DRUPAL-CONTRIB-2026-152

This module adds automatic highlighting of taxonomy terms in content. The module doesn't sufficiently check access on taxonomy terms. As a result, anonymous users can view any of the site's taxonomy terms at the module's JSON endpoint, including taxonomy terms that are unpublished or otherwise...

DRUPAL-CONTRIB-2026-143

This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider. The miniorange\saml module does not sufficiently validate certain user-supplied URLs before performing redirects. An attacker could cause users...

DRUPAL-CONTRIB-2026-140

This module enables you to manage content deletion and provides reports for identifying orphaned content. The module doesn't sufficiently sanitize node titles when displaying the orphaned nodes report. This leads to a persistent cross-site scripting vulnerability XSS. This vulnerability is...

DRUPAL-CONTRIB-2026-138

This module enables you to add key-based authentication on a per-user basis. The module doesn't cache per user, potentially allowing an attacker to view another user's authentication keys, if the attacker has the same permissions. This vulnerability is mitigated by the fact that the site must hav...

CVE-2026-79921 vulnerabilities

Vulnerabilities for packages: argo-events-fips, guac, trufflehog, versitygw-fips, sftpgo-plugin-pubsub, keda, bento-fips, opentelemetry-collector-contrib-fips, keda-fips, falcosidekick-fips, dapr, opentelemetry-collector-contrib, bento, nuclio-controller-fips, trufflehog-fips, minio-fips,...

DRUPAL-CONTRIB-2026-131

This module enables you to add dynamic caption support to PhotoSwipe image galleries. The module doesn't sufficiently sanitize user-supplied input such as image alt tags in its dynamic caption script, leading to a Cross-Site Scripting XSS vulnerability. This vulnerability is mitigated by the fact...

DRUPAL-CONTRIB-2026-130

The Monobank payment API module provides integration with Monobank acquiring payments. The module did not verify the Monobank webhook signature before processing payment status callbacks...

DRUPAL-CONTRIB-2026-127

This module enables you to restrict access to JSON:API routes based on specific user roles. The module doesn't sufficiently enforce access controls under scenarios where a request mimics an XMLHttpRequest...

DRUPAL-CONTRIB-2026-124

This module enables you to add extra layer of verification for user registration. The module doesn't sufficiently validate user-supplied input resulting in an account takeover vulnerability...

DRUPAL-CONTRIB-2026-118

This module enables AJAX updates for advanced search, facet, and search result blocks. The module doesn’t sufficiently check block access when arbitrary block IDs are submitted to its publicly accessible AJAX endpoint. This may allow an unauthenticated attacker to retrieve restricted block conten...

CVE-2026-76757

CVE-2026-76757 affects the Drupal Gammu SMS Daemon contrib module across all versions (. ). The Drupal security team has marked the project as unsupported , and the known security flaw remains unaddressed by the maintainer. No specific root cause or affected function is identified in the provided...

CLEANSTART-2026-LU79721 Security fixes in opentelemetry-collector-contrib-fips 0.158.0-r1

Package opentelemetry-collector-contrib-fips version 0.158.0-r1 fixes 10 vulnerabilities: CVE-2026-56864, CVE-2026-56865, CVE-2026-56860, CVE-2026-56858, CVE-2026-33818...

CLEANSTART-2026-WP42827 Security fixes in opentelemetry-collector-contrib 0.159.0-r1

Package opentelemetry-collector-contrib version 0.159.0-r1 fixes 2 vulnerabilities: CVE-2026-56864, CVE-2026-56865...

CLEANSTART-2026-LD03070 Security fixes in opentelemetry-collector-contrib-fips 0.159.0-r2

Package opentelemetry-collector-contrib-fips version 0.159.0-r2 fixes 10 vulnerabilities: CVE-2026-56864, CVE-2026-56865, CVE-2026-56860, CVE-2026-56858, CVE-2026-33818...

CLEANSTART-2026-IA07692 Security fixes in opentelemetry-collector-contrib-fips 0.158.0-r2

Package opentelemetry-collector-contrib-fips version 0.158.0-r2 fixes 10 vulnerabilities: CVE-2026-56864, CVE-2026-56865, CVE-2026-56860, CVE-2026-56858, CVE-2026-33818...

CLEANSTART-2026-DF04587 Security fixes in opentelemetry-collector-contrib-fips 0.158.0-r3

Package opentelemetry-collector-contrib-fips version 0.158.0-r3 fixes 10 vulnerabilities: CVE-2026-56864, CVE-2026-56865, CVE-2026-56860, CVE-2026-56858, CVE-2026-33818...

CLEANSTART-2026-WR36950 Security fixes in opentelemetry-collector-contrib 0.159.0-r2

Package opentelemetry-collector-contrib version 0.159.0-r2 fixes 2 vulnerabilities: CVE-2026-56864, CVE-2026-56865...

CLEANSTART-2026-FB79569 Security fixes in opentelemetry-collector-contrib-fips 0.159.0-r1

Package opentelemetry-collector-contrib-fips version 0.159.0-r1 fixes 10 vulnerabilities: CVE-2026-56864, CVE-2026-56865, CVE-2026-56860, CVE-2026-56858, CVE-2026-33818...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: opentelemetry-collector-contrib: opentelemetry-collector-contrib-0.159.0-0.1.1.hum1 aarch64, x8664 opentelemetry-collector-contrib-0.159.0-0.1.1.hum1.src src Security Fixes:...

DRUPAL-CONTRIB-2026-116

This module enables you to create one or more multisites with highly granular page permissions. The module doesn't sufficiently sanitize HTML code contained in the page name when displayed in the built-in tree browser. This results in a cross-site scripting vulnerability that may allow attackers ...