Veille CVE

Samedi 11 juillet 2026

45 CVE

Critique 4 Élevée 4 Moyenne 32 Faible 5 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Drupal drupal » ✕
  1. CVE-2026-15089 9.1 Critique

    Drupal Commerce guest registration

    Vulnerability in Drupal Commerce guest registration. This issue affects Commerce guest registration versions: *.*.

  2. CVE-2026-15087 5.9 Moyenne

    Drupal Clean RESTful

    vulnerability in Drupal Clean RESTful allows . This issue affects Clean RESTful versions: *.*.

  3. CVE-2026-15086 5.9 Moyenne

    Drupal Raw Formatter [Meta Tag Formatter]

    vulnerability in Drupal Raw Formatter [Meta Tag Formatter] allows . This issue affects Raw Formatter [Meta Tag Formatter] versions: *.*.

  4. CVE-2026-11915 5.9 Moyenne

    Drupal Brute force attack protection

    vulnerability in Drupal Brute force attack protection allows . This issue affects Brute force attack protection versions: *.*.

  5. CVE-2026-11914 5.9 Moyenne

    Drupal Composer

    vulnerability in Drupal Composer allows . This issue affects Composer versions: *.*.

  6. CVE-2026-11913 9.8 Critique

    Drupal Mother May I

    vulnerability in Drupal Mother May I allows . This issue affects Mother May I versions: *.*.

  7. CVE-2026-58591 5.4 Moyenne

    Drupal Colorbox · Colorbox project colorbox

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Colorbox allows Cross-Site Scripting (XSS). This issue affects Colorbox versions: from 0.0.0 to 2.1.5, from 0.0.0 to 2.2.0.

  8. CVE-2026-58590 5.4 Moyenne

    Drupal FlowDrop · Flowdrop project flowdrop

    Missing Authorization vulnerability in Drupal FlowDrop allows Forceful Browsing. This issue affects FlowDrop versions: from 0.0.0 to 1.6.0.

  9. CVE-2026-58589 5.4 Moyenne

    Drupal FlowDrop · Flowdrop project flowdrop

    Missing Authorization vulnerability in Drupal FlowDrop allows Forceful Browsing. This issue affects FlowDrop versions: from 0.0.0 to 1.6.0.

  10. CVE-2026-58588 6.1 Moyenne

    Drupal Canvas · Drupal canvas project drupal canvas

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal Canvas allows Cross-Site Scripting (XSS). This issue affects Drupal Canvas versions: from 0.0.0 to 1.4.2, from 1.5.0 to 1.5.2, from 1.6.0 to 1.6.1, from 1.7.0 to 1.7.1.

  11. CVE-2026-58587 6.1 Moyenne

    Drupal Canvas · Drupal canvas project drupal canvas

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal Canvas allows Cross-Site Scripting (XSS). This issue affects Drupal Canvas versions: from 0.0.0 to 1.4.2, from 1.5.0 to 1.5.2, from 1.6.0 to 1.6.1, from 1.7.0 to 1.7.1.

  12. CVE-2026-55810 8.1 Élevée

    Drupal Plotly.js Graphing · Plotly plotly.js graphing

    Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Plotly.js Graphing allows Object Injection. This issue affects Plotly.js Graphing versions: from 0.0.0 to 3.0.2.

  13. CVE-2026-55809 8.1 Élevée

    Drupal Flag attendance field · Flag attendance field project flag attendance field

    Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Flag attendance field allows Object Injection. This issue affects Flag attendance field versions: from 0.0.0 to 1.2.

  14. CVE-2026-55808 5.4 Moyenne

    Drupal core · Drupal drupal

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Drupal core versions: from 0.0.0 to 10.5.12, from 10.6.0 to 10.6.11, from 11.2.0 to 11.2.14, from 11.3.0 to 11.3.12, from 0.0.0 to 11.0.*, from 0.0.0 to 11.1.*.

  15. CVE-2026-55807 3.1 Faible

    Drupal core · Drupal drupal

    Server-Side Request Forgery (SSRF) vulnerability in Drupal Drupal core allows Server Side Request Forgery. This issue affects Drupal core versions: from 0.0.0 to 10.5.12, from 10.6.0 to 10.6.11, from 11.2.0 to 11.2.14, from 11.3.0 to 11.3.12, from 0.0.0 to 11.0.*, from 0.0.0 to 11.1.*.

