug 25, 2026
Medium 5.7

CVE-2026-16646

PanKM - Critical - Unsupported - SA-CONTRIB-2026-083

Vulnerability in Drupal PanKM. This issue affects PanKM versions: *.*.

Drupal PanKM

Aug 25, 2026

Revision history

2026-08-25 #2
Referenz(en) aufgenommen: EUVD-2026-66205, EUVD-2026-66204, EUVD-2026-66203, EUVD-2026-66202, EUVD-2026-66201, EUVD-2026-66182, EUVD-2026-66181, EUVD-2026-66208, EUVD-2026-66207, EUVD-2026-66206
2026-07-22 #1
Initiale Fassung

References

Drupal Security Advisory sa-contrib-2026-080 vom 2026-07-22
https://www.drupal.org/sa-contrib-2026-080
Drupal Security Advisory sa-contrib-2026-081 vom 2026-07-22
https://www.drupal.org/sa-contrib-2026-081
Drupal Security Advisory sa-contrib-2026-082 vom 2026-07-22
https://www.drupal.org/sa-contrib-2026-082
Drupal Security Advisory sa-contrib-2026-087 vom 2026-07-22
https://www.drupal.org/sa-contrib-2026-087
Drupal Security Advisory sa-contrib-2026-088 vom 2026-07-22
https://www.drupal.org/sa-contrib-2026-088
Drupal Security Advisory sa-contrib-2026-083 vom 2026-07-22
https://www.drupal.org/sa-contrib-2026-083
Drupal Security Advisory sa-contrib-2026-084 vom 2026-07-22
https://www.drupal.org/sa-contrib-2026-084
Drupal Security Advisory sa-contrib-2026-085 vom 2026-07-22
https://www.drupal.org/sa-contrib-2026-085
Drupal Security Advisory sa-contrib-2026-086 vom 2026-07-22
https://www.drupal.org/sa-contrib-2026-086
Drupal Security Advisory sa-contrib-2026-089 vom 2026-07-22
https://www.drupal.org/sa-contrib-2026-089