Tag
#Drupal
Understanding and Defending Against CVE-2026-107251: Incorrect Authorization in Drupal Entity Reference Manager
CVE-2026-107251 is an Incorrect Authorization vulnerability in the Drupal Entity Reference Manager (Merge entities) module, allowing for Forceful Browsing. This vulnerability affects versions from 0.0.0 to 1.0.3 and has a CVSS score of 6.5. While not actively exploited, understanding this vulnerability is crucial for maintaining the security of Drupal installations.
Critical Object Injection Vulnerability in Drupal Block AJAX (CVE-2026-107249)
A critical vulnerability (CVE-2026-107249) with a CVSS score of 9.8 has been discovered in the Drupal Block AJAX module, affecting versions from 0.0.0 to 3.0.2. This Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability allows for Object Injection, posing a significant risk to Drupal installations. Immediate patching is recommended to prevent potential exploitation.