CVE-2026-114543

Simple User Management - Moderately critical - Access bypass - SA-CONTRIB-2026-239

Incorrect Authorization vulnerability in Drupal Simple User Management allows Forceful Browsing. This issue affects Simple User Management versions: from 0.0.0 to 1.11.0.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Simple User Management

CVE-2026-121447

svg-sanitizer before 1.1.0 XSS via animateTransform on Safari

svg-sanitizer before 1.1.0 contains a cross-site scripting vulnerability that allows attackers to bypass sanitization by placing javascript: URLs in the animateTransform values attribute. Attackers can upload crafted SVG files whose animateTransform targets the href attribute, executing arbitrary JavaScript when Safari users click the link.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Darylldoyle Drupal

Products

Svg-sanitizer Svg Sanitizer

CVE-2026-121443

svg-sanitizer from 1.1.0 before 1.1.1 Denial of Service via Unclosed Tag

svg-sanitizer from 1.1.0 before 1.1.1 contains a denial of service vulnerability that allows remote attackers to crash requests by submitting SVG input ending inside an unclosed tag. Attackers can upload truncated input like a single '<' to trigger an uncaught ValueError from strpos() in hasElementWithTooManyAttributes() or hasInternalDtdSubset() on PHP 8, failing the request.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Darylldoyle Drupal

Products

Svg-sanitizer Svg Sanitizer

CVE-2026-121446

svg-sanitizer 0.5.0 before 1.1.0 Incomplete url() Filtering in SVG Attributes

svg-sanitizer from 0.5.0 before 1.1.0 contains an incomplete filtering vulnerability that allows attackers to bypass remote URL removal by using CSS escape sequences inside url() in SVG presentation attributes. Attackers can supply SVG files with attributes like fill containing escaped slashes that browsers resolve to remote URLs, triggering external requests and enabling data exfiltration.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Svg Sanitizer

CVE-2026-118563

CacheFlush - Critical - Unsupported - SA-CONTRIB-2026-276

Vulnerability in Drupal CacheFlush. This issue affects CacheFlush versions: *.*.

CVSS 3.1 · 6.6 Medium EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Cacheflush

CVE-2026-118565

GroupEx PRO ( Daxko ) integration - Critical - Unsupported - SA-CONTRIB-2026-278

Vulnerability in Drupal GroupEx PRO ( Daxko ) integration. This issue affects GroupEx PRO ( Daxko ) integration versions: *.*.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Groupex Pro ( Daxko ) Integration

CVE-2026-114536

USWDS Paragraph Components - Moderately critical - Cross site scripting - SA-CONTRIB-2026-234

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal USWDS Paragraph Components allows Stored XSS. This issue affects USWDS Paragraph Components versions: from 0.0.0 to 3.1.3.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Uswds Paragraph Components

CVE-2026-114534

Block Attributes - Moderately critical - Cross site Scripting - SA-CONTRIB-2026-232

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Block Attributes allows Stored XSS. This issue affects Block Attributes versions: from 0.0.0 to 2.1.0.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Block Attributes

CVE-2026-114535

Swiper formatter - Moderately critical - Information disclosure - SA-CONTRIB-2026-233

Missing Authorization vulnerability in Drupal Swiper formatter allows Forceful Browsing. This issue affects Swiper formatter versions: from 0.0.0 to 2.1.2, from 3.0.1 to 3.1.0.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Swiper Formatter

CVE-2026-114533

Ágora Transparency Theme - Moderately critical - Information disclosure - SA-CONTRIB-2026-231

Missing Authorization vulnerability in Drupal Ágora Transparency Theme allows Forceful Browsing. This issue affects Ágora Transparency Theme versions: from 0.0.0 to 1.2.3.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Ágora Transparency Theme

CVE-2026-114532

UI Icons - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-230

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal UI Icons allows Cross-Site Scripting (XSS). This issue affects UI Icons versions: from 0.0.0 to 1.1.3, from 2.0.0 to 2.0.2.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Ui Icons

CVE-2026-110738

Gin Admin Theme - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-219

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Gin Admin Theme allows Cross-Site Scripting (XSS). This issue affects Gin Admin Theme versions: from 0.0.0 to 4.1.4, from 5.0.0 to 5.0.16.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Gin Admin Theme

CVE-2026-114553

Frontend Editing - Less critical - Access bypass - SA-CONTRIB-2026-241

Incorrect Authorization vulnerability in Drupal Frontend Editing allows Forceful Browsing. This issue affects Frontend Editing versions: from 0.0.0 to 1.9.3.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Frontend Editing

CVE-2026-107260

Sector Distribution - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-229

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Sector Distribution allows Stored XSS. This issue affects Sector Distribution versions: from 0.0.0 to 10.3.3, from 10.4.0 to 10.4.2.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Sector Distribution

CVE-2026-114531

Swiper formatter - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-228

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Swiper formatter allows Stored XSS. This issue affects Swiper formatter versions: from 0.0.0 to 2.1.2, from 3.0.1 to 3.1.0.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Swiper Formatter

CVE-2026-114530

Dopup - Critical - Information disclosure - SA-CONTRIB-2026-227

Incorrect Authorization vulnerability in Drupal Dopup allows Forceful Browsing. This issue affects Dopup versions: from 0.0.0 to 1.0.7.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Dopup

CVE-2026-114529

CSV Field - Moderately critical - Cross site Scripting - SA-CONTRIB-2026-226

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal CSV Field allows Stored XSS. This issue affects CSV Field versions: from 0.0.0 to 2.0.10, from 3.0.0 to 3.0.7.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Csv Field

CVE-2026-114524

Custom Formatters - Critical - Remote code execution - SA-CONTRIB-2026-225

Privilege Defined With Unsafe Actions vulnerability in Drupal Custom Formatters allows Privilege Escalation. This issue affects Custom Formatters versions: from 0.0.0 to 4.2.1.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Custom Formatters

CVE-2026-114525

ABC - Critical - Cross-site scripting - SA-CONTRIB-2026-224

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal ABC allows Stored XSS. This issue affects ABC versions: from 0.0.0 to 1.25.0, from 2.0.0 to 2.0.1.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Abc

CVE-2026-114526

Black Hole - Critical - Cross-site scripting - SA-CONTRIB-2026-223

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Black Hole allows Stored XSS. This issue affects Black Hole versions: from 0.0.0 to 1.26.0, from 2.0.0 to 2.0.1.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Black Hole