Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Tagify allows Cross-Site Scripting (XSS).This issue affects Tagify: from 0.0.0 before 1.2.49.
Cross-Site Request Forgery (CSRF) vulnerability in Drupal Theme Negotiation by Rules allows Cross Site Request Forgery.This issue affects Theme Negotiation by Rules: from 0.0.0 before 1.2.1.
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal UI Icons allows Cross-Site Scripting (XSS).This issue affects UI Icons: from 0.0.0 before 1.0.1, from 1.1.0 before 1.1.1.
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Quick Edit allows Cross-Site Scripting (XSS).This issue affects Quick Edit: from 0.0.0 before 1.0.5, from 2.0.0 before 2.0.1.
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Login Disable allows Functionality Bypass.This issue affects Login Disable: from 0.0.0 before 2.1.3.
CVE-2026-1554 is an XML Injection vulnerability, specifically a Blind XPath Injection, found in the Drupal Central Authentication System (CAS) Server versions before 2.0.3 and between 2.1.0 and 2.1.2. This vulnerability allows an attacker with limited privileges to escalate their privileges by manipulating XML input used in authentication processes. The CVSS score is 4.2, indicating a medium severity level, with network attack vector but requiring high attack complexity and low privileges.
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Microsoft Entra ID SSO Login allows Privilege Escalation.This issue affects Microsoft Entra ID SSO Login: from 0.0.0 before 1.0.4.
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AT Internet Piano Analytics allows Cross-Site Scripting (XSS).This issue affects AT Internet Piano Analytics: from 0.0.0 before 1.0.1, from 2.0.0 before 2.3.1.
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AT Internet SmartTag allows Cross-Site Scripting (XSS).This issue affects AT Internet SmartTag: from 0.0.0 before 1.0.1.
Privilege Defined With Unsafe Actions vulnerability in Drupal Role Delegation allows Privilege Escalation.This issue affects Role Delegation: from 1.3.0 before 1.5.0.
Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal Group invite allows Forceful Browsing.This issue affects Group invite: from 0.0.0 before 2.3.9, from 3.0.0 before 3.0.4, from 4.0.0 before 4.0.4.
CVE-2025-14840 is a high-severity vulnerability in the Drupal HTTP Client Manager affecting versions prior to 9.3.13, 10.0.2, and 11.0.1. It stems from an improper check for unusual or exceptional conditions (CWE-754), enabling forceful browsing attacks. The vulnerability allows unauthenticated, remote attackers to cause a denial of service by exploiting the HTTP Client Manager's failure to handle exceptional conditions properly. There are no known exploits in the wild yet.
CVE-2025-14472 is a high-severity Cross-Site Request Forgery (CSRF) vulnerability affecting Drupal's Acquia Content Hub versions before 3.6.4 and between 3.7.0 and 3.7.3. The vulnerability allows attackers to trick authenticated users into executing unwanted actions on the Content Hub without their consent, potentially leading to unauthorized data modification or leakage. Exploitation requires user interaction but no privileges or authentication from the attacker. The vulnerability impacts confidentiality and integrity but not availability.
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Disable Login Page allows Functionality Bypass.This issue affects Disable Login Page: from 0.0.0 before 1.1.3.
CVE-2025-13985 is an incorrect authorization vulnerability in the Drupal Entity Share module versions before 3.13.0. It allows unauthenticated attackers to perform forceful browsing, potentially accessing resources they should not be authorized to view. The vulnerability has a CVSS score of 5.3, indicating medium severity, with low impact on confidentiality and no impact on integrity or availability. Exploitation requires no privileges or user interaction and can be performed remotely. No known exploits are currently reported in the wild. European organizations using Drupal with the vulnerable Entity Share module should prioritize patching or mitigating this issue to prevent unauthorized data exposure. Countries with high Drupal adoption and critical public or private sector infrastructures using Drupal are more likely to be affected.
CVE-2025-13984 is a medium severity vulnerability in Drupal's Next.js integration involving a permissive cross-domain security policy that allows untrusted domains. This misconfiguration enables Cross-Site Scripting (XSS) attacks by permitting malicious domains to execute scripts in the context of trusted sites. The vulnerability affects Next.js versions from 0.0.0 before 1.6.4 and from 2.0.
CVE-2025-13983 is a medium severity Cross-Site Scripting (XSS) vulnerability in the Drupal Tagify module versions before 1.2.44. It arises from improper neutralization of input during web page generation, allowing attackers with low privileges and requiring user interaction to inject malicious scripts. The vulnerability impacts confidentiality and integrity by enabling script execution in the context of authenticated users, potentially leading to session hijacking or data manipulation. No known exploits are currently reported in the wild. European organizations using Drupal with the vulnerable Tagify versions should prioritize patching to mitigate risks. The vulnerability has a CVSS score of 5.4, reflecting its moderate impact and exploitability. Countries with significant Drupal adoption and critical web infrastructure, such as Germany, France, and the UK, are most likely to be affected.
CVE-2025-13982 is a high-severity Cross-Site Request Forgery (CSRF) vulnerability affecting the Drupal Login Time Restriction module versions before 1.0.3. This vulnerability allows an attacker to trick authenticated users into executing unwanted actions related to login time restrictions without their consent. Exploitation requires user interaction but no privileges or authentication are needed, and it can result in high confidentiality and integrity impacts. Although no known exploits are currently in the wild, the vulnerability poses a significant risk to Drupal sites using this module. European organizations relying on Drupal for web content management could face unauthorized changes to login policies, potentially leading to unauthorized access or denial of legitimate access. Mitigation involves promptly updating the module to version 1.0.3 or later once available, implementing anti-CSRF tokens, and monitoring for suspicious activity.
