Feed Block - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-137

The Feed Block module provides a block content type that displays items pulled from a remote RSS/Atom feed. The module does not sufficiently validate or sanitize the RSS feed it generates, resulting in a stored cross-site scripting XSS vulnerability...

SAML SSO - Service Provider - Moderately critical - Information disclosure - SA-CONTRIB-2026-149

This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider. The module stores sensitive authentication information in a manner that could allow disclosure to users with access to configuration or related...

Patreon - Critical - Unsupported - SA-CONTRIB-2026-139

The Drupal Security Team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, read the documentation on becoming the maintainer of a project that is unsupported for security...

SAML SSO - Service Provider - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-146

This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider. The module does not sufficiently sanitize user-supplied data before displaying it in generated HTML leading to a cross-site scripting...

SAML SSO - Service Provider - Critical - Improper certificate validation - SA-CONTRIB-2026-142

This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider. The module does not properly validate TLS certificates when making outbound HTTPS requests. An attacker in a position to intercept network...

SAML SSO - Service Provider - Critical - Improper access control - SA-CONTRIB-2026-141

This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider. The miniorangesaml module does not correctly restrict access to certain functionality intended for administrative use. This could allow...

SafeDelete - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-140

This module enables you to manage content deletion and provides reports for identifying orphaned content. The module doesn't sufficiently sanitize node titles when displaying the orphaned nodes report. This leads to a persistent cross-site scripting vulnerability XSS. This vulnerability is...

Key auth - Moderately critical - Access bypass - SA-CONTRIB-2026-138

This module enables you to add key-based authentication on a per-user basis. The module doesn't cache per user, potentially allowing an attacker to view another user's authentication keys, if the attacker has the same permissions. This vulnerability is mitigated by the fact that the site must hav...

PT-2026-95862

TuxCare rebuilt drupal/gdpr to address 1 CVE. Fixed in 7.1.0-p1+tuxcare...

PT-2026-95857

TuxCare rebuilt drupal/colorbox to address 1 CVE. Fixed in 2.1.2-p1+tuxcare...

PT-2026-95855

TuxCare rebuilt drupal/bootstrap site alert to address 1 CVE. Fixed in 7.1.6-p1+tuxcare...

PT-2026-95858

TuxCare rebuilt drupal/access code to address 1 CVE. Fixed in 7.1.1-p1+tuxcare...

PT-2026-89253

This module adds automatic highlighting of taxonomy terms in content. The module doesn't sufficiently check access on taxonomy terms. As a result, anonymous users can view any of the site's taxonomy terms at the module's JSON endpoint, including taxonomy terms that are unpublished or otherwise...

PT-2026-89249

This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider. The module contains embedded credentials used by the functionality provided by the module. Under certain circumstances, these credentials could...

PT-2026-89241

This module enables you to manage content deletion and provides reports for identifying orphaned content. The module doesn't sufficiently sanitize node titles when displaying the orphaned nodes report. This leads to a persistent cross-site scripting vulnerability XSS. This vulnerability is...

CVE-2026-87942

CVE-2026-87942 affects the SafeDelete Drupal contrib module, which manages content deletion and provides reports for identifying orphaned content. The root cause is insufficient sanitization of node titles when displaying the orphaned nodes report, resulting in a persistent cross-site scripting (...

PT-2026-95864

TuxCare rebuilt drupal/gdpr to address 1 CVE. Fixed in 3.1.0-p1+tuxcare...

PT-2026-95861

TuxCare rebuilt drupal/spamspan to address 1 CVE. Fixed in 7.1.4-p1+tuxcare...

PT-2026-89247

This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider. The module does not sufficiently sanitize user-supplied data before displaying it in generated HTML leading to a cross-site scripting...

PT-2026-89243

This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider. The module does not properly validate TLS certificates when making outbound HTTPS requests. An attacker in a position to intercept network...