Threat database

A vulnerability identified as CVE-2026-118551 affects the Drupal AI (Artificial Intelligence) module, allowing insecure storage of sensitive information. This flaw enables retrieval of embedded sensitive data. The issue impacts versions from 0.0.0 to 1.4.11 and from 1.5.0 to 1.5.2 of the Drupal AI module.

An incorrect authorization vulnerability in Drupal Commerce Shipping allows forceful browsing. This affects Commerce Shipping versions from 0.0.0 to 2.16.0 and from 3.0.0 to 3.0.6. The flaw could enable unauthorized users to access resources or pages they should not be able to reach.

An incorrect authorization vulnerability in Drupal AI (Artificial Intelligence) allows resource injection. The issue affects versions from 0.0.0 to 1.4.11 and from 1.5.0 to 1.5.2. No CVSS score or detailed impact information is provided.

A Cross-Site Scripting (XSS) vulnerability exists in Drupal AI (Artificial Intelligence) versions from 0.0.0 to 1.4.11 and from 1.5.0 to 1.5.2 due to improper neutralization of input during web page generation. This vulnerability could allow an attacker to inject malicious scripts into web pages viewed by other users.

A vulnerability in Drupal Commerce Core allows exposure of sensitive information through data queries, enabling forceful browsing. This affects Commerce Core versions from 0.0.0 to 2.41.0 and from 3.0.0 to 3.3.13. No CVSS score or patch information is provided.

A Cross-Site Scripting (XSS) vulnerability exists in Drupal AI versions from 0.0.0 to 1.4.11 and from 1.5.0 to 1.5.2 due to improper neutralization of input during web page generation. This flaw could allow an attacker to inject malicious scripts into web pages viewed by other users.

An incorrect authorization vulnerability in Drupal Commerce Core allows forceful browsing, potentially enabling unauthorized access to resources. This affects Commerce Core versions from 0.0.0 up to 2.41.0 and from 3.0.0 up to 3.3.13.

A Cross-Site Request Forgery (CSRF) vulnerability exists in Drupal Commerce Core affecting versions from 0.0.0 to 2.41.0 and from 3.0.0 to 3.3.13. This vulnerability allows an attacker to perform unauthorized actions on behalf of authenticated users without their consent.

A vulnerability identified as CVE-2026-114573 affects the Monster Menus module for Drupal. It involves improperly controlled modification of dynamically-determined object attributes, which can lead to object injection. The affected versions range from 0.0.0 up to 9.5.6. No CVSS score or detailed impact information is provided.

An incorrect authorization vulnerability in Drupal Commerce Core allows forceful browsing, potentially enabling unauthorized access to resources. This affects Commerce Core versions from 0.0.0 up to 2.41 and from 3.0.0 up to 3.2.0.

An incorrect authorization vulnerability in Drupal Commerce Core allows forceful browsing. This affects Commerce Core versions from 0.0.0 up to 2.41.0 and from 3.0.0 up to 3.3.13. The vulnerability could enable unauthorized access to resources due to improper authorization checks.

A missing authorization vulnerability in Drupal Commerce Core allows unauthorized users to perform forceful browsing. This affects Commerce Core versions from 0.0.0 up to 2.41 and from 3.0.0 up to 3.3.13. The vulnerability is identified as CWE-862. No CVSS score or patch information is provided.

An authentication bypass vulnerability exists in the Drupal Domain Login Restrict module, allowing attackers to bypass authentication using an alternate path or channel. This affects versions from 0.0.0 up to and including 1.5.0 of the module.

A stored cross-site scripting (XSS) vulnerability exists in the Drupal Data field component, affecting versions from 0.0.0 up to 2.0.14. This vulnerability is due to improper neutralization of input during web page generation, allowing malicious scripts to be stored and executed in users' browsers.

An Incorrect Authorization vulnerability in the Drupal AI File to Text module allows forceful browsing. This affects versions from 0.0.0 up to 1.0.1. The vulnerability relates to improper access control, enabling unauthorized users to access resources they should not be able to. No CVSS score or detailed impact information is provided.

An Incorrect Authorization vulnerability in the Drupal Rabbit Hole module allows forceful browsing. This affects Rabbit Hole versions from 0.0.0 up to and including 1.3.0. The vulnerability could enable unauthorized users to access content or functionality they should not be able to reach.

An incorrect authorization vulnerability in Drupal Frontend Editing versions up to 1.9.3 allows forceful browsing, potentially enabling unauthorized access to restricted frontend editing functionality.

An incorrect authorization vulnerability in the Drupal Fullcalendar View module allows forceful browsing. This vulnerability affects Fullcalendar View versions from 0.0.0 up to 5.2.6. No CVSS score or detailed impact information is provided.

A missing authorization vulnerability in the Drupal TinyPNG module allows forceful browsing. This affects TinyPNG versions from 0.0.0 up to 2.0.2. The vulnerability is identified as CVE-2026-114547 and is categorized under CWE-862 (Missing Authorization). No CVSS score or patch information is provided.

Incorrect Authorization vulnerability in Drupal Media Bulk Upload allows Forceful Browsing. This issue affects Media Bulk Upload versions: from 0.0.0 to 3.0.6.