Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Orejime allows Cross-Site Scripting (XSS).
This issue affects Orejime: from 0.0.0 before 2.0.16.
CVE-2026-0748 is a medium severity vulnerability in the Drupal 7 Internationalization (i18n) module, specifically the i18n_node submodule. It allows users with both "Translate content" and "Administer content translations" permissions to bypass intended access controls and view unpublished node titles and IDs through the translation UI and its autocomplete widget. This affects versions 7.x-1.0 through 7.x-1.35 of the module. There are no known exploits in the wild and no patch information is provided in the available data.
CVE-2026-1556 is an information disclosure vulnerability in Drupal File (Field) Paths 7.x prior to version 7.1.3. It allows authenticated users to access other users' private files by exploiting filename-collision uploads. This vulnerability affects the file URI processing, causing certain consumers of hook_node_insert()—such as email attachment modules—to receive incorrect file URIs, thereby bypassing normal access controls on private files. The vulnerability has a medium severity with a CVSS score of 6.9. No official patch or remediation information is provided in the available data.
Cross-Site Request Forgery (CSRF) vulnerability in Drupal Automated Logout allows Cross Site Request Forgery.This issue affects Automated Logout: from 0.0.0 before 1.7.0, from 2.0.0 before 2.0.2.
Incorrect Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Resource Injection.This issue affects AI (Artificial Intelligence): from 0.0.0 before 1.1.11, from 1.2.0 before 1.2.12.
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal OpenID Connect / OAuth client allows Authentication Bypass.This issue affects OpenID Connect / OAuth client: from 0.0.0 before 1.5.0.
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Google Analytics GA4 allows Cross-Site Scripting (XSS).This issue affects Google Analytics GA4: from 0.0.0 before 1.1.14.
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Calculation Fields allows Cross-Site Scripting (XSS).This issue affects Calculation Fields: from 0.0.0 before 1.0.4.
Missing Authentication for Critical Function vulnerability in Drupal AJAX Dashboard allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AJAX Dashboard: from 0.0.0 before 3.1.0.
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Responsive Favicons allows Cross-Site Scripting (XSS).This issue affects Responsive Favicons: from 0.0.0 before 2.0.2.
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal SAML SSO - Service Provider allows Cross-Site Scripting (XSS).This issue affects SAML SSO - Service Provider: from 0.0.0 before 3.1.3.
CVE-2026-3216 is a Server-Side Request Forgery (SSRF) vulnerability affecting Drupal Canvas versions from 0.0.0 up to but not including 1.1.1. This vulnerability allows an attacker with low privileges to induce the server to make unauthorized requests to internal or external resources. The CVSS score is 5.0, indicating a medium severity level. There is no official patch or vendor advisory provided yet, and no known exploits in the wild have been reported. The vulnerability impacts confidentiality but not integrity or availability.
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Islandora allows Cross-Site Scripting (XSS).This issue affects Islandora: from 0.0.0 before 2.17.5.
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal CAPTCHA allows Functionality Bypass.This issue affects CAPTCHA: from 0.0.0 before 1.17.0, from 2.0.0 before 2.0.10.
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Anti-Spam by CleanTalk allows Cross-Site Scripting (XSS).This issue affects Anti-Spam by CleanTalk: from 0.0.0 before 9.7.0.
