Security37 mOctober 10, 2026, 13:20

CVE-2026-96358: 436,276 Drupal Fingerprints Don't Mean Vulnerable Sites

CERT-BUND issued advisory WID-SEC-2026-3554 on 23 September 2026 covering multiple flaws in 16 contributed Drupal modules, including Webform and AI CKEditor. ZoomEye counted 436,276 hosts running Drupal, but that figure does not represent vulnerable sites because it ignores installed modules and their versions.

DEV Community

Open source

CVE-2026-96358: 436,276 Drupal Fingerprints Don't Mean Vulnerable Sites

Advisory WID-SEC-2026-3554 covers 19 version ranges across 16 Drupal modules
ZoomEye: 436,276 Drupal hosts and zero matches for CVE-2026-96358
The flaws allow code execution, privilege escalation and XSS attacks
Vendor fixes exist; in-range modules must be updated and rechecked

#Drupal#ZoomEye#CERT-BUND

CERT-Bund: XSS in Drupal extensions among 35 flaws in WID-SEC-2026-3554

Security

CVE-2026-96364 in Drupal: 16 modules affected, detection only by version

Security

CERT-BUND flags 36 Drupal module flaws, including Webform and REST API

Security

CVE-2026-96358: 436,276 Drupal Fingerprints Don't Mean Vulnerable Sites

CERT-Bund: XSS in Drupal extensions among 35 flaws in WID-SEC-2026-3554

CVE-2026-96364 in Drupal: 16 modules affected, detection only by version

CERT-BUND flags 36 Drupal module flaws, including Webform and REST API

CERT-BUND flags 36 CVEs in 16 Drupal projects, CVSS 9.8