CVE-2026-81166

Digital Signage Framework - Moderately critical - Access bypass - SA-CONTRIB-2026-109

Missing Authorization vulnerability in Drupal Digital Signage Framework allows Forceful Browsing. This issue affects Digital Signage Framework versions: from 0.0.0 to 2.6.1.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Drupal Lakedrops

Products

Digital Signage Framework Digital Signage Framework

CVE-2026-73478

Diff - Moderately critical - Access bypass - SA-CONTRIB-2026-096

Incorrect Authorization vulnerability in Drupal Diff allows Forceful Browsing. This issue affects Diff versions: from 0.0.0 to 2.0.1, from 2.1.0 to 2.1.1.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Diff Project Drupal

Products

Diff Diff

CVE-2026-81205

LDAP / Active Directory Integration - Moderately critical - Information Disclosure - SA-CONTRIB-2026-115

Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in Drupal LDAP / Active Directory Integration allows LDAP Injection. This issue affects LDAP / Active Directory Integration versions: from 0.0.0 to 2.2.1.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Drupal Miniorange

Products

Ldap / Active Directory Integration Ldap \/ Active Directory Integration

CVE-2026-73477

Quick Tabs - Moderately critical - Access bypass - SA-CONTRIB-2026-099

Incorrect Authorization vulnerability in Drupal Quick Tabs allows Forceful Browsing. This issue affects Quick Tabs versions: from 0.0.0 to 4.3.1.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Drupal Quick Tabs Project

Products

Quick Tabs Quick Tabs

CVE-2026-81201

Monster Menus - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-116

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Monster Menus allows Stored XSS. This issue affects Monster Menus versions: from 0.0.0 to 9.5.3.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Drupal Monster Menus Project

Products

Monster Menus Monster Menus

CVE-2026-73476

External Authentication - Moderately critical - Access bypass - SA-CONTRIB-2026-098

Improper Handling of Case Sensitivity vulnerability in Drupal External Authentication allows Privilege Escalation. This issue affects External Authentication versions: from 0.0.0 to 2.0.13.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Drupal External Authentication Project

Products

External Authentication External Authentication

CVE-2026-81168

CAPTCHA Protected Page - Moderately critical - Cookie Forgery - SA-CONTRIB-2026-105

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal CAPTCHA Protected Page allows Functionality Bypass. This issue affects CAPTCHA Protected Page versions: from 0.0.0 to 1.0.2.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed

Vendors

Captcha Protected Page Project Drupal

Products

Captcha Protected Page Captcha Protected Page

CVE-2026-81167

Address Suggestion - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-103

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Address Suggestion allows Cross-Site Scripting (XSS). This issue affects Address Suggestion versions: from 0.0.0 to 1.0.25.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Address Suggestion Project Drupal

Products

Address Suggestion Address Suggestion

CVE-2026-81162

DXPR Builder: The AI Visual Page Builder for Drupal - Moderately critical - Information Disclosure - SA-CONTRIB-2026-112

Insertion of Sensitive Information Into Sent Data vulnerability in Drupal DXPR Builder: The Best Editing (AI) Experience for Drupal allows Forceful Browsing. This issue affects DXPR Builder: The Best Editing (AI) Experience for Drupal versions: from 0.0.0 to 2.8.1.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Drupal Dxpr Builder Project

Products

Dxpr Builder: The Best Editing (ai) Experience For Drupal Dxpr Builder

CVE-2026-81269

Data field - Moderately critical - Information disclosure - SA-CONTRIB-2026-108

Missing Authorization vulnerability in Drupal Data field allows Forceful Browsing. This issue affects Data field versions: from 0.0.0 to 2.0.13.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Data Field Project Drupal

Products

Data Field Data Field

CVE-2026-73474

Entity Share Websub - Moderately critical - Server-side request forgery (SSRF) - SA-CONTRIB-2026-097

Server-Side Request Forgery (SSRF) vulnerability in Drupal Entity Share Websub allows Server Side Request Forgery. This issue affects Entity Share Websub versions: from 0.0.0 to 1.1.2.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Drupal Entity Share Websub Project

Products

Entity Share Entity Share Websub

CVE-2026-73475

Commerce PayPal - Moderately critical - Access bypass - SA-CONTRIB-2026-095

Incorrect Authorization vulnerability in Drupal Commerce PayPal allows Forceful Browsing. This issue affects Commerce PayPal versions: from 0.0.0 to 1.12.0, from 2.0.0 to 2.1.3.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Centarro Drupal

Products

Commerce Paypal Commerce Paypal

CVE-2026-18986

Entity Browser - Moderately critical - Cross site scripting - SA-CONTRIB-2026-094

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Entity Browser allows Stored XSS. This issue affects Entity Browser versions: from 0.0.0 to 2.16.0.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Drupal Entity Browser Project

Products

Entity Browser Entity Browser

CVE-2026-16647

Disable Login Page - Moderately critical - Access bypass - SA-CONTRIB-2026-111

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Disable Login Page allows Functionality Bypass. This issue affects Disable Login Page versions: from 0.0.0 to 1.1.4.

CVSS 3.1 · 4.1 Medium EPSS < 1% KEV · Not listed

Vendors

Drupal Zyxware

Products

Disable Login Page Disable Login Page

CVE-2026-76759

Screenshot - Critical - Unsupported - SA-CONTRIB-2026-102

Vulnerability in Drupal Screenshot. This issue affects Screenshot versions: *.*.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Screenshot

CVE-2026-76758

Link content parser - Critical - Unsupported - SA-CONTRIB-2026-101

Vulnerability in Drupal Link content parser. This issue affects Link content parser versions: *.*.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Link Content Parser

CVE-2026-18260

Disable Login Page - Moderately critical - Access bypass - SA-CONTRIB-2026-110

Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Disable Login Page allows Brute Force. This issue affects Disable Login Page versions: from 0.0.0 to 1.1.4.

CVSS 3.1 · 5.7 Medium EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Disable Login Page

CVE-2026-18985

Edit in-place field - Moderately critical - Access bypass - SA-CONTRIB-2026-093

Incorrect Authorization vulnerability in Drupal Edit in-place field allows Forceful Browsing. This issue affects Edit in-place field versions: from 0.0.0 to 2.1.1.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Edit In-place Field

CVE-2026-18261

Powerful Surveys - Critical - Unsupported - SA-CONTRIB-2026-092

Vulnerability in Drupal Powerful Surveys. This issue affects Powerful Surveys versions: *.*.

CVSS 3.1 · 5.7 Medium EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Powerful Surveys

CVE-2026-18259

Token Content Access - Moderately critical - Access bypass - SA-CONTRIB-2026-090

Observable Timing Discrepancy vulnerability in Drupal Token Content Access allows Brute Force. This issue affects Token Content Access versions: from 0.0.0 to 3.1.2.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Token Content Access