CVE-2026-114542

Simple OAuth (OAuth2) & OpenID Connect - Moderately critical - Access bypass - SA-CONTRIB-2026-242

Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Simple OAuth (OAuth2) & OpenID Connect allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Simple OAuth (OAuth2) & OpenID Connect versions: from 6.1.0 to 6.1.3.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Simple Oauth (oauth2) & Openid Connect

CVE-2026-118571

Media Alias Display - Moderately critical - Information disclosure - SA-CONTRIB-2026-292

Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Media Alias Display allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Media Alias Display versions: from 0.0.0 to 2.1.3, from 3.0.0 to 3.0.3.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Media Alias Display

CVE-2026-96386

Smart Content - Moderately critical - Access bypass - SA-CONTRIB-2026-190

Missing Authorization vulnerability in Drupal Smart Content allows Forceful Browsing. This issue affects Smart Content versions: from 0.0.0 to 3.2.1.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Smart Content

CVE-2026-96377

Combined image style - Moderately critical - Improper access control - SA-CONTRIB-2026-188

Allocation of Resources Without Limits or Throttling vulnerability in Drupal Combined image style allows Excessive Allocation. This issue affects Combined image style versions: from 0.0.0 to 1.0.7.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Combined Image Style

CVE-2026-121444

svg-sanitizer 0.11.0 before 1.1.0 Algorithmic Complexity DoS via use Reference Graph

svg-sanitizer from 0.11.0 before 1.1.0 contains an algorithmic complexity denial of service vulnerability in hasInfiniteLoop() and countUse() of the use reference-graph analysis. Attackers can upload a small layered SVG with 15 levels of fanned-out use elements, forcing exponential path enumeration that pins PHP workers for hours.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Darylldoyle Drupal

Products

Svg-sanitizer Svg Sanitizer

CVE-2026-121445

svg-sanitizer 1.0.0 before 1.1.0 ReDoS and Fail-Open via image-set CSS Stripping

darylldoyle svg-sanitizer from 1.0.0 before 1.1.0 contains a regular expression denial of service vulnerability in the image-set pattern of stripRemoteCssTokens() when removeRemoteReferences is enabled. Attackers can submit SVGs with many unclosed image-set tokens to exhaust CPU, or trigger PCRE limits causing sanitize() to throw a TypeError and leave unsanitized content.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Darylldoyle Drupal

Products

Svg-sanitizer Svg Sanitizer

CVE-2021-41184

XSS in the `of` option of the `.position()` util

jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `of` option of the `.position()` util from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. Any string value passed to the `of` option is now treated as a CSS selector. A workaround is to not accept the value of the `of` option from untrusted sources.

CVSS 3.1 · 6.5 Medium EPSS 40.8% KEV · Not listed

Vendors

Drupal Fedoraproject Jqueryui and 4 more

Products

Drupal Fedora Jquery Ui and 33 more

CVE-2020-11022

jQuery has a potential XSS vulnerability

In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

CVSS 3.1 · 6.9 Medium EPSS 99.2% KEV · Not listed

Vendors

Debian Drupal Fedoraproject and 6 more

Products

Debian Linux Drupal Fedora and 85 more

CVE-2026-118539

Commerce Core - Highly critical - Access bypass - SA-CONTRIB-2026-254

Missing Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41, from 3.0.0 to 3.3.13.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Commerce Core

CVE-2026-107253

Orphans Media - Critical - Unsupported - SA-CONTRIB-2026-196

Vulnerability in Drupal Orphans Media. This issue affects Orphans Media versions: *.*.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Orphans Media

CVE-2026-87941

Patreon - Critical - Unsupported - SA-CONTRIB-2026-139

Vulnerability in Drupal Patreon. This issue affects Patreon versions: 7.x.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Patreon

CVE-2026-107262

Advanced Filesystem - Moderately critical - Cross-Site Request Forgery - SA-CONTRIB-2026-217

Cross-Site Request Forgery (CSRF) vulnerability in Drupal Advanced Filesystem allows Cross Site Request Forgery. This issue affects Advanced Filesystem versions: from 0.0.0 to 1.0.28.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Advanced Filesystem

CVE-2026-107308

Country - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-211

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Country allows Cross-Site Scripting (XSS). This issue affects Country versions: from 0.0.0 to 2.1.3, from 2.2.0 to 2.2.1.

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Country

CVE-2026-107306

Menu Link Attributes - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-209

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Menu Link Attributes allows Stored XSS. This issue affects Menu Link Attributes versions: from 0.0.0 to 1.8.0.

CVSS 3.1 · 3.8 Low EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Menu Link Attributes

CVE-2026-114572

Domain Login Restrict - Moderately critical - Access bypass - SA-CONTRIB-2026-249

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Domain Login Restrict allows Authentication Bypass. This issue affects Domain Login Restrict versions: from 0.0.0 to 1.5.0.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Domain Login Restrict

CVE-2026-107311

Permissions by Term - Moderately critical - Information disclosure - SA-CONTRIB-2026-214

Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal Permissions by Term allows Forceful Browsing. This issue affects Permissions by Term versions: from 0.0.0 to 3.1.41.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Permissions By Term

CVE-2026-107310

Freelinking - Moderately critical - Information Disclosure - SA-CONTRIB-2026-213

Server-Side Request Forgery (SSRF) vulnerability in Drupal Freelinking allows Server Side Request Forgery. This issue affects Freelinking versions: from 0.0.0 to 4.0.3.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Freelinking

CVE-2026-107309

Easy Breadcrumb - Moderately critical - Information disclosure - SA-CONTRIB-2026-212

Missing Authorization vulnerability in Drupal Easy Breadcrumb allows Forceful Browsing. This issue affects Easy Breadcrumb versions: from 0.0.0 to 2.0.11.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Easy Breadcrumb

CVE-2026-107307

SmartLinker AI - Moderately critical - Information disclosure - SA-CONTRIB-2026-210

Incorrect Authorization vulnerability in Drupal SmartLinker AI allows Forceful Browsing. This issue affects SmartLinker AI versions: from 0.0.0 to 1.0.3.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Smartlinker Ai

CVE-2026-107267

DKAN - Moderately critical - Access bypass - SA-CONTRIB-2026-208

Missing Authorization vulnerability in Drupal DKAN allows Forceful Browsing. This issue affects DKAN versions: from 0.0.0 to 4.0.4, from 4.1.0 to 4.1.5.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Dkan