CLSA-2026-1788969961 TuxCare security update for drupal/access_code (1 CVE)

TuxCare rebuilt drupal/accesscode to address 1 CVE. Fixed in 7.1.1-p1+tuxcare...

CLSA-2026-1788969384 TuxCare security update for drupal/colorbox (1 CVE)

TuxCare rebuilt drupal/colorbox to address 1 CVE. Fixed in 2.1.2-p1+tuxcare...

CLSA-2026-1788968613 TuxCare security update for drupal/openid_connect (3 CVEs)

TuxCare rebuilt drupal/openidconnect to address 3 CVEs. Fixed in 7.1.3-p1+tuxcare...

CLSA-2026-1788968317 TuxCare security update for drupal/bootstrap_site_alert (1 CVE)

TuxCare rebuilt drupal/bootstrapsitealert to address 1 CVE. Fixed in 7.1.6-p1+tuxcare...

PT-2026-95855

TuxCare rebuilt drupal/bootstrap site alert to address 1 CVE. Fixed in 7.1.6-p1+tuxcare...

PT-2026-95861

TuxCare rebuilt drupal/spamspan to address 1 CVE. Fixed in 7.1.4-p1+tuxcare...

PT-2026-95859

TuxCare rebuilt drupal/colorbox to address 1 CVE. Fixed in 7.2.19-p1+tuxcare...

PT-2026-95864

TuxCare rebuilt drupal/gdpr to address 1 CVE. Fixed in 3.1.0-p1+tuxcare...

PT-2026-95862

TuxCare rebuilt drupal/gdpr to address 1 CVE. Fixed in 7.1.0-p1+tuxcare...

PT-2026-95863

TuxCare rebuilt drupal/link to address 1 CVE. Fixed in 7.1.13-p1+tuxcare...

PT-2026-95856

TuxCare rebuilt drupal/openid connect to address 3 CVEs. Fixed in 7.1.3-p1+tuxcare...

PT-2026-95858

TuxCare rebuilt drupal/access code to address 1 CVE. Fixed in 7.1.1-p1+tuxcare...

PT-2026-95865

TuxCare rebuilt drupal/spamspan to address 1 CVE. Fixed in 3.2.0-p1+tuxcare...

PT-2026-95857

TuxCare rebuilt drupal/colorbox to address 1 CVE. Fixed in 2.1.2-p1+tuxcare...

SAML SSO - Service Provider - Critical - Improper access control - SA-CONTRIB-2026-141

This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider. The miniorangesaml module does not correctly restrict access to certain functionality intended for administrative use. This could allow...

SAML SSO - Service Provider - Moderately critical - Authentication bypass - SA-CONTRIB-2026-145

This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider. The module does not properly restrict which signature algorithm may be used to validate a SAML assertion, allowing the algorithm to be influenc...

SAML SSO - Service Provider - Moderately critical - Embedded credentials - SA-CONTRIB-2026-148

This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider. The module contains embedded credentials used by the functionality provided by the module. Under certain circumstances, these credentials could...

Taxonomy Term Glossary - Critical - Access bypass - SA-CONTRIB-2026-152

This module adds automatic highlighting of taxonomy terms in content. The module doesn't sufficiently check access on taxonomy terms. As a result, anonymous users can view any of the site's taxonomy terms at the module's JSON endpoint, including taxonomy terms that are unpublished or otherwise...

PT-2026-89243

This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider. The module does not properly validate TLS certificates when making outbound HTTPS requests. An attacker in a position to intercept network...

PT-2026-89244

This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider. The miniorange saml module does not sufficiently validate certain user-supplied URLs before performing redirects. An attacker could cause users...