Quick Tabs - Moderately critical - Access bypass - SA-CONTRIB-2026-099

This module enables you to display content in tabs, where each tab renders a block, a node, a view, or another Quick Tabs instance. The module did not correctly enforce access when rendering node and block tabs. It treated a neutral access result as a grant for node tabs and block plugins, and...

Exploit for Improper Input Validation in Drupal

CVE-2018-7600 Drupalgeddon2 — Red Team Project ITSOLERA...

DRUPAL-CONTRIB-2026-094

The Entity Browser module allows you to select entities from entity reference fields using a custom entity browser widget. The module doesn't sufficiently sanitize the the tab titles, resulting in a stored cross-site scripting XSS vulnerability. The vulnerability is mitigated by the fact an...

DRUPAL-CONTRIB-2026-093

This module provides formatters to allow in-place editing in a View or other display full content, teaser.... The module doesn't sufficiently check access when editing entities. A malicious user could craft requests to allow them to modify any field on any entity. This vulnerability is mitigated ...

Drupal Core 11.3.9 Anonymous Blind SQL Injection

A proof of concept exploit for an anonymous blind SQL injection vulnerability in Drupal Core version 11.3.9. The vulnerability affects Drupal Core versions 8.9.0 through 11.3.9 when using PostgreSQL as the database backend and is caused by improper handling of attacker-controlled array keys while...

📄 Drupal Core 11.3.9 Anonymous Blind SQL Injection

A proof of concept exploit for an anonymous blind SQL injection vulnerability in Drupal Core version 11.3.9. The vulnerability affects Drupal Core versions 8.9.0 through 11.3.9 when using PostgreSQL as the database backend and is caused by improper handling of attacker-controlled array keys while...

K000162772: Drupal vulnerability CVE-2026-9082

Security Advisory Description Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Drupal Drupal core allows SQL Injection. This issue affects Drupal core: from 8.9.0 before 10.4.10, from 10.5.0 before 10.5.10, from 10.6.0 before 10.6.9, from 11.0.0...

CLSA-2026-1784682869 TuxCare security update for drupal/core (21 CVEs)

TuxCare rebuilt drupal/core to address 21 CVEs. Fixed in 8.9.20-p1+tuxcare...

CLSA-2026-1779410881 TuxCare security update for drupal/core (1 CVE)

TuxCare rebuilt drupal/core to address 1 CVE. Fixed in 9.5.11-p3+tuxcare...

GHSA-32RQ-JHR7-M3HH vulnerabilities

Vulnerabilities for packages: nextcloud-server, privatebin, drupal...

GHSA-3FVR-2JW6-CRQ4 vulnerabilities

Vulnerabilities for packages: nextcloud-server, privatebin, drupal...

CVE-2026-67355 vulnerabilities

Vulnerabilities for packages: nextcloud-server, privatebin, drupal...

CVE-2026-67339 vulnerabilities

Vulnerabilities for packages: nextcloud-server, privatebin, drupal...

GHSA-MQQ9-GXG5-M58G vulnerabilities

Vulnerabilities for packages: nextcloud-server, privatebin, drupal...

CVE-2026-67354 vulnerabilities

Vulnerabilities for packages: nextcloud-server, privatebin, drupal...

CVE-2026-67353 vulnerabilities

Vulnerabilities for packages: nextcloud-server, privatebin, drupal...

GHSA-MJRX-74JH-7XGW vulnerabilities

Vulnerabilities for packages: nextcloud-server, privatebin, drupal...

CVE-2026-55810

A flaw was found in Drupal Plotly.js Graphing. This vulnerability, stemming from improperly controlled modification of dynamically-determined object attributes, allows for object injection. This could enable an attacker to manipulate application data or potentially execute unauthorized code...

DRUPAL-CONTRIB-2026-091

An advisory for this issue has been issued at and an additional issue was identified and fixed via This module is now resupported. See that advisory for more details. Original content The security team is marking this project unsupported. There is a known security issue with the project that has...

Powerful Surveys - Critical - Unsupported - SA-CONTRIB-2026-092

The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466s-becoming-owner-maintainer-or-co-mai...