PT-2026-107745

This module integrates the MathJax library into your Drupal site. MathJax is the modern JavaScript-based LaTeX rendering solution for the Internet. The module ships with library configurations that do not escape JavaScript within the TeX it formats. Notice: This release updates CDN URLs where...

Country - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-211

The module Country provides a dedicated field type for Drupal core's official country list. The module does not sufficiently escape user input in its autocomplete widget, which can lead to a cross site scripting vulnerability. This vulnerability is mitigated by the fact that it can not occur out ...

PT-2026-107762

The module Country provides a dedicated field type for Drupal core's official country list. The module does not sufficiently escape user input in its autocomplete widget, which can lead to a cross site scripting vulnerability. This vulnerability is mitigated by the fact that it can not occur out ...

PT-2026-107748

This module enables you to restrict access to routes by IP address. The module doesn't reliably restrict a subset of dynamic routes, leading to an access bypass vulnerability. The impact depends on how a site uses this module and whether it has any routes that are dynamic...

PT-2026-107749

Actstream short for Activity Stream aggregates a user's activity from external services RSS feeds, etc. into per-user activity stream entities. The configuration route does not sufficiently check that the user editing it is the account owner or a user administrator leading to an access bypass...

Examples for Developers - Less critical - Allocation of resources without limits or throttling - SA-CONTRIB-2026-215

The Examples for Developers project aims to provide high-quality, well-documented API examples for a broad range of Drupal core functionality. The "Email Example" feature implemented by the emailexample submodule can be used to send illegitimate emails to arbitrary email addresses. Therefore, the...

CVE-2026-107262

The Advanced Filesystem: Backup submodule of Drupal is vulnerable to a Cross-Site Request Forgery (CSRF) flaw due to insufficient validation of certain requests. This could allow an attacker to trick an authenticated user into performing unintended actions. The impact is limited to environments w...

PT-2026-107754

This module provides a new UI experience for node editing using the Gutenberg Editor library. The module does not sufficiently check entity access in several editor endpoints. This vulnerability is mitigated by the fact that an attacker must have a role with the “use gutenberg” permission...

CVE-2026-96389

The Drupal Audit module fails to sufficiently check entity access when rendering an entity through the display-mode example route . This flaw allows an attacker to view content that is unpublished or otherwise access-restricted. However, the impact is partially mitigated because field-level acces...

CVE-2026-107250

Technical details for CVE-2026-107250 are not publicly available in the provided documents. Action: monitor for updates.

CVE-2026-107263

The DRUPAL-CONTRIB-2026-202 module, which provides a new UI experience for node editing using the Gutenberg Editor library , fails to sufficiently check entity access across several editor endpoints. This flaw allows for potential unauthorized access, though the risk is mitigated by the requireme...

Menu Link Attributes - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-209

This module enables you to add HTML attributes to menu links and their container elements . The module doesn't sufficiently sanitize the attributes it applies to menu link container elements. This vulnerability is mitigated by the fact that an attacker must have a role with the permissions...

PT-2026-107760

This module enables you to add HTML attributes to menu links and their container elements . The module doesn't sufficiently sanitize the attributes it applies to menu link container elements. This vulnerability is mitigated by the fact that an attacker must have a role with the permissions...

PT-2026-107763

This module enables you to show a breadcrumb trail for taxonomy term hierarchies. The module doesn't sufficiently check for view access of parent terms before rendering the crumb segment. This vulnerability is mitigated by the fact that the setting "Add parent hierarchy" term hierarchy must be...

PT-2026-107766

The Examples for Developers project aims to provide high-quality, well-documented API examples for a broad range of Drupal core functionality. The "Email Example" feature implemented by the email example submodule can be used to send illegitimate emails to arbitrary email addresses. Therefore, th...

PT-2026-107744

Entity Reference Manager is an advanced administrative module for Drupal that allows site administrators to identify, analyze, and replace entity references across the system. The module does not sufficiently restrict access to all entity management operations. Users who can view content can acce...

PT-2026-107750

This module renders entity add/edit forms inside an AJAX dialog for use with entity reference fields. This module relies only on the "access administration pages" permission, without checking whether the current user had create or update access to the entity itself. This vulnerability is mitigate...

PT-2026-107758

The DKAN module enables organizations and individuals to build open data portals in Drupal. The DKAN datastore imports tabular data files into database tables and exposes them for querying with a JSON API. The module does not correctly check access for all of its endpoints, leading to a potential...

PT-2026-107765

This module enables you to restrict view access to single nodes via taxonomy terms. The module doesn't sufficiently check access rights when in "Permission mode" and a node referencing a deleted taxonomy term is accessed via JSON:API. This vulnerability is mitigated by the fact that it requires a...

PT-2026-107756

The Leaflet module provides integration with the Leaflet JS mapping library. Under certain circumstances, when the Leaflet field formatter builds a map it does not filter content titles, leading to a stored cross-site scripting vulnerability. This vulnerability is mitigated by the fact an attacke...