CLSA-2026-1789633654 TuxCare security update for drupal/form_builder (1 CVE)

TuxCare rebuilt drupal/formbuilder to address 1 CVE. Fixed in 7.1.22-p1+tuxcare...

CLSA-2026-1789633542 TuxCare security update for drupal/commerce_paybox (1 CVE)

TuxCare rebuilt drupal/commercepaybox to address 1 CVE. Fixed in 7.1.5-p1+tuxcare...

CLSA-2026-1789633448 TuxCare security update for drupal/coffee (1 CVE)

TuxCare rebuilt drupal/coffee to address 1 CVE. Fixed in 7.2.3-p1+tuxcare...

CLSA-2026-1789633295 TuxCare security update for drupal/protected_pages (1 CVE)

TuxCare rebuilt drupal/protectedpages to address 1 CVE. Fixed in 7.2.4-p1+tuxcare...

CLSA-2026-1789633080 TuxCare security update for drupal/filefield_paths (1 CVE)

TuxCare rebuilt drupal/filefieldpaths to address 1 CVE. Fixed in 7.1.2-p1+tuxcare...

CLSA-2026-1789632846 TuxCare security update for drupal/i18n (1 CVE)

TuxCare rebuilt drupal/i18n to address 1 CVE. Fixed in 7.1.35-p1+tuxcare...

CLSA-2026-1789632791 TuxCare security update for drupal/flag (1 CVE)

TuxCare rebuilt drupal/flag to address 1 CVE. Fixed in 7.3.9-p1+tuxcare...

CLSA-2026-1789632682 TuxCare security update for drupal/shs (1 CVE)

TuxCare rebuilt drupal/shs to address 1 CVE. Fixed in 7.1.10-p1+tuxcare...

CLSA-2026-1789632490 TuxCare security update for drupal/facebook_pixel (1 CVE)

TuxCare rebuilt drupal/facebookpixel to address 1 CVE. Fixed in 7.1.1-p1+tuxcare...

Drupal 10.6.x < 10.6.17 / 11.3.x < 11.3.17 / 11.4.x < 11.4.7 Drupal Vulnerability (SA-CORE-2026-013)

According to its self-reported version, the instance of Drupal running on the remote web server is 10.6.x prior to 10.6.17, 11.3.x prior to 11.3.17, or 11.4.x prior to 11.4.7. It is, therefore, affected by a vulnerability. - The Drupal project uses the CKEditor library for WYSIWYG editing. CKEdit...

CLSA-2026-1789375926 TuxCare security update for drupal/term_reference_tree (1 CVE)

TuxCare rebuilt drupal/termreferencetree to address 1 CVE. Fixed in 7.1.11-p1+tuxcare...

Exploit for SQL Injection in Drupal

Metasploitable3 — Penetration Test Report Author: Arlen F...

DRUPAL-CONTRIB-2026-152

This module adds automatic highlighting of taxonomy terms in content. The module doesn't sufficiently check access on taxonomy terms. As a result, anonymous users can view any of the site's taxonomy terms at the module's JSON endpoint, including taxonomy terms that are unpublished or otherwise...

DRUPAL-CONTRIB-2026-151

This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider. The module does not sufficiently validate URLs obtained from identity provider metadata. An attacker with the ability to configure identity...

DRUPAL-CONTRIB-2026-150

This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider. The module does not sufficiently prevent reuse of previously accepted SAML assertions. Under certain circumstances, a valid assertion may be...

DRUPAL-CONTRIB-2026-149

This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider. The module stores sensitive authentication information in a manner that could allow disclosure to users with access to configuration or related...

DRUPAL-CONTRIB-2026-148

This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider. The module contains embedded credentials used by the functionality provided by the module. Under certain circumstances, these credentials could...

DRUPAL-CONTRIB-2026-147

This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider. The module does not sufficiently sanitize certain values derived from SAML assertions before displaying them to users. A malicious identity...

DRUPAL-CONTRIB-2026-146

This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider. The module does not sufficiently sanitize user-supplied data before displaying it in generated HTML leading to a cross-site scripting...

DRUPAL-CONTRIB-2026-145

This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider. The module does not properly restrict which signature algorithm may be used to validate a SAML assertion, allowing the algorithm to be influenc...