Threat database

A Cross-Site Scripting (XSS) vulnerability exists in the Drupal AI (Artificial Intelligence) component due to improper neutralization of input during web page generation. This vulnerability affects versions from 0.0.0 to 1.4.11 and from 1.5.0 to 1.5.2 of the Drupal AI module. The flaw allows injection of malicious scripts into web pages, potentially leading to client-side code execution in users' browsers.

An incorrect authorization vulnerability in Drupal Commerce Shipping allows forceful browsing. This affects Commerce Shipping versions from 0.0.0 to 2.16.0 and from 3.0.0 to 3.0.6. The vulnerability is identified as CVE-2026-118557 and relates to improper access control.

A vulnerability in Drupal OpenID Connect Client versions up to 2.3.1 allows authentication bypass via an alternate path or channel. This flaw could enable unauthorized access by circumventing normal authentication mechanisms.

A Cross-Site Request Forgery (CSRF) vulnerability exists in Drupal Commerce Stripe versions 2.0.0 through 2.2.3. This vulnerability allows an attacker to perform unauthorized actions on behalf of an authenticated user without their consent.

An incorrect authorization vulnerability in Drupal Commerce License versions up to 3.1.1 allows forceful browsing, potentially enabling unauthorized access to resources.

A vulnerability in Drupal AI (Artificial Intelligence) allows sensitive information to be stored in the web browser cache due to incorrectly configured access control security levels. This affects versions from 0.0.0 to 1.4.11 and from 1.5.0 to 1.5.2. The issue could expose sensitive data through the browser cache if exploited.

A Cross-Site Scripting (XSS) vulnerability exists in the Drupal AI (Artificial Intelligence) component due to improper neutralization of input during web page generation. This vulnerability affects versions from 0.0.0 to 1.4.11 and from 1.5.0 to 1.5.2 of the Drupal AI module. The flaw allows injection of malicious scripts into web pages, potentially impacting users who view the affected content.

A stored cross-site scripting (XSS) vulnerability exists in Drupal AI versions from 0.0.0 to 1.4.11 and from 1.5.0 to 1.5.2 due to improper neutralization of input during web page generation. This flaw allows malicious input to be stored and later executed in users' browsers when viewing affected pages.

A vulnerability identified as CVE-2026-118551 affects the Drupal AI (Artificial Intelligence) module, allowing insecure storage of sensitive information. This flaw enables retrieval of embedded sensitive data. The issue impacts versions from 0.0.0 to 1.4.11 and from 1.5.0 to 1.5.2 of the Drupal AI module.

An incorrect authorization vulnerability in Drupal Commerce Shipping allows forceful browsing. This affects Commerce Shipping versions from 0.0.0 to 2.16.0 and from 3.0.0 to 3.0.6. The flaw could enable unauthorized users to access resources or pages they should not be able to reach.

An incorrect authorization vulnerability in Drupal AI (Artificial Intelligence) allows resource injection. The issue affects versions from 0.0.0 to 1.4.11 and from 1.5.0 to 1.5.2. No CVSS score or detailed impact information is provided.

A Cross-Site Scripting (XSS) vulnerability exists in Drupal AI (Artificial Intelligence) versions from 0.0.0 to 1.4.11 and from 1.5.0 to 1.5.2 due to improper neutralization of input during web page generation. This vulnerability could allow an attacker to inject malicious scripts into web pages viewed by other users.

A vulnerability in Drupal Commerce Core allows exposure of sensitive information through data queries, enabling forceful browsing. This affects Commerce Core versions from 0.0.0 to 2.41.0 and from 3.0.0 to 3.3.13. No CVSS score or patch information is provided.

A Cross-Site Scripting (XSS) vulnerability exists in Drupal AI versions from 0.0.0 to 1.4.11 and from 1.5.0 to 1.5.2 due to improper neutralization of input during web page generation. This flaw could allow an attacker to inject malicious scripts into web pages viewed by other users.

An incorrect authorization vulnerability in Drupal Commerce Core allows forceful browsing, potentially enabling unauthorized access to resources. This affects Commerce Core versions from 0.0.0 up to 2.41.0 and from 3.0.0 up to 3.3.13.

A Cross-Site Request Forgery (CSRF) vulnerability exists in Drupal Commerce Core affecting versions from 0.0.0 to 2.41.0 and from 3.0.0 to 3.3.13. This vulnerability allows an attacker to perform unauthorized actions on behalf of authenticated users without their consent.

A vulnerability identified as CVE-2026-114573 affects the Monster Menus module for Drupal. It involves improperly controlled modification of dynamically-determined object attributes, which can lead to object injection. The affected versions range from 0.0.0 up to 9.5.6. No CVSS score or detailed impact information is provided.

An incorrect authorization vulnerability in Drupal Commerce Core allows forceful browsing, potentially enabling unauthorized access to resources. This affects Commerce Core versions from 0.0.0 up to 2.41 and from 3.0.0 up to 3.2.0.

An incorrect authorization vulnerability in Drupal Commerce Core allows forceful browsing. This affects Commerce Core versions from 0.0.0 up to 2.41.0 and from 3.0.0 up to 3.3.13. The vulnerability could enable unauthorized access to resources due to improper authorization checks.

A missing authorization vulnerability in Drupal Commerce Core allows unauthorized users to perform forceful browsing. This affects Commerce Core versions from 0.0.0 up to 2.41 and from 3.0.0 up to 3.3.13. The vulnerability is identified as CWE-862. No CVSS score or patch information is provided.