15435 matches found
Drupal Canvas 安全漏洞
Drupal Canvas is a page builder developed by the Drupal company. Versions of Drupal Canvas prior to 1.1.1 contained security vulnerabilities, which were due to susceptibility to server-side request forgeing attacks...
Drupal Islandora 安全漏洞
Drupal Islandora is an extension platform for content management systems developed by the Drupal company, used for digital asset management and digital library construction. Versions of Drupal Islandora prior to 2.17.5 contained a security vulnerability caused by improper input handling, which...
Drupal SAML SSO 安全漏洞
Drupal SAML SSO is an extension for Drupal-based content management systems that provides SAML-based single-sign-on authentication functionality. Versions of Drupal SAML SSO prior to 3.1.3 contained a security vulnerability, which was caused by improper input handling and could lead to cross-site...
Drupal Responsive Favicons 安全漏洞
Drupal Responsive Favicons is an extension for the Drupal content management system that is designed to generate and adapt favicon icons for multiple devices and browsers. Versions of Drupal Responsive Favicons prior to 2.0.2 contained a security vulnerability caused by improper input handling,...
Drupal Material Icons 安全漏洞
Drupal Material Icons is a module provided by the Drupal company that offers interface icon display and management functions. Versions of Drupal Material Icons prior to 2.0.4 contained security vulnerabilities, which were caused by improper authorization and could lead to forced browsing...
Drupal UI Icons 安全漏洞
Drupal UI Icons is a content management system module provided by the Drupal company that offers interface icon display and management functions. Versions of Drupal UI Icons prior to 1.0.1 and 1.1.1 contained security vulnerabilities, which were caused by improper input handling and could lead to...
Drupal Quick Edit 安全漏洞
Drupal Quick Edit is a content management system module provided by the Drupal company that enables quick editing and immediate modification of page content. Versions of Drupal Quick Edit prior to 1.0.5 and 2.0.1 contained security vulnerabilities, which were due to improper input handling and...
Drupal Tagify 安全漏洞
Drupal Tagify is a Drupal module from the Drupal community that integrates the Tagify JavaScript library. Versions of Drupal Tagify prior to 1.2.49 contained a security vulnerability, which was caused by improper input handling and could lead to cross-site scripting attacks...
Drupal CAPTCHA 安全漏洞
Drupal CAPTCHA is a CAPTCHA module developed by the Drupal company. Versions of Drupal CAPTCHA prior to 1.17.0, as well as versions from 2.0.0 to 2.0.10, contained security vulnerabilities. These vulnerabilities stemmed from the use of alternative paths or channels to bypass authentication,...
📄 ddev/ddev ZipSlip Path Traversal
A ZipSlip path traversal vulnerability exists in ddev/ddev, a popular open-source local development tool for PHP, Python, and Node.js projects. Both the Untar and Unzip functions in pkg/archive/archive.go use filepath.Joindest, file.Name without any path containment validation, allowing a crafted...
websec-audit
🔐 websec-audit Professional Web Security Audit Framework...
CVE-2026-33228 vulnerabilities
Vulnerabilities for packages: authentik-fips, renovate, semaphore, gitlab-rails-ce, authentik, gitlab-rails-ce-fips, langfuse-fips, prism, wazuh-dashboard, wazuh-dashboard-fips, drupal, kubeflow-katib, langfuse, eslint, librechat, sqlpad, arangodb, vitess...
GHSA-RF6F-7FWH-WJGH vulnerabilities
Vulnerabilities for packages: authentik-fips, renovate, semaphore, gitlab-rails-ce, authentik, gitlab-rails-ce-fips, langfuse-fips, prism, wazuh-dashboard, wazuh-dashboard-fips, drupal, kubeflow-katib, langfuse, eslint, librechat, sqlpad, arangodb, vitess...
DRUPAL-CONTRIB-2026-030
This module provides a site administrator the ability to log users out after a specified time of inactivity. The module doesn't sufficiently protect its routes from cross-site request forgery CSRF, allowing the logout route to be triggered without user interaction...
CVE-2026-32141 vulnerabilities
Vulnerabilities for packages: wazuh-dashboard-fips, drupal, langfuse, argo-workflows, gitlab-rails-ce, authentik, tileserver-gl, arangodb, vitess, semaphore, tileserver-gl-fips, wazuh-dashboard, langfuse-fips, prism, kubeflow-katib, eslint, sqlpad, authentik-fips, renovate, gitlab-rails-ce-fips,...
GHSA-25H7-PFQ9-P65F vulnerabilities
Vulnerabilities for packages: wazuh-dashboard-fips, drupal, langfuse, argo-workflows, gitlab-rails-ce, authentik, tileserver-gl, arangodb, vitess, semaphore, tileserver-gl-fips, wazuh-dashboard, langfuse-fips, prism, kubeflow-katib, eslint, sqlpad, authentik-fips, renovate, gitlab-rails-ce-fips,...
PT-2026-26218
Name of the Vulnerable Software and Affected Versions Drupal Automated Logout versions 0.0.0 through 1.6.9 Drupal Automated Logout versions 2.0.0 through 2.0.1 Description The Automated Logout module for Drupal does not adequately protect its routes against Cross-Site Request Forgery CSRF. This...
Automated Logout - Moderately critical - Cross-site request forgery - SA-CONTRIB-2026-030
This module provides a site administrator the ability to log users out after a specified time of inactivity. The module doesn't sufficiently protect its routes from cross-site request forgery CSRF, allowing the logout route to be triggered without user interaction...