CVE-2026-114539

DocCheck Basic - Moderately critical - Access bypass - SA-CONTRIB-2026-237

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal DocCheck Basic allows Authentication Bypass. This issue affects DocCheck Basic versions: 7.x.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Doccheck Basic

CVE-2026-114538

Bootstrap - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-236

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Bootstrap allows Cross-Site Scripting (XSS). This issue affects Bootstrap versions: from 0.0.0 to 3.45.0.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Bootstrap

CVE-2026-114537

View Unpublished - Moderately critical - Access bypass - SA-CONTRIB-2026-235

Incorrect Authorization vulnerability in Drupal View Unpublished allows Forceful Browsing. This issue affects View Unpublished versions: from 0.0.0 to 1.5.0.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

View Unpublished

CVE-2026-77152

Field Collection for Drupal 7 access bypass via missing parent entity access check

Improper Authorization vulnerability in Drupal Field Collection for Drupal 7 allows a user with the "edit field collections" permission to bypass access control on the parent (host) entity. The access check for field collection items (field_collection_item_access()) granted edit and delete access to any user holding the "edit field collections" permission without verifying the user's access to the host entity. As a result, a user with "edit field collections" but without edit/update access to the host entity (for example a node they cannot edit) could edit or delete field collection items attached to that entity, bypassing the intended entity/node access restrictions. The fix requires access to the parent entity in addition to the field collection permission. This issue affects Field Collection for Drupal 7: version 7.x-1.0 up to and including 7.x-1.2.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Field Collection For Drupal 7

CVE-2026-110176

File Force Download for Drupal 7 Access Bypass via Unconditional Download Headers

The File Force Download module for Drupal 7 implements hook_file_download() to add a Content-Disposition header when a file URL carries the download query parameter. In Drupal 7, returning a non-empty header array from that hook is itself a grant of access to the file. In versions 7.1.0 through 7.1.2, the module only delegated to other modules' hook_file_download() implementations when the file was in the private scheme. For every other scheme it returned its headers without any check. An unauthenticated visitor who appended download=1 to the URL of a file in the temporary:// scheme, or in a stream wrapper supplied by another module, could retrieve the file, overriding the access checks that would otherwise have applied. Files in the public and private schemes are not affected.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

File Force Download

CVE-2026-118584

Field Permissions - Moderately critical - Access bypass - SA-CONTRIB-2026-289

Incorrect Authorization vulnerability in Drupal Field Permissions allows Forceful Browsing. This issue affects Field Permissions versions: from 0.0.0 to 1.6.0.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Field Permissions

CVE-2026-118582

CAPTCHA - Moderately critical - Session Replay (CAPTCHA bypass) - SA-CONTRIB-2026-281

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal CAPTCHA allows Functionality Bypass. This issue affects CAPTCHA versions: from 0.0.0 to 1.18.0, from 2.0.0 to 2.0.11.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Captcha

CVE-2026-118564

PayUmoney for Drupal Commerce - Critical - Unsupported - SA-CONTRIB-2026-277

Vulnerability in Drupal PayUmoney for Drupal Commerce. This issue affects PayUmoney for Drupal Commerce versions: *.*.

CVSS 3.1 · 6.6 Medium EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Payumoney For Drupal Commerce

CVE-2026-118562

Single Content Sync - Critical - Remote code execution - SA-CONTRIB-2026-275

Deserialization of Untrusted Data vulnerability in Drupal Single Content Sync allows Object Injection. This issue affects Single Content Sync versions: from 0.0.0 to 1.4.19.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Single Content Sync

CVE-2026-118561

Single Content Sync - Critical - External control of file name or path - SA-CONTRIB-2026-274

External Control of File Name or Path vulnerability in Drupal Single Content Sync allows Path Traversal. This issue affects Single Content Sync versions: from 0.0.0 to 1.4.19.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Single Content Sync

CVE-2026-118568

Content Sync (content-sync.io) - Moderately critical - Information disclosure - SA-CONTRIB-2026-291

Insecure Storage of Sensitive Information vulnerability in Drupal Content Sync (content-sync.io) allows Retrieve Embedded Sensitive Data. This issue affects Content Sync (content-sync.io) versions: from 0.0.0 to 3.2.2.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Content Sync (content-sync.io)

CVE-2026-118573

OAuth2 Token Manager - Critical - Access bypass - SA-CONTRIB-2026-290

Missing Authorization vulnerability in Drupal OAuth2 Token Manager allows Forceful Browsing. This issue affects OAuth2 Token Manager versions: from 0.0.0 to 1.2.0.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Oauth2 Token Manager

CVE-2026-118583

Field Permissions - Moderately critical - Access bypass - SA-CONTRIB-2026-288

Incorrect Authorization vulnerability in Drupal Field Permissions allows Forceful Browsing. This issue affects Field Permissions versions: from 0.0.0 to 1.6.0.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Field Permissions

CVE-2026-118576

Stage File Proxy - Critical - Cross-site scripting - SA-CONTRIB-2026-286

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Stage File Proxy allows Cross-Site Scripting (XSS). This issue affects Stage File Proxy versions: from 0.0.0 to 3.1.7, from 4.0.0 to 4.0.1.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Stage File Proxy

CVE-2026-118574

S3 File System - Moderately critical - Access bypass - SA-CONTRIB-2026-279

Incorrect Permission Assignment for Critical Resource vulnerability in Drupal S3 File System allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects S3 File System versions: from 0.0.0 to 3.12.0.

CVSS 3.1 · 5.6 Medium EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

S3 File System

CVE-2026-118570

Fasttoggle - Moderately critical - Cross-Site Request Forgery - SA-CONTRIB-2026-283

Cross-Site Request Forgery (CSRF) vulnerability in Drupal Fasttoggle allows Cross Site Request Forgery. This issue affects Fasttoggle versions: from 0.0.0 to 4.1.1.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Fasttoggle

CVE-2026-118569

Fasttoggle - Moderately critical - Access bypass - SA-CONTRIB-2026-282

Incorrect Authorization vulnerability in Drupal Fasttoggle allows Forceful Browsing. This issue affects Fasttoggle versions: from 0.0.0 to 4.1.1.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Fasttoggle

CVE-2026-118550

AI (Artificial Intelligence) - Moderately critical - Access bypass - SA-CONTRIB-2026-270

Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal AI (Artificial Intelligence) allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Artificial Intelligence

CVE-2026-118559

Commerce Stripe - Moderately critical - Improper verification of cryptographic signature - SA-CONTRIB-2026-264

Improper Verification of Cryptographic Signature vulnerability in Drupal Commerce Stripe allows Signature Spoof. This issue affects Commerce Stripe versions: from 0.0.0 to 1.4, from 2.0.0 to 2.2.3.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Commerce Stripe

CVE-2026-118544

Commerce Core - Moderately critical - Information disclosure - SA-CONTRIB-2026-259

Exposure of Sensitive Information Through Data Queries vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Commerce Core