Live › vulnerability › CVE-2026-96374
Go to dashboardDrupal's Project Browser module has a cross-site request forgery flaw affecting versions up to 2.0.3 and 2.1.0 through 2.1.5. An attacker can trick a logged-in user's browser into sending requests the site will act on.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Drupal sites that have the Project Browser module installed and enabled. Sites without this module, or running a fixed version, are not affected. The sources do not describe further preconditions.
No product ranges from the sources yet.
drush pm:list --filter=project_browser or in the Drupal admin under Extend.2.0.3 or earlier, or 2.1.0 through 2.1.5.2.1.5 or 2.0.3, per the Drupal security advisory (unknown exact fixed version in the sources).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Cross-Site Request Forgery (CSRF) vulnerability in Drupal Project Browser allows Cross Site Request Forgery. This issue affects Project Browser versions: from 0.0.0 to 2.0.3, from 2.1.0 to 2.1.5.
This page as .md · .json · in your agent: get_signal("CVE-2026-96374")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.