CVE-2026-107259

priority · track · 0DEUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

— EPSS

no CVSS

Is it mine?

65 products

Who says so?

2 sources

cert_bund · osv

No description recorded.

cvss

Technical severity, 0–10. One row per scoring source.

No CVSS score recorded.

The CWE weakness classes this flaw belongs to.

No weakness (CWE) mapping recorded.

Products and version ranges known to be affected.

showing 20 of 65

Vendor and ecosystem advisories describing this.

WID-SEC-W-2026-3819Drupal Erweiterungen: Mehrere SchwachstellenDeutsch2026-10-08csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Drupal ausnutzen, um beliebigen Programmcode auszuführen, erweiterte Berechtigungen zu erlangen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren und offenzulegen oder Cross-Site-Scripting-Angriffe durchzuführen.
DRUPAL-CONTRIB-2026-2002026-10-07vendor · osvUS
This module enables you to link the output of a field to a URL or to the value of another field. The module doesn't sufficiently separate field content from template code when rendering linked field output. Depending on the Twig extensions installed on the site, this can be used to expose site configuration values, which may include sensitive information such as API keys or credentials. This vulnerability is mitigated by the fact that an attacker must have a role with permission to create or edit content in a field that has Linked Field enabled in its display settings.

Which sources assert this record, and when.

published —modified —

External citations — patches, advisories, analysis.

No references recorded.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.