DeutschShown in its original language — a full translation is planned for a future version.
Drupal Erweiterungen: Mehrere Schwachstellen
view advisory published 2026-09-02
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in verschiedenen Drupal Erweiterungen ausnutzen, um Zugriffsbeschränkungen zu umgehen, geschützte oder sensible Inhalte offenzulegen, Benutzerkonten zu übernehmen, unberechtigte Änderungen oder Löschungen vorzunehmen, Zahlungsstatus zu manipulieren sowie Cross-Site-Scripting-Angriffe auszuführen.
01
describes (16)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-84924US | — | — | ||
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Email Verification / SMS Verification / OTP Verification allows Reflect… | ||||
| CVE-2026-84923US | —OT elevated | — | ||
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Email Verification / SMS Verification / OTP Verification allows Authentication Bypass. This issue a… | ||||
| CVE-2026-84921US | —OT elevated | — | ||
Missing Authorization vulnerability in Drupal Webform Submissions Delete allows Forceful Browsing. This issue affects Webform Submissions Delete versions: from 0.0.0 to 1.2.0. | ||||
| CVE-2026-84920US | —OT elevated | — | ||
Incorrect Authorization vulnerability in Drupal Unpublished Node Permissions allows Forceful Browsing. This issue affects Unpublished Node Permissions versions: from 0.0.0 to 1.8.0… | ||||
| CVE-2026-84919US | — | — | ||
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery allows Stored XS… | ||||
| CVE-2026-84918US | — | — | ||
Improper Verification of Cryptographic Signature vulnerability in Drupal Monobank payment API allows Signature Spoof. This issue affects Monobank payment API versions: from 0.0.0 t… | ||||
| CVE-2026-84917US | —OT elevated | — | ||
Incorrect Authorization vulnerability in Drupal Jsonapi Role Access allows Forceful Browsing. This issue affects Jsonapi Role Access versions: from 0.0.0 to 2.0.2. | ||||
| CVE-2026-84916US | —OT elevated | — | ||
Missing Authorization vulnerability in Drupal Islandora allows Forceful Browsing. This issue affects Islandora versions: from 0.0.0 to 2.19.0. | ||||
| CVE-2026-84915US | — | — | ||
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Component blocks allows Stored XSS. This issue affects Component blocks… | ||||
| CVE-2026-84914US | —OT elevated | — | ||
Missing Authorization vulnerability in Drupal Calculate Working Days allows Forceful Browsing. This issue affects Calculate Working Days versions: from 0.0.0 to 2.0.3. | ||||
| CVE-2026-84913US | —OT elevated | — | ||
Missing Authorization vulnerability in Drupal AI Translate allows Forceful Browsing. This issue affects AI Translate versions: from 0.0.0 to 1.3.2, from 1.4.0 to 1.4.1. | ||||
| CVE-2026-84912US | —OT elevated | — | ||
Missing Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Forceful Browsing. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.3.13,… | ||||
| CVE-2026-84911US | — | — | ||
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Stored XSS. This issue affects AI (… | ||||
| CVE-2026-84910US | —OT elevated | — | ||
Missing Authorization vulnerability in Drupal Advanced Search allows Forceful Browsing. This issue affects Advanced Search versions: from 0.0.0 to 2.4.5. | ||||
| CVE-2026-81163US | — | — | ||
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Drupal Media Library Importer allows Path Traversal. This issue affects Media Librar… | ||||
| CVE-2026-16648US | — | — | ||
Insertion of Sensitive Information into Log File vulnerability in Drupal Mailer Plus Log allows Remote Services with Stolen Credentials. This issue affects Mailer Plus Log versions… | ||||
02
references
External citations — patches, advisories, analysis.
- WID-SEC-W-2026-3168 - CSAF Versionself
- WID-SEC-2026-3168 - Portal Versionself
- Drupal Security Advisory sa-contrib-2026-118 vom 2026-09-02external
- Drupal Security Advisory sa-contrib-2026-119 vom 2026-09-02external
- Drupal Security Advisory sa-contrib-2026-120 vom 2026-09-02external
- Drupal Security Advisory sa-contrib-2026-121 vom 2026-09-02external
- Drupal Security Advisory sa-contrib-2026-122 vom 2026-09-02external
- Drupal Security Advisory sa-contrib-2026-123 vom 2026-09-02external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan