Threat database

Incorrect Authorization vulnerability in Drupal Blazy allows Forceful Browsing. This issue affects Blazy versions: from 0.0.0 to 3.0.18.

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal CAPTCHA Protected Page allows Functionality Bypass. This issue affects CAPTCHA Protected Page versions: from 0.0.0 to 1.0.2.

Observable Timing Discrepancy vulnerability in Drupal Commerce CyberSource allows Brute Force. This issue affects Commerce CyberSource versions: from 0.0.0 to 1.10.0.

Privilege Defined With Unsafe Actions vulnerability in Drupal Content Moderation Notifications allows Privilege Escalation. This issue affects Content Moderation Notifications versions: from 0.0.0 to 3.9.0.

Missing Authorization vulnerability in Drupal Data field allows Forceful Browsing. This issue affects Data field versions: from 0.0.0 to 2.0.13.

Missing Authorization vulnerability in Drupal Digital Signage Framework allows Forceful Browsing. This issue affects Digital Signage Framework versions: from 0.0.0 to 2.6.1.

Insertion of Sensitive Information Into Sent Data vulnerability in Drupal DXPR Builder: The Best Editing (AI) Experience for Drupal allows Forceful Browsing. This issue affects DXPR Builder: The Best Editing (AI) Experience for Drupal versions: from 0.0.0 to 2.8.1.

Incorrect Authorization vulnerability in Drupal Entity API allows Forceful Browsing. This issue affects Entity API versions: from 0.0.0 to 1.8.0.

Missing Authorization vulnerability in Drupal Entity PDF allows Forceful Browsing. This issue affects Entity PDF versions: from 0.0.0 to 2.1.5.

Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in Drupal LDAP / Active Directory Integration allows LDAP Injection. This issue affects LDAP / Active Directory Integration versions: from 0.0.0 to 2.2.1.

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Monster Menus allows Stored XSS. This issue affects Monster Menus versions: from 0.0.0 to 9.5.3.

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Slick Carousel allows Stored XSS. This issue affects Slick Carousel versions: from 0.0.0 to 2.1.0.

CVE-2026-15916 is a missing authorization vulnerability in Drupal core that allows forceful browsing. It affects multiple Drupal core versions up to 10.6.13 and certain 11.x versions. The vulnerability has a medium severity with a CVSS score of 4.2. No official patch or remediation guidance is currently provided by the vendor. There are no known exploits in the wild at this time.

CVE-2026-15917 is a Cross-Site Scripting (XSS) vulnerability in Drupal core that arises from improper neutralization of input during web page generation. It affects multiple versions of Drupal core, including all versions from 0.0.0 up to 11.2.*, as well as versions 11.3.0 through 11.3.14 and 11.4.0 through 11.4.4. The vulnerability has a medium severity rating with a CVSS score of 4.7. No official patch or remediation guidance is currently provided, and there are no known exploits in the wild. The vulnerability allows an attacker to inject malicious scripts into web pages generated by Drupal, potentially impacting confidentiality and integrity with user interaction required for exploitation.

CVE-2026-55805 is a stored cross-site scripting (XSS) vulnerability in Drupal core that affects multiple versions up to 10.6.13, 11.3.14, and 11.4.4. The vulnerability arises from improper neutralization of input during web page generation, allowing an attacker to inject malicious scripts. The CVSS score is 5.4, indicating a medium severity level. No official patch or remediation guidance is currently provided by the vendor. There are no known exploits in the wild at this time.

CVE-2026-16646 is a medium severity vulnerability in the Drupal PanKM product. It involves a security issue classified under CWE-306, which relates to missing or insufficient access control. The vulnerability has a CVSS score of 5.7, indicating a moderate impact with high confidentiality and integrity impact but no availability impact. The vulnerability requires high privileges and user interaction, and the attack complexity is high. No specific affected versions or patch information is provided.

CVE-2026-18261 is a medium severity vulnerability in the Drupal Powerful Surveys module. It affects all versions of the module, but specific affected versions are not detailed. The vulnerability involves improper input validation (CWE-20) and requires high privileges and user interaction to exploit. The impact includes high confidentiality and integrity loss, but no availability impact. No official patch or remediation guidance is currently available, and there are no known exploits in the wild.

CVE-2026-18985 is a high-severity incorrect authorization vulnerability in the Drupal Edit in-place field module, affecting versions from 0.0.0 up to 2.1.1. It allows forceful browsing due to improper authorization checks, potentially leading to unauthorized access and modification of sensitive data. The vulnerability has a CVSS score of 8.1, indicating a significant impact on confidentiality and integrity without requiring user interaction. No official patch or remediation guidance is currently available from the vendor.

CVE-2026-18260 is a vulnerability in the Drupal Disable Login Page module that allows excessive authentication attempts, enabling brute force attacks. It affects versions from 0.0.0 up to 1.1.4. The vulnerability is categorized under improper restriction of excessive authentication attempts (CWE-307). The CVSS score is 5.7, indicating a medium severity level. There are no known exploits in the wild and no vendor-provided patch or remediation information is currently available.