CLEANSTART-2024-ZN01309 Archive_Tar through 1

Security vulnerability affects the drupal7 package. ArchiveTar through 1...

CLEANSTART-2024-CD56288 Cross-site Scripting (XSS) vulnerability in Drupal core's sanitization API fails to properly filter cross-site scripting under certain circumstances

Security vulnerability affects the drupal7 package. Cross-site Scripting XSS vulnerability in Drupal core's sanitization API fails to properly filter cross-site scripting under certain circumstances...

CLEANSTART-2024-NF15761 jQuery-UI is the official jQuery user interface library

Security vulnerability affects the drupal7 package. jQuery-UI is the official jQuery user interface library...

CLEANSTART-2024-CD40650 Drupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to improper input validation

Security vulnerability affects the drupal7 package. Drupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to improper input validation...

CLEANSTART-2024-DI95704 Xecurify's miniOrange Premium, Standard, and Enterprise Drupal SAML SP modules possess an authentication and authorization bypass vulnerability

Security vulnerability affects the drupal7 package. Xecurify's miniOrange Premium, Standard, and Enterprise Drupal SAML SP modules possess an authentication and authorization bypass vulnerability...

drupalgeddon2-cve-lab

Drupalgeddon2 CVE-2018-7600 ラボ このリポジトリは、Drupalgeddon2 実行用の再利用可能なターゲットパッケージです。 Sentinel は 2026-08-27 に、SQLite と PHP 7.4 を搭載した Drupal core 7.57 に対して CVE-2018-7600 を再現しました。このエクスプロイトは、Drupal 7 の 2 リクエスト AJAX レンダー配列パスです: 1. namepostrender=passthru、namemarkup=id、nametype=markup...

Drupal - Remote Code Execution

Drupal 8.5.x before 8.5.11 and Drupal 8.6.x before 8.6.10 V contain certain field types that do not properly sanitize data from non-form sources, which can lead to arbitrary PHP code execution in some cases. id: CVE-2019-6340 info: name: Drupal - Remote Code Execution author: madrobot severity:...

CLSA-2026-1790249402 TuxCare security update for drupal/gdpr (1 CVE)

TuxCare rebuilt drupal/gdpr to address 1 CVE. Fixed in 3.0.0-p1+tuxcare...

PT-2026-105452

TuxCare rebuilt drupal/gdpr to address 1 CVE. Fixed in 3.0.0-p1+tuxcare...

DRUPAL-CONTRIB-2026-191

The Diba Carousel Slider adds a Bootstrap carousel slider block that can be used directly without creating a View or custom integration. When the "Allow HTML description" option is enabled, slide descriptions are rendered using the raw stored field value instead of the field's rendered output. Th...

DRUPAL-CONTRIB-2026-190

This module enables you to personalize content for anonymous and authenticated users by showing different blocks to visitors based on client-side conditions. The Smart Content Block submodule doesn't sufficiently check block access when it renders the blocks of a "Display Blocks" reaction through...

DRUPAL-CONTRIB-2026-189

This module lets a frontend scanner post CSS-usage measurements to the site so admin reports can show real-page statistics. This module doesn't sufficiently protect the /css-usage-analyzer/save endpoint against forged or repeated submissions...

DRUPAL-CONTRIB-2026-188

This module enables you to combine multiple image styles into a single image derivative. The module does not sufficiently validate image style names when generating image derivatives. Under certain circumstances, this allows anonymous users to generate image derivatives without a valid token,...

DRUPAL-CONTRIB-2026-186

This module enables you to retrieve and submit webforms via REST. The module doesn't sufficiently check permission to webform and webform submission entities when retrieving webform elements or fields...

DRUPAL-CONTRIB-2026-185

This module runs a client-side accessibility checker that automatically reports results to dashboard views over an API. The module incorrectly described a permission as a "view" permission when it grants edit and delete access to module data, resulting in a potential access bypass...

DRUPAL-CONTRIB-2026-183

This module enables sites to block access for the administrative user account user 1 or users with the administrator role. The module does not sufficiently enforce these access restrictions across all supported authentication mechanisms. As a result, a blocked administrative user may still be abl...

DRUPAL-CONTRIB-2026-182

This module enables you to add an extra authentication layer to the API. The module does not sufficiently validate authentication requirements for all API requests, which can result in an access bypass vulnerability...

DRUPAL-CONTRIB-2026-179

This module enables REST endpoints for a decoupled Commerce experience which allow for remote order creation. The module doesn't sufficiently sanitize order data passed into the order creation endpoint, which allows for potentially unsafe order properties to be set on an order...

DRUPAL-CONTRIB-2026-178

The Project Browser module enables you to apply recipes and enable modules from the web user interface. The module doesn't sufficiently validate admin actions to protect against cross-site request forgery attacks CSRF...

DRUPAL-CONTRIB-2026-175

The Webform module allows site builders to create forms, collect submissions, and render submitted values in configurable formats. Webform does not sufficiently exclude certain format templates from token replacement. This can allow an attacker to submit data that is evaluated as template code wh...