Skip to content
OpenAdvisories
Critical WID-SEC-2026-4230 68 CVEs

Drupal Erweiterungen: Mehrere Schwachstellen

Published Oct 28, 2026 · Updated Oct 29, 2026 · Revision 2 · de-DE

Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Drupal ausnutzen, um erweiterte Berechtigungen zu erlangen und Benutzerkonten zu übernehmen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen, Daten zu manipulieren, Cross-Site-Scripting-Angriffe durchzuführen und nicht näher spezifizierte Auswirkungen zu verursachen.

Product

Drupal ist ein freies Content-Management-System, basierend auf der Scriptsprache PHP und einer SQL-Datenbank. Über zahlreiche Extensions kann der Funktionsumfang der Core-Installation individuell erweitert werden.

Vulnerabilities 68

  • Critical 9.8
    CVE-2026-114523

    Ffmpeg Image Toolkit - Highly critical - Remote Code Execution - SA-CONTRIB-2026-220

    Improper Neutralization of Special Elements used in an OS Command ("OS Command Injection") vulnerability in Drupal Ffmpeg Image Toolkit allows OS Command Injection. This issue affects Ffmpeg Image Toolkit versions: from 0.0.0 to 1.0.3.

    Drupal Ffmpeg Image Toolkit drupal/ffmpeg_image_toolkit Packagist
  • High 8.8
    CVE-2026-114573

    Monster Menus - Critical - PHP object injection - SA-CONTRIB-2026-253

    Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Monster Menus allows Object Injection. This issue affects Monster Menus versions: from 0.0.0 to 9.5.6.

    Drupal Monster Menus drupal/monster_menus Packagist
  • High 7.3
    CVE-2026-118558

    Commerce Stripe - Critical - Cross-site request forgery - SA-CONTRIB-2026-263

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal Commerce Stripe allows Cross Site Request Forgery. This issue affects Commerce Stripe versions: from 2.0.0 to 2.2.3.

    Drupal Commerce Stripe drupal/commerce_stripe Packagist
  • High 7.3
    CVE-2026-118582

    CAPTCHA - Moderately critical - Session Replay (CAPTCHA bypass) - SA-CONTRIB-2026-281

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal CAPTCHA allows Functionality Bypass. This issue affects CAPTCHA versions: from 0.0.0 to 1.18.0, from 2.0.0 to 2.0.11.

    Drupal CAPTCHA drupal/captcha Packagist
  • High 7.2
    CVE-2026-114524

    Custom Formatters - Critical - Remote code execution - SA-CONTRIB-2026-225

    Privilege Defined With Unsafe Actions vulnerability in Drupal Custom Formatters allows Privilege Escalation. This issue affects Custom Formatters versions: from 0.0.0 to 4.2.1.

    Drupal Custom Formatters drupal/custom_formatters Packagist
  • High 7.2
    CVE-2026-118561

    Single Content Sync - Critical - External control of file name or path - SA-CONTRIB-2026-274

    External Control of File Name or Path vulnerability in Drupal Single Content Sync allows Path Traversal. This issue affects Single Content Sync versions: from 0.0.0 to 1.4.19.

    Drupal Single Content Sync drupal/single_content_sync Packagist
  • High 7.2
    CVE-2026-118562

    Single Content Sync - Critical - Remote code execution - SA-CONTRIB-2026-275

    Deserialization of Untrusted Data vulnerability in Drupal Single Content Sync allows Object Injection. This issue affects Single Content Sync versions: from 0.0.0 to 1.4.19.

    Drupal Single Content Sync drupal/single_content_sync Packagist
  • High 7.2
    CVE-2026-118565

    GroupEx PRO ( Daxko ) integration - Critical - Unsupported - SA-CONTRIB-2026-278

    Vulnerability in Drupal GroupEx PRO ( Daxko ) integration. This issue affects GroupEx PRO ( Daxko ) integration versions: *.*.

    Drupal GroupEx PRO ( Daxko ) integration drupal/groupexpro Packagist
  • High 7.1
    CVE-2026-114525

    ABC - Critical - Cross-site scripting - SA-CONTRIB-2026-224

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal ABC allows Stored XSS. This issue affects ABC versions: from 0.0.0 to 1.25.0, from 2.0.0 to 2.0.1.