  16. CVE-2026-55806 5.9 Moyenne

    Drupal core · Drupal drupal

    URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal Drupal core allows Content Spoofing. This issue affects Drupal core versions: from 0.0.0 to 10.5.12, from 10.6.0 to 10.6.11, from 11.2.0 to 11.2.14, from 11.3.0 to 11.3.12, from 0.0.0 to 11.0.*, from 0.0.0 to 11.1.*.

  17. CVE-2026-55804 5.9 Moyenne

    Drupal core · Drupal drupal

    Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection. This issue affects Drupal core versions: from 0.0.0 to 10.5.12, from 10.6.0 to 10.6.11, from 11.2.0 to 11.2.14, from 11.3.0 to 11.3.12, from 0.0.0 to 11.0.*, from 0.0.0 to 11.1.*.

  18. CVE-2026-55803 5.9 Moyenne

    Drupal core · Drupal drupal

    Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection. This issue affects Drupal core versions: from 0.0.0 to 10.5.12, from 10.6.0 to 10.6.11, from 11.2.0 to 11.2.14, from 11.3.0 to 11.3.12, from 0.0.0 to 11.0.*, from 0.0.0 to 11.1.*.

  19. CVE-2026-15085 5.4 Moyenne

    Drupal AI SEO/GEO Analyzer · J-vee ai seo\/geo analyzer

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI SEO/GEO Analyzer allows Stored XSS. This issue affects AI SEO/GEO Analyzer versions: from 0.0.0 to 1.1.3.

  20. CVE-2026-15084 5.4 Moyenne

    Drupal UI Patterns (SDC in Drupal UI) · Ademarco ui patterns

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal UI Patterns (SDC in Drupal UI) allows Stored XSS. This issue affects UI Patterns (SDC in Drupal UI) versions: from 2.0.0 to 2.0.17.

  21. CVE-2026-15083 4.2 Moyenne

    Drupal ECA: Event - Condition - Action · Jurgenhaas eca\

    Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal ECA: Event - Condition - Action allows Object Injection. This issue affects ECA: Event - Condition - Action versions: from 0.0.0 to 2.1.20, from 3.0.0 to 3.0.12, from 3.1.0 to 3.1.4.

  22. CVE-2026-15082 5.4 Moyenne

    Drupal Siteimprove Analytics · Ijsbrandy siteimprove analytics

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Siteimprove Analytics allows Cross-Site Scripting (XSS). This issue affects Siteimprove Analytics versions: from 0.0.0 to 2.0.1.

  23. CVE-2026-15081 7.4 Élevée

    Drupal Location Selector · Handkerchief location selector

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Location Selector allows SQL Injection. This issue affects Location Selector versions: from 0.0.0 to 1.3.0.

  24. CVE-2026-15080 4.3 Moyenne

    Drupal Ray Enterprise Translation · Lingotek ray enterprise translation

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal Ray Enterprise Translation allows Cross Site Request Forgery. This issue affects Ray Enterprise Translation versions: from 0.0.0 to 4.0.4, from 4.1.0 to 4.1.4, from 11.0.0 to 11.0.4.

  25. CVE-2026-15079 5.4 Moyenne

    Drupal Login Disable · Budda login disable

    Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Login Disable allows Brute Force. This issue affects Login Disable versions: from 0.0.0 to 2.1.4.

  26. CVE-2026-13244 8.1 Élevée

    Drupal Tealium iQ Tag Management · Dakku tealium iq tag management

    Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Tealium iQ Tag Management allows Object Injection. This issue affects Tealium iQ Tag Management versions: from 0.0.0 to 2.4.0.

  27. CVE-2026-13243 4.8 Moyenne

    Drupal Salesforce Suite · Victorkane salesforce suite

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal Salesforce Suite allows Cross Site Request Forgery. This issue affects Salesforce Suite versions: from 0.0.0 to 5.1.3.

  28. CVE-2026-13242 6.5 Moyenne

    Drupal Geolocation Field · Dopry geolocation field

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Geolocation Field allows SQL Injection. This issue affects Geolocation Field versions: from 0.0.0 to 3.15.0.

  29. CVE-2026-13241 6.5 Moyenne

    Drupal Paragraphs · Md-systems paragraphs

    Missing Authorization vulnerability in Drupal Paragraphs allows Forceful Browsing. This issue affects Paragraphs versions: from 0.0.0 to 1.21.0.

  30. CVE-2026-13240 6.5 Moyenne

    Drupal Paragraphs · Md-systems paragraphs

    Missing Authorization vulnerability in Drupal Paragraphs allows Forceful Browsing. This issue affects Paragraphs versions: from 0.0.0 to 1.21.0.

