Vulnerability-Lookup

CVE-2026-10770 (GCVE-0-2026-10770)

Vulnerability from cvelistv5 – Published: 2026-07-10 21:42 – Updated: 2026-07-14 14:34

Title

Anti-Spam by CleanTalk - Moderately critical - Cross site scripting - SA-CONTRIB-2026-042

Summary

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Anti-Spam by CleanTalk allows Reflected XSS. This issue affects Anti-Spam by CleanTalk versions: from 0.0.0 to 9.7.1.

Severity

6.1 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")

Assigner

drupal

References

1 reference

URL	Tags
https://www.drupal.org/sa-contrib-2026-042

Impacted products

1 product

Vendor	Product	Version
Drupal	Anti-Spam by CleanTalk	Affected: 0.0.0 , < 9.7.1 (semver)

Date Public

2026-06-03 16:14

Credits

Ra MÃ¤nd (ram4nd) alexandergull anton1211 Ra MÃ¤nd (ram4nd) Neil Drumm (drumm) Greg Knaddison (greggles) Juraj Nemec (poker10)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 6.1,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "CHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-10770",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-14T13:58:26.163849Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-14T14:34:48.521Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://www.drupal.org/project/cleantalk",
          "product": "Anti-Spam by CleanTalk",
          "repo": "https://git.drupalcode.org/project/cleantalk",
          "vendor": "Drupal",
          "versions": [
            {
              "lessThan": "9.7.1",
              "status": "affected",
              "version": "0.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Ra M\u00c3\u00a4nd (ram4nd)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "alexandergull"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "anton1211"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Ra M\u00c3\u00a4nd (ram4nd)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Neil Drumm (drumm)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Greg Knaddison (greggles)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Juraj Nemec (poker10)"
        }
      ],
      "datePublic": "2026-06-03T16:14:56.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal Anti-Spam by CleanTalk allows Reflected XSS. This issue affects Anti-Spam by CleanTalk versions: from 0.0.0 to 9.7.1."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-591",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-591 Reflected XSS"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\")",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-10T21:42:57.867Z",
        "orgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
        "shortName": "drupal"
      },
      "references": [
        {
          "url": "https://www.drupal.org/sa-contrib-2026-042"
        }
      ],
      "title": "Anti-Spam by CleanTalk - Moderately critical - Cross site scripting - SA-CONTRIB-2026-042"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
    "assignerShortName": "drupal",
    "cveId": "CVE-2026-10770",
    "datePublished": "2026-07-10T21:42:57.867Z",
    "dateReserved": "2026-06-03T15:41:16.331Z",
    "dateUpdated": "2026-07-14T14:34:48.521Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-10770",
      "date": "2026-07-15",
      "epss": "0.00181",
      "percentile": "0.07837"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-10770\",\"sourceIdentifier\":\"mlhess@drupal.org\",\"published\":\"2026-07-10T22:16:38.770\",\"lastModified\":\"2026-07-14T15:16:56.080\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Improper Neutralization of Input During Web Page Generation (\\\"Cross-site Scripting\\\") vulnerability in Drupal Anti-Spam by CleanTalk allows Reflected XSS. This issue affects Anti-Spam by CleanTalk versions: from 0.0.0 to 9.7.1.\"}],\"affected\":[{\"source\":\"mlhess@drupal.org\",\"affectedData\":[{\"vendor\":\"Drupal\",\"product\":\"Anti-Spam by CleanTalk\",\"collectionURL\":\"https://www.drupal.org/project/cleantalk\",\"repo\":\"https://git.drupalcode.org/project/cleantalk\",\"versions\":[{\"version\":\"0.0.0\",\"lessThan\":\"9.7.1\",\"versionType\":\"semver\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\",\"baseScore\":6.1,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":2.7}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-07-14T13:58:26.163849Z\",\"id\":\"CVE-2026-10770\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"mlhess@drupal.org\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-79\"}]}],\"references\":[{\"url\":\"https://www.drupal.org/sa-contrib-2026-042\",\"source\":\"mlhess@drupal.org\"}]}}"
  }
}

drupal-contrib-2026-042

Vulnerability from drupal

Published

2026-06-03 16:14

Modified

2026-06-03 16:14

Summary

Details

This module provides spam protection using the CleanTalk cloud service.

