CVE-2026-15087

MediumCVSS 5.9/10Last modified Oct 25, 2026

Description

vulnerability in Drupal Clean RESTful allows . This issue affects Clean RESTful versions: *.*.

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-287

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
DrupalClean RESTful*.*

References

Timeline

Published
Jul 10, 2026
Last modified
Oct 25, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-150885.7Vulnerability in Drupal Development Environment. This issue affects Development Environment versions: *.*.CVE-2026-150899.1Vulnerability in Drupal Commerce guest registration. This issue affects Commerce guest registration versions: *.*.CVE-2026-15095.4The Avada (Fusion) Builder plugin for WordPress is vulnerable to Arbitrary WordPress Action Execution in all versions up to, and including, CVE-2026-150907.5The Link Library plugin for WordPress is vulnerable to time-based SQL Injection via the 'link_url' parameter in all versions up to, and inclCVE-2026-150919.3IBM Engineering AI Hub 1.0.0, 1.1.0, and 1.2.0 could allow a remote attacker to execute arbitrary scripts due to improper neutralization of CVE-2026-150934.3IBM Engineering AI Hub 1.0.0, 1.1.0, and 1.2.0 could allow a remote attacker to redirect users to malicious websites due to improper validatCVE-2026-150946.1The WP Hotel Booking plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'check_in_date' parameter in all versions CVE-2026-150954.9The Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping & Social Channels plugin for WordPress is vulnerable to DirectorCVE-2026-150966.4The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Map Module 'b_width_map' Field in all versions up CVE-2026-150976.4The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'height_slider' Slider Module Field in all versionCVE-2026-150986.4The Real3D Flipbook Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'lightboxtext' shortcode attribute (and oCVE-2026-150996.4The Delicious Recipes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'steps' block attribute in versions up to, a
CVE-2026-15087: Medium severity, CVSS 5.9 | Vulnix