Unpublished Node Permissions - Critical - Access bypass - SA-CONTRIB-2026-029

This module creates permissions per node content type to control access to unpublished nodes per content type. The module does not consistently control access for unpublished translated nodes...

CVE-2026-29786 vulnerabilities

Vulnerabilities for packages: redisinsight, tileserver-gl-fips, gitlab-rails-ce, node-gyp, gemini-cli, py3-jupyterlab, kibana, sqlpad, saf, gitlab-rails-ce-fips, lerna, pnpm-stage0, prism, tensorflow-cpu-jupyter, opensearch-dashboards-fips, wazuh-dashboard, renovate, graalvm, pulumi,...

GHSA-QFFP-2RHF-9H96 vulnerabilities

Vulnerabilities for packages: redisinsight, tileserver-gl-fips, gitlab-rails-ce, node-gyp, gemini-cli, py3-jupyterlab, kibana, sqlpad, saf, gitlab-rails-ce-fips, lerna, pnpm-stage0, prism, tensorflow-cpu-jupyter, opensearch-dashboards-fips, wazuh-dashboard, renovate, graalvm, pulumi,...

CVE-2026-27601 vulnerabilities

Vulnerabilities for packages: renovate, kubeflow-centraldashboard, prism, vitess, drupal, kubeflow-katib...

GHSA-QPX9-HPMF-5GMW vulnerabilities

Vulnerabilities for packages: renovate, kubeflow-centraldashboard, prism, vitess, drupal, kubeflow-katib...

DRUPAL-CONTRIB-2026-027

This module enables you to use an external OpenID Connect login provider to authenticate and log in users on your site. If a user signs in with a login provider for the first time on the website, a new Drupal user will be created. The module doesn't sufficiently validate the uniqueness of certain...

DRUPAL-CONTRIB-2026-026

This module enables you to use an external OpenID Connect login provider to authenticate and log in users on your site. If a user signs in with a login provider for the first time on the website, a new Drupal user will be created. A visitor who successfully logs in to their Identity Provider and ...

DRUPAL-CONTRIB-2026-025

This module enables you to use an external OpenID Connect login provider to authenticate and log in users on your site. If a user signs in with a login provider for the first time on the website, a new Drupal user will be created. The module doesn't sufficiently validate certain fields coming fro...

DRUPAL-CONTRIB-2026-024

The Google Analytics GA4 module enables users to add custom attributes to the script tag used to load the Google Analytics library. The module does not sufficiently sanitize these attributes. This vulnerability is mitigated by the fact that an attacker must have a role with the "ga4 configure" or...

DRUPAL-CONTRIB-2026-023

This module extends the Drupal form API adding "Calculation element" form element types, which can evaluate a maths expression. It offers webform integration. The module doesn't sufficiently validate user input; this could be exploited to achieve Information Disclosure or Cross-site Scripting XSS...

DRUPAL-CONTRIB-2026-022

AJAX Dashboard: Entity Dashboards enables you to create configurable dashboards attached to entities which include AJAX-reloading of a main content area based on inputs from a configurable set of buttons. The module doesn't sufficiently check access on the dashboard configuration route...

DRUPAL-CONTRIB-2026-021

This module moves files to and from private storage depending on the access of its owning entities. The module does not always validate the access logic correctly, resulting in files attached to an entity not being protected in certain circumstances. This vulnerability is mitigated by the fact th...

DRUPAL-CONTRIB-2026-020

This module moves files to and from private storage depending on the access of its owning entities. The module does not sufficiently incorporate the results of hook\file\download when a custom or contrib module implements that hook leading to access bypass...

GHSA-5C6J-R48X-RMVQ vulnerabilities

Vulnerabilities for packages: argo-workflows, arangodb, langfuse-fips, tileserver-gl-fips, langfuse, gitlab-rails-ce-fips, wazuh-dashboard-fips, opensearch-dashboards, tileserver-gl, gitlab-rails-ce, sqlpad, librechat, drupal, opensearch-dashboards-fips, wazuh-dashboard, kubeflow-katib...

PT-2026-23108

Name of the Vulnerable Software and Affected Versions Drupal File Access Fix deprecated versions prior to 1.2.0 Description The File Access Fix module deprecated has an authorization issue that allows for forceful browsing. The module manages file access, moving files between public and private...

Calculation Fields - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-023

This module extends the Drupal form API adding "Calculation element" form element types, which can evaluate a maths expression. It offers webform integration. The module doesn't sufficiently validate user input; this could be exploited to achieve Information Disclosure or Cross-site Scripting XSS...

PT-2026-23113

Name of the Vulnerable Software and Affected Versions Drupal OpenID Connect / OAuth client versions prior to 1.5.0 Description A Server-Side Request Forgery SSRF issue exists in the OpenID Connect / OAuth client module of Drupal. This flaw stems from insufficient validation of data received from...

PT-2026-23114

Name of the Vulnerable Software and Affected Versions Drupal OpenID Connect / OAuth client versions prior to 1.5.0 Description A flaw exists in the OpenID Connect / OAuth client module that could allow for authentication bypass. Specifically, if a user successfully authenticates with their Identi...

OpenID Connect / OAuth client - Moderately critical - Server-side request forgery, Information disclosure - SA-CONTRIB-2026-025

This module enables you to use an external OpenID Connect login provider to authenticate and log in users on your site. If a user signs in with a login provider for the first time on the website, a new Drupal user will be created. The module doesn't sufficiently validate certain fields coming fro...

AJAX Dashboard - Critical - Access bypass - SA-CONTRIB-2026-022

AJAX Dashboard: Entity Dashboards enables you to create configurable dashboards attached to entities which include AJAX-reloading of a main content area based on inputs from a configurable set of buttons. The module doesn't sufficiently check access on the dashboard configuration route...