File Access Fix (deprecated) - Moderately critical - Access bypass - SA-CONTRIB-2026-020

This module moves files to and from private storage depending on the access of its owning entities. The module does not sufficiently incorporate the results of hookfiledownload when a custom or contrib module implements that hook leading to access bypass...

PT-2026-23109

Name of the Vulnerable Software and Affected Versions Drupal File Access Fix deprecated versions prior to 1.2.0 Description The File Access Fix module deprecated contains an authorization flaw that could allow forceful browsing of files. The module manages file storage based on entity access...

PT-2026-23115

Name of the Vulnerable Software and Affected Versions Drupal OpenID Connect / OAuth client versions prior to 1.5.0 Description A flaw exists in the OpenID Connect / OAuth client module that allows for privilege escalation due to improper handling of case sensitivity. The module does not adequatel...

Google Analytics GA4 - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-024

The Google Analytics GA4 module enables users to add custom attributes to the script tag used to load the Google Analytics library. The module does not sufficiently sanitize these attributes. This vulnerability is mitigated by the fact that an attacker must have a role with the "ga4 configure" or...

OpenID Connect / OAuth client - Moderately critical - Access bypass - SA-CONTRIB-2026-026

This module enables you to use an external OpenID Connect login provider to authenticate and log in users on your site. If a user signs in with a login provider for the first time on the website, a new Drupal user will be created. A visitor who successfully logs in to their Identity Provider and ...

PT-2026-23110

Name of the Vulnerable Software and Affected Versions Drupal AJAX Dashboard versions prior to 3.1.0 Description A missing authentication check for a critical function in Drupal AJAX Dashboard allows exploitation of incorrectly configured access control security levels. The issue resides in the AJ...

PT-2026-23112

Name of the Vulnerable Software and Affected Versions Drupal Google Analytics GA4 versions prior to 1.1.14 Description The Google Analytics GA4 module does not properly sanitize custom attributes added to the script tag used to load the Google Analytics library, leading to a Cross-Site Scripting...

OpenID Connect / OAuth client - Less critical - Access bypass - SA-CONTRIB-2026-027

This module enables you to use an external OpenID Connect login provider to authenticate and log in users on your site. If a user signs in with a login provider for the first time on the website, a new Drupal user will be created. The module doesn't sufficiently validate the uniqueness of certain...

File Access Fix (deprecated) - Moderately critical - Access bypass - SA-CONTRIB-2026-021

This module moves files to and from private storage depending on the access of its owning entities. The module does not always validate the access logic correctly, resulting in files attached to an entity not being protected in certain circumstances. This vulnerability is mitigated by the fact th...

PT-2026-23111

Name of the Vulnerable Software and Affected Versions Drupal Calculation Fields versions prior to 1.0.4 Description The Calculation Fields module for Drupal does not properly validate user-supplied input, potentially allowing for Information Disclosure or Cross-Site Scripting XSS attacks. This...

GHSA-7R86-CG39-JMMJ vulnerabilities

Vulnerabilities for packages: tileserver-gl-fips, langfuse, py3-captum, gitlab-rails-ce, vitess, node-gyp, py3-jupyterlab, code-server, serve, kibana, saf, opentelemetry-auto-instrumentations-node, semaphore, ts-patch, emscripten, gitlab-rails-ce-fips, lerna, pnpm-stage0, authentik, authentik-fip...

CVE-2026-27903 vulnerabilities

Vulnerabilities for packages: tileserver-gl-fips, langfuse, py3-captum, gitlab-rails-ce, vitess, node-gyp, py3-jupyterlab, code-server, serve, kibana, saf, opentelemetry-auto-instrumentations-node, semaphore, ts-patch, emscripten, gitlab-rails-ce-fips, lerna, pnpm-stage0, authentik, authentik-fip...

CVE-2026-27904 vulnerabilities

Vulnerabilities for packages: tileserver-gl-fips, langfuse, py3-captum, gitlab-rails-ce, vitess, node-gyp, py3-jupyterlab, code-server, serve, kibana, saf, opentelemetry-auto-instrumentations-node, semaphore, ts-patch, emscripten, gitlab-rails-ce-fips, kubeflow-centraldashboard, lerna, authentik,...

GHSA-23C5-XMQV-RM74 vulnerabilities

Vulnerabilities for packages: tileserver-gl-fips, langfuse, py3-captum, gitlab-rails-ce, vitess, node-gyp, py3-jupyterlab, code-server, serve, kibana, saf, opentelemetry-auto-instrumentations-node, semaphore, ts-patch, emscripten, gitlab-rails-ce-fips, kubeflow-centraldashboard, lerna, authentik,...

honeypot-server

ReportedIP Honeypot Server !License: BSL 1.1https://img.s...

DRUPAL-CONTRIB-2026-019

This module adds the favicons generated by realfavicongenerator.net to your Drupal site. The module does not filter administrator-entered text, leading to a persistent Cross-site scripting XSS vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with the...

DRUPAL-CONTRIB-2026-018

This module enables you to perform SAML protocol-based single sign-on SSO on a Drupal site. The module doesn't sufficiently sanitize user input, leading to a reflected Cross-site scripting XSS vulnerability...

DRUPAL-CONTRIB-2026-017

This module enables you to easily theme and build an entire website using only their browser, without the need to write code beyond basic JSX and CSS. Content creators are able to compose content on any part of the page without relying on developers. The project has a hidden sub-module, Drupal...

DRUPAL-CONTRIB-2026-016

This module integrates with Islandora, an open-source digital asset management DAM framework. Islandora integrates with various open-source services, which can be run in a distributed environment. The module doesn't sufficiently sanitize URI paths for its custom route used for attaching media to...

DRUPAL-CONTRIB-2026-015

This module enables you to protect web forms from automated spam by requiring users to pass a challenge. The module doesn't sufficiently invalidate used security tokens under certain scenarios, which can lead to the CAPTCHA being bypassed on subsequent submissions. This vulnerability is mitigated...