Drupal Form Builder security vulnerabilities

Drupal Form Builder is a form generation plugin for the Drupal community. Versions 7.X-1.0 to 7.X-1.22 of Drupal Form Builder have security vulnerabilities. These vulnerabilities stem from improper input handling during form generation, which may lead to cross-site scripting attacks...

Oracle Linux 9 : osbuild-composer (ELSA-2026-1381)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-1381 advisory. 149-3.0.1 - Add missing dependency over dracut-config-rescue for image-installer ORABUG: 38587453 - Switch to UEKR8 repositories for OL9.6 Orabug: 37962207 - Ad...

Moderate: Red Hat Security Advisory: image-builder security update

An update for image-builder is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...

OSV-2026-153 Security exception in org.apache.lucene.analysis.miscellaneous.ConcatenateGraphFilter$BytesRefBuilderT

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=478558485 Crash type: Security exception Crash state: org.apache.lucene.analysis.miscellaneous.ConcatenateGraphFilter$BytesRefBuilderT org.apache.lucene.analysis.miscellaneous.ConcatenateGraphFilter$BytesRefBuilderT...

ALSA-2026:1377 Moderate: image-builder security update

A local binary for building customized OS artifacts such as VM images and OSTree commits. Uses osbuild under the hood. Security Fixes: golang: archive/tar: Unbounded allocation when parsing GNU sparse map CVE-2025-58183 For more details about the security issues, including the impact, a CVSS scor...

Moderate: image-builder security update

A local binary for building customized OS artifacts such as VM images and OSTree commits. Uses osbuild under the hood. Security Fixes: golang: archive/tar: Unbounded allocation when parsing GNU sparse map CVE-2025-58183 For more details about the security issues, including the impact, a CVSS scor...

RHEL 9 : image-builder (RHSA-2026:1377)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:1377 advisory. A local binary for building customized OS artifacts such as VM images and OSTree commits. Uses osbuild under the hood. Security Fixes: golang:...

RHEL 10 : osbuild-composer (RHSA-2026:1378)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:1378 advisory. A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for...

@saltcorn/admin-models (>=1.5.0-beta.0, <=1.5.0-beta.18), @saltcorn/base-plugin (>=1.5.0-beta.0, <=1.5.0-beta.18) +5 more potentially affected by unknown CVE via @saltcorn/data (>=1.5.0-beta.0, <=1.5.0-beta.18)

@saltcorn/data NPM version =1.5.0-beta.0, =1.5.0-beta.0, =1.5.0-beta.0, =1.5.0-beta.0, =1.5.0-beta.0, =1.5.0-beta.0, =1.5.0-beta.0, =1.5.0-beta.0, =1.5.0-beta.18 Source cves: unknown CVE Source advisory: SNYK:JS-SALTCORNDATA-15126137...

@saltcorn/cli (>=1.5.0-beta.0, <=1.5.0-beta.18), @saltcorn/mobile-builder (>=1.5.0-beta.0, <=1.5.0-beta.18) +1 more potentially affected by unknown CVE via @saltcorn/admin-models (>=1.5.0-beta.0, <=1.5.0-beta.18)

@saltcorn/admin-models NPM version =1.5.0-beta.0, =1.5.0-beta.0, =1.5.0-beta.0, =1.5.0-beta.0, =1.5.0-beta.18 Source cves: unknown CVE Source advisory: SNYK:JS-SALTCORNADMINMODELS-15126138...

@saltcorn/cli (>=1.1.1, <=1.4.1), @saltcorn/mobile-builder (>=1.1.1, <=1.4.1) potentially affected by unknown CVE via @saltcorn/server (>=1.1.1, <=1.4.1)

@saltcorn/server NPM version =1.1.1, =1.1.1, =1.1.1, =1.4.1 Source cves: unknown CVE Source advisory: SNYK:JS-SALTCORNSERVER-15126139...

@saltcorn/admin-models (>=1.1.1, <=1.4.1), @saltcorn/base-plugin (>=1.1.1, <=1.4.1) +5 more potentially affected by unknown CVE via @saltcorn/data (>=1.1.1, <=1.4.1)

@saltcorn/data NPM version =1.1.1, =1.1.1, =1.1.1, =1.1.1, =1.1.1, =1.1.1, =1.1.1, =1.1.1, =1.4.1 Source cves: unknown CVE Source advisory: SNYK:JS-SALTCORNDATA-15126137...

@saltcorn/cli (>=1.1.1, <=1.5.0-beta.18), @saltcorn/mobile-builder (>=1.1.1, <=1.5.0-beta.18) potentially affected by unknown CVE via @saltcorn/server (>=1.1.1, <=1.5.0-beta.18)

@saltcorn/server NPM version =1.1.1, =1.1.1, =1.1.1, =1.5.0-beta.18 Source cves: unknown CVE Source advisory: GHSA-CR3W-CW5W-H3FJ...

@saltcorn/cli (>=1.1.1, <=1.4.1), @saltcorn/mobile-builder (>=1.1.1, <=1.4.1) +1 more potentially affected by unknown CVE via @saltcorn/admin-models (>=1.1.1, <=1.4.1)

@saltcorn/admin-models NPM version =1.1.1, =1.1.1, =1.1.1, =1.1.1, =1.4.1 Source cves: unknown CVE Source advisory: SNYK:JS-SALTCORNADMINMODELS-15126138...

@saltcorn/cli (>=1.1.1, <=1.5.0-beta.18), @saltcorn/mobile-builder (>=1.1.1, <=1.5.0-beta.18) potentially affected by unknown CVE via @saltcorn/server (>=1.1.1, <=1.5.0-beta.18)

@saltcorn/server NPM version =1.1.1, =1.1.1, =1.1.1, =1.5.0-beta.18 Source cves: unknown CVE Source advisory: OSV:GHSA-CR3W-CW5W-H3FJ...

@saltcorn/cli (>=1.5.0-beta.0, <=1.5.0-beta.18), @saltcorn/mobile-builder (>=1.5.0-beta.0, <=1.5.0-beta.18) potentially affected by unknown CVE via @saltcorn/server (>=1.5.0-beta.0, <=1.5.0-beta.18)

@saltcorn/server NPM version =1.5.0-beta.0, =1.5.0-beta.0, =1.5.0-beta.0, =1.5.0-beta.18 Source cves: unknown CVE Source advisory: SNYK:JS-SALTCORNSERVER-15126139...

CVE-2026-24594

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in livemesh Livemesh Addons for WPBakery Page Builder addons-for-visual-composer allows Stored XSS.This issue affects Livemesh Addons for WPBakery Page Builder: from n/a through = 3.9.4...

CVE-2026-24620

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in PluginOps Landing Page Builder page-builder-add allows Stored XSS.This issue affects Landing Page Builder: from n/a through = 1.5.3.4...

CVE-2025-13139

The SurveyJS: Drag & Drop WordPress Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.5.2. This is due to missing nonce validation on the SurveyJSAddSurvey AJAX action. This makes it possible for unauthenticated attackers to crea...

CVE-2025-13205

CVE-2025-13205 affects the SurveyJS: Drag & Drop Form Builder for WordPress, versions up to and including 1.12.20. The root cause is missing or incorrect nonce validation on the SurveyJS_CloneSurvey AJAX action, enabling CSRF. Impact: unauthenticated attackers could duplicate surveys by tricking ...