The module doesn't sufficiently sanitize API response messages before rendering them in HTML output. The _cleantalk_die() and ct_die() functions output the CleanTalk API response message directly into HTML without proper sanitization, allowing potential injection of arbitrary HTML or JavaScript.

This vulnerability is mitigated by the fact that an attacker must be able to influence the CleanTalk cloud API response (e.g., through a man-in-the-middle attack or a compromised API server).

Credits

Ra Mänd (ram4nd) www.drupal.org/u/ram4nd

References

URL

Type

https://www.drupal.org/sa-contrib-2026-042

WEB

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "affected_versions": "\u003c9.7.1"
      },
      "package": {
        "ecosystem": "Packagist:https://packages.drupal.org/8",
        "name": "drupal/cleantalk"
      },
      "ranges": [
        {
          "database_specific": {
            "constraint": "\u003c9.7.1"
          },
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "9.7.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "severity": []
    }
  ],
  "aliases": [
    "CVE-2026-10770"
  ],
  "credits": [
    {
      "contact": [
        "https://www.drupal.org/u/ram4nd"
      ],
      "name": "Ra M\u00e4nd (ram4nd)"
    }
  ],
  "details": "This module provides spam protection using the CleanTalk cloud service.\n\nThe module doesn\u0027t sufficiently sanitize API response messages before rendering them in HTML output. The `_cleantalk_die()` and `ct_die()` functions output the CleanTalk API response message directly into HTML without proper sanitization, allowing potential injection of arbitrary HTML or JavaScript.\n\nThis vulnerability is mitigated by the fact that an attacker must be able to influence the CleanTalk cloud API response (e.g., through a man-in-the-middle attack or a compromised API server).",
  "id": "DRUPAL-CONTRIB-2026-042",
  "modified": "2026-06-03T16:14:56.000Z",
  "published": "2026-06-03T16:14:56.000Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://www.drupal.org/sa-contrib-2026-042"
    }
  ],
  "schema_version": "1.7.0"
}

FKIE_CVE-2026-10770

Vulnerability from fkie_nvd - Published: 2026-07-10 22:16 - Updated: 2026-07-14 15:16

Severity

6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Summary

References

	URL	Tags
	mlhess@drupal.org	https://www.drupal.org/sa-contrib-2026-042

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "collectionURL": "https://www.drupal.org/project/cleantalk",
          "product": "Anti-Spam by CleanTalk",
          "repo": "https://git.drupalcode.org/project/cleantalk",
          "vendor": "Drupal",
          "versions": [
            {
              "lessThan": "9.7.1",
              "status": "affected",
              "version": "0.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "mlhess@drupal.org"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal Anti-Spam by CleanTalk allows Reflected XSS. This issue affects Anti-Spam by CleanTalk versions: from 0.0.0 to 9.7.1."
    }
  ],
  "id": "CVE-2026-10770",
  "lastModified": "2026-07-14T15:16:56.080",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.7,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-10770",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-07-14T13:58:26.163849Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-07-10T22:16:38.770",
  "references": [
    {
      "source": "mlhess@drupal.org",
      "url": "https://www.drupal.org/sa-contrib-2026-042"
    }
  ],
  "sourceIdentifier": "mlhess@drupal.org",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "mlhess@drupal.org",
      "type": "Secondary"
    }
  ]
}

GHSA-FHCJ-F666-RHJR

Vulnerability from github – Published: 2026-07-11 00:31 – Updated: 2026-07-14 15:32

Details

Severity

6.1 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-10770"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-10T22:16:38Z",
    "severity": "MODERATE"
  },
  "details": "Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal Anti-Spam by CleanTalk allows Reflected XSS. This issue affects Anti-Spam by CleanTalk versions: from 0.0.0 to 9.7.1.",
  "id": "GHSA-fhcj-f666-rhjr",
  "modified": "2026-07-14T15:32:06Z",
  "published": "2026-07-11T00:31:46Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-10770"
    },
    {
      "type": "WEB",
      "url": "https://www.drupal.org/sa-contrib-2026-042"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

WID-SEC-W-2026-1799

Vulnerability from csaf_certbund - Published: 2026-06-04 22:00 - Updated: 2026-06-04 22:00

Summary

Drupal Erweiterungen: Mehrere Schwachstellen

Severity

Mittel

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung: Drupal ist ein freies Content-Management-System, basierend auf der Scriptsprache PHP und einer SQL-Datenbank. Über zahlreiche Extensions kann der Funktionsumfang der Core-Installation individuell erweitert werden.

