A missing authorization vulnerability in Drupal Commerce Core allows unauthorized users to perform forceful browsing. This affects Commerce Core versions from 0.0.0 up to 2.41 and from 3.0.0 up to 3.3.13. The vulnerability is identified as CWE-862. No CVSS score or patch information is provided.
An authentication bypass vulnerability exists in the Drupal Domain Login Restrict module, allowing attackers to bypass authentication using an alternate path or channel. This affects versions from 0.0.0 up to and including 1.5.0 of the module.
A stored cross-site scripting (XSS) vulnerability exists in the Drupal Data field component, affecting versions from 0.0.0 up to 2.0.14. This vulnerability is due to improper neutralization of input during web page generation, allowing malicious scripts to be stored and executed in users' browsers.
An Incorrect Authorization vulnerability in the Drupal AI File to Text module allows forceful browsing. This affects versions from 0.0.0 up to 1.0.1. The vulnerability relates to improper access control, enabling unauthorized users to access resources they should not be able to. No CVSS score or detailed impact information is provided.
An Incorrect Authorization vulnerability in the Drupal Rabbit Hole module allows forceful browsing. This affects Rabbit Hole versions from 0.0.0 up to and including 1.3.0. The vulnerability could enable unauthorized users to access content or functionality they should not be able to reach.
An incorrect authorization vulnerability in Drupal Frontend Editing versions up to 1.9.3 allows forceful browsing, potentially enabling unauthorized access to restricted frontend editing functionality.
An incorrect authorization vulnerability in the Drupal Fullcalendar View module allows forceful browsing. This vulnerability affects Fullcalendar View versions from 0.0.0 up to 5.2.6. No CVSS score or detailed impact information is provided.
A missing authorization vulnerability in the Drupal TinyPNG module allows forceful browsing. This affects TinyPNG versions from 0.0.0 up to 2.0.2. The vulnerability is identified as CVE-2026-114547 and is categorized under CWE-862 (Missing Authorization). No CVSS score or patch information is provided.
Incorrect Authorization vulnerability in Drupal Media Bulk Upload allows Forceful Browsing. This issue affects Media Bulk Upload versions: from 0.0.0 to 3.0.6.
Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Media Alias Display allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Media Alias Display versions: from 0.0.0 to 2.1.2, from 3.0.0 to 3.0.2.
Incorrect Authorization vulnerability in Drupal Simple User Management allows Forceful Browsing. This issue affects Simple User Management versions: from 0.0.0 to 1.11.0.
Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Simple OAuth (OAuth2) & OpenID Connect allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Simple OAuth (OAuth2) & OpenID Connect versions: from 6.1.0 to 6.1.3.
Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal ImageAPI Optimize WebP allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects ImageAPI Optimize WebP versions: from 0.0.0 to 2.1.2.
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal DocCheck Basic allows Authentication Bypass. This issue affects DocCheck Basic versions: 7.x.
Cross-Site Request Forgery (CSRF) vulnerability in Drupal Frontend Editing allows Cross Site Request Forgery. This issue affects Frontend Editing versions: from 0.0.0 to 1.9.3.
Missing Authorization vulnerability in Drupal Swiper formatter allows Forceful Browsing. This issue affects Swiper formatter versions: from 0.0.0 to 2.1.2, from 3.0.1 to 3.1.0.
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal USWDS Paragraph Components allows Stored XSS. This issue affects USWDS Paragraph Components versions: from 0.0.0 to 3.1.3.
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Block Attributes allows Stored XSS. This issue affects Block Attributes versions: from 0.0.0 to 2.1.0.
Incorrect Authorization vulnerability in Drupal View Unpublished allows Forceful Browsing. This issue affects View Unpublished versions: from 0.0.0 to 1.5.0.