17335 matches found
PT-2026-107759
This module enables you to add an extra layer of verification for user login flow. The Two Factor Authentication - TFA / Passwordless Login module for Drupal contains a vulnerability in the headless login endpoint that can disclose the site's stored miniOrange customer API key to unauthenticated...
PT-2026-107753
Advanced File System turns Drupal's file storage into a manageable, observable and maintainable subsystem. The Advanced Filesystem: Backup submodule does not sufficiently validate certain requests. This may allow an attacker to trick an authenticated user into performing unintended actions throug...
PT-2026-107745
This module integrates the MathJax library into your Drupal site. MathJax is the modern JavaScript-based LaTeX rendering solution for the Internet. The module ships with library configurations that do not escape JavaScript within the TeX it formats. Notice: This release updates CDN URLs where...
PT-2026-107744
Entity Reference Manager is an advanced administrative module for Drupal that allows site administrators to identify, analyze, and replace entity references across the system. The module does not sufficiently restrict access to all entity management operations. Users who can view content can acce...
Drupal - Remote Code Execution
Drupal 7.x and 8.x contain a remote code execution vulnerability that exists within multiple subsystems. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being compromised. This vulnerability is related to Drupal core - Highly...
CLSA-2026-1790872344 TuxCare security update for drupal/core (2 CVEs)
TuxCare rebuilt drupal/core to address 2 CVEs. Fixed in 10.5.12-p1+tuxcare...
CLEANSTART-2024-RD27757 Drupal before 7
Security vulnerability affects the drupal7 package. Drupal before 7...
CLEANSTART-2024-FK19349 remote code execution vulnerability exists within multiple subsystems of Drupal 7
Security vulnerability affects the drupal7 package. A remote code execution vulnerability exists within multiple subsystems of Drupal 7...
CLEANSTART-2024-WW17035 In Drupal 7 versions prior to 7
Security vulnerability affects the drupal7 package. In Drupal 7 versions prior to 7...
CLEANSTART-2024-OJ63880 Open Redirect vulnerability in Drupal Core allows a user to be tricked into visiting a specially crafted link which would redirect them to an arbitrary external URL
Security vulnerability affects the drupal7 package. Open Redirect vulnerability in Drupal Core allows a user to be tricked into visiting a specially crafted link which would redirect them to an arbitrary external URL...
CLEANSTART-2024-SC89971 Cross Site Request Forgery vulnerability in Drupal Core Form API does not properly handle certain form input from cross-site requests, which can lead to other vulnerabilities
Security vulnerability affects the drupal7 package. Cross Site Request Forgery vulnerability in Drupal Core Form API does not properly handle certain form input from cross-site requests, which can lead to other vulnerabilities...
CLEANSTART-2024-AP37400 Cross-site scripting vulnerability in Drupal Core
Security vulnerability affects the drupal7 package. Cross-site scripting vulnerability in Drupal Core...
CLEANSTART-2024-ZN01309 Archive_Tar through 1
Security vulnerability affects the drupal7 package. ArchiveTar through 1...
CLEANSTART-2024-CD56288 Cross-site Scripting (XSS) vulnerability in Drupal core's sanitization API fails to properly filter cross-site scripting under certain circumstances
Security vulnerability affects the drupal7 package. Cross-site Scripting XSS vulnerability in Drupal core's sanitization API fails to properly filter cross-site scripting under certain circumstances...
CLEANSTART-2024-NF15761 jQuery-UI is the official jQuery user interface library
Security vulnerability affects the drupal7 package. jQuery-UI is the official jQuery user interface library...
CLEANSTART-2024-CD40650 Drupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to improper input validation
Security vulnerability affects the drupal7 package. Drupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to improper input validation...
CLEANSTART-2024-DI95704 Xecurify's miniOrange Premium, Standard, and Enterprise Drupal SAML SP modules possess an authentication and authorization bypass vulnerability
Security vulnerability affects the drupal7 package. Xecurify's miniOrange Premium, Standard, and Enterprise Drupal SAML SP modules possess an authentication and authorization bypass vulnerability...
drupalgeddon2-cve-lab
Drupalgeddon2 CVE-2018-7600 ラボ このリポジトリは、Drupalgeddon2 実行用の再利用可能なターゲットパッケージです。 Sentinel は 2026-08-27 に、SQLite と PHP 7.4 を搭載した Drupal core 7.57 に対して CVE-2018-7600 を再現しました。このエクスプロイトは、Drupal 7 の 2 リクエスト AJAX レンダー配列パスです: 1. namepostrender=passthru、namemarkup=id、nametype=markup...