DeutschShown in its original language — a full translation is planned for a future version.
Drupal Erweiterungen: Mehrere Schwachstellen
view advisory published 2026-09-09
Ein Angreifer kann mehrere Schwachstellen in Drupal ausnutzen, um Datenbankinhalte zu manipulieren oder auszulesen, Zugriffsbeschränkungen und Authentifizierungsmechanismen zu umgehen, vertrauliche Informationen offenzulegen, Cross Site Scripting Angriffe auszuführen, Benutzer auf manipulierte Webseiten umzuleiten, SAML-Authentifizierungen zu beeinflussen oder wiederzuverwenden, interne Ressourcen über SSRF anzusprechen sowie unberechtigt Dateien auf den Server hochzuladen.
01
describes (20)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-87955US | —OT elevated | — | ||
Missing Authorization vulnerability in Drupal Ultimate Table Field allows Forceful Browsing. This issue affects Ultimate Table Field versions: from 0.0.0 to 1.1.1, from 2.0.0 to 2.… | ||||
| CVE-2026-87954US | —OT elevated | — | ||
Missing Authorization vulnerability in Drupal Taxonomy Term Glossary allows Forceful Browsing. This issue affects Taxonomy Term Glossary versions: from 0.0.0 to 4.6.0. | ||||
| CVE-2026-87953US | — | — | ||
Server-Side Request Forgery (SSRF) vulnerability in Drupal SAML SSO - Service Provider allows Server Side Request Forgery. This issue affects SAML SSO - Service Provider versions… | ||||
| CVE-2026-87952US | —OT elevated | — | ||
Authentication Bypass by Capture-replay vulnerability in Drupal SAML SSO - Service Provider allows Remote Services with Stolen Credentials. This issue affects SAML SSO - Service P… | ||||
| CVE-2026-87951US | — | — | ||
Insecure Storage of Sensitive Information vulnerability in Drupal SAML SSO - Service Provider allows Retrieve Embedded Sensitive Data. This issue affects SAML SSO - Service Provid… | ||||
| CVE-2026-87950US | —OT elevated | — | ||
Use of Hard-coded Credentials vulnerability in Drupal SAML SSO - Service Provider allows Retrieve Embedded Sensitive Data. This issue affects SAML SSO - Service Provider versions… | ||||
| CVE-2026-87949US | — | — | ||
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal SAML SSO - Service Provider allows Cross-Site Scripting (XSS). This is… | ||||
| CVE-2026-87948US | — | — | ||
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal SAML SSO - Service Provider allows Cross-Site Scripting (XSS). This is… | ||||
| CVE-2026-87947US | — | — | ||
Improper Verification of Cryptographic Signature vulnerability in Drupal SAML SSO - Service Provider allows Signature Spoof. This issue affects SAML SSO - Service Provider versio… | ||||
| CVE-2026-87946US | — | — | ||
Observable Timing Discrepancy vulnerability in Drupal SAML SSO - Service Provider allows Brute Force. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0… | ||||
| CVE-2026-87945US | — | — | ||
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal SAML SSO - Service Provider allows Fake the Source of Data. This issue affects SAML SSO - Service Provi… | ||||
| CVE-2026-87944US | — | — | ||
Improper Certificate Validation vulnerability in Drupal SAML SSO - Service Provider allows Adversary in the Middle (AiTM). This issue affects SAML SSO - Service Provider versions… | ||||
| CVE-2026-87943US | —OT elevated | — | ||
Missing Authorization vulnerability in Drupal SAML SSO - Service Provider allows Forceful Browsing. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0. | ||||
| CVE-2026-87942US | — | — | ||
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal SafeDelete allows Stored XSS. This issue affects SafeDelete versions: f… | ||||
| CVE-2026-87941US | — | — | ||
Vulnerability in Drupal Patreon. This issue affects Patreon versions: 7.x. | ||||
| CVE-2026-87940US | — | — | ||
Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Key auth allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affec… | ||||
| CVE-2026-87939US | — | — | ||
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Feed Block allows Stored XSS. This issue affects Feed Block versions: f… | ||||
| CVE-2026-87938US | — | — | ||
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal CSP log allows SQL Injection. This issue affects CSP log versions: from… | ||||
| CVE-2026-87937US | — | — | ||
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal Central Authentication System (CAS) Server allows Fake the Source of Data. This issue affects Central Au… | ||||
| CVE-2026-87936US | — | — | ||
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal amazee.ai Private AI Provider allows SQL Injection. This issue affects… | ||||
02
references
External citations — patches, advisories, analysis.
- WID-SEC-W-2026-3284 - CSAF Versionself
- WID-SEC-2026-3284 - Portal Versionself
- Drupal Security Advisory sa-contrib-2026-134 vom 2026-09-09external
- Drupal Security Advisory sa-contrib-2026-135 vom 2026-09-09external
- Drupal Security Advisory sa-contrib-2026-136 vom 2026-09-09external
- Drupal Security Advisory sa-contrib-2026-137 vom 2026-09-09external
- Drupal Security Advisory sa-contrib-2026-138 vom 2026-09-09external
- Drupal Security Advisory sa-contrib-2026-139 vom 2026-09-09external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan