---METADATA---
VENDOR: Drupal
PRODUCT: Core
AFFECTED_VERSIONS: Drupal core: 8.9.0 through 10.4.9, 10.5.0 through 10.5.9, 10.6.0 through 10.6.8, 11.0.0 through 11.1.9, 11.2.0 through 11.2.11, and 11.3.0 through 11.3.9.
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A critical SQL injection vulnerability exists in Drupal Core for PostgreSQL backends, allowing unauthenticated attackers to execute arbitrary SQL statements.

Executive Summary:
Drupal Core is affected by a critical SQL injection vulnerability that is currently being exploited in the wild, posing an immediate risk of remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-9082

Affected Software: Drupal Core

Affected Versions: Drupal core: from 8.9.0 before 10.4.10, from 10.5.0 before 10.5.10, from 10.6.0 before 10.6.9, from 11.0.0 before 11.1.10, from 11.2.0 before 11.2.12, and from 11.3.0 before 11.3.10.

Vulnerability: This is an unauthenticated SQL injection vulnerability affecting Drupal sites using PostgreSQL. Attackers can inject malicious SQL via network-accessible inputs, potentially leading to data exfiltration, modification, or remote code execution.

Business Impact

With a CVSS score of 9.5, this vulnerability represents a critical risk. Successful exploitation allows an attacker to bypass authentication, potentially gaining full control over the Drupal instance and the underlying database. This could result in complete loss of data confidentiality, integrity, and availability, as well as unauthorized access to integrated enterprise systems.

Remediation Plan

Immediate Action: Update Drupal core to versions 10.4.10, 10.5.10, 10.6.9, 11.1.10, 11.2.12, or 11.3.10 immediately.

Proactive Monitoring: Review database query logs for anomalous or malformed SQL patterns originating from external sources.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules designed to detect and block SQL injection patterns, though this should be treated only as a temporary measure.

Exploitation Status

Public Exploit Available: True

Analyst Notes: As of May 22, 2026, this vulnerability is listed in the CISA KEV catalog. Extensive exploitation attempts have been recorded globally, confirming that this is an active target for threat actors.

Analyst Recommendation

Given the confirmed active exploitation and the critical nature of this SQL injection flaw, organizations must prioritize patching their Drupal environments immediately. Failure to update will leave systems vulnerable to complete compromise by unauthenticated attackers.

---METADATA---
VENDOR: Drupal
PRODUCT: Plotly.js Graphing
AFFECTED_VERSIONS: 0.0.0 up to (excluding) 3.0.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A PHP object injection vulnerability exists in the Drupal Plotly.js Graphing module due to improper control of dynamically determined object attributes during deserialization.

Executive Summary:
An object injection vulnerability in the Drupal Plotly.js Graphing module, affecting versions prior to 3.0.2, poses a significant risk of unauthorized data modification and potential remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-55810

Affected Software: Drupal Plotly.js Graphing

Affected Versions: 0.0.0 up to (excluding) 3.0.2

Vulnerability: This vulnerability involves improper deserialization of PHP objects within the Plotly.js Graphing module. An attacker with authenticated access (specifically the ability to edit content entities containing a plotly_js_graph field) can inject malicious objects that are processed during deserialization.

Business Impact

The CVSS score of 8.1 reflects a high-severity risk, primarily due to the potential for significant integrity and confidentiality compromise. Successful exploitation could allow an attacker to alter application logic or data structures, potentially leading to unauthorized system access or full compromise of the affected Drupal site. Because this requires specific permissions, the risk is most acute for organizations with multiple contributors or those utilizing the JSON:API module with permissive settings.

Remediation Plan

Immediate Action: Update the Drupal Plotly.js Graphing module to version 3.0.2 or later immediately to resolve the deserialization flaw.

Proactive Monitoring: Review web server and Drupal access logs for anomalous requests targeting content editing endpoints or unexpected serialized data patterns.

Compensating Controls: Ensure that the JSON:API module is configured to restrict operations and verify that user permissions are strictly limited to the principle of least privilege, preventing unauthorized users from editing fields that utilize the vulnerable graphing component.

Exploitation Status

Public Exploit Available: No (no confirmed public exploit identified).

Analyst Notes: As of July 10, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw's inherent exploitability is limited by the requirement for specific authenticated access and configuration, but it remains a critical target due to the potential for total impact on the host application.

Analyst Recommendation

Given the high CVSS score and the nature of object injection vulnerabilities, organizations should prioritize patching this module immediately. The requirement for authentication does not eliminate the risk, particularly in environments with broad user access. Administrators must verify their current version and apply the 3.0.2 update to prevent potential compromise of their Drupal environment.

---METADATA---
VENDOR: Drupal
PRODUCT: Commerce guest registration
AFFECTED_VERSIONS: All versions ( . )
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A critical security vulnerability exists in the Drupal Commerce guest registration module, which is now unmaintained and obsolete.

Executive Summary:
The Drupal Commerce guest registration module contains a critical, unpatchable vulnerability that necessitates immediate removal of the software.

Vulnerability Details

CVE-ID: CVE-2026-15089

Affected Software: Drupal Commerce guest registration

Affected Versions: All versions ( . )

Vulnerability: This is a critical security flaw affecting all versions of the module. As the module is unmaintained, the Drupal security team has confirmed that no security patches will be issued.

Business Impact

The vulnerability carries a CVSS score of 9.1, reflecting a high risk of total system compromise or unauthorized data access. Because the module is obsolete and unmaintained, the risk to business continuity is severe, as there is no path to remediation other than complete removal. Failure to uninstall this component leaves the environment permanently exposed to potential exploitation.

Remediation Plan

Immediate Action: You must uninstall and remove the Drupal Commerce guest registration module from your environment immediately. The functionality is already integrated into Drupal Commerce core versions 10.x and later, rendering this standalone module unnecessary.

Proactive Monitoring: Review web server and Drupal application logs for any unusual access patterns or attempts to interact with guest registration endpoints.

Compensating Controls: Since no patch is available, ensure that a Web Application Firewall (WAF) is configured to block unauthorized requests to commerce registration paths until the module is successfully removed.

Exploitation Status

Public Exploit Available: No (unknown)

Analyst Notes: As of July 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is considered highly dangerous due to the lack of vendor support and the permanent nature of the flaw.

Analyst Recommendation

Given the critical severity and the fact that this module is obsolete, there is no acceptable alternative to uninstallation. Administrators should prioritize the removal of this module during the next maintenance window to eliminate this security risk entirely.

---METADATA---
VENDOR: Drupal
PRODUCT: Location Selector
AFFECTED_VERSIONS: <1.3.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A critical SQL injection vulnerability in the Drupal Location Selector module allows unauthenticated attackers to execute arbitrary SQL commands via unsanitized input in Views filters.

Executive Summary:
The Drupal Location Selector module is affected by a critical SQL injection vulnerability that could allow full database compromise.

Vulnerability Details

CVE-ID: CVE-2026-15081

Affected Software: Drupal Location Selector

Affected Versions: <1.3.0

Vulnerability: The vulnerability (CWE-89) occurs due to improper neutralization of special elements used in SQL commands. The module fails to properly sanitize user input within its Views filters, allowing an attacker to inject and execute malicious SQL queries.

Business Impact

A CVSS score of 9.8 reflects the high risk associated with SQL injection, which can lead to unauthorized data disclosure, data modification, or total destruction of the database. This represents a significant risk to the confidentiality, integrity, and availability of the entire Drupal application.

Remediation Plan

Immediate Action: Update the Location Selector module to version 1.3.0 to resolve the input validation flaws.

Proactive Monitoring: Scan database query logs for suspicious syntax or anomalies that suggest attempts to extract or manipulate table data.

Compensating Controls: Use a Web Application Firewall (WAF) to filter and block common SQL injection patterns in incoming HTTP requests until the module can be updated.

Exploitation Status

Public Exploit Available: No (unknown)

Analyst Notes: As of July 10, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. SQL injection remains one of the most dangerous vulnerability types; given the ease with which such flaws can be weaponized, this should be treated as a high-priority remediation.

Analyst Recommendation

The severity of this SQL injection necessitates an immediate update to version 1.3.0. Database security is paramount, and any delay in patching this vulnerability exposes the organization to significant risk of data breach and system compromise.

---METADATA---
VENDOR: Drupal
PRODUCT: Login Disable
AFFECTED_VERSIONS: <2.1.4
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The Drupal Login Disable module fails to properly restrict excessive authentication attempts, creating a vulnerability that facilitates brute force attacks against user accounts.

Executive Summary:
An improper authentication restriction vulnerability in the Drupal Login Disable module allows attackers to execute brute force attacks against user accounts.

Vulnerability Details

CVE-ID: CVE-2026-15079

Affected Software: Drupal Login Disable

Affected Versions: <2.1.4

Vulnerability: This vulnerability (CWE-307) stems from the module's failure to enforce adequate rate limiting or account lockout mechanisms during the authentication process. The flaw allows an attacker to systematically test password combinations without being blocked by the system.

Business Impact

With a CVSS score of 9.8, this vulnerability represents a critical risk of account takeover. If exploited, an attacker could gain unauthorized access to privileged accounts, potentially leading to a complete compromise of the Drupal environment and the exfiltration of sensitive site data.

Remediation Plan

Immediate Action: Update the Login Disable module to version 2.1.4 to enable robust rate limiting and brute force protection.

Proactive Monitoring: Review authentication logs for patterns indicative of credential stuffing or brute force attempts, such as high volumes of failed login requests from single or distributed IP addresses.

Compensating Controls: Deploy a Web Application Firewall (WAF) or an intrusion prevention system to detect and block IP addresses exhibiting high-frequency login failures.

Exploitation Status

Public Exploit Available: No (unknown)

Analyst Notes: As of July 10, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly exploitable due to the lack of built-in rate limiting, making it an attractive target for automated credential-stuffing tools.

Analyst Recommendation

Administrators should apply the patch immediately to ensure account security. Ensuring that rate limiting is active is a fundamental security requirement that must be addressed to prevent unauthorized access and maintain system integrity.

---METADATA---
VENDOR: Drupal
PRODUCT: OpenAI Provider
AFFECTED_VERSIONS: <1.1.1 || >=1.2.0 <1.2.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A Server-Side Request Forgery (SSRF) vulnerability in the Drupal OpenAI Provider module allows remote attackers to force the server to make unauthorized requests to internal or external resources.

Executive Summary:
The Drupal OpenAI Provider module contains a critical SSRF vulnerability that may allow attackers to bypass network controls and access internal services.

Vulnerability Details

CVE-ID: CVE-2026-13233

Affected Software: Drupal OpenAI Provider

Affected Versions: <1.1.1 || >=1.2.0 <1.2.2

Vulnerability: This is a Server-Side Request Forgery (CWE-918) vulnerability caused by insufficient sanitization of user-supplied URLs. The vulnerability allows an authenticated attacker with specific permissions to manipulate host URLs to target internal network services or third-party systems.

Business Impact

Successful exploitation of this vulnerability can lead to unauthorized access to internal network resources that are otherwise protected by firewalls. Given the CVSS score of 9.1, this is a critical risk that could result in sensitive data exposure or the lateral movement of an attacker within the organization's infrastructure.

Remediation Plan

Immediate Action: Update the Drupal OpenAI Provider module to version 1.1.1 or 1.2.2 immediately to apply the necessary input validation patches.

Proactive Monitoring: Monitor server access and egress logs for unusual outbound requests originating from the web server, particularly those targeting internal IP ranges.

Compensating Controls: Implement strict egress filtering on the web server to block requests to internal network segments and unauthorized external destinations until the update is applied.

Exploitation Status

Public Exploit Available: No (unknown)

Analyst Notes: As of July 10, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the CVSS score is high, the complexity of the exploit, which requires specific module configuration and user interaction, reduces the immediate probability of mass exploitation.

Analyst Recommendation

Organizations utilizing the OpenAI Provider module for Drupal must prioritize this update. Despite the lack of confirmed active exploitation, the severity of SSRF vulnerabilities necessitates immediate patching to prevent potential internal network compromise.

---METADATA---
VENDOR: Drupal
PRODUCT: Formatter Field
AFFECTED_VERSIONS: 0.0.0 to 2.0.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The Drupal Formatter Field module contains an object injection vulnerability due to improper control of dynamically determined object attributes.

