EUVD-2026-43051

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Formatter Field allows Object Injection. This issue affects Formatter Field versions: from 0.0.0 to 2.0.0...

CVE-2026-12535

The CVE-2026-12535 entry concerns Drupal’s Formatter Field module, affected versions 0.0.0–2.0.0. The vulnerability arises from PHP-serialized data stored in the formatter_field field, which can be written maliciously and later unserialized, enabling Object Injection. Exploitation requires the at...