Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools

drupal_canvas_project

Source -

NVD

BOS Name -

N/A

CNA CVEs -

0

ADP CVEs -

0

CISA CVEs -

0

NVD CVEs -

4
Related CVEsRelated ProductsRelated AssignersReports
4Vulnerabilities found
CVE-2026-58588
Assigner-Drupal.org
ShareView Details
Assigner-Drupal.org
CVSS Score-6.1||MEDIUM
EPSS-0.15% / 4.83%
||
7 Day CHG-0.10%
Published-10 Jul, 2026 | 21:46
Updated-21 Jul, 2026 | 15:40
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Drupal Canvas - Moderately critical - Improper validation - SA-CONTRIB-2026-066

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal Canvas allows Cross-Site Scripting (XSS). This issue affects Drupal Canvas versions: from 0.0.0 to 1.4.2, from 1.5.0 to 1.5.2, from 1.6.0 to 1.6.1, from 1.7.0 to 1.7.1.

Action-Not Available
Vendor-drupal_canvas_projectThe Drupal Association
Product-drupal_canvasDrupal Canvas
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-58587
Assigner-Drupal.org
ShareView Details
Assigner-Drupal.org
CVSS Score-6.1||MEDIUM
EPSS-0.15% / 4.54%
||
7 Day CHG-0.10%
Published-10 Jul, 2026 | 21:46
Updated-21 Jul, 2026 | 15:41
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Drupal Canvas - Moderately critical - Improper validation - SA-CONTRIB-2026-065

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal Canvas allows Cross-Site Scripting (XSS). This issue affects Drupal Canvas versions: from 0.0.0 to 1.4.2, from 1.5.0 to 1.5.2, from 1.6.0 to 1.6.1, from 1.7.0 to 1.7.1.

Action-Not Available
Vendor-drupal_canvas_projectThe Drupal Association
Product-drupal_canvasDrupal Canvas
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-3216
Assigner-Drupal.org
ShareView Details
Assigner-Drupal.org
CVSS Score-5||MEDIUM
EPSS-0.29% / 20.88%
||
7 Day CHG~0.00%
Published-25 Mar, 2026 | 15:24
Updated-31 Mar, 2026 | 19:25
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Drupal Canvas - Moderately critical - Server-side request forgery, Information disclosure - SA-CONTRIB-2026-017

Server-Side Request Forgery (SSRF) vulnerability in Drupal Drupal Canvas allows Server Side Request Forgery.This issue affects Drupal Canvas: from 0.0.0 before 1.1.1.

Action-Not Available
Vendor-drupal_canvas_projectThe Drupal Association
Product-drupal_canvasDrupal Canvas
CWE ID-CWE-918
Server-Side Request Forgery (SSRF)
CVE-2026-1553
Assigner-Drupal.org
ShareView Details
Assigner-Drupal.org
CVSS Score-4.8||MEDIUM
EPSS-0.14% / 3.61%
||
7 Day CHG~0.00%
Published-04 Feb, 2026 | 20:26
Updated-11 Feb, 2026 | 19:19
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Drupal Canvas - Moderately critical - Access bypass - SA-CONTRIB-2026-006

Incorrect Authorization vulnerability in Drupal Drupal Canvas allows Forceful Browsing.This issue affects Drupal Canvas: from 0.0.0 before 1.0.4.

Action-Not Available
Vendor-drupal_canvas_projectThe Drupal Association
Product-drupal_canvasDrupal Canvas
CWE ID-CWE-863
Incorrect Authorization