36CVE-2026-107249Drupal Block AJAX · Block AJAX - Highly critical - PHP object injection - SA-CONTRIB-2026-192Ignore reportBlock vendor9.80.4%