    Drupal ABC drupal/abc Packagist
  • High 7.1
    CVE-2026-114526

    Black Hole - Critical - Cross-site scripting - SA-CONTRIB-2026-223

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Black Hole allows Stored XSS. This issue affects Black Hole versions: from 0.0.0 to 1.26.0, from 2.0.0 to 2.0.1.

    Drupal Black Hole drupal/black_hole Packagist
  • High 7.1
    CVE-2026-114527

    UI Icons - Critical - Cross site scripting - SA-CONTRIB-2026-221

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal UI Icons allows Cross-Site Scripting (XSS). This issue affects UI Icons versions: from 0.0.0 to 1.1.3, from 2.0.0 to 2.0.2.

    Drupal UI Icons drupal/ui_icons Packagist
  • High 7.1
    CVE-2026-114528

    Zero Point - Critical - Cross-site scripting - SA-CONTRIB-2026-222

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Zero Point allows Stored XSS. This issue affects Zero Point versions: from 0.0.0 to 1.30.0, from 2.0.0 to 2.0.1.

    Drupal Zero Point drupal/zeropoint Packagist
  • High 7.1
    CVE-2026-114538

    Bootstrap - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-236

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Bootstrap allows Cross-Site Scripting (XSS). This issue affects Bootstrap versions: from 0.0.0 to 3.45.0.

    Drupal Bootstrap drupal/bootstrap debootstrap Azure Linux Packagist
  • High 7.1
    CVE-2026-118549

    AI (Artificial Intelligence) - Critical - Cross-site scripting - SA-CONTRIB-2026-269

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Cross-Site Scripting (XSS). This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1…

    Drupal AI (Artificial Intelligence) drupal/ai Packagist
  • Medium 6.6
    CVE-2026-118563

    CacheFlush - Critical - Unsupported - SA-CONTRIB-2026-276

    Vulnerability in Drupal CacheFlush. This issue affects CacheFlush versions: *.*.

    Drupal CacheFlush drupal/cacheflush Packagist
  • Medium 6.6
    CVE-2026-118564

    PayUmoney for Drupal Commerce - Critical - Unsupported - SA-CONTRIB-2026-277

    Vulnerability in Drupal PayUmoney for Drupal Commerce. This issue affects PayUmoney for Drupal Commerce versions: *.*.

    Drupal PayUmoney for Drupal Commerce drupal/commerce_payumoney Web / CMS Packagist
  • Medium 6.5
    CVE-2026-107260

    Sector Distribution - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-229

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Sector Distribution allows Stored XSS. This issue affects Sector Distribution versions: from 0.0.0 to 10.3.3, from 10.4.0 to 10.4.2.

    Drupal Sector Distribution drupal/sector Packagist
  • Medium 6.5
    CVE-2026-114529

    CSV Field - Moderately critical - Cross site Scripting - SA-CONTRIB-2026-226

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal CSV Field allows Stored XSS. This issue affects CSV Field versions: from 0.0.0 to 2.0.10, from 3.0.0 to 3.0.7.

    Drupal CSV Field drupal/csv_field Packagist
  • Medium 6.5
    CVE-2026-114531

    Swiper formatter - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-228

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Swiper formatter allows Stored XSS. This issue affects Swiper formatter versions: from 0.0.0 to 2.1.2, from 3.0.1 to 3.1.0.

    Drupal Swiper formatter drupal/swiper_formatter Packagist
  • Medium 6.5
    CVE-2026-114532

    UI Icons - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-230

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal UI Icons allows Cross-Site Scripting (XSS). This issue affects UI Icons versions: from 0.0.0 to 1.1.3, from 2.0.0 to 2.0.2.

    Drupal UI Icons drupal/ui_icons Packagist
  • Medium 6.5
    CVE-2026-114536

    USWDS Paragraph Components - Moderately critical - Cross site scripting - SA-CONTRIB-2026-234

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal USWDS Paragraph Components allows Stored XSS. This issue affects USWDS Paragraph Components versions: from 0.0.0 to 3.1.3.

    Drupal USWDS Paragraph Components drupal/uswds_paragraph_components Packagist
  • Medium 6.5
    CVE-2026-114571

    Rabbit Hole - Moderately critical - Access Bypass - SA-CONTRIB-2026-252

    Incorrect Authorization vulnerability in Drupal Rabbit Hole allows Forceful Browsing. This issue affects Rabbit Hole versions: from 0.0.0 to 1.3.0.

    Drupal Rabbit Hole drupal/rabbit_hole Packagist
  • Medium 6.5
    CVE-2026-118539 Scanner template

    Commerce Core - Highly critical - Access bypass - SA-CONTRIB-2026-254

    Missing Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41, from 3.0.0 to 3.3.13.

    Drupal Commerce Core drupal/commerce Packagist
  • Medium 6.5
    CVE-2026-118545

    AI (Artificial Intelligence) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-266

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Cross-Site Scripting (XSS). This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1…

    Drupal AI (Artificial Intelligence) drupal/ai Packagist
  • Medium 6.5
    CVE-2026-118546

    AI (Artificial Intelligence) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-267

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Cross-Site Scripting (XSS). This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1…

    Drupal AI (Artificial Intelligence) drupal/ai Packagist
  • Medium 6.5
    CVE-2026-118552

    AI (Artificial Intelligence) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-272

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Cross-Site Scripting (XSS). This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1…

    Drupal AI (Artificial Intelligence) drupal/ai Packagist
  • Medium 6.5
    CVE-2026-118556

    Commerce Shipping - Moderately critical - Access bypass - SA-CONTRIB-2026-261

    Incorrect Authorization vulnerability in Drupal Commerce Shipping allows Forceful Browsing. This issue affects Commerce Shipping versions: from 0.0.0 to 2.16.0, from 3.0.0 to 3.0.6.

    Drupal Commerce Shipping drupal/commerce_shipping Packagist
  • Medium 6.5
    CVE-2026-118570 Public exploit

    Fasttoggle - Moderately critical - Cross-Site Request Forgery - SA-CONTRIB-2026-283

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal Fasttoggle allows Cross Site Request Forgery. This issue affects Fasttoggle versions: from 0.0.0 to 4.1.1.

    Drupal Fasttoggle drupal/fasttoggle Packagist
  • Medium 6.5
    CVE-2026-118576

    Stage File Proxy - Critical - Cross-site scripting - SA-CONTRIB-2026-286

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Stage File Proxy allows Cross-Site Scripting (XSS). This issue affects Stage File Proxy versions: from 0.0.0 to 3.1.7, from 4.0.0 to 4.0.1.

    Drupal Stage File Proxy drupal/stage_file_proxy Packagist
  • Medium 6.3
    CVE-2026-114539

    DocCheck Basic - Moderately critical - Access bypass - SA-CONTRIB-2026-237

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal DocCheck Basic allows Authentication Bypass. This issue affects DocCheck Basic versions: 7.x.

    Drupal DocCheck Basic
  • Medium 6.3
    CVE-2026-114540

    Domain - Moderately critical - Access bypass - SA-CONTRIB-2026-238

    Incorrect Authorization vulnerability in Drupal Domain allows Forceful Browsing. This issue affects Domain versions: from 3.0.0 to 3.0.2.

    Drupal Domain drupal/domain Packagist
  • Medium 6.3
    CVE-2026-114543

    Simple User Management - Moderately critical - Access bypass - SA-CONTRIB-2026-239

    Incorrect Authorization vulnerability in Drupal Simple User Management allows Forceful Browsing. This issue affects Simple User Management versions: from 0.0.0 to 1.11.0.

    Drupal Simple User Management drupal/simple_user_management Packagist
  • Medium 6.3
    CVE-2026-118555

    Commerce License - Moderately critical - Access bypass - SA-CONTRIB-2026-260

    Incorrect Authorization vulnerability in Drupal Commerce License allows Forceful Browsing. This issue affects Commerce License versions: from 0.0.0 to 3.1.1.

    Drupal Commerce License drupal/commerce_license Packagist
  • Medium 6.1
    CVE-2026-118575

    Signature pad widget - Critical - Cross-site scripting - SA-CONTRIB-2026-285

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Signature pad widget allows Stored XSS. This issue affects Signature pad widget versions: from 0.0.0 to 1.15.0.

