Two critical Drupal bugs need contributed modules to be dangerous, and one route needs no login at all.