Entity Api (Entity Api Project) - vulnerabilities (CVEs)
7 CVEs, 0 in the last 30 days, 56 known versions, newest CVE from 2026-09-02. Vendor: Entity Api Project.
CVEs of Entity Api
- CVE-2026-81158 - CVSS 5.3 (medium), 2026-09-02: Incorrect Authorization vulnerability in Drupal Entity API allows Forceful Browsing. This issue affects Entity API versions: from 0.0.0 to 1.8.0.
- CVE-2014-1400 - CVSS 6.5 (medium), 2018-04-10: The entity_access API in the Entity API module 7.x-1.x before 7.x-1.3 for Drupal might allow remote authenticated users to bypass intended access restrictions…
- CVE-2014-1399 - CVSS 6.5 (medium), 2018-04-10: The entity wrapper access API in the Entity API module 7.x-1.x before 7.x-1.3 for Drupal might allow remote authenticated users to bypass intended access…
- CVE-2014-1398 - CVSS 6.5 (medium), 2018-04-10: The entity wrapper access API in the Entity API module 7.x-1.x before 7.x-1.3 for Drupal might allow remote authenticated users to bypass intended access…
- CVE-2015-2197 - CVSS 3.5 (low), 2015-03-03: Cross-site scripting (XSS) vulnerability in the Entity API module before 7.x-1.6 for Drupal allows remote authenticated users to inject arbitrary web script…
- CVE-2013-7391 - CVSS 5 (medium), 2014-07-19: The Entity API module 7.x-1.x before 7.x-1.2 for Drupal, when using the (a) Views field or (b) area plugins, allows remote attackers to read restricted…
- CVE-2013-4273 - CVSS 4 (medium), 2014-07-19: The Entity API module 7.x-1.x before 7.x-1.2 for Drupal does not properly restrict access to node comments, which allows remote authenticated users to read…
