PT-2026-95855

TuxCare rebuilt drupal/bootstrap site alert to address 1 CVE. Fixed in 7.1.6-p1+tuxcare...

PT-2026-95861

TuxCare rebuilt drupal/spamspan to address 1 CVE. Fixed in 7.1.4-p1+tuxcare...

PT-2026-95859

TuxCare rebuilt drupal/colorbox to address 1 CVE. Fixed in 7.2.19-p1+tuxcare...

PT-2026-95864

TuxCare rebuilt drupal/gdpr to address 1 CVE. Fixed in 3.1.0-p1+tuxcare...

SAML SSO - Service Provider - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-146

This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider. The module does not sufficiently sanitize user-supplied data before displaying it in generated HTML leading to a cross-site scripting...

PT-2026-95862

TuxCare rebuilt drupal/gdpr to address 1 CVE. Fixed in 7.1.0-p1+tuxcare...

PT-2026-95863

TuxCare rebuilt drupal/link to address 1 CVE. Fixed in 7.1.13-p1+tuxcare...

PT-2026-89236

Name of the Vulnerable Software and Affected Versions amazee.ai Drupal provider versions prior to 1.3.7 amazee.ai Drupal provider versions prior to 1.4.3 Description The module integrates AI services into Drupal, utilizing a Postgres/pgvector vector database backend for Search API AI Search. The...

SAML SSO - Service Provider - Moderately critical - Embedded credentials - SA-CONTRIB-2026-148

This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider. The module contains embedded credentials used by the functionality provided by the module. Under certain circumstances, these credentials could...

PT-2026-95856

TuxCare rebuilt drupal/openid connect to address 3 CVEs. Fixed in 7.1.3-p1+tuxcare...

PT-2026-95858

TuxCare rebuilt drupal/access code to address 1 CVE. Fixed in 7.1.1-p1+tuxcare...

Taxonomy Term Glossary - Critical - Access bypass - SA-CONTRIB-2026-152

This module adds automatic highlighting of taxonomy terms in content. The module doesn't sufficiently check access on taxonomy terms. As a result, anonymous users can view any of the site's taxonomy terms at the module's JSON endpoint, including taxonomy terms that are unpublished or otherwise...

SAML SSO - Service Provider - Moderately critical - Server Side Request Forgery - SA-CONTRIB-2026-151

This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider. The module does not sufficiently validate URLs obtained from identity provider metadata. An attacker with the ability to configure identity...

Ultimate Table Field - Critical - Access bypass - SA-CONTRIB-2026-153

The Ultimate Table Field module enables you to store table data in a field and edit each table cell through a dialog, using cell field plugins such as text, link, and file. The module doesn't sufficiently protect the route that opens the cell editor dialog. The route is accessible to anonymous...

SAML SSO - Service Provider - Critical - Open redirect - SA-CONTRIB-2026-143

This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider. The miniorangesaml module does not sufficiently validate certain user-supplied URLs before performing redirects. An attacker could cause users ...

SAML SSO - Service Provider - Critical - Improper certificate validation - SA-CONTRIB-2026-142

This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider. The module does not properly validate TLS certificates when making outbound HTTPS requests. An attacker in a position to intercept network...

SAML SSO - Service Provider - Critical - Improper access control - SA-CONTRIB-2026-141

This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider. The miniorangesaml module does not correctly restrict access to certain functionality intended for administrative use. This could allow...

Patreon - Critical - Unsupported - SA-CONTRIB-2026-139

The Drupal Security Team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, read the documentation on becoming the maintainer of a project that is unsupported for security...

SAML SSO - Service Provider - Moderately critical - Information disclosure - SA-CONTRIB-2026-149

This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider. The module stores sensitive authentication information in a manner that could allow disclosure to users with access to configuration or related...

amazee.ai Private AI Provider - Critical - SQL injection - SA-CONTRIB-2026-134

Update 2026-09-11: Increased risk score to reflect publicly documented methods for developing exploits. This module integrates amazee.ai's AI services into Drupal, including a Postgres/pgvector vector database backend for use with Search API AI Search. The module doesn't sufficiently sanitize...