CVE-2026-55568 vulnerabilities

Vulnerabilities for packages: nextcloud-server, drupal, privatebin...

GHSA-WPWQ-4J6V-78M3 vulnerabilities

Vulnerabilities for packages: nextcloud-server, drupal, privatebin...

CVE-2026-55766 vulnerabilities

Vulnerabilities for packages: nextcloud-server, drupal, privatebin...

GHSA-VM85-HXW5-5432 vulnerabilities

Vulnerabilities for packages: nextcloud-server, drupal, privatebin...

CVE-2026-48998 vulnerabilities

Vulnerabilities for packages: nextcloud-server, drupal, privatebin...

GHSA-HQ7V-MX3G-29HW vulnerabilities

Vulnerabilities for packages: nextcloud-server, drupal, privatebin...

CVE-2026-49214 vulnerabilities

Vulnerabilities for packages: nextcloud-server, drupal, privatebin...

GHSA-34XG-WGJX-8XPH vulnerabilities

Vulnerabilities for packages: nextcloud-server, drupal, privatebin...

GHSA-VMF3-W455-68VH vulnerabilities

Vulnerabilities for packages: kubeflow-katib, pnpm-stage0, wazuh-dashboard-fips, drupal, renovate, tensorflow-cpu-jupyter, npm, opensearch-dashboards-fips, gitlab-rails-ce-fips, thingsboard, gemini-cli, py3-captum, py3-jupyterlab, wazuh-dashboard, graalvm, sqlpad, pulumi, tileserver-gl-fips,...

CVE-2026-53655 vulnerabilities

Vulnerabilities for packages: kubeflow-katib, pnpm-stage0, wazuh-dashboard-fips, drupal, renovate, tensorflow-cpu-jupyter, npm, opensearch-dashboards-fips, gitlab-rails-ce-fips, thingsboard, gemini-cli, py3-captum, py3-jupyterlab, wazuh-dashboard, graalvm, sqlpad, pulumi, tileserver-gl-fips,...

The vulnerability of the `denormalize` method in the `FieldItemNormalizer` class of the Drupal CMS system allows a hacker to execute arbitrary code.

The vulnerability of the denormalize method in the FieldItemNormalizer class of the Drupal CMS system is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability could allow an attacker to execute arbitrary code...

Drupal 10.5.x < 10.5.12 / 10.6.x < 10.6.11 / 11.2.x < 11.2.14 / 11.3.x < 11.3.12 Multiple Vulnerabilities (drupal-2026-06-17)

According to its self-reported version, the instance of Drupal running on the remote web server is 10.5.x prior to 10.5.12, 10.6.x prior to 10.6.11, 11.2.x prior to 11.2.14, or 11.3.x prior to 11.3.12. It is, therefore, affected by multiple vulnerabilities. - Drupal core contains a chain of metho...

DRUPAL-CORE-2026-009

The JSON:API and REST modules allow you to upload image files to image fields. The validation rules check the file extension of the uploaded file but not the file MIME type. This may allow a malicious user to upload a file that is not an image. Certain web-server configurations may serve the...

DRUPAL-CORE-2026-008

The Media module comes with support for oEmbed. The oEmbed specification contains two discovery mechanisms, via providers.json and via URL discovery. The URL discovery code could be leveraged to trick Drupal into making server-side requests to any URL...

DRUPAL-CORE-2026-007

Drupal core ships a rebuild.php front controller that can be used to rebuild Drupal clearing the caches and rebuilding the container when the site is in an unexpected condition. This script doesn't correctly check the Host header against the list of trusted host patterns. This could result in cac...

DRUPAL-CORE-2026-006

Drupal core contains a chain of methods that could be exploitable when an insecure deserialization vulnerability exists on the site. This so-called "gadget chain" presents no direct threat, but is a vector that can be used to achieve remote code execution or SQL injection if the application...

DRUPAL-CORE-2026-005

SA-CORE-2019-003 added protection for fields that store serialized data to disallow direct writes via web services. The above fix did not cover all potential attack vectors for JSON:API. An attacker with appropriate JSON:API write permission could potentially inject a malicious payload in certain...

DRUPAL-CONTRIB-2026-050

The Plotly.js Graphing module provides a fully customizable implementation of the open source Plotly.js graphing library. The module stores some data as PHP-serialized strings. In some situations, malicious data can be written directly to the field. This can lead to an object injection...

DRUPAL-CONTRIB-2026-049

The Flag attendance field module gives you the ability to add attendance by depending on Flag module. flagattendancefield stores some data as PHP-serialized strings. In some situations, malicious data can be written directly to the field. This can lead to an object injection vulnerability when th...

DRUPAL-CONTRIB-2026-048

The Formatter Field module provides a mechanism for specifying a formatter and formatter settings to be used for displaying a field, on a per-entity basis. formatterfield stores some data as PHP-serialized strings. In some situations, malicious data can be written directly to the field. This can...