17335 matches found
DRUPAL-CONTRIB-2026-142
This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider. The module does not properly validate TLS certificates when making outbound HTTPS requests. An attacker in a position to intercept network...
DRUPAL-CONTRIB-2026-141
This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider. The miniorange\saml module does not correctly restrict access to certain functionality intended for administrative use. This could allow...
DRUPAL-CONTRIB-2026-140
This module enables you to manage content deletion and provides reports for identifying orphaned content. The module doesn't sufficiently sanitize node titles when displaying the orphaned nodes report. This leads to a persistent cross-site scripting vulnerability XSS. This vulnerability is...
DRUPAL-CONTRIB-2026-138
This module enables you to add key-based authentication on a per-user basis. The module doesn't cache per user, potentially allowing an attacker to view another user's authentication keys, if the attacker has the same permissions. This vulnerability is mitigated by the fact that the site must hav...
DRUPAL-CONTRIB-2026-137
The Feed Block module provides a block content type that displays items pulled from a remote RSS/Atom feed. The module does not sufficiently validate or sanitize the RSS feed it generates, resulting in a stored cross-site scripting XSS vulnerability...
DRUPAL-CONTRIB-2026-136
The CSP Log module enhances any module that adds the CSP header to a site, by providing a reporting endpoint, custom storage, and aggregated reports that can be used to trace issues or adapt the CSP headers. The module did not sufficiently sanitize user-supplied values used in database queries,...
DRUPAL-CONTRIB-2026-135
This module enables you to turn a Drupal install into the Central Authentication System CAS Server. It makes your database the primary location for other systems to use for authentication in a SSO environment. The module doesn't sufficiently check the service URL used to redirect the user during...
DRUPAL-CONTRIB-2026-134
Update 2026-09-11: Increased risk score to reflect publicly documented methods for developing exploits. This module integrates amazee.ai's AI services into Drupal, including a Postgres/pgvector vector database backend for use with Search API AI Search. The module doesn't sufficiently sanitize...
CLSA-2026-1788973403 TuxCare security update for drupal/spamspan (1 CVE)
TuxCare rebuilt drupal/spamspan to address 1 CVE. Fixed in 3.2.0-p1+tuxcare...
CLSA-2026-1788972898 TuxCare security update for drupal/gdpr (1 CVE)
TuxCare rebuilt drupal/gdpr to address 1 CVE. Fixed in 3.1.0-p1+tuxcare...
CLSA-2026-1788972447 TuxCare security update for drupal/link (1 CVE)
TuxCare rebuilt drupal/link to address 1 CVE. Fixed in 7.1.13-p1+tuxcare...
CLSA-2026-1788971869 TuxCare security update for drupal/gdpr (1 CVE)
TuxCare rebuilt drupal/gdpr to address 1 CVE. Fixed in 7.1.0-p1+tuxcare...
CLSA-2026-1788971215 TuxCare security update for drupal/spamspan (1 CVE)
TuxCare rebuilt drupal/spamspan to address 1 CVE. Fixed in 7.1.4-p1+tuxcare...
CLSA-2026-1788970571 TuxCare security update for drupal/colorbox (1 CVE)
TuxCare rebuilt drupal/colorbox to address 1 CVE. Fixed in 7.2.19-p1+tuxcare...
CLSA-2026-1788969961 TuxCare security update for drupal/access_code (1 CVE)
TuxCare rebuilt drupal/accesscode to address 1 CVE. Fixed in 7.1.1-p1+tuxcare...
CLSA-2026-1788969384 TuxCare security update for drupal/colorbox (1 CVE)
TuxCare rebuilt drupal/colorbox to address 1 CVE. Fixed in 2.1.2-p1+tuxcare...
CLSA-2026-1788968613 TuxCare security update for drupal/openid_connect (3 CVEs)
TuxCare rebuilt drupal/openidconnect to address 3 CVEs. Fixed in 7.1.3-p1+tuxcare...
CLSA-2026-1788968317 TuxCare security update for drupal/bootstrap_site_alert (1 CVE)
TuxCare rebuilt drupal/bootstrapsitealert to address 1 CVE. Fixed in 7.1.6-p1+tuxcare...
