CVE-2026-96386

MediumCVSS 6.5/10Last modified Oct 22, 2026

Description

Missing Authorization vulnerability in Drupal Smart Content allows Forceful Browsing. This issue affects Smart Content versions: from 0.0.0 to 3.2.1.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-862

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Oct 22, 2026
Last modified
Oct 22, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-963873.8Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Stop administrator login allows Authentication Bypass. ThisCVE-2026-963885.4Cross-Site Request Forgery (CSRF) vulnerability in Drupal Tawk.to - Live chat application allows Cross Site Request Forgery. This issue affeCVE-2026-96396.5Nil-pointer dereference in CreateCustomVolumeFromBackup in LXD up to version 6.8 and 5.21 on Linux allows an authenticated user with can_creCVE-2026-963904.3Privilege Defined With Unsafe Actions vulnerability in Drupal Editoria11y Accessibility Checker allows Privilege Escalation. This issue affeCVE-2026-96391Missing Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. This issue affects Webform REST versions: from 0.0.0 toCVE-2026-963923.5Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal AI CKEditor allows Code Injection. This issue CVE-2026-963933.6The Affinity by Canva app before 3.3.1 (October 2026 release) did not perform adequate bounds checking when parsing Affinity document files,CVE-2026-963942.9The Affinity by Canva application for macOS before 3.3.1 (October 2026 release) did not validate image dimensions against the size of the piCVE-2026-963953.6The Affinity by Canva app for macOS before 3.3.1 (October 2026 release) did not perform adequate bounds checking when generating QuickLook tCVE-2026-963964.9The Affinity by Canva application for macOS before 3.3.1 (October 2026 release) did not safely calculate the size of an image buffer when geCVE-2026-963984.3Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12,CVE-2026-963997.5A repository's external issue tracker regular expression containing alternating capture groups could produce invalid slice indexes when Gite
CVE-2026-96386: Medium severity, CVSS 6.5 | Vulnix