CVE-2026-107309

Easy Breadcrumb - Moderately critical - Information disclosure - SA-CONTRIB-2026-212

Missing Authorization vulnerability in Drupal Easy Breadcrumb allows Forceful Browsing. This issue affects Easy Breadcrumb versions: from 0.0.0 to 2.0.11.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Easy Breadcrumb

CVE-2026-107307

SmartLinker AI - Moderately critical - Information disclosure - SA-CONTRIB-2026-210

Incorrect Authorization vulnerability in Drupal SmartLinker AI allows Forceful Browsing. This issue affects SmartLinker AI versions: from 0.0.0 to 1.0.3.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Smartlinker Ai

CVE-2026-107267

DKAN - Moderately critical - Access bypass - SA-CONTRIB-2026-208

Missing Authorization vulnerability in Drupal DKAN allows Forceful Browsing. This issue affects DKAN versions: from 0.0.0 to 4.0.4, from 4.1.0 to 4.1.5.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Dkan

CVE-2026-107268

Two Factor Authentication - TFA / Passwordless Login - Moderately critical - Information disclosure - SA-CONTRIB-2026-207

Insertion of Sensitive Information Into Sent Data vulnerability in Drupal Two Factor Authentication - TFA / Passwordless Login allows Forceful Browsing. This issue affects Two Factor Authentication - TFA / Passwordless Login versions: from 0.0.0 to 5.4.1, from 5.5.0 to 5.5.2.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Two Factor Authentication - Tfa / Passwordless Login

CVE-2026-96389

Xray Audit - Moderately critical - Access bypass - SA-CONTRIB-2026-206

Missing Authorization vulnerability in Drupal Xray Audit allows Forceful Browsing. This issue affects Xray Audit versions: from 0.0.0 to 1.6.3, from 2.0.0 to 2.0.4, from 3.0.0 to 3.1.1.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Xray Audit

CVE-2026-107265

Leaflet - Moderately critical - Cross site scripting - SA-CONTRIB-2026-204

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Leaflet allows Stored XSS. This issue affects Leaflet versions: from 0.0.0 to 10.4.13.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Leaflet

CVE-2026-107264

Inline Formatter Field - Moderately critical - Server-side template injection - SA-CONTRIB-2026-203

Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Inline Formatter Field allows Code Injection. This issue affects Inline Formatter Field versions: from 0.0.0 to 4.2.0.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Inline Formatter Field

CVE-2026-107263

Gutenberg - Moderately critical - Access bypass - SA-CONTRIB-2026-202

Incorrect Authorization vulnerability in Drupal Gutenberg allows Forceful Browsing. This issue affects Gutenberg versions: from 0.0.0 to 2.15.0, from 3.0.0 to 3.0.7.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Gutenberg

CVE-2026-107261

Authenticator Login Plus (2FA) - Moderately critical - Improper authentication - SA-CONTRIB-2026-201

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Authenticator Login Plus (2FA) allows Authentication Bypass. This issue affects Authenticator Login Plus (2FA) versions: from 0.0.0 to 1.0.1.

CVSS 3.1 · 4.2 Medium EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Authenticator Login Plus (2fa)

CVE-2026-107259

Linked Field - Moderately critical - Server-side template injection - SA-CONTRIB-2026-200

Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Linked Field allows Code Injection. This issue affects Linked Field versions: from 0.0.0 to 1.8.0.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Linked Field

CVE-2026-107258

Inline Entity Form Dialog - Moderately critical - Access bypass - SA-CONTRIB-2026-199

Incorrect Authorization vulnerability in Drupal Inline Entity Form Dialog allows Forceful Browsing. This issue affects Inline Entity Form Dialog versions: from 0.0.0 to 1.0.6.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Inline Entity Form Dialog

CVE-2026-107257

Actstream - Critical - Access bypass - SA-CONTRIB-2026-198

Incorrect Authorization vulnerability in Drupal Actstream allows Forceful Browsing. This issue affects Actstream versions: from 0.0.0 to 2.0.1, from 2.1.0 to 2.1.1.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Actstream

CVE-2026-107254

Authenticator Login Plus (2FA) - Critical - Improper authentication - SA-CONTRIB-2026-197

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Authenticator Login Plus (2FA) allows Authentication Bypass. This issue affects Authenticator Login Plus (2FA) versions: from 0.0.0 to 1.0.1.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Authenticator Login Plus (2fa)

CVE-2026-107252

MathJax: LaTeX for Drupal - Critical - Cross site scripting - SA-CONTRIB-2026-195

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal MathJax: LaTeX for Drupal allows Cross-Site Scripting (XSS). This issue affects MathJax: LaTeX for Drupal versions: from 0.0.0 to 4.1.2.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Mathjax: Latex For Drupal

CVE-2026-107251

Entity Reference Manager (Merge entities) - Critical - Access bypass - SA-CONTRIB-2026-194

Incorrect Authorization vulnerability in Drupal Entity Reference Manager (Merge entities) allows Forceful Browsing. This issue affects Entity Reference Manager (Merge entities) versions: from 0.0.0 to 1.0.3.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Entity Reference Manager (merge Entities)

CVE-2026-107250

ECA Helper - Critical - Unsupported - SA-CONTRIB-2026-193

Vulnerability in Drupal ECA Helper. This issue affects ECA Helper versions: *.*.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Eca Helper

CVE-2026-107249

Block AJAX - Highly critical - PHP object injection - SA-CONTRIB-2026-192

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Block AJAX allows Object Injection. This issue affects Block AJAX versions: from 0.0.0 to 3.0.2.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Drupal

Products

Block Ajax

CVE-2026-103039

Gravity Forms <= 3.1.2 - Unauthenticated PHP Object Injection via Post Custom Field

The Gravity Forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.1.2 via a Post Custom Field whose input type is List. This is due to GFFormsModel::create_post() passing the submitted value to WordPress' unrestricted global maybe_unserialize() rather than the plugin's own hardened GFCommon::maybe_unserialize(), which was added in 3.1.1 and passes allowed_classes => false precisely to prevent object instantiation. Where the field has a content template enabled, the submitted row reaches that call verbatim. This makes it possible for unauthenticated attackers to inject a PHP object into post meta. No PHP Object Injection gadget chain is present in the plugin itself; however, if a gadget chain is present via an additional plugin or theme, it could allow the attacker to perform actions such as remote code execution. Where the custom field is mapped to the protected _wp_page_template meta key, WordPress itself supplies the chain: validate_file() accepts non-scalars, WP_Theme::__toString() then resolves an attacker-controlled path, and on hosts with a readable PEAR install and register_argc_argv enabled this yields remote code execution.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Gravityforms Wordpress-extensions

Products

Gravity Forms Gravity Forms

CVE-2026-85268

Cross-Site Scripting (XSS) in Firebase Auth Handler via Malicious Bundle ID

A Cross-Site Scripting (XSS) (CWE-79) vulnerability in the auth/handler in Google Cloud Identity Platform and Firebase Authentication versions prior to 2026-08-14 on iOS allows an unauthenticated remote attacker to execute arbitrary JavaScript using a malicious iOS bundle ID.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Google Cloud

Products

Identity Platform And Firebase Authentication

CVE-2025-31704

Dahua Intelligent Connection Center command injection

A vulnerability has been found in the Dahua Intelligent Connection Center. A remote attacker could send a specially crafted request to the affected system, allowing the attacker to execute arbitrary commands, resulting in remote code execution.

CVSS 3.1 · 9.8 Critical EPSS 1.4% KEV · Not listed

Vendors

Dahua

Products

Intelligent Connection Center