Islandora - Moderately critical - Access bypass - SA-CONTRIB-2026-126

This islandoraadvancedsearch sub module enables AJAX updates for advanced search, facet, and search result blocks. The module doesn't sufficiently check block access when arbitrary block ID's are submitted to its publicly accessible AJAX endpoint. This may allow an unauthenticated attacker to...

PT-2026-84892

This islandora advanced search sub module enables AJAX updates for advanced search, facet, and search result blocks. The module doesn't sufficiently check block access when arbitrary block ID's are submitted to its publicly accessible AJAX endpoint. This may allow an unauthenticated attacker to...

ca.islandora.alpaca:islandora-connector-broadcast (>=0.2.0, <=0.3.0), ca.islandora.alpaca:islandora-indexing-triplestore (0.1.0) +545 more potentially affected by CVE-2026-41852 via org.springframework:spring-expression (4.1.9.release)

org.springframework:spring-expression MAVEN version 4.1.9.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - ca.islandora.alpaca:islandora-connector-broadcast =0.2.0, =1.0.0, =2.0.0-rc2,...

ca.islandora.alpaca:islandora-connector-broadcast (>=0.2.0, <=0.3.0), ca.islandora.alpaca:islandora-indexing-triplestore (0.1.0) +545 more potentially affected by CVE-2026-41849 via org.springframework:spring-expression (4.1.9.release)

org.springframework:spring-expression MAVEN version 4.1.9.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - ca.islandora.alpaca:islandora-connector-broadcast =0.2.0, =1.0.0, =2.0.0-rc2,...

CVE-2026-3215

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Islandora allows Cross-Site Scripting XSS.This issue affects Islandora: from 0.0.0 before 2.17.5...

EUVD-2026-15474

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Islandora allows Cross-Site Scripting XSS.This issue affects Islandora: from 0.0.0 before 2.17.5...

CVE-2026-3215

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Islandora allows Cross-Site Scripting XSS.This issue affects Islandora: from 0.0.0 before 2.17.5...

CVE-2026-3215 Islandora - Moderately critical - Arbitrary file upload, Cross-site scripting - SA-CONTRIB-2026-016

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Islandora allows Cross-Site Scripting XSS.This issue affects Islandora: from 0.0.0 before 2.17.5...

CVE-2026-3215 Islandora - Moderately critical - Arbitrary file upload, Cross-site scripting - SA-CONTRIB-2026-016

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Islandora allows Cross-Site Scripting XSS.This issue affects Islandora: from 0.0.0 before 2.17.5...

CVE-2026-3215

The Drupal Islandora digital asset management framework is vulnerable to Cross-Site Scripting (XSS) in versions prior to 2.17.5 . The root cause is the insufficient sanitization of URI paths within a custom route used for attaching media to nodes. An attacker with the "create media" permission an...

CVE-2026-3215 Islandora - Moderately critical - Arbitrary file upload, Cross-site scripting - SA-CONTRIB-2026-016

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Islandora allows Cross-Site Scripting XSS.This issue affects Islandora: from 0.0.0 before 2.17.5...

CVE-2026-3215: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Islandora allows Cross-Site Scripting XSS.This issue affects Islandora: from 0.0.0 before 2.17.5...

Drupal Islandora 安全漏洞

Drupal Islandora is an extension platform for content management systems developed by the Drupal company, used for digital asset management and digital library construction. Versions of Drupal Islandora prior to 2.17.5 contained a security vulnerability caused by improper input handling, which...

DRUPAL-CONTRIB-2026-016

This module integrates with Islandora, an open-source digital asset management DAM framework. Islandora integrates with various open-source services, which can be run in a distributed environment. The module doesn't sufficiently sanitize URI paths for its custom route used for attaching media to...

Islandora - Moderately critical - Arbitrary file upload, Cross-site scripting - SA-CONTRIB-2026-016

This module integrates with Islandora, an open-source digital asset management DAM framework. Islandora integrates with various open-source services, which can be run in a distributed environment. The module doesn't sufficiently sanitize URI paths for its custom route used for attaching media to...

PT-2026-22087

Name of the Vulnerable Software and Affected Versions Drupal Islandora versions prior to 2.17.5 Description A flaw exists in Drupal Islandora that allows for Cross-Site Scripting XSS. The issue stems from insufficient sanitization of URI paths used in a custom route for attaching media to nodes...

EUVD-2025-4966

Malicious code in bioql PyPI...

CVE-2025-25286 Crayfish allows Remote Code Execution via Homarus Authorization header

Crayfish is a collection of Islandora 8 microservices, one of which, Homarus, provides FFmpeg as a microservice. Prior to Crayfish version 4.1.0, remote code execution may be possible in web-accessible installations of Homarus in certain configurations. The issue has been patched in...

Crayfish 安全漏洞

Crayfish is a collection of Islandora microservices open-sourced by Islandora. A security vulnerability exists in Crayfish that stems from remote code execution that can occur in Homarus installations that are accessible via the Web under certain configurations...

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Overview Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' via the X-Islandora-Args header. An attacker can execute arbitrary code on the server by sending a crafted request containing malicious inp...