CVE-2026-107306

Keine CWE-Zuordnung erfasst.

• Open Source Drupal Actstream <2.0.1alle Versionencert_bundDE
• Open Source Drupal Actstream <2.1.1alle Versionencert_bundDE
• Open Source Drupal Advanced Filesystem <1.0.28alle Versionencert_bundDE
• Open Source Drupal Authenticator Login Plus (2FA) <1.0.1alle Versionencert_bundDE
• Open Source Drupal Block AJAX <3.0.2alle Versionencert_bundDE
• Open Source Drupal Country <2.1.3alle Versionencert_bundDE
• Open Source Drupal Country <2.2.1alle Versionencert_bundDE
• Open Source Drupal DKAN <4.0.4alle Versionencert_bundDE
• Open Source Drupal DKAN <4.1.5alle Versionencert_bundDE
• Open Source Drupal ECA Helperalle Versionencert_bundDEcpe:/a:drupal:drupal:eca_helper
• Open Source Drupal Easy Breadcrumb <2.0.11alle Versionencert_bundDE
• Open Source Drupal Entity Reference Manager (Merge entities) <1.0.3alle Versionencert_bundDE
• Open Source Drupal Examples for Developers <4.0.7alle Versionencert_bundDE
• Open Source Drupal Freelinking <4.0.3alle Versionencert_bundDE
• Open Source Drupal Gutenberg <2.15.0alle Versionencert_bundDE
• Open Source Drupal Gutenberg <3.0.7alle Versionencert_bundDE
• Open Source Drupal Inline Entity Form Dialog <1.0.6alle Versionencert_bundDE
• Open Source Drupal Inline Formatter Field <4.2.0alle Versionencert_bundDE
• Open Source Drupal Leaflet <10.4.13alle Versionencert_bundDE
• Open Source Drupal Linked Field <1.8.0alle Versionencert_bundDE

• WID-SEC-W-2026-3819Drupal Erweiterungen: Mehrere SchwachstellenDeutsch2026-10-08csaf · cert_bundDE

  Ein Angreifer kann mehrere Schwachstellen in Drupal ausnutzen, um beliebigen Programmcode auszuführen, erweiterte Berechtigungen zu erlangen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren und offenzulegen oder Cross-Site-Scripting-Angriffe durchzuführen.

• DRUPAL-CONTRIB-2026-2092026-10-07vendor · osvUS

  This module enables you to add HTML attributes to menu links and their container elements (`<li>`). The module doesn't sufficiently sanitize the attributes it applies to menu link container elements. This vulnerability is mitigated by the fact that an attacker must have a role with the permissions "*Administer menus and menu links*" and "*Use menu link attributes*". In addition, an unsafe container attribute must already be configured by a user with the restricted permission "*Administer menu link attributes*". The default configuration is not affected.