    Drupal Signature pad widget drupal/sign_widget Packagist
  • Medium 5.9
    CVE-2026-114534

    Block Attributes - Moderately critical - Cross site Scripting - SA-CONTRIB-2026-232

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Block Attributes allows Stored XSS. This issue affects Block Attributes versions: from 0.0.0 to 2.1.0.

    Drupal Block Attributes drupal/block_attributes Packagist
  • Medium 5.9
    CVE-2026-118550

    AI (Artificial Intelligence) - Moderately critical - Access bypass - SA-CONTRIB-2026-270

    Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal AI (Artificial Intelligence) allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4…

    Drupal AI (Artificial Intelligence) drupal/ai Packagist
  • Medium 5.9
    CVE-2026-118571

    Media Alias Display - Moderately critical - Information disclosure - SA-CONTRIB-2026-292

    Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Media Alias Display allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Media Alias Display versions: from 0.0.0 to 2.1.3, from 3.0.0 to …

    Drupal Media Alias Display drupal/media_alias_display Packagist
  • Medium 5.6
    CVE-2026-118574

    S3 File System - Moderately critical - Access bypass - SA-CONTRIB-2026-279

    Incorrect Permission Assignment for Critical Resource vulnerability in Drupal S3 File System allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects S3 File System versions: from 0.0.0 to 3.12.0.

    Drupal S3 File System drupal/s3fs Packagist
  • Medium 5.5
    CVE-2026-118553

    AI (Artificial Intelligence) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-273

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Stored XSS. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2.

    Drupal AI (Artificial Intelligence) drupal/ai Packagist
  • Medium 5.4
    CVE-2026-114544

    Media Bulk Upload - Moderately critical - Access bypass - SA-CONTRIB-2026-243

    Incorrect Authorization vulnerability in Drupal Media Bulk Upload allows Forceful Browsing. This issue affects Media Bulk Upload versions: from 0.0.0 to 3.0.6.

    Drupal Media Bulk Upload drupal/media_bulk_upload Packagist
  • Medium 5.4
    CVE-2026-114545

    Fullcalendar View - Moderately critical - Access bypass - SA-CONTRIB-2026-244

    Incorrect Authorization vulnerability in Drupal Fullcalendar View allows Forceful Browsing. This issue affects Fullcalendar View versions: from 0.0.0 to 5.2.6.

    Drupal Fullcalendar View drupal/fullcalendar_view Packagist
  • Medium 5.4
    CVE-2026-114553

    Frontend Editing - Less critical - Access bypass - SA-CONTRIB-2026-241

    Incorrect Authorization vulnerability in Drupal Frontend Editing allows Forceful Browsing. This issue affects Frontend Editing versions: from 0.0.0 to 1.9.3.

    Drupal Frontend Editing drupal/frontend_editing Packagist
  • Medium 5.4
    CVE-2026-118554

    OpenID Connect Client - Moderately critical - Improper authentication - SA-CONTRIB-2026-287

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal OpenID Connect Client allows Authentication Bypass. This issue affects OpenID Connect Client versions: from 0.0.0 to 2.3.1.

    Drupal OpenID Connect Client drupal/oidc Packagist
  • Medium 5.4
    CVE-2026-118569 Public exploit

    Fasttoggle - Moderately critical - Access bypass - SA-CONTRIB-2026-282

    Incorrect Authorization vulnerability in Drupal Fasttoggle allows Forceful Browsing. This issue affects Fasttoggle versions: from 0.0.0 to 4.1.1.

    Drupal Fasttoggle drupal/fasttoggle Packagist
  • Medium 5.3
    CVE-2026-107256

    Shield - Moderately critical - Access bypass - SA-CONTRIB-2026-248

    Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Shield allows Brute Force. This issue affects Shield versions: from 0.0.0 to 1.9.0.

    Drupal Shield drupal/shield Packagist
  • Medium 5.3
    CVE-2026-114530

    Dopup - Critical - Information disclosure - SA-CONTRIB-2026-227

    Incorrect Authorization vulnerability in Drupal Dopup allows Forceful Browsing. This issue affects Dopup versions: from 0.0.0 to 1.0.7.

    Drupal Dopup drupal/dopup Packagist
  • Medium 5.3
    CVE-2026-114533

    Ágora Transparency Theme - Moderately critical - Information disclosure - SA-CONTRIB-2026-231

    Missing Authorization vulnerability in Drupal Ágora Transparency Theme allows Forceful Browsing. This issue affects Ágora Transparency Theme versions: from 0.0.0 to 1.2.3.

    Drupal Ágora Transparency Theme drupal/agora_theme Packagist
  • Medium 5.3
    CVE-2026-114535

    Swiper formatter - Moderately critical - Information disclosure - SA-CONTRIB-2026-233

    Missing Authorization vulnerability in Drupal Swiper formatter allows Forceful Browsing. This issue affects Swiper formatter versions: from 0.0.0 to 2.1.2, from 3.0.1 to 3.1.0.

    Drupal Swiper formatter drupal/swiper_formatter Packagist
  • Medium 5.3
    CVE-2026-118540

    Commerce Core - Moderately critical - Information disclosure - SA-CONTRIB-2026-255

    Incorrect Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41, from 3.0.0 to 3.2.0.

    Drupal Commerce Core drupal/commerce Packagist
  • Medium 5.3
    CVE-2026-118543

    Commerce Core - Moderately critical - Cross-site request forgery - SA-CONTRIB-2026-258

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal Commerce Core allows Cross Site Request Forgery. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13.

    Drupal Commerce Core drupal/commerce Packagist
  • Medium 5.3
    CVE-2026-118559

    Commerce Stripe - Moderately critical - Improper verification of cryptographic signature - SA-CONTRIB-2026-264

    Improper Verification of Cryptographic Signature vulnerability in Drupal Commerce Stripe allows Signature Spoof. This issue affects Commerce Stripe versions: from 0.0.0 to 1.4, from 2.0.0 to 2.2.3.

    Drupal Commerce Stripe drupal/commerce_stripe Packagist
  • Medium 5.3
    CVE-2026-118583

    Field Permissions - Moderately critical - Access bypass - SA-CONTRIB-2026-288

    Incorrect Authorization vulnerability in Drupal Field Permissions allows Forceful Browsing. This issue affects Field Permissions versions: from 0.0.0 to 1.6.0.

    Drupal Field Permissions drupal/field_permissions Packagist
  • Medium 5.3
    CVE-2026-118584

    Field Permissions - Moderately critical - Access bypass - SA-CONTRIB-2026-289

    Incorrect Authorization vulnerability in Drupal Field Permissions allows Forceful Browsing. This issue affects Field Permissions versions: from 0.0.0 to 1.6.0.

    Drupal Field Permissions drupal/field_permissions Packagist
  • Medium 4.8
    CVE-2026-114541

    Frontend Editing - Moderately critical - Cross-Site Request Forgery (CSRF) - SA-CONTRIB-2026-240

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal Frontend Editing allows Cross Site Request Forgery. This issue affects Frontend Editing versions: from 0.0.0 to 1.9.3.

    Drupal Frontend Editing drupal/frontend_editing Packagist
  • Medium 4.8
    CVE-2026-118572

    OAuth Login - OAuth OIDC SSO - Critical - Authentication bypass - SA-CONTRIB-2026-284

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal OAuth Login - OAuth OIDC SSO allows Authentication Bypass. This issue affects OAuth Login - OAuth OIDC SSO versions: from 0.0.0 to 3.1.1.

    Drupal OAuth Login - OAuth OIDC SSO drupal/oauth_login_oauth2 Packagist
  • Medium 4.8
    CVE-2026-118573

    OAuth2 Token Manager - Critical - Access bypass - SA-CONTRIB-2026-290

    Missing Authorization vulnerability in Drupal OAuth2 Token Manager allows Forceful Browsing. This issue affects OAuth2 Token Manager versions: from 0.0.0 to 1.2.0.