Angriff: Ein entfernter Angreifer kann mehrere Schwachstellen in verschiedenen Drupal Erweiterungen ausnutzen, um Daten zu manipulieren oder offenzulegen, sowie um Cross-Site Scripting Angriffe durchzuführen.

Betroffene Betriebssysteme: - Linux - UNIX - Windows

CVE-2026-10768

Affected products

Known affected 4 products

Product	Identifier	Version	Remediation
Open Source Drupal TacJS <6.8 Open Source / Drupal		TacJS <6.8
Open Source Drupal LocalGov Workflows <1.6.0 Open Source / Drupal		LocalGov Workflows <1.6.0
Open Source Drupal Anti-Spam by CleanTalk <9.7.1 Open Source / Drupal		Anti-Spam by CleanTalk <9.7.1
Open Source Drupal Commerce Core <3.3.6 Open Source / Drupal		Commerce Core <3.3.6

CVE-2026-10769

Affected products

Known affected 4 products

Product	Identifier	Version	Remediation
Open Source Drupal TacJS <6.8 Open Source / Drupal		TacJS <6.8
Open Source Drupal LocalGov Workflows <1.6.0 Open Source / Drupal		LocalGov Workflows <1.6.0
Open Source Drupal Anti-Spam by CleanTalk <9.7.1 Open Source / Drupal		Anti-Spam by CleanTalk <9.7.1
Open Source Drupal Commerce Core <3.3.6 Open Source / Drupal		Commerce Core <3.3.6

CVE-2026-10770

Affected products

Known affected 4 products

Product	Identifier	Version	Remediation
Open Source Drupal TacJS <6.8 Open Source / Drupal		TacJS <6.8
Open Source Drupal LocalGov Workflows <1.6.0 Open Source / Drupal		LocalGov Workflows <1.6.0
Open Source Drupal Anti-Spam by CleanTalk <9.7.1 Open Source / Drupal		Anti-Spam by CleanTalk <9.7.1
Open Source Drupal Commerce Core <3.3.6 Open Source / Drupal		Commerce Core <3.3.6

CVE-2026-49977

Affected products

Known affected 4 products

Product	Identifier	Version	Remediation
Open Source Drupal TacJS <6.8 Open Source / Drupal		TacJS <6.8
Open Source Drupal LocalGov Workflows <1.6.0 Open Source / Drupal		LocalGov Workflows <1.6.0
Open Source Drupal Anti-Spam by CleanTalk <9.7.1 Open Source / Drupal		Anti-Spam by CleanTalk <9.7.1
Open Source Drupal Commerce Core <3.3.6 Open Source / Drupal		Commerce Core <3.3.6

