Security1 hSeptember 29, 2026, 20:01

CVE-2026-96357 in Drupal: 16 modules, 19 affected version ranges

CERT-BUND advisory WID-SEC-2026-3554 covers CVE-2026-96357 in 16 contributed Drupal modules across 19 affected version ranges. The flaw is rated high risk with a CVSS 3.1 base score of 9.8 and temporal score of 8.5, is remotely exploitable, and fixes are available.

DEV Community

Open source

CERT-BUND: 16 Drupal projects, 19 affected version ranges
CVSS 3.1 base score 9.8, temporal score 8.5, high risk
Modules include Webform, Project Browser and Editoria11y
ZoomEye: 436,263 Drupal instances visible on 25 September

#Drupal

CVE-2026-96363 Is a Webform Entity Print Submodule Issue, Not Drupal Core

Security

CVE-2026-63349: Privilege Dropping Bypass and DoS in AnyIO Subprocess Module

Science

US next 10,000-ton submarine payload module built, can carry more long-range weapons

Security

CVE-2026-96357 in Drupal: 16 modules, 19 affected version ranges

CVE-2026-96363 Is a Webform Entity Print Submodule Issue, Not Drupal Core

CVE-2026-63349: Privilege Dropping Bypass and DoS in AnyIO Subprocess Module

US next 10,000-ton submarine payload module built, can carry more long-range weapons

CVE-2026-7273 in Zyxel GS1900 switches allows unauthenticated OS command execution