Executive Summary:
The Drupal Formatter Field module is affected by a critical object injection vulnerability that could allow attackers to manipulate application data and behavior.

Vulnerability Details

CVE-ID: CVE-2026-12535

Affected Software: Drupal Formatter Field

Affected Versions: 0.0.0 to 2.0.0

Vulnerability: The vulnerability involves improper control of dynamically determined object attributes, leading to potential object injection. This allows an unauthenticated attacker to manipulate how the application processes data, potentially leading to arbitrary code execution or data corruption.

Business Impact

The CVSS score of 9.8 indicates a critical severity level, posing a significant threat to the entire Drupal installation. Successful exploitation allows an attacker to inject and manipulate objects, which can result in full system compromise, unauthorized data modification, or the execution of malicious logic within the server environment.

Remediation Plan

Immediate Action: Update the Drupal Formatter Field module to version 2.0.0 or later to resolve the underlying object injection flaw.

Proactive Monitoring: Review system and application logs for unusual object-related errors or anomalies that might indicate an attempted injection attack.

Compensating Controls: Deploy a WAF with rules designed to detect and block common object injection patterns or abnormal input structures that could trigger this vulnerability.

Exploitation Status

Public Exploit Available: No (unknown)

Analyst Notes: As of July 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Object injection flaws are typically complex to exploit but carry high impact, making patching essential.

Analyst Recommendation

Given the critical impact of object injection vulnerabilities, organizations must prioritize updating the Formatter Field module. Testing the update in a staging environment before deployment is recommended to ensure compatibility, but the urgency of this patch suggests a rapid deployment timeline.

---METADATA---
VENDOR: Drupal
PRODUCT: Mother May I
AFFECTED_VERSIONS: All versions
CONFIDENCE: medium
MISSING: patch, versions
---END_METADATA---

Description Summary:
A critical vulnerability in the Drupal Mother May I module allows unauthenticated attackers to execute arbitrary code or perform unauthorized actions on the host site.

Executive Summary:
A critical vulnerability in the Drupal Mother May I module permits unauthenticated remote attackers to achieve full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-11913

Affected Software: Drupal Mother May I

Affected Versions: All versions

Vulnerability: This is a critical security flaw in a Drupal contribution module that does not require any user authentication to exploit. The nature of the flaw allows for potential remote code execution, which grants an attacker full control over the affected Drupal installation.

Business Impact

The CVSS score of 9.8 indicates a critical risk to any organization using the affected module. Exploitation could result in the total compromise of the Drupal site, including the theft of sensitive user data, defacement of web content, or the injection of malicious scripts to target site visitors.

Remediation Plan

Immediate Action: Navigate to the Drupal security advisory link provided to determine the specific patch status and update the Mother May I module to the latest secure version immediately.

Proactive Monitoring: Review web server logs for suspicious HTTP requests, particularly those targeting module-specific paths or unusual POST requests that could indicate exploitation attempts.

Compensating Controls: If a patch is not immediately available, consider disabling the module entirely or implementing strict Web Application Firewall (WAF) rules to block suspicious traffic patterns targeting the module's functions.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of July 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While CISA's SSVC assessment confirms the vulnerability is automatable and has a high technical impact, there is currently no evidence of exploitation in the wild.

Analyst Recommendation

Given the critical nature of this vulnerability and the lack of authentication requirements, immediate action is required. Organizations should prioritize updating the Mother May I module and perform a thorough audit of their Drupal installation to ensure no unauthorized access has already occurred.

---METADATA---
VENDOR: Drupal
PRODUCT: LocalGov Workflows
AFFECTED_VERSIONS: 0.0.0 to 1.6.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A missing authorization vulnerability in the Drupal LocalGov Workflows module allows unauthorized users to access restricted resources via forceful browsing.

Executive Summary:
The Drupal LocalGov Workflows module is susceptible to a critical missing authorization flaw that allows unauthenticated attackers to bypass access controls.