    Drupal OAuth2 Token Manager drupal/oauth2_token_manager Packagist
  • Medium 4.7
    CVE-2026-118567

    Bulk Update User Roles - Moderately critical - Incorrect authorization - SA-CONTRIB-2026-280

    Incorrect Authorization vulnerability in Drupal Bulk Update User Roles allows Forceful Browsing. This issue affects Bulk Update User Roles versions: from 0.0.0 to 1.0.5.

    Drupal Bulk Update User Roles drupal/bulk_update_user_roles Packagist
  • Medium 4.3
    CVE-2026-114554

    AI File to Text - Moderately critical - Access bypass - SA-CONTRIB-2026-251

    Incorrect Authorization vulnerability in Drupal AI File to Text allows Forceful Browsing. This issue affects AI File to Text versions: from 0.0.0 to 1.0.1.

    Drupal AI File to Text drupal/ai_file_to_text Packagist
  • Medium 4.3
    CVE-2026-118541

    Commerce Core - Less critical - Access bypass - SA-CONTRIB-2026-256

    Incorrect Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13.

    Drupal Commerce Core drupal/commerce Packagist
  • Low 3.7
    CVE-2026-114547

    TinyPNG - Moderately critical - Information disclosure - SA-CONTRIB-2026-246

    Missing Authorization vulnerability in Drupal TinyPNG allows Forceful Browsing. This issue affects TinyPNG versions: from 0.0.0 to 2.0.2.

    Drupal TinyPNG drupal/tinypng Packagist
  • Low 3.7
    CVE-2026-114548

    ImageAPI Optimize WebP - Moderately critical - Information disclosure - SA-CONTRIB-2026-247

    Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal ImageAPI Optimize WebP allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects ImageAPI Optimize WebP versions: from 0.0.0 to 2.1.2.

    Drupal ImageAPI Optimize WebP drupal/imageapi_optimize_webp Packagist
  • Low 3.7
    CVE-2026-118544

    Commerce Core - Moderately critical - Information disclosure - SA-CONTRIB-2026-259

    Exposure of Sensitive Information Through Data Queries vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13.

    Drupal Commerce Core drupal/commerce Packagist
  • Low 3.7
    CVE-2026-118548

    AI (Artificial Intelligence) - Moderately critical - Information disclosure - SA-CONTRIB-2026-268

    Incorrect Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Resource Injection. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2.

    Drupal AI (Artificial Intelligence) drupal/ai Packagist
  • Low 3.5
    CVE-2026-114555

    Data field - Moderately critical - Cross site scripting - SA-CONTRIB-2026-250

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Data field allows Stored XSS. This issue affects Data field versions: from 0.0.0 to 2.0.14.

    Drupal Data field drupal/datafield Packagist
  • Low 3.3
    CVE-2026-118568

    Content Sync (content-sync.io) - Moderately critical - Information disclosure - SA-CONTRIB-2026-291

    Insecure Storage of Sensitive Information vulnerability in Drupal Content Sync (content-sync.io) allows Retrieve Embedded Sensitive Data. This issue affects Content Sync (content-sync.io) versions: from 0.0.0 to 3.2.2.

    Drupal Content Sync (content-sync.io) drupal/cms_content_sync Packagist
  • Low 3.1
    CVE-2026-118551

    AI (Artificial Intelligence) - Less critical - Information Disclosure - SA-CONTRIB-2026-271

    Insecure Storage of Sensitive Information vulnerability in Drupal AI (Artificial Intelligence) allows Retrieve Embedded Sensitive Data. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2.

    Drupal AI (Artificial Intelligence) drupal/ai Packagist
  • Low 2.7
    CVE-2026-118542

    Commerce Core - Moderately critical - Access bypass - SA-CONTRIB-2026-257

    Incorrect Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13.

    Drupal Commerce Core drupal/commerce Packagist
  • Low 2.7
    CVE-2026-118557

    Commerce Shipping - Less critical - Access bypass - SA-CONTRIB-2026-262

    Incorrect Authorization vulnerability in Drupal Commerce Shipping allows Forceful Browsing. This issue affects Commerce Shipping versions: from 0.0.0 to 2.16.0, from 3.0.0 to 3.0.6.

    Drupal Commerce Shipping drupal/commerce_shipping Packagist

Revision history

  1. #2

    CVE's ergänzt

  2. #1

    Initiale Fassung

References