DRUPAL-CONTRIB-2026-059

The module adds support for the mirador viewer in WissKI and enables annotations on images via the mirador viewer. It does not sufficiently check the submitted parameters via a route and writes these to the session object without further checks, which can lead to Access Bypass. This vulnerability...

WissKI - Critical - Access bypass - SA-CONTRIB-2026-059

The module adds support for the mirador viewer in WissKI and enables annotations on images via the mirador viewer. It does not sufficiently check the submitted parameters via a route and writes these to the session object without further checks, which can lead to Access Bypass. This vulnerability...

PT-2026-52172

Name of the Vulnerable Software and Affected Versions WissKI versions 0.0.0 through 4.2.0 Description A missing authorization issue in the wisski mirador submodule allows forceful browsing and access bypass. The module fails to sufficiently validate parameters submitted via a route before writing...

hotel-mirador.net Improper Access Control vulnerability OBB-3858315

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Potential XSS in jQuery dependency in Mirador

Impact Mirador users less than v3.0.0 alpha-rc versions that have an unpatched jQuery. When adopters update jQuery they will find some of Mirador functionality to be broken. Patches Mirador adopters should update to v3.0.0, no updates exist for v2.x releases. Workarounds Yes, Mirador users could...

GHSA-HGWM-PV9H-Q5M7 Potential XSS in jQuery dependency in Mirador

Impact Mirador users less than v3.0.0 alpha-rc versions that have an unpatched jQuery. When adopters update jQuery they will find some of Mirador functionality to be broken. Patches Mirador adopters should update to v3.0.0, no updates exist for v2.x releases. Workarounds Yes, Mirador users could...