CVE-2026-118568

Insecure Storage of Sensitive Information vulnerability in Drupal Content Sync content-sync.io allows Retrieve Embedded Sensitive Data. This issue affects Content Sync content-sync.io versions: from 0.0.0 to 3.2.2...

CVE-2026-118561

External Control of File Name or Path vulnerability in Drupal Single Content Sync allows Path Traversal. This issue affects Single Content Sync versions: from 0.0.0 to 1.4.19...

CVE-2026-118562

Deserialization of Untrusted Data vulnerability in Drupal Single Content Sync allows Object Injection. This issue affects Single Content Sync versions: from 0.0.0 to 1.4.19...

CVE-2026-118561 Single Content Sync - Critical - External control of file name or path - SA-CONTRIB-2026-274

External Control of File Name or Path vulnerability in Drupal Single Content Sync allows Path Traversal. This issue affects Single Content Sync versions: from 0.0.0 to 1.4.19...

CVE-2026-118561

The Single Content Sync module for Drupal (versions 0.0.0 to 1.4.19 ) is vulnerable to an External Control of File Name or Path (CWE-73) issue. The root cause is the module's failure to sufficiently validate file sources and destinations during content imports. An attacker with the import single ...

CVE-2026-118561

External Control of File Name or Path vulnerability in Drupal Single Content Sync allows Path Traversal. This issue affects Single Content Sync versions: from 0.0.0 to 1.4.19...

EUVD-2026-113498

External Control of File Name or Path vulnerability in Drupal Single Content Sync allows Path Traversal. This issue affects Single Content Sync versions: from 0.0.0 to 1.4.19...

CVE-2026-118562 Single Content Sync - Critical - Remote code execution - SA-CONTRIB-2026-275

Deserialization of Untrusted Data vulnerability in Drupal Single Content Sync allows Object Injection. This issue affects Single Content Sync versions: from 0.0.0 to 1.4.19...

CVE-2026-118562

The Drupal Single Content Sync module (versions 0.0.0 to 1.4.19) is vulnerable to a Deserialization of Untrusted Data flaw (CWE-502). A maliciously crafted import file can trigger the deserialization of untrusted data, potentially leading to Object Injection and Remote Code Execution (RCE) . The ...

CVE-2026-118562

Deserialization of Untrusted Data vulnerability in Drupal Single Content Sync allows Object Injection. This issue affects Single Content Sync versions: from 0.0.0 to 1.4.19...

EUVD-2026-113497

Deserialization of Untrusted Data vulnerability in Drupal Single Content Sync allows Object Injection. This issue affects Single Content Sync versions: from 0.0.0 to 1.4.19...

CVE-2026-118568

The Drupal Content Sync (content-sync.io) module (versions 0.0.0 to 3.2.2 ) contains an Insecure Storage of Sensitive Information vulnerability (CWE-922 ). The root cause is that the module fails to sufficiently encrypt the password of the system user used for content synchronization. This flaw c...

CVE-2026-118568 Content Sync (content-sync.io) - Moderately critical - Information disclosure - SA-CONTRIB-2026-291

Insecure Storage of Sensitive Information vulnerability in Drupal Content Sync content-sync.io allows Retrieve Embedded Sensitive Data. This issue affects Content Sync content-sync.io versions: from 0.0.0 to 3.2.2...

EUVD-2026-113683

Insecure Storage of Sensitive Information vulnerability in Drupal Content Sync content-sync.io allows Retrieve Embedded Sensitive Data. This issue affects Content Sync content-sync.io versions: from 0.0.0 to 3.2.2...

Single Content Sync - Critical - External control of file name or path - SA-CONTRIB-2026-274

Single Content Sync enables exporting and importing content, referenced entities, and files between Drupal sites. The module does not sufficiently validate file sources and destinations during content imports. An attacker can write arbitrary files, disclose sensitive local files accessible to the...

Content Sync (content-sync.io) - Moderately critical - Information disclosure - SA-CONTRIB-2026-291

This module enables you to share and reuse content across websites. The module did not sufficiently encrypt the password of the system user used when synchronizing content. This can potentially allow unprivileged users to view the password. This vulnerability is mitigated by the fact that an...

PT-2026-130590

Single Content Sync enables exporting and importing content, referenced entities, and files between Drupal sites. A maliciously crafted import file can cause untrusted data to be deserialized, potentially leading to remote code execution. This vulnerability is mitigated by the fact that an attack...

PT-2026-130589

Single Content Sync enables exporting and importing content, referenced entities, and files between Drupal sites. The module does not sufficiently validate file sources and destinations during content imports. An attacker can write arbitrary files, disclose sensitive local files accessible to the...

Single Content Sync - Critical - Remote code execution - SA-CONTRIB-2026-275

Single Content Sync enables exporting and importing content, referenced entities, and files between Drupal sites. A maliciously crafted import file can cause untrusted data to be deserialized, potentially leading to remote code execution. This vulnerability is mitigated by the fact that an attack...

CVE-2026-13600 AutoNetTV Relay < 3.0.14 - Unauthenticated Privilege Escalation via Scheduled Sync Cron

The AutoNetTV Relay WordPress plugin before 3.0.14 does not perform any capability or authentication check before setting a WordPress administrator authentication cookie during its scheduled content-synchronization task. On server configurations where the scheduled task executes before the HTTP...