Vulnerability Details

CVE-ID: CVE-2026-10768

Affected Software: Drupal LocalGov Workflows

Affected Versions: 0.0.0 to 1.6.0

Vulnerability: This vulnerability is caused by missing authorization checks, which permits unauthenticated attackers to perform forceful browsing. This allows access to sensitive workflow data or administrative functions that should be restricted.

Business Impact

With a CVSS score of 9.8, this vulnerability represents a critical risk to data confidentiality and integrity. Successful exploitation could allow an attacker to view or modify sensitive administrative workflows, potentially leading to unauthorized data exposure or complete compromise of the application's workflow management system.

Remediation Plan

Immediate Action: Update the Drupal LocalGov Workflows module to version 1.6.0 or later immediately to apply the necessary authorization checks.

Proactive Monitoring: Monitor application access logs for unexpected attempts to access administrative paths or workflow-related objects by unprivileged users.

Compensating Controls: Implement strict access control lists at the web server or WAF level to restrict access to sensitive module paths until the update is applied.

Exploitation Status

Public Exploit Available: No (unknown)

Analyst Notes: As of July 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous because it requires no authentication to reach the vulnerable code.

Analyst Recommendation

This vulnerability is highly critical and should be treated with the utmost urgency. Administrators must prioritize updating to version 1.6.0 or later to ensure that proper authorization logic is enforced and to prevent unauthorized access to sensitive system resources.

Executive Summary:
A critical authentication bypass vulnerability, identified as CVE-2025-8995, has been discovered in the Drupal Authenticator Login module. This flaw allows an unauthenticated attacker to completely bypass the login process and gain unauthorized access to the application. Successful exploitation could lead to a full system compromise, data theft, and service disruption.

Vulnerability Details

CVE-ID: CVE-2025-8995

Affected Software: Drupal Authenticator Login module

Affected Versions: Versions prior to 2.1.4

Vulnerability: The vulnerability is an Authentication Bypass Using an Alternate Path or Channel (CWE-288). An unauthenticated remote attacker can exploit this flaw by sending a specially crafted request to the Drupal instance. This allows the attacker to circumvent the standard authentication mechanisms enforced by the Authenticator Login module, granting them access to the application, potentially with the privileges of a high-level user such as an administrator.

Business Impact

This vulnerability is rated as critical, with a CVSS score of 9.8, reflecting the severe potential for damage. An attacker who successfully bypasses authentication can gain complete control over the affected Drupal site. The potential consequences include theft of sensitive data (customer information, intellectual property), website defacement, installation of malware or backdoors, and disruption of business operations. This could result in significant financial loss, reputational damage, and regulatory penalties.

Remediation Plan

Immediate Action: Immediately update the Drupal Authenticator Login module to the patched version 2.1.4 or a later release. After patching, it is crucial to review access logs and audit user accounts for any signs of unauthorized access or suspicious activity that may have occurred prior to the update.

Proactive Monitoring: Security teams should actively monitor for exploitation attempts. This includes analyzing web server and Drupal application logs for unusual login patterns, successful access from unexpected IP addresses, or direct access to administrative URLs without a preceding successful login event. Monitor for unauthorized changes to site configuration, content, or user accounts.

Compensating Controls: If immediate patching is not feasible, consider the following mitigating actions:

• Temporarily disable the Authenticator Login module if it is not critical to operations.
• Implement strict Web Application Firewall (WAF) rules to inspect and block malicious requests targeting authentication endpoints.
• Restrict access to the Drupal administrative login page to trusted IP addresses at the network or web server level.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Aug 15, 2025, there are no known public proof-of-concept exploits or active attacks targeting this vulnerability. However, due to the critical severity and the nature of authentication bypass flaws, it is highly probable that a functional exploit will be developed and released by security researchers or threat actors in the near future. Organizations should anticipate that attackers will begin scanning for vulnerable instances.

Analyst Recommendation

Given the critical CVSS score of 9.8 and the risk of complete system compromise, this vulnerability requires immediate attention. We strongly recommend that all organizations using the affected Drupal Authenticator Login module apply the vendor-supplied patch to version 2.1.4 or later on an emergency basis. Although this CVE is not currently listed on the CISA KEV catalog, its severity warrants treating it with the highest priority to prevent unauthorized access and protect critical assets.