105 matches found
DRUPAL-CONTRIB-2026-227
The Dopup module provides functionality for selecting and working with Webforms. The module does not perform sufficient entity access checking in some cases and may expose the title of private Webforms...
PT-2026-120905
The Dopup module provides functionality for selecting and working with Webforms. The module does not perform sufficient entity access checking in some cases and may expose the title of private Webforms...
DRUPAL-CONTRIB-2026-210
This module adds a "Generate internal links" action to the AI CKEditor toolbar, letting editors select text and have the module search the site's content for relevant pages to link to. The module's search query did not respect entity access when returning results to the browser. This vulnerabilit...
DRUPAL-CONTRIB-2026-206
This module enables you to audit a Drupal site by generating reports about its content, entities, display modes and configuration. The module doesn't sufficiently check entity access when rendering an entity through the display-mode example route. This allows an attacker to view unpublished or...
PT-2026-107761
This module adds a "Generate internal links" action to the AI CKEditor toolbar, letting editors select text and have the module search the site's content for relevant pages to link to. The module's search query did not respect entity access when returning results to the browser. This vulnerabilit...
PT-2026-107770
This module enables you to audit a Drupal site by generating reports about its content, entities, display modes and configuration. The module doesn't sufficiently check entity access when rendering an entity through the display-mode example route. This allows an attacker to view unpublished or...
CVE-2026-18423 Concrete CMS 9.0.0 through 9.5.2 is vulnerable to Insecure direct object reference (IDOR) in the Express saved search preset delete and edit dialogs allowing an authenticated user with permission on one Express entity to delete or rename saved search pres
Concrete CMS 9.0.0 through 9.5.2 is vulnerable to Insecure direct object reference IDOR in the Express saved search preset delete and edit dialogs . An authenticated user holding only view permission on a single Express entity could therefore permanently delete, with no undo, or rename saved sear...
CVE-2026-68529 Concrete CMS 9.0.0 through 9.5.2 us missing authorization in the Express entries advanced-search dashboard action allowing a low-privileged user to read other entities' Express entries
Concrete CMS 9.0.0 through 9.5.2 was missing an authorization check on the Express entries advanced-search dashboard action. The advancedsearch method in DashboardSelectableExpressEntryListTrait resolved an Express entity directly from a user-supplied entity ID and rendered that entity's entries...
Malicious code in gatorhelper (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 54f5990a3f959ce168ab7ece44797a63a5a61024f2783572d773da2381b47e88 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
CVE-2026-45071
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, Crawler::addXmlContent set DOMDocument::$validateOnParse = true before loadXML, re-enabling external entity resolution and allowing attacker-supplied XML ...
Malicious code in tailwindcss-animates-css (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f7250854be2f2ab8b43e62611a704a3c31d3f42180356e61955b4fc30fd2bcf4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
WS-2022-0118
Drupal 9.3 implemented a generic entity access API for entity revisions. However, this API was not completely integrated with existing permissions, resulting in some possible access bypass for users who have access to use revisions of content generally, but who do not have access to individual...
Malicious code in levex-press (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f33c109f544ebe960d2fe2880abba71a8abbbcfc1b8042ca5c5d5d9e6ac6b557 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-854 Malicious code in sinon-node (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9c9ac1d9ff3647908703db921b2e950e479861f18e7b1bad8377baaa7400d32c The package sinon-node was found to contain malicious code. Source: ghsa-malware 5aa93130bd1915120b30dc2472c774ac984ea2c2166d7865d30fdf8343225f50 Any...
EUVD-2012-2297
Malware in sbrugna...
EUVD-2022-3687
Malicious code in bioql PyPI...
EUVD-2022-0877
Malicious code in bioql PyPI...
Linux Distros Unpatched Vulnerability : CVE-2023-6194
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Eclipse Memory Analyzer versions 0.7 to 1.14.0, report definition XML files are not filtered to prohibit document type definition DTD references to external...
DRUPAL-CONTRIB-2025-093
This module enables you to access an edit page for a config page. The module doesn't sufficiently check the access permissions hookENTITYTYPEaccess wasn't taken into account. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "edit ID config page" an...