https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-16T14:53:03.226395+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/drupal-contrib-2025-070 DRUPAL-CONTRIB-2025-070 2026-10-16T14:53:03.331568+00:00

Affected: Packagist:https://packages.drupal.org/8: drupal/bookable_calendar

This module enables you to setup a repeating date rule that users can "book" different dates, allowing you to let users register for a variety of different things like conference rooms or guitar lessons.

This module has a permission of "view booking" and "view booking contact" which allows you to view them regardless of whether you own them or not. Due to bad naming of the permissions it's likely admins have configured those to users that shouldn't have them.

This vulnerability is mitigated by the fact that an attacker must have a role with the permission "view booking" or "view booking contact".

 https://cve.radiocsirt.org/vuln/euvd-2026-244268 EUVD-2026-244268 2026-10-16T14:53:03.331637+00:00 EUVD-2026-244268 https://cve.radiocsirt.org/vuln/fkie_cve-2025-48916 fkie_cve-2025-48916 2026-10-16T14:53:03.331655+00:00

Missing Authorization vulnerability in Drupal Bookable Calendar allows Forceful Browsing.This issue affects Bookable Calendar: from 0.0.0 before 2.2.13.

 https://cve.radiocsirt.org/vuln/ghsa-p996-488q-cfm2 GHSA-p996-488q-cfm2 2026-10-16T14:53:03.331678+00:00

Missing Authorization vulnerability in Drupal Bookable Calendar allows Forceful Browsing.This issue affects Bookable Calendar: from 0.0.0 before 2.2.13.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-1172 WID-SEC-W-2025-1172 — Drupal: Mehrere Schwachstellen 2026-10-16T14:53:03.331693+00:00

Ein Angreifer kann mehrere Schwachstellen in Drupal ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen oder Sicherheitsvorkehrungen zu umgehen.