DRUPAL-CONTRIB-2026-195

This module integrates the MathJax library into your Drupal site. MathJax is the modern JavaScript-based LaTeX rendering solution for the Internet. The module ships with library configurations that do not escape JavaScript within the TeX it formats. Notice: This release updates CDN URLs where...

DRUPAL-CONTRIB-2026-194

Entity Reference Manager is an advanced administrative module for Drupal that allows site administrators to identify, analyze, and replace entity references across the system. The module does not sufficiently restrict access to all entity management operations. Users who can view content can acce...

DRUPAL-CONTRIB-2026-193

The Drupal Security Team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, read the documentation on becoming the maintainer of a project that is unsupported for security...

DRUPAL-CONTRIB-2026-192

The Block AJAX module enables you to load blocks asynchronously via Ajax. The module doesn't sufficiently validate user-supplied data which is used to construct a block. In the worst case scenario, this can lead to PHP Object Injection and Remote Code Execution. The vulnerability is mitigated by...

Drupal_REST-RCE_Unauthenticated

CVE-2019-6340 — ड्रुपल RESTful वेब सेवाएँ RCE CVE-2019-6340 के लिए रिमोट कोड निष्पादन exploit का Python कार्यान्वयन, Metasploit मॉड्यूल और leonjza द्वारा पूर्व कार्य के विश्लेषण पर आधारित। EDB-46459 से मुख्य अंतर: GET के बजाय POST का उपयोग करता है, Drupal के पेज कैश को दरकिनार करते हुए — बिना कैश...

webenum-ng

webenum-ng L'equivalent web de enum4linux-ng : un seul orch...

fad-checker

fad-checker AKA F ormidable A uditor's D ependency C hecker AKA F uckin' A utonomous D ependency C hecker fad-checker is a polyglot dependency auditor built for professional code audits. It scans 10 ecosystems + 9 CMS/Frameworks WordPress, Drupal, Symfony, Laravel… in one pass, with no build tool...

Audit-BlackBox-Web-to-Root

Pentest Lab : वेब और सिस्टम एक्सप्लॉइटेशन चेन Drupal to Root अस्वीकरण यह परियोजना शैक्षिक और अकादमिक उद्देश्यों के लिए एक नियंत्रित और पृथक प्रयोगशाला वातावरण में की गई थी। किसी भी वास्तविक बुनियादी ढांचे को लक्षित नहीं किया गया। उद्देश्य हमले के तंत्र को समझकर सिस्टम को सुरक्षित करना सीखना है।...

PT-2026-107745

This module integrates the MathJax library into your Drupal site. MathJax is the modern JavaScript-based LaTeX rendering solution for the Internet. The module ships with library configurations that do not escape JavaScript within the TeX it formats. Notice: This release updates CDN URLs where...

CVE-2026-107263

The DRUPAL-CONTRIB-2026-202 module, which provides a new UI experience for node editing using the Gutenberg Editor library , fails to sufficiently check entity access across several editor endpoints. This flaw allows for potential unauthorized access, though the risk is mitigated by the requireme...

Country - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-211

The module Country provides a dedicated field type for Drupal core's official country list. The module does not sufficiently escape user input in its autocomplete widget, which can lead to a cross site scripting vulnerability. This vulnerability is mitigated by the fact that it can not occur out ...

PT-2026-107762

The module Country provides a dedicated field type for Drupal core's official country list. The module does not sufficiently escape user input in its autocomplete widget, which can lead to a cross site scripting vulnerability. This vulnerability is mitigated by the fact that it can not occur out ...

PT-2026-107748

This module enables you to restrict access to routes by IP address. The module doesn't reliably restrict a subset of dynamic routes, leading to an access bypass vulnerability. The impact depends on how a site uses this module and whether it has any routes that are dynamic...

PT-2026-107749

Actstream short for Activity Stream aggregates a user's activity from external services RSS feeds, etc. into per-user activity stream entities. The configuration route does not sufficiently check that the user editing it is the account owner or a user administrator leading to an access bypass...

Menu Link Attributes - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-209

This module enables you to add HTML attributes to menu links and their container elements . The module doesn't sufficiently sanitize the attributes it applies to menu link container elements. This vulnerability is mitigated by the fact that an attacker must have a role with the permissions...

PT-2026-107760

This module enables you to add HTML attributes to menu links and their container elements . The module doesn't sufficiently sanitize the attributes it applies to menu link container elements. This vulnerability is mitigated by the fact that an attacker must have a role with the permissions...

PT-2026-107763

This module enables you to show a breadcrumb trail for taxonomy term hierarchies. The module doesn't sufficiently check for view access of parent terms before rendering the crumb segment. This vulnerability is mitigated by the fact that the setting "Add parent hierarchy" term hierarchy must be...

PT-2026-107766

The Examples for Developers project aims to provide high-quality, well-documented API examples for a broad range of Drupal core functionality. The "Email Example" feature implemented by the email example submodule can be used to send illegitimate emails to arbitrary email addresses. Therefore, th...

PT-2026-107744

Entity Reference Manager is an advanced administrative module for Drupal that allows site administrators to identify, analyze, and replace entity references across the system. The module does not sufficiently restrict access to all entity management operations. Users who can view content can acce...

PT-2026-107750

This module renders entity add/edit forms inside an AJAX dialog for use with entity reference fields. This module relies only on the "access administration pages" permission, without checking whether the current user had create or update access to the entity itself. This vulnerability is mitigate...