Ffmpeg Image Toolkit - Highly critical - Remote Code Execution - SA-CONTRIB-2026-220

This module enables you to use ffmpeg for image conversion The module doesn't sufficiently sanitize file names passed to the ffmpeg cli tool. This vulnerability is mitigated by the fact that an attacker must be able to upload images on the site...

Swiper formatter - Moderately critical - Information disclosure - SA-CONTRIB-2026-233

Swiper is mobile first, layout and gestures wise, it provides great amount of options for designing your own widget and related events. This module provides a route for displaying published content entities in a dialog. The route does not sufficiently verify the current user's access to the...

Block Attributes - Moderately critical - Cross site Scripting - SA-CONTRIB-2026-232

This module allows you to define custom attributes for a block. You can specify an attribute name to be added to the block in a predefined format. The module does not sufficiently sanitize attributes against cross site scripting. This issue is mitigated by the fact that the attacker must have the...

Sector Distribution - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-229

Sector is a distribution targeted towards Drupal site builders and site owners who are looking for a fully configured Drupal project out of the box. A module specific to this distribution doesn't sufficiently sanitize media names, potentially leading to an XSS exploit. This vulnerability is...

PT-2026-120908

This theme provides a front-end design for transparency and open-government sites, including a table preview of CSV files attached to content. The theme doesn't sufficiently check file access when it renders that preview. It reads the file directly, so a visitor who may view the content, but whos...

PT-2026-120912

This module allows granting access to unpublished nodes per content type. For nodes with at least one unpublished translation, the module grants every user with the "access content" permission view access to the published translations of that node. This overrides the restrictions of other node...

USWDS Paragraph Components - Moderately critical - Cross site scripting - SA-CONTRIB-2026-234

This module provides a suite of Paragraphs bundles that works within the USWDS framework. The module's twig templates do not sufficiently sanitize values passed to its markup. This vulnerability is mitigated by the fact that an attacker must have a role to edit content that uses the paragraph...

DocCheck Basic - Moderately critical - Access bypass - SA-CONTRIB-2026-237

This module allows healthcare professionals to log in to a shared account on the Drupal website using their DocCheck credentials. The module doesn't sufficiently verify the authentication data with DocCheck API in some cases...

Dopup - Critical - Information disclosure - SA-CONTRIB-2026-227

The Dopup module provides functionality for selecting and working with Webforms. The module does not perform sufficient entity access checking in some cases and may expose the title of private Webforms...

CSV Field - Moderately critical - Cross site Scripting - SA-CONTRIB-2026-226

This module enables you to upload CSV files to a field and display them as an interactive, sortable and searchable table. The module doesn't sufficiently escape CSV cell and header values before passing them to the DataTables library, leading to a potential cross-site scripting vulnerability. Thi...

Swiper formatter - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-228

The module provides integration with third party JS library SwiperJs. User-entered text is used as part of the slide without appropriate filtering leading to a cross-site scripting XSS vulnerability. This vulnerability is mitigated by the fact that an attacker would need a role with permission to...

UI Icons - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-230

This module provides a user interface to select and configure icons, including a CKEditor 5 button and widget that embed an icon in formatted text. Under uncommon situations, the CKEditor 5 widget displays admin-controlled text with appropriate filtering leading to a Cross-site scripting XSS...

PT-2026-120916

This module lets non-administrators approve, deactivate and delete users, limited by the roles they can delegate through Role Delegation. The module doesn't sufficiently check role delegation when approving users, and offers an Activate link for blocked administrators. It also doesn't protect use...

PT-2026-120905

The Dopup module provides functionality for selecting and working with Webforms. The module does not perform sufficient entity access checking in some cases and may expose the title of private Webforms...

Linux Distros Unpatched Vulnerability : CVE-2026-109252

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP from 3.9.0 before 3.32.0 contains a NULL pointer dereference vulnerability in the RDPEAR NDR reader that allows malicious servers to crash clients via...

SUSE SLES15: apache2-mod_php8 / php8 / php8-bcmath / php8-bz2 / php8-calendar / etc (SUSE-SU-2026:4602-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4602-1 advisory. - CVE-2025-1218: php: php: Denial of Service via out-of-bounds read in mysqlnd wire protocol parser bsc1282981. - CVE-2025-14181:...

SUSE SLES15 Security Update : golang-github-prometheus-prometheus (SUSE-SU-2026:4606-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4606-1 advisory. golang-github-prometheus-prometheus was updated to version 3.13.2: - Security issues: CVE-2026-39821: Fixed validation bypass and privilege...

Linux Distros Unpatched Vulnerability : CVE-2026-109254

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP 2.1.0 before 3.32.0 contains a use-after-free vulnerability in the static rdpsnd channel disconnect path, which frees audio formats and device without...

Unity Linux 20.1070a Security Update: python3.11 (UTSA-2026-141791)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-141791 advisory. There is a MEDIUM severity vulnerability affecting CPython. The email module didnt properly quote newlines for email headers when serializing an email message allowi...

Linux kernel Host1x DoS

The vulnerability of the host1xdeviceadd function in the drivers/gpu/host1x/bus.c kernel module of the Linux operating system is related to errors during link counter updates. Exploiting this vulnerability could allow an attacker to cause a service failure...