CVE-2026-107250

priority · track · 0DEUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

— EPSS

no CVSS

Is it mine?

3 products

Who says so?

2 sources

cert_bund · osv

No description recorded.

cvss

Technical severity, 0–10. One row per scoring source.

No CVSS score recorded.

The CWE weakness classes this flaw belongs to.

No weakness (CWE) mapping recorded.

Products and version ranges known to be affected.

Open Source Drupal ECA Helperall versionscert_bundDEcpe:/a:drupal:drupal:eca_helper
Open Source Drupal Orphans Mediaall versionscert_bundDEcpe:/a:drupal:drupal:orphans_media
Packagist:https://packages.drupal.org/8 drupal/eca_helperall versionsosvUSpkg:composer/drupal/eca_helper?repository_url=https:%2F%2Fpackages.drupal.org%2F8

Vendor and ecosystem advisories describing this.

WID-SEC-W-2026-3819Drupal Erweiterungen: Mehrere SchwachstellenDeutsch2026-10-08csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Drupal ausnutzen, um beliebigen Programmcode auszuführen, erweiterte Berechtigungen zu erlangen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren und offenzulegen oder Cross-Site-Scripting-Angriffe durchzuführen.
DRUPAL-CONTRIB-2026-1932026-10-07vendor · osvUS
The Drupal Security Team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, read the documentation on [becoming the maintainer of a project that is unsupported for security reasons](https://www.drupal.org/drupal-security-team/becoming-primary-maintainer-of-a-project-that-is-unsupported-for-security-reasons).

Which sources assert this record, and when.

published —modified —

External citations — patches, advisories, analysis.

No references recorded.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.