  31. CVE-2026-13239 6.5 Moyenne

    Drupal WissKI · Wiss-ki wisski

    Missing Authorization vulnerability in Drupal WissKI allows Forceful Browsing. This issue affects WissKI versions: from 0.0.0 to 4.2.0.

  32. CVE-2026-13238 4.8 Moyenne

    Drupal Commerce Realex / Global Payments · Stella commerce realex \/ global payments

    Incorrect Authorization vulnerability in Drupal Commerce Realex / Global Payments allows Forceful Browsing. This issue affects Commerce Realex / Global Payments versions: from 0.0.0 to 3.0.2.

  33. CVE-2026-13237 4.8 Moyenne

    Drupal AI Agents · Artificial intelligence project artificial intelligence

    Incorrect Authorization vulnerability in Drupal AI Agents allows Forceful Browsing. This issue affects AI Agents versions: from 0.0.0 to 1.1.4, from 1.2.0 to 1.2.5, from 1.3.0 to 1.3.1.

  34. CVE-2026-13236 4.2 Moyenne

    Drupal AI Agents · Artificial intelligence project artificial intelligence

    Missing Authorization vulnerability in Drupal AI Agents allows Forceful Browsing. This issue affects AI Agents versions: from 0.0.0 to 1.1.4, from 1.2.0 to 1.2.5, from 1.3.0 to 1.3.1.

  35. CVE-2026-13235 3.3 Faible

    Drupal AI (Artificial Intelligence) · Artificial intelligence project artificial intelligence

    Missing Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Forceful Browsing. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.2.17, from 1.3.0 to 1.3.8, from 1.4.0 to 1.4.3.

  36. CVE-2026-13234 6.1 Moyenne

    Drupal AI (Artificial Intelligence) · Artificial intelligence project artificial intelligence

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Cross-Site Scripting (XSS). This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.2.17, from 1.3.0 to 1.3.8, from 1.4.0 to 1.4.3.

  37. CVE-2026-13233 3.3 Faible

    Drupal OpenAI Provider · Openai provider project openai provider

    Server-Side Request Forgery (SSRF) vulnerability in Drupal OpenAI Provider allows Server Side Request Forgery. This issue affects OpenAI Provider versions: from 0.0.0 to 1.1.1, from 1.2.0 to 1.2.2.

  38. CVE-2026-13232 3.1 Faible

    Drupal Advanced Content Feedback (aka admin_feedback) · Anuaralfetahe advanced content feedback

    Incorrect Authorization vulnerability in Drupal Advanced Content Feedback (aka admin_feedback) allows Forceful Browsing. This issue affects Advanced Content Feedback (aka admin_feedback) versions: from 0.0.0 to 2.8.0.

  39. CVE-2026-13231 6.1 Moyenne

    Drupal Advanced Content Feedback (aka admin_feedback) · Anuaralfetahe advanced content feedback

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Advanced Content Feedback (aka admin_feedback) allows Stored XSS. This issue affects Advanced Content Feedback (aka admin_feedback) versions: from 0.0.0 to 2.8.0.

  40. CVE-2026-12535 9.8 Critique

    Drupal Formatter Field · Zroger formatter field

    Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Formatter Field allows Object Injection. This issue affects Formatter Field versions: from 0.0.0 to 2.0.0.

  41. CVE-2026-11909 3.3 Faible

    Drupal Examples for Developers · Rfay examples for developers

    Missing Authorization vulnerability in Drupal Examples for Developers allows Forceful Browsing. This issue affects Examples for Developers versions: from 0.0.0 to 4.0.6.

  42. CVE-2026-11908 5.4 Moyenne

    Drupal Tagify · Factorial tagify

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Tagify allows Stored XSS. This issue affects Tagify versions: from 0.0.0 to 1.2.52.

  43. CVE-2026-10770 6.1 Moyenne

    Drupal Anti-Spam by CleanTalk · Cleantalk anti-spam

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Anti-Spam by CleanTalk allows Reflected XSS. This issue affects Anti-Spam by CleanTalk versions: from 0.0.0 to 9.7.1.

  44. CVE-2026-10769 5.4 Moyenne

    Drupal Commerce Core · Centarro commerce core

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Commerce Core allows Stored XSS. This issue affects Commerce Core versions: from 3.3.0 to 3.3.6.

  45. CVE-2026-10768 9.8 Critique

    Drupal LocalGov Workflows · Localgovdrupal localgov workflows

    Missing Authorization vulnerability in Drupal LocalGov Workflows allows Forceful Browsing. This issue affects LocalGov Workflows versions: from 0.0.0 to 1.6.0.