CERT-Bund bundles 35 Drupal extension CVEs into one advisory

CERT-Bund published advisory WID-SEC-2026-3554 on 23 September 2026, bundling 35 CVEs (CVE-2026-96355 through 96398) in Drupal extensions. The flaws allow arbitrary code execution, privilege escalation, security bypass, data manipulation and XSS; version ranges are not listed in the document.

• CERT-Bund advisory WID-SEC-2026-3554 was published on 23 September 2026
• The 35 CVEs span multiple extensions and defect classes
• ZoomEye returned 436,331 assets matching app="Drupal" on 28 September
• Fixes arrive in separate per-CVE vendor advisories