Jsonapi Role Access - Critical - Access bypass - SA-CONTRIB-2026-127

This module enables you to restrict access to JSON:API routes based on specific user roles. The module doesn't sufficiently enforce access controls under scenarios where a request mimics an XMLHttpRequest...

CVE-2023-20577: Stack-based Buffer Overflow

A heap overflow in SMM module may allow an attacker with access to a second vulnerability that enables writing to SPI flash, potentially resulting in arbitrary code execution...

CVE-2026-12526: Improper Authentication

The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 does not verify that the requester is authorized to edit the targeted user account in the update-user action of its front-end Forms module; it only checks a capability when the submitted role is administrator or superadmin. On a...

angie-module-njs -- multiple vulnerabilities

The njs development team reports: Access control bypass in jsaccess when an asynchronous request body continuation threw an exception or produced an unhandled rejection CVE-2026-18329. Previously, nginx could continue processing the request as though the jsaccess check had succeeded. Affects...

njs -- heap buffer overflow in XML exclusive canonicalization

F5 reports: A flaw in the NGINX JavaScript XML module allows an out-of-bounds write when xml.exclusiveC14n processes a crafted XML namespace prefix list. This may lead to worker process crashes, heap corruption or memory disclosure. The NGINX SAML reference implementation is affected because it...

PT-2026-84899

Name of the Vulnerable Software and Affected Versions Drupal Email Verification / SMS Verification / OTP Verification versions 0.0.0 through 2.4.0 Description An unauthenticated reflected Cross-site Scripting XSS issue exists because the module does not sufficiently filter user-supplied input...

PT-2026-84886

Name of the Vulnerable Software and Affected Versions Drupal Advanced Search versions 0.0.0 through 2.4.5 Description A missing authorization issue allows forceful browsing. The module fails to sufficiently verify block access when arbitrary block IDs are submitted to its publicly accessible AJAX...

Media Library Importer - Moderately critical - Access bypass - SA-CONTRIB-2026-129

A module to import media files into media library. The import folder is a plain textfield with no validation. Point it at any directory the web user can read, and the importer copies every file whose extension matches a selected media type into the public files directory and publishes it as a Med...

Unpublished Node Permissions - Critical - Access bypass - SA-CONTRIB-2026-132

This module creates permissions per node content type to control access to unpublished content. The module has allowed view access for published content, overriding other access mechanisms that might have been in place...

PT-2026-84891

Name of the Vulnerable Software and Affected Versions Component blocks versions 0.0.0 through 1.2.7 Description Stored Cross-site Scripting XSS occurs because the module does not sufficiently validate user input before passing it to token replacement. This issue requires the attacker to possess a...

Email Verification / SMS Verification / OTP Verification - Critical - Access Bypass - SA-CONTRIB-2026-124

This module enables you to add extra layer of verification for user registration. The module doesn't sufficiently validate user-supplied input resulting in an account takeover vulnerability...

MiracleLinux 9 : nginx-1.20.1-28.el9_8.5.ML.1 (AXSA:2026-1735:07)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1735:07 advisory. nginx: NGINX: Heap buffer over-read allows memory modification or denial of service CVE-2026-56434 nginx: NGINX: Memory disclosure and denial of...

PT-2026-84893

Name of the Vulnerable Software and Affected Versions Jsonapi Role Access versions 0.0.0 through 2.0.2 Description An incorrect authorization issue exists in the module used to restrict access to JSON:API routes based on user roles. The module fails to sufficiently enforce access controls when a...

Unity Linux 20.1070-8ae / 20.1070e Security Update: kernel (UTSA-2026-105424)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-105424 advisory. In the Linux kernel, the following vulnerability has been resolved: MIPS: vpe-mt: fix possible memory leak while module exiting Afer commit 1fa5ae857bb1 driver core:...

PhotoSwipe - Responsive JavaScript Modal Image Gallery - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-131

This module enables you to add dynamic caption support to PhotoSwipe image galleries. The module doesn't sufficiently sanitize user-supplied input such as image alt tags in its dynamic caption script, leading to a Cross-Site Scripting XSS vulnerability. This vulnerability is mitigated by the fact...

snuffleupagus v0.14.0

Snuffleupagus Security module for php7 and php8 - Killing bugclasses and virtual-patching the rest! Key Features • Download • Examples • Documentation • License • Thanks Snuffleupagus is a PHP 7+ and 8+ module designed to drastically raise the cost of attacks against websites, by killing entire b...

CVE-2026-81928 Net::DNS versions before 1.57 for Perl allow memory exhaustion via unbounded recursion in sig_data when re-encoding a message with a misplaced TSIG record

Net::DNS versions before 1.57 for Perl allow memory exhaustion via unbounded recursion in sigdata when re-encoding a message with a misplaced TSIG record. sigdata signs a message by re-encoding it, and removes TSIG records only from the additional section. A TSIG decoded into the answer or...

CVE-2026-73750

Vulnerabilities exist in the authentication module that may improperly process malformed or truncated input. An authenticated remote attacker could exploit these vulnerabilities by providing specially crafted input from a compromised or hostile authentication server. Successful exploitation could...

CVE-2026-73524

Cypht before 2.12.2 contains a cross-site scripting vulnerability in the contacts module that allows remote attackers to execute arbitrary script content by embedding malicious payloads within angle brackets in the FROM email header. The sanitization logic removes only the first occurrence of eac...

CVE-2026-73524

CVE-2026-73524 is a cross-site scripting (XSS) vulnerability in Cypht (versions before 2.12.2 ), located in the contacts module . The root cause is a flawed sanitization routine that removes only the first occurrence of each angle bracket character, leaving additional angle brackets intact. An at...