DRUPAL-CONTRIB-2026-110

This module enables you to disable access to the /user/login form unless a secret key is provided. The module does not sufficiently restrict repeated attempts to guess that key, allowing brute-force attacks against the access-control mechanism...

DRUPAL-CONTRIB-2026-108

This module enables you to store structured data in configurable fields and expose Data Field values through JSON endpoints. The module doesn't sufficiently check access when returning Data Field values through its JSON endpoint. This may allow anonymous users to access field values belonging to...

DRUPAL-CONTRIB-2026-107

The module provides a permission that allows users to configure email templates containing Twig code. This permission was not marked as restricted. A site administrator might inadvertently grant this permission to less-trusted users. This would allow those users to execute Twig within email...

DRUPAL-CONTRIB-2026-105

This module enables site administrators to require CAPTCHA confirmation on specific pages. The module does not sufficiently validate its CAPTCHA verification cookies. Under certain circumstances, an unauthenticated user or automated bot can forge the cookie and bypass CAPTCHA verification entirel...

CVE-2026-16646

PanKM is a Drupal contrib module affected across all versions (. ). Drupal's security team has marked the project unsupported , indicating a known security issue that the maintainer has not fixed. The vulnerability is rated Critical by Drupal, with a CVSS 3.1 base score of 5.7 (Medium) (AV:N/AC:H...

DRUPAL-CONTRIB-2026-102

The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, read the documentation on becoming the maintainer of a project that is unsupported for security reasons...

GO-2024-2900 vulnerabilities

Vulnerabilities for packages: opentelemetry-collector-contrib, opentelemetry-collector-contrib-fips, opentelemetry-collector-fips, opentelemetry-collector...

GO-2024-3110 vulnerabilities

Vulnerabilities for packages: neuvector-scanner-fips, opentelemetry-collector-contrib-fips, kubernetes, cadvisor, kubernetes-fips, eks-distro, opentelemetry-collector-contrib, neuvector, ctop, grafana-alloy, runc, grype, k8s-device-plugin, cluster-autoscaler, cluster-autoscaler-fips, gosu,...

GO-2024-2791 vulnerabilities

Vulnerabilities for packages: cadvisor-fips, opentelemetry-collector-contrib, opentelemetry-collector-contrib-fips, kubernetes, cadvisor, ctop, wolfictl, neuvector-scanner, grype, buildah...

GO-2025-4123 vulnerabilities

Vulnerabilities for packages: dapr, vault-fips, telegraf, argo-events-fips, opentelemetry-collector-contrib, argo-events, grafana-alloy, sqlexporter-fips, cluster-api-aws-controller-fips, splunk-otel-collector-fips, amazon-cloudwatch-agent, vault, amazon-cloudwatch-agent-fips,...

GO-2024-2911 vulnerabilities

Vulnerabilities for packages: opentelemetry-collector, opentelemetry-collector-contrib, spicedb...

GO-2024-2900 vulnerabilities

Vulnerabilities for packages: opentelemetry-collector, opentelemetry-collector-contrib...

GO-2025-3650 vulnerabilities

Vulnerabilities for packages: opentelemetry-collector-contrib, splunk-otel-collector, sqlexporter, grafana-alloy...

GO-2026-4514 vulnerabilities

Vulnerabilities for packages: datadog-agent, k3s, witness, goreleaser, grafana-alloy, loki, prometheus, rclone, vcluster, kubevela, gitlab-runner, cri-tools, maru, minio, nuclei, redpanda, opentelemetry-collector-contrib, ollama, teleport, k8sgpt, weaviate, eksctl, opentelemetry-collector,...

GO-2024-2978 vulnerabilities

Vulnerabilities for packages: k3s, kaniko, cloudnative-pg, ksops, pulumi-language-dotnet, k3d, k8sgpt-operator, zot, gomplate, osv-scanner, falcosidekick, dex, cert-manager-cmctl, spegel, vcluster, temporal, fulcio, sops, zarf, ferretdb, kots, minio, spire-server, cilium-cli, grafana-mimir,...

GO-2024-3110 vulnerabilities

Vulnerabilities for packages: kubernetes, ctop, grype, k3s, syft, cadvisor, docker, buildah, neuvector-scanner, grafana-alloy, runc, k8s-device-plugin, opentelemetry-collector-contrib, podman...

GO-2024-2791 vulnerabilities

Vulnerabilities for packages: kubernetes, ctop, grype, wolfictl, cadvisor, buildah, neuvector-scanner, opentelemetry-collector-contrib...

GO-2025-4123 vulnerabilities

Vulnerabilities for packages: argo-events, splunk-otel-collector, amazon-cloudwatch-agent, sqlexporter, bento, grafana-alloy, cluster-api-aws-controller, opentelemetry-collector-contrib, jitsucom-bulker...

GO-2025-3525 vulnerabilities

Vulnerabilities for packages: splunk-otel-collector, amazon-cloudwatch-agent, kargo, k8sgpt, kubeflow-pipelines, argo-workflows, grafana-alloy, argo-rollouts, opentelemetry-collector, opentelemetry-collector-contrib, nats...

GO-2024-2918 vulnerabilities

Vulnerabilities for packages: buildkitd, chezmoi, pulumi, boring-registry, goreleaser, ksops, druid, airflow, zot, hugo, rclone, flux-image-reflector-controller, hugo-extended, fulcio, sqlpad, sops, zarf, policy-controller, spire-server, nuclei, py3-azure-identity, opentelemetry-collector-contrib...