CVE-2026-114528

Zero Point - Critical - Cross-site scripting - SA-CONTRIB-2026-222

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Zero Point allows Stored XSS. This issue affects Zero Point versions: from 0.0.0 to 1.30.0, from 2.0.0 to 2.0.1.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Zero Point

CVE-2026-114527

UI Icons - Critical - Cross site scripting - SA-CONTRIB-2026-221

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal UI Icons allows Cross-Site Scripting (XSS). This issue affects UI Icons versions: from 0.0.0 to 1.1.3, from 2.0.0 to 2.0.2.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Ui Icons

CVE-2026-114523

Ffmpeg Image Toolkit - Highly critical - Remote Code Execution - SA-CONTRIB-2026-220

Improper Neutralization of Special Elements used in an OS Command ("OS Command Injection") vulnerability in Drupal Ffmpeg Image Toolkit allows OS Command Injection. This issue affects Ffmpeg Image Toolkit versions: from 0.0.0 to 1.0.3.

CVSS 3.1 · 9.8 Critical EPSS 1.0% KEV · Not listed

Vendors

Drupal

Products

Ffmpeg Image Toolkit

CVE-2026-108099

Entity List - Critical - Remote code execution - SA-CONTRIB-2026-218

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Drupal Entity List allows Reflection Injection. This issue affects Entity List versions: from 0.0.0 to 3.0.10.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Entity List

CVE-2026-108514

Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-016

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Drupal core versions: from 10.3.0 to 10.6.19, from 11.0.0 to 11.3.19, from 11.4.0 to 11.4.10, from 12.0.0-alpha1 to 12.0.0-beta2.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Drupal Core

CVE-2026-108515

Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-015

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Drupal core versions: from 8.9.0 to 10.6.19, from 11.0.0 to 11.3.19, from 11.4.0 to 11.4.10, from 12.0.0-alpha1 to 12.0.0-beta2.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Drupal Core

CVE-2026-108097

Drupal core - Critical - Remote code execution - SA-CORE-2026-014

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Drupal Drupal core allows Reflection Injection. This issue affects Drupal core versions: from 8.9.0 to 10.6.19, from 11.0.0 to 11.3.19, from 11.4.0 to 11.4.10, from 12.0.0-alpha1 to 12.0.0-beta2.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Drupal Core

CVE-2026-107255

Restrict route by IP - Critical - Access bypass - SA-CONTRIB-2026-216

Incorrect Authorization vulnerability in Drupal Restrict route by IP allows Forceful Browsing. This issue affects Restrict route by IP versions: from 0.0.0 to 1.3.1, from 2.0.0 to 2.0.1.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Restrict Route By Ip

CVE-2026-107266

Views Share - Moderately critical - Access bypass - SA-CONTRIB-2026-205

Missing Authorization vulnerability in Drupal Views Share allows Forceful Browsing. This issue affects Views Share versions: from 0.0.0 to 2.0.1.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Views Share

CVE-2026-114545

Fullcalendar View - Moderately critical - Access bypass - SA-CONTRIB-2026-244

Incorrect Authorization vulnerability in Drupal Fullcalendar View allows Forceful Browsing. This issue affects Fullcalendar View versions: from 0.0.0 to 5.2.6.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Fullcalendar View

CVE-2026-118575

Signature pad widget - Critical - Cross-site scripting - SA-CONTRIB-2026-285

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Signature pad widget allows Stored XSS. This issue affects Signature pad widget versions: from 0.0.0 to 1.15.0.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Signature Pad Widget

CVE-2026-118551

AI (Artificial Intelligence) - Less critical - Information Disclosure - SA-CONTRIB-2026-271

Insecure Storage of Sensitive Information vulnerability in Drupal AI (Artificial Intelligence) allows Retrieve Embedded Sensitive Data. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2.

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Artificial Intelligence

CVE-2026-118549

AI (Artificial Intelligence) - Critical - Cross-site scripting - SA-CONTRIB-2026-269

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Cross-Site Scripting (XSS). This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Artificial Intelligence

CVE-2026-118542

Commerce Core - Moderately critical - Access bypass - SA-CONTRIB-2026-257

Incorrect Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13.

CVSS 3.1 · 2.7 Low EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Commerce Core

CVE-2026-114548

ImageAPI Optimize WebP - Moderately critical - Information disclosure - SA-CONTRIB-2026-247

Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal ImageAPI Optimize WebP allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects ImageAPI Optimize WebP versions: from 0.0.0 to 2.1.2.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Imageapi Optimize Webp

CVE-2026-114547

TinyPNG - Moderately critical - Information disclosure - SA-CONTRIB-2026-246

Missing Authorization vulnerability in Drupal TinyPNG allows Forceful Browsing. This issue affects TinyPNG versions: from 0.0.0 to 2.0.2.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Tinypng

CVE-2026-114546

Media Alias Display - Moderately critical - Information disclosure - SA-CONTRIB-2026-245

Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Media Alias Display allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Media Alias Display versions: from 0.0.0 to 2.1.2, from 3.0.0 to 3.0.2.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Media Alias Display

CVE-2026-114544

Media Bulk Upload - Moderately critical - Access bypass - SA-CONTRIB-2026-243

Incorrect Authorization vulnerability in Drupal Media Bulk Upload allows Forceful Browsing. This issue affects Media Bulk Upload versions: from 0.0.0 to 3.0.6.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Media Bulk Upload

CVE-2026-114541

Frontend Editing - Moderately critical - Cross-Site Request Forgery (CSRF) - SA-CONTRIB-2026-240

Cross-Site Request Forgery (CSRF) vulnerability in Drupal Frontend Editing allows Cross Site Request Forgery. This issue affects Frontend Editing versions: from 0.0.0 to 1.9.3.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Frontend Editing

CVE-2026-114540

Domain - Moderately critical - Access bypass - SA-CONTRIB-2026-238

Incorrect Authorization vulnerability in Drupal Domain allows Forceful Browsing. This issue affects Domain versions: from 3.0.0 to 3.0.2.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Domain