https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 02:53:39 +0000 https://cve.radiocsirt.org/vuln/drupal-contrib-2026-112 <p><strong>Affected:</strong> Packagist:https://packages.drupal.org/8: drupal/dxpr_builder</p> <p>The [DXPR Builder](https://www.drupal.org/project/dxpr_builder) module provides a visual / AI page builder for Drupal. The module uses a JSON Web Token for licensing, user license management, AI services, and subscription metadata.</p> <p>The 2.x version of the module does not sufficiently restrict access to API credentials in JavaScript settings. When AI agent features are enabled, the token is exposed to all page visitors (including anonymous users) via `drupalSettings`.</p> <p>This vulnerability is mitigated by the fact that a site must have DXPR Builder AI features enabled and configured with an API token.</p> <p><strong>Affected:</strong> Packagist:https://packages.drupal.org/8: drupal/dxpr_builder</p> <p>The [DXPR Builder](https://www.drupal.org/project/dxpr_builder) module provides a visual / AI page builder for Drupal. The module uses a JSON Web Token for licensing, user license management, AI services, and subscription metadata.</p> <p>The 2.x version of the module does not sufficiently restrict access to API credentials in JavaScript settings. When AI agent features are enabled, the token is exposed to all page visitors (including anonymous users) via `drupalSettings`.</p> <p>This vulnerability is mitigated by the fact that a site must have DXPR Builder AI features enabled and configured with an API token.</p> https://cve.radiocsirt.org/vuln/drupal-contrib-2026-112 https://cve.radiocsirt.org/vuln/euvd-2026-363308 EUVD-2026-363308 https://cve.radiocsirt.org/vuln/euvd-2026-363308 https://cve.radiocsirt.org/vuln/fkie_cve-2026-81162 <p>Insertion of Sensitive Information Into Sent Data vulnerability in Drupal DXPR Builder: The Best Editing (AI) Experience for Drupal allows Forceful Browsing. This issue affects DXPR Builder: The Best Editing (AI) Experience for Drupal versions: from 0.0.0 to 2.8.1.</p> <p>Insertion of Sensitive Information Into Sent Data vulnerability in Drupal DXPR Builder: The Best Editing (AI) Experience for Drupal allows Forceful Browsing. This issue affects DXPR Builder: The Best Editing (AI) Experience for Drupal versions: from 0.0.0 to 2.8.1.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-81162 https://cve.radiocsirt.org/vuln/ghsa-q42r-j7mq-j9mc <p>Insertion of Sensitive Information Into Sent Data vulnerability in Drupal DXPR Builder: The Best Editing (AI) Experience for Drupal allows Forceful Browsing. This issue affects DXPR Builder: The Best Editing (AI) Experience for Drupal versions: from 0.0.0 to 2.8.1.</p> <p>Insertion of Sensitive Information Into Sent Data vulnerability in Drupal DXPR Builder: The Best Editing (AI) Experience for Drupal allows Forceful Browsing. This issue affects DXPR Builder: The Best Editing (AI) Experience for Drupal versions: from 0.0.0 to 2.8.1.</p> https://cve.radiocsirt.org/vuln/ghsa-q42r-j7mq-j9mc https://cve.radiocsirt.org/vuln/wid-sec-w-2026-3041 <p>Ein Angreifer kann mehrere Schwachstellen in verschiedenen Drupal Erweiterungen ausnutzen, um Sicherheitsmaßnahmen zu umgehen, sensible Informationen offenzulegen, Daten zu manipulieren und Cross-Site-Scripting-Angriffe durchzuführen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in verschiedenen Drupal Erweiterungen ausnutzen, um Sicherheitsmaßnahmen zu umgehen, sensible Informationen offenzulegen, Daten zu manipulieren und Cross-Site-Scripting-Angriffe durchzuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-3041