CVE-2026-107249

priority · track · 0DEUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

— EPSS

no CVSS

Is it mine?

65 products

Who says so?

2 sources

cert_bund · osv

No description recorded.

cvss

Technical severity, 0–10. One row per scoring source.

No CVSS score recorded.

The CWE weakness classes this flaw belongs to.

No weakness (CWE) mapping recorded.

Products and version ranges known to be affected.

showing 20 of 65

Vendor and ecosystem advisories describing this.

WID-SEC-W-2026-3819Drupal Erweiterungen: Mehrere SchwachstellenDeutsch2026-10-08csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Drupal ausnutzen, um beliebigen Programmcode auszuführen, erweiterte Berechtigungen zu erlangen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren und offenzulegen oder Cross-Site-Scripting-Angriffe durchzuführen.
DRUPAL-CONTRIB-2026-1922026-10-07vendor · osvUS
The Block AJAX module enables you to load blocks asynchronously via Ajax. The module doesn't sufficiently validate user-supplied data which is used to construct a block. In the worst case scenario, this can lead to PHP Object Injection and Remote Code Execution. The vulnerability is mitigated by the fact that it only affects sites that have Layout Builder enabled (or another block plugin that handles the data this module passes to it in a potentially unsafe way). Please see the release notes for details of potentially breaking changes.

Which sources assert this record, and when.

published —modified —

External citations — patches, advisories, analysis.

No references recorded.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.