Filtered by vendor Drupal Subscriptions
Total 1212 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2026-13235 2 Artificial Intelligence Project, Drupal 2 Artificial Intelligence, Artificial Intelligence 2026-07-13 3.3 Low
Missing Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Forceful Browsing. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.2.17, from 1.3.0 to 1.3.8, from 1.4.0 to 1.4.3.
CVE-2026-13236 2 Artificial Intelligence Project, Drupal 2 Artificial Intelligence, Ai Agents 2026-07-13 4.2 Medium
Missing Authorization vulnerability in Drupal AI Agents allows Forceful Browsing. This issue affects AI Agents versions: from 0.0.0 to 1.1.4, from 1.2.0 to 1.2.5, from 1.3.0 to 1.3.1.
CVE-2026-13232 2 Anuaralfetahe, Drupal 2 Advanced Content Feedback, Advanced Content Feedback (aka Admin Feedback) 2026-07-13 3.1 Low
Incorrect Authorization vulnerability in Drupal Advanced Content Feedback (aka admin_feedback) allows Forceful Browsing. This issue affects Advanced Content Feedback (aka admin_feedback) versions: from 0.0.0 to 2.8.0.
CVE-2026-13241 2 Drupal, Md-systems 2 Paragraphs, Paragraphs 2026-07-13 6.5 Medium
Missing Authorization vulnerability in Drupal Paragraphs allows Forceful Browsing. This issue affects Paragraphs versions: from 0.0.0 to 1.21.0.
CVE-2026-13240 2 Drupal, Md-systems 2 Paragraphs, Paragraphs 2026-07-13 6.5 Medium
Missing Authorization vulnerability in Drupal Paragraphs allows Forceful Browsing. This issue affects Paragraphs versions: from 0.0.0 to 1.21.0.
CVE-2026-13239 2 Drupal, Wiss-ki 2 Wisski, Wisski 2026-07-13 6.5 Medium
Missing Authorization vulnerability in Drupal WissKI allows Forceful Browsing. This issue affects WissKI versions: from 0.0.0 to 4.2.0.
CVE-2026-13244 2 Dakku, Drupal 2 Tealium Iq Tag Management, Tealium Iq Tag Management 2026-07-13 8.1 High
Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Tealium iQ Tag Management allows Object Injection. This issue affects Tealium iQ Tag Management versions: from 0.0.0 to 2.4.0.
CVE-2026-13243 2 Drupal, Victorkane 2 Salesforce Suite, Salesforce Suite 2026-07-13 4.8 Medium
Cross-Site Request Forgery (CSRF) vulnerability in Drupal Salesforce Suite allows Cross Site Request Forgery. This issue affects Salesforce Suite versions: from 0.0.0 to 5.1.3.
CVE-2026-15080 2 Drupal, Lingotek 2 Ray Enterprise Translation, Ray Enterprise Translation 2026-07-13 4.3 Medium
Cross-Site Request Forgery (CSRF) vulnerability in Drupal Ray Enterprise Translation allows Cross Site Request Forgery. This issue affects Ray Enterprise Translation versions: from 0.0.0 to 4.0.4, from 4.1.0 to 4.1.4, from 11.0.0 to 11.0.4.
CVE-2026-15079 2 Budda, Drupal 2 Login Disable, Login Disable 2026-07-13 5.4 Medium
Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Login Disable allows Brute Force. This issue affects Login Disable versions: from 0.0.0 to 2.1.4.
CVE-2026-58590 2 Drupal, Flowdrop Project 2 Flowdrop, Flowdrop 2026-07-13 5.4 Medium
Missing Authorization vulnerability in Drupal FlowDrop allows Forceful Browsing. This issue affects FlowDrop versions: from 0.0.0 to 1.6.0.
CVE-2026-58589 2 Drupal, Flowdrop Project 2 Flowdrop, Flowdrop 2026-07-13 5.4 Medium
Missing Authorization vulnerability in Drupal FlowDrop allows Forceful Browsing. This issue affects FlowDrop versions: from 0.0.0 to 1.6.0.
CVE-2026-13231 2 Anuaralfetahe, Drupal 2 Advanced Content Feedback, Advanced Content Feedback (aka Admin Feedback) 2026-07-13 6.1 Medium
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Advanced Content Feedback (aka admin_feedback) allows Stored XSS. This issue affects Advanced Content Feedback (aka admin_feedback) versions: from 0.0.0 to 2.8.0.
CVE-2026-13234 2 Artificial Intelligence Project, Drupal 2 Artificial Intelligence, Artificial Intelligence 2026-07-13 6.1 Medium
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Cross-Site Scripting (XSS). This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.2.17, from 1.3.0 to 1.3.8, from 1.4.0 to 1.4.3.
CVE-2026-58587 2 Drupal, Drupal Canvas Project 2 Drupal Canvas, Drupal Canvas 2026-07-13 6.1 Medium
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal Canvas allows Cross-Site Scripting (XSS). This issue affects Drupal Canvas versions: from 0.0.0 to 1.4.2, from 1.5.0 to 1.5.2, from 1.6.0 to 1.6.1, from 1.7.0 to 1.7.1.
CVE-2026-13242 2 Dopry, Drupal 2 Geolocation Field, Geolocation Field 2026-07-13 6.5 Medium
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Geolocation Field allows SQL Injection. This issue affects Geolocation Field versions: from 0.0.0 to 3.15.0.
CVE-2026-9726 2 Alternativecommerce, Drupal 2 Alternativecommerce, Drupal Alternativecommerce (basket) 2026-07-13 9.8 Critical
Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal AlternativeCommerce (Basket) allows Object Injection. This issue affects Drupal AlternativeCommerce (Basket) versions: from 0.0.0 to 2.1.17.
CVE-2026-10768 2 Drupal, Localgovdrupal 2 Localgov Workflows, Localgov Workflows 2026-07-13 9.8 Critical
Missing Authorization vulnerability in Drupal LocalGov Workflows allows Forceful Browsing. This issue affects LocalGov Workflows versions: from 0.0.0 to 1.6.0.
CVE-2026-4929 2 Drupal, Simple Hierarchical Select Project 2 Simple Hierarchical Select (shs), Simple Hierarchical Select 2026-06-01 5.4 Medium
Simple Hierarchical Select (SHS) for Drupal 7 contains cross-site scripting risk due to improper output escaping of term-derived text. Confirmed affected paths include field formatter output (shs_field_formatter_view) and term-tree child-term data generation (shs_term_get_children). Malicious taxonomy term names can be rendered unsafely depending on output context. This affects versions from 7.x-1.0 through (and including) 7.x-1.10.
CVE-2026-4093 2 Drupal, Taxonomy Term Reference Tree Widget Project 2 Term Reference Tree, Taxonomy Term Reference Tree Widget 2026-06-01 5.4 Medium
In the Drupal 7 Term Reference Tree module, two stored XSS vectors exist in the widget/formatter rendering pipeline. Vector A (token display templates): When the Token module is enabled and token display templates are configured, attacker-controlled token output (e.g., term description) is rendered without proper sanitization. Any user who can edit the referenced taxonomy terms can inject HTML/JS that executes when the field is rendered. Vector B (term label rendering): Taxonomy term labels are not properly sanitized before being rendered in the widget, allowing a user with permission to create or edit taxonomy terms to inject scripts into the term name that execute when a form containing the widget is viewed. Exploit affects versions 7.x-1.x up to and including 7.x-1.11.