Filtered by vendor Drupal Subscriptions
Total 1212 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2026-96389 1 Drupal 1 Xray Audit 2026-10-31 6.5 Medium
Missing Authorization vulnerability in Drupal Xray Audit allows Forceful Browsing. This issue affects Xray Audit versions: from 0.0.0 to 1.6.3, from 2.0.0 to 2.0.4, from 3.0.0 to 3.1.1.
CVE-2026-107266 1 Drupal 1 Views Share 2026-10-31 N/A
Missing Authorization vulnerability in Drupal Views Share allows Forceful Browsing. This issue affects Views Share versions: from 0.0.0 to 2.0.1.
CVE-2026-107265 1 Drupal 1 Leaflet 2026-10-31 5.4 Medium
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Leaflet allows Stored XSS. This issue affects Leaflet versions: from 0.0.0 to 10.4.13.
CVE-2026-107264 1 Drupal 1 Inline Formatter Field 2026-10-31 5.4 Medium
Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Inline Formatter Field allows Code Injection. This issue affects Inline Formatter Field versions: from 0.0.0 to 4.2.0.
CVE-2026-107263 1 Drupal 1 Gutenberg 2026-10-31 5.4 Medium
Incorrect Authorization vulnerability in Drupal Gutenberg allows Forceful Browsing. This issue affects Gutenberg versions: from 0.0.0 to 2.15.0, from 3.0.0 to 3.0.7.
CVE-2026-107261 1 Drupal 1 Authenticator Login Plus (2fa) 2026-10-31 4.2 Medium
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Authenticator Login Plus (2FA) allows Authentication Bypass. This issue affects Authenticator Login Plus (2FA) versions: from 0.0.0 to 1.0.1.
CVE-2026-107259 1 Drupal 1 Linked Field 2026-10-31 5.4 Medium
Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Linked Field allows Code Injection. This issue affects Linked Field versions: from 0.0.0 to 1.8.0.
CVE-2026-107258 1 Drupal 1 Inline Entity Form Dialog 2026-10-31 5.4 Medium
Incorrect Authorization vulnerability in Drupal Inline Entity Form Dialog allows Forceful Browsing. This issue affects Inline Entity Form Dialog versions: from 0.0.0 to 1.0.6.
CVE-2026-107257 1 Drupal 1 Actstream 2026-10-31 6.5 Medium
Incorrect Authorization vulnerability in Drupal Actstream allows Forceful Browsing. This issue affects Actstream versions: from 0.0.0 to 2.0.1, from 2.1.0 to 2.1.1.
CVE-2026-107254 1 Drupal 1 Authenticator Login Plus (2fa) 2026-10-31 4.8 Medium
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Authenticator Login Plus (2FA) allows Authentication Bypass. This issue affects Authenticator Login Plus (2FA) versions: from 0.0.0 to 1.0.1.
CVE-2026-107252 1 Drupal 1 Mathjax: Latex For Drupal 2026-10-31 5.4 Medium
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal MathJax: LaTeX for Drupal allows Cross-Site Scripting (XSS). This issue affects MathJax: LaTeX for Drupal versions: from 0.0.0 to 4.1.2.
CVE-2026-107251 1 Drupal 1 Entity Reference Manager (merge Entities) 2026-10-31 6.5 Medium
Incorrect Authorization vulnerability in Drupal Entity Reference Manager (Merge entities) allows Forceful Browsing. This issue affects Entity Reference Manager (Merge entities) versions: from 0.0.0 to 1.0.3.
CVE-2026-107250 1 Drupal 1 Eca Helper 2026-10-31 5.9 Medium
Vulnerability in Drupal ECA Helper. This issue affects ECA Helper versions: *.*.
CVE-2026-107249 1 Drupal 1 Block Ajax 2026-10-31 9.8 Critical
Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Block AJAX allows Object Injection. This issue affects Block AJAX versions: from 0.0.0 to 3.0.2.
CVE-2026-118553 1 Drupal 1 Artificial Intelligence 2026-10-31 N/A
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Stored XSS. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2.
CVE-2026-118552 1 Drupal 1 Artificial Intelligence 2026-10-31 N/A
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Cross-Site Scripting (XSS). This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2.
CVE-2026-118551 1 Drupal 1 Artificial Intelligence 2026-10-31 N/A
Insecure Storage of Sensitive Information vulnerability in Drupal AI (Artificial Intelligence) allows Retrieve Embedded Sensitive Data. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2.
CVE-2026-118550 1 Drupal 1 Artificial Intelligence 2026-10-31 N/A
Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal AI (Artificial Intelligence) allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2.
CVE-2026-118549 1 Drupal 1 Artificial Intelligence 2026-10-31 N/A
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Cross-Site Scripting (XSS). This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2.
CVE-2026-118548 1 Drupal 1 Artificial Intelligence 2026-10-31 N/A
Incorrect Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Resource Injection. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2.