CERT-BUND flags 36 Drupal module flaws, including CVE-2026-96369

CERT-BUND's WID-SEC-2026-3554 advisory, published 23 September 2026 and rated high risk, covers 36 CVE identifiers (96355–96398) in contributed Drupal modules. Fixes span 16 projects and 19 releases; Drupal core is explicitly excluded. The exploitation mechanism for CVE-2026-96369 is not disclosed.

• Advisory covers CVE-2026-96355–96398, CVSS v3.1 base 9.8, temporal 8.5
• Fixes released for 16 modules, including Webform 6.3.1 and Project Browser 2.1.5
• Drupal core is explicitly outside the advisory's scope
• ZoomEye found 436,345 Drupal assets on 28 September, none linked to CVE-2026-96369