DRUPAL-CONTRIB-2026-251

The AI File to Text module extracts text from uploaded documents, including Word, PDF, OpenDocument, CSV, Markdown and plain text files, and exposes that extraction to AI agents and automators as a tool. The module does not sufficiently check whether the current user is permitted to view a file...

DRUPAL-CONTRIB-2026-246

TinyPNG uses smart lossy compression techniques to reduce the file size of your PNG files. The module doesn't sufficiently check access to image style derivatives when those files are served via a file stream other than private://. This vulnerability is mitigated by the fact that Drupal must be...

DRUPAL-CONTRIB-2026-243

This module enables users to upload files and create media items in bulk. The module doesn't sufficiently check user permission to create specific media types if the bulk upload form is configured for that media type. This vulnerability is mitigated by the fact that an attacker must have a role...

CVE-2026-114491

pdfmake 0.3.8 before 0.3.12 fails to apply the setLocalAccessPolicy restriction to images referenced inside SVG content, allowing attackers to read blocked local files. Attackers supplying a document definition can add an SVG image href pointing to a local path, embedding restricted file contents...

CVE-2026-114491

The pdfmake library (versions 0.3.8 before 0.3.12 ) contains a vulnerability where it fails to apply the setLocalAccessPolicy() restriction to images referenced within SVG content. This flaw allows an attacker providing a document definition to include an SVG image with an href pointing to a loca...

CVE-2026-114491 pdfmake 0.3.8 before 0.3.12 Local File Policy Bypass via SVG Images

pdfmake 0.3.8 before 0.3.12 fails to apply the setLocalAccessPolicy restriction to images referenced inside SVG content, allowing attackers to read blocked local files. Attackers supplying a document definition can add an SVG image href pointing to a local path, embedding restricted file contents...

CVE-2026-114491 pdfmake 0.3.8 before 0.3.12 Local File Policy Bypass via SVG Images

pdfmake 0.3.8 before 0.3.12 fails to apply the setLocalAccessPolicy restriction to images referenced inside SVG content, allowing attackers to read blocked local files. Attackers supplying a document definition can add an SVG image href pointing to a local path, embedding restricted file contents...

EUVD-2026-107419

pdfmake 0.3.8 before 0.3.12 fails to apply the setLocalAccessPolicy restriction to images referenced inside SVG content, allowing attackers to read blocked local files. Attackers supplying a document definition can add an SVG image href pointing to a local path, embedding restricted file contents...

CVE-2026-114112

A flaw was found in sharp. An attacker can exploit this vulnerability by submitting specially crafted AV1 Image File Format AVIF or High-Efficiency Image File Format HEIF images to applications processing untrusted media. Due to memory corruption during image decoding in a bundled library,...

CVE-2026-114094

A flaw was found in Dulwich. On Windows systems, the application fails to validate drive letter prefixes within repository paths during checkout operations. A remote attacker could exploit this flaw by enticing a user to clone or check out a specially crafted Git repository containing malicious...

DRUPAL-CONTRIB-2026-231

This theme provides a front-end design for transparency and open-government sites, including a table preview of CSV files attached to content. The theme doesn't sufficiently check file access when it renders that preview. It reads the file directly, so a visitor who may view the content, but whos...

DRUPAL-CONTRIB-2026-220

This module enables you to use ffmpeg for image conversion The module doesn't sufficiently sanitize file names passed to the ffmpeg cli tool. This vulnerability is mitigated by the fact that an attacker must be able to upload images on the site...

Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites

Summary: A malicious website may be able to cause unauthorized file changes in a developer’s project while an affected Storybook development server is running. Under additional conditions, a changed file could be executed by a local runtime with the developer’s privileges. We are not aware of...

CVE-2026-114126 Storybook dev server: devices on the same network can obtain the WebSocket token and write code into story files

Storybook is a frontend workshop for building user interface components and pages in isolation. From 8.0.0 until 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6, the Storybook development server can expose its WebSocket authentication token to clients able to load its HTML pages over a local network. ...

CVE-2026-114126 Storybook dev server: devices on the same network can obtain the WebSocket token and write code into story files

Storybook is a frontend workshop for building user interface components and pages in isolation. From 8.0.0 until 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6, the Storybook development server can expose its WebSocket authentication token to clients able to load its HTML pages over a local network. ...

CVE-2026-114126

The Storybook development server is vulnerable to a security flaw where it exposes its WebSocket authentication token to clients on the local network. Affected versions include 8.0.0 to 8.6.18 , 9.1.21 , 10.6.2 , and 11.0.0-alpha.6 . A LAN attacker can obtain this token to access WebSocket-backed...

djust: Arbitrary absolute-path file read in the find_handlers_for_template MCP tool

Affected version / file / line Version: djust v1.1.4 latest release, published 2026-09-23. File: python/djust/mcp/server.py:354-433 MCP tool findhandlersfortemplate. Confirmed identical on the commit used for triage, a7e4fafd1667b4db0b1465652d4a63cb17117a07. Description @mcp.tool def...

GHSA-R57G-MC79-8HJ2 djust: Arbitrary absolute-path file read in the find_handlers_for_template MCP tool

Affected version / file / line Version: djust v1.1.4 latest release, published 2026-09-23. File: python/djust/mcp/server.py:354-433 MCP tool findhandlersfortemplate. Confirmed identical on the commit used for triage, a7e4fafd1667b4db0b1465652d4a63cb17117a07. Description @mcp.tool def...

EUVD-2026-107407

Luxion KeyShot BIP File Parsing Uncontrolled Search Path Element Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Luxion KeyShot. User interaction is required to exploit this vulnerability in that the target mus...

CVE-2026-92202

The Luxion KeyShot software is vulnerable to Remote Code Execution (RCE) due to an uncontrolled search path element during the parsing of BIP files . The flaw occurs because the application loads a library from an unsecured location, which an attacker can exploit to execute arbitrary code in the ...