References

6 references

URL	Category
https://wid.cert-bund.de/.well-known/csaf/white/2…	self
https://wid.cert-bund.de/portal/wid/securityadvis…	self
https://www.drupal.org/sa-contrib-2026-039	external
https://www.drupal.org/sa-contrib-2026-040	external
https://www.drupal.org/sa-contrib-2026-041	external
https://www.drupal.org/sa-contrib-2026-042	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "mittel"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Drupal ist ein freies Content-Management-System, basierend auf der Scriptsprache PHP und einer SQL-Datenbank. \u00dcber zahlreiche Extensions kann der Funktionsumfang der Core-Installation individuell erweitert werden.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein entfernter Angreifer kann mehrere Schwachstellen in verschiedenen Drupal Erweiterungen ausnutzen, um Daten zu manipulieren oder offenzulegen, sowie um Cross-Site Scripting Angriffe durchzuf\u00fchren.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Linux\n- UNIX\n- Windows",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2026-1799 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-1799.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2026-1799 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-1799"
      },
      {
        "category": "external",
        "summary": "Drupal Security Advisory sa-contrib-2026-039 vom 2026-06-04",
        "url": "https://www.drupal.org/sa-contrib-2026-039"
      },
      {
        "category": "external",
        "summary": "Drupal Security Advisory sa-contrib-2026-040 vom 2026-06-04",
        "url": "https://www.drupal.org/sa-contrib-2026-040"
      },
      {
        "category": "external",
        "summary": "Drupal Security Advisory sa-contrib-2026-041 vom 2026-06-04",
        "url": "https://www.drupal.org/sa-contrib-2026-041"
      },
      {
        "category": "external",
        "summary": "Drupal Security Advisory sa-contrib-2026-042 vom 2026-06-04",
        "url": "https://www.drupal.org/sa-contrib-2026-042"
      }
    ],
    "source_lang": "en-US",
    "title": "Drupal Erweiterungen: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2026-06-04T22:00:00.000+00:00",
      "generator": {
        "date": "2026-06-05T11:07:24.707+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.6.0"
        }
      },
      "id": "WID-SEC-W-2026-1799",
      "initial_release_date": "2026-06-04T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2026-06-04T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "LocalGov Workflows \u003c1.6.0",
                "product": {
                  "name": "Open Source Drupal LocalGov Workflows \u003c1.6.0",
                  "product_id": "T055013"
                }
              },
              {
                "category": "product_version",
                "name": "LocalGov Workflows 1.6.0",
                "product": {
                  "name": "Open Source Drupal LocalGov Workflows 1.6.0",
                  "product_id": "T055013-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:drupal:drupal:localgov_workflows__1.6.0"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "TacJS \u003c6.8",
                "product": {
                  "name": "Open Source Drupal TacJS \u003c6.8",
                  "product_id": "T055014"
                }
              },
              {
                "category": "product_version",
                "name": "TacJS 6.8",
                "product": {
                  "name": "Open Source Drupal TacJS 6.8",
                  "product_id": "T055014-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:drupal:drupal:tacjs__6.8"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "Commerce Core \u003c3.3.6",
                "product": {
                  "name": "Open Source Drupal Commerce Core \u003c3.3.6",
                  "product_id": "T055015"
                }
              },
              {
                "category": "product_version",
                "name": "Commerce Core 3.3.6",
                "product": {
                  "name": "Open Source Drupal Commerce Core 3.3.6",
                  "product_id": "T055015-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:drupal:drupal:commerce_core__3.3.6"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "Anti-Spam by CleanTalk \u003c9.7.1",
                "product": {
                  "name": "Open Source Drupal Anti-Spam by CleanTalk \u003c9.7.1",
                  "product_id": "T055016"
                }
              },
              {
                "category": "product_version",
                "name": "Anti-Spam by CleanTalk 9.7.1",
                "product": {
                  "name": "Open Source Drupal Anti-Spam by CleanTalk 9.7.1",
                  "product_id": "T055016-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:drupal:drupal:anti-spam_by_cleantalk__9.7.1"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Drupal"
          }
        ],
        "category": "vendor",
        "name": "Open Source"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-10768",
      "product_status": {
        "known_affected": [
          "T055014",
          "T055013",
          "T055016",
          "T055015"
        ]
      },
      "release_date": "2026-06-04T22:00:00.000+00:00",
      "title": "CVE-2026-10768"
    },
    {
      "cve": "CVE-2026-10769",
      "product_status": {
        "known_affected": [
          "T055014",
          "T055013",
          "T055016",
          "T055015"
        ]
      },
      "release_date": "2026-06-04T22:00:00.000+00:00",
      "title": "CVE-2026-10769"
    },
    {
      "cve": "CVE-2026-10770",
      "product_status": {
        "known_affected": [
          "T055014",
          "T055013",
          "T055016",
          "T055015"
        ]
      },
      "release_date": "2026-06-04T22:00:00.000+00:00",
      "title": "CVE-2026-10770"
    },
    {
      "cve": "CVE-2026-49977",
      "product_status": {
        "known_affected": [
          "T055014",
          "T055013",
          "T055016",
          "T055015"
        ]
      },
      "release_date": "2026-06-04T22:00:00.000+00:00",
      "title": "CVE-2026-49977"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2026-10770 (GCVE-0-2026-10770)

drupal-contrib-2026-042

Vulnerability from drupal

FKIE_CVE-2026-10770

GHSA-FHCJ-F666-RHJR

WID-SEC-W-2026-1799

Tags

Sightings

Nomenclature