Drupal core - Moderately critical - Gadget chain - SA-CORE-2026-006

Drupal core contains a chain of methods that could be exploitable when an insecure deserialization vulnerability exists on the site. This so-called "gadget chain" presents no direct threat, but is a vector that can be used to achieve remote code execution or SQL injection if the application...

PT-2026-50607

Name of the Vulnerable Software and Affected Versions Drupal core affected versions not specified Description Drupal core contains a gadget chain, which is a sequence of existing code fragments that can be leveraged during the deserialization of untrusted data. While this issue is not directly...

Drupal core - Moderately critical - Server-side request forgery - SA-CORE-2026-008

The Media module comes with support for oEmbed. The oEmbed specification contains two discovery mechanisms, via providers.json and via URL discovery. The URL discovery code could be leveraged to trick Drupal into making server-side requests to any URL...

Flag attendance field - Critical - PHP object injection - SA-CONTRIB-2026-049

The Flag attendance field module gives you the ability to add attendance by depending on Flag module. flagattendancefield stores some data as PHP-serialized strings. In some situations, malicious data can be written directly to the field. This can lead to an object injection vulnerability when th...

CVE-2026-48779 vulnerabilities

Vulnerabilities for packages: opensearch-dashboards, homepage, langfuse, drupal, code-server, opensearch-dashboards-fips, wazuh-dashboard-fips, kibana, gemini-cli, langfuse-fips, argo-workflows, gitlab-rails-ce-fips, arangodb, py3-jupyterlab, kubeflow-katib, tensorflow-cpu-jupyter, wazuh-dashboar...

CVE-2026-53550 vulnerabilities

Vulnerabilities for packages: eslint, opensearch-dashboards, homepage, renovate, drupal, semaphore, kibana, argo-workflows, authentik-fips, py3-jupyterlab, tensorflow-cpu-jupyter, thingsboard-fips, kubeflow-katib, saf, airflow, opensearch-dashboards-fips, thingsboard, redisinsight,...

GHSA-H67P-54HQ-RP68 vulnerabilities

Vulnerabilities for packages: eslint, opensearch-dashboards, homepage, renovate, drupal, semaphore, kibana, argo-workflows, authentik-fips, py3-jupyterlab, tensorflow-cpu-jupyter, thingsboard-fips, kubeflow-katib, saf, airflow, opensearch-dashboards-fips, thingsboard, redisinsight,...

GHSA-96HV-2XVQ-FX4P vulnerabilities

Vulnerabilities for packages: opensearch-dashboards, homepage, langfuse, drupal, code-server, opensearch-dashboards-fips, wazuh-dashboard-fips, kibana, gemini-cli, langfuse-fips, argo-workflows, gitlab-rails-ce-fips, arangodb, py3-jupyterlab, kubeflow-katib, tensorflow-cpu-jupyter, wazuh-dashboar...

Grimoire

書 — The Pentesterʼs Spellbook Answer the questions. Unleash th...

webstrike-framework

WebStrike — Automated Web Pentesting Framework Created by...

📄 Drupal core 10.5.5 JSON:API PostgreSQL Error-Based SQL Injection

This code demonstrates a research-oriented implementation targeting a reported SQL injection condition in Drupal JSON:API endpoints backed by PostgreSQL. ================================================================================================================================== | Title :...

DRUPAL-CONTRIB-2026-047

The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466s-becoming-owner-maintainer-or-co-mai...

DRUPAL-CONTRIB-2026-046

The security team is marking the Composer module for Drupal project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read:...

DRUPAL-CONTRIB-2026-045

The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466s-becoming-owner-maintainer-or-co-mai...

DRUPAL-CONTRIB-2026-044

The Examples for Developers project aims to provide high-quality, well-documented API examples for a broad range of Drupal core functionality. The "Read from a file" feature implemented by the file\example submodule can be used to expose any file that PHP can access. Therefore, the file\example...

DRUPAL-CONTRIB-2026-043

This module integrates the Tagify JavaScript library to enhance entity reference selection in entity reference widgets. The module does not properly sanitise the name of parent taxonomy terms when rendering suggestions in the Tagify dropdown. This results in a cross-site scripting vulnerability...

Exploit for Improper Input Validation in Drupal

drupalgeddon2-cli A command-line rewrite of the Drupalged...

PT-2026-48594

Name of the Vulnerable Software and Affected Versions Drupal Composer affected versions not specified Description A security issue exists in the Drupal Composer project. This project is a Drupal system component that utilizes Composer and is distinct from the Composer software itself...

Tagify - Moderately critical - Cross-site scripting (XSS) - SA-CONTRIB-2026-043

This module integrates the Tagify JavaScript library to enhance entity reference selection in entity reference widgets. The module does not properly sanitise the name of parent taxonomy terms when rendering suggestions in the Tagify dropdown. This results in a cross-site scripting vulnerability...

Brute force attack protection - Critical - Unsupported - SA-CONTRIB-2026-047

The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466s-becoming-owner-maintainer-or-co-mai...