DeutschIn der Originalsprache angezeigt — eine vollständige Übersetzung ist für eine zukünftige Version geplant.
Drupal Extensions: Mehrere Schwachstellen
Advisory ansehen veröffentlicht 2026-08-26
Ein Angreifer kann mehrere Schwachstellen in verschiedenen Drupal Erweiterungen ausnutzen, um Sicherheitsmaßnahmen zu umgehen, sensible Informationen offenzulegen, Daten zu manipulieren und Cross-Site-Scripting-Angriffe durchzuführen.
01
beschreibt (14)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-81269US | —OT erhöht | — | ||
Missing Authorization vulnerability in Drupal Data field allows Forceful Browsing. This issue affects Data field versions: from 0.0.0 to 2.0.13. | ||||
| CVE-2026-81205US | — | — | ||
Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in Drupal LDAP / Active Directory Integration allows LDAP Injection. This issue a… | ||||
| CVE-2026-81201US | — | — | ||
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Monster Menus allows Stored XSS. This issue affects Monster Menus versi… | ||||
| CVE-2026-81168US | —OT erhöht | — | ||
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal CAPTCHA Protected Page allows Functionality Bypass. This issue affects CAPTCHA Protected Page versi… | ||||
| CVE-2026-81167US | — | — | ||
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Address Suggestion allows Cross-Site Scripting (XSS). This issue affect… | ||||
| CVE-2026-81166US | —OT erhöht | — | ||
Missing Authorization vulnerability in Drupal Digital Signage Framework allows Forceful Browsing. This issue affects Digital Signage Framework versions: from 0.0.0 to 2.6.1. | ||||
| CVE-2026-81165US | —OT erhöht | — | ||
Incorrect Authorization vulnerability in Drupal Blazy allows Forceful Browsing. This issue affects Blazy versions: from 0.0.0 to 3.0.18. | ||||
| CVE-2026-81164US | —OT erhöht | — | ||
Missing Authorization vulnerability in Drupal Entity PDF allows Forceful Browsing. This issue affects Entity PDF versions: from 0.0.0 to 2.1.5. | ||||
| CVE-2026-81162US | — | — | ||
Insertion of Sensitive Information Into Sent Data vulnerability in Drupal DXPR Builder: The Best Editing (AI) Experience for Drupal allows Forceful Browsing. This issue affects DXP… | ||||
| CVE-2026-81161US | — | — | ||
Privilege Defined With Unsafe Actions vulnerability in Drupal Content Moderation Notifications allows Privilege Escalation. This issue affects Content Moderation Notifications vers… | ||||
| CVE-2026-81160US | — | — | ||
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Slick Carousel allows Stored XSS. This issue affects Slick Carousel ver… | ||||
| CVE-2026-81159US | — | — | ||
Observable Timing Discrepancy vulnerability in Drupal Commerce CyberSource allows Brute Force. This issue affects Commerce CyberSource versions: from 0.0.0 to 1.10.0. | ||||
| CVE-2026-81158US | —OT erhöht | — | ||
Incorrect Authorization vulnerability in Drupal Entity API allows Forceful Browsing. This issue affects Entity API versions: from 0.0.0 to 1.8.0. | ||||
| CVE-2026-16647US | medium4.1OT erhöht | — | ||
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Disable Login Page allows Functionality Bypass. This issue affects Disable Login Page versions: fro… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- WID-SEC-W-2026-3041 - CSAF Versionself
- WID-SEC-2026-3041 - Portal Versionself
- Drupal Security Advisory sa-contrib-2026-103 vom 2026-08-26external
- Drupal Security Advisory sa-contrib-2026-104 vom 2026-08-26external
- Drupal Security Advisory sa-contrib-2026-105 vom 2026-08-26external
- Drupal Security Advisory sa-contrib-2026-106 vom 2026-08-26external
- Drupal Security Advisory sa-contrib-2026-107 vom 2026-08-26external
- Drupal Security Advisory sa-contrib-2026-108 vom 2026-08-26external
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan