DRUPAL-CONTRIB-2026-315

The htmLawed module enables use of the htmLawed PHP library as a filter in a Text Format for restriction/filtering of HTML in textual input. The htmLawed filter does not sufficiently filter attributes, leading to a cross-site scripting XSS vulnerability. This vulnerability affects sites on Drupal...

DRUPAL-CONTRIB-2026-314

The htmLawed module enables use of the htmLawed PHP library as a filter in a Text Format for restriction/filtering of HTML in textual input. The module's filtering of malicious HTML can be bypassed by using a malformed UTF8 character, leading to a cross-site scripting XSS vulnerability. Only site...

DRUPAL-CONTRIB-2026-313

Islandora does not sufficiently check file update access when processing media source and derivative uploads. A user with permission to update media or create derivatives can submit a crafted request to overwrite files they are not authorized to modify, including private files. The Islandora Text...

DRUPAL-CONTRIB-2026-312

The Mime Mail module gives Drupal sites the ability to send HTML email messages. Under rare site configuration conditions, a user with the ability to send HTML emails could send non-public data that had been uploaded to the files directory, This vulnerability is mitigated by the fact the attacker...

DRUPAL-CONTRIB-2026-311

This module integrates the Site Catalyst or AdobeAnalytics software into a Drupal site. The module does not sufficiently provide access controls for advanced functionality, which exposes a cross-site scripting XSS vulnerability. This vulnerability is mitigated by the fact that an attacker must ha...

DRUPAL-CONTRIB-2026-310

The WordsOnline Connector module integrates Drupal with the WordsOnline translation service through the TMGMT module. The module doesn't properly validate data, resulting in an SQL Injection vulnerability. An attacker can use this to read data from the Drupal database, including user account data...

DRUPAL-CONTRIB-2026-309

The Extended HTML Filter module allows using style attributes in CKEditor. The module XSS filter does not sufficiently sanitize certain HTMX attributes, which can lead to a cross-site scripting XSS vulnerability. The vulnerability is mitigated by the fact an attacker must be able to insert HTML...

DRUPAL-CONTRIB-2026-308

The Allowed Languages module makes it possible to set restrictions on which content a user can edit based on language. The module doesn't sufficiently protect against using a disallowed language during content creation. This is mitigated by the fact that the user must have access to create conten...

DRUPAL-CONTRIB-2026-307

This module provides a separate page with a form for users to change their own password, which asks for the current password before accepting a new one. The module doesn't sufficiently verify the current password in some cases. This vulnerability is mitigated by the fact that an attacker must...

DRUPAL-CONTRIB-2026-306

This module enables you to schedule content to be published or unpublished at a certain time in the future. The module doesn't sufficiently check if a user has permission to change publication or unpublication dates. This might cause certain information to be publicly disclosed ahead of the...

DRUPAL-CONTRIB-2026-305

This module enables you to reset passwords via one time passcode to email or SMS rather than reset password links. The module doesn't sufficiently validate resetting passwords for blocked users. This vulnerability is mitigated by the fact that someone with appropriate permissions must unblock the...

DRUPAL-CONTRIB-2026-304

The Name Field module provides a field for storing a personal name as separate components. The module does not sufficiently sanitize values under some circumstances. A name stored on the field can be interpreted as HTML, which can lead to a cross-site scripting XSS vulnerability...

DRUPAL-CONTRIB-2026-303

This module allows forums to be set private and to be given moderators. The module doesn't sufficiently check access for creating forum topics in private forums. As a result, a user can post new topics in a forum where they should only have view access. This vulnerability is mitigated by the fact...

DRUPAL-CONTRIB-2026-302

This module enables you to accept payments through Escrow.com with Drupal Commerce. The module doesn't sufficiently verify incoming Escrow.com webhook notifications. An attacker can forge payment and order status updates, marking unpaid orders as paid or completed, or cancelling orders that are i...

DRUPAL-CONTRIB-2026-301

This module lets customers replace an item in their cart with one of the alternative product variations listed for it. The module does not check that a cart belongs to the current visitor when the visitor is not logged in. An anonymous visitor can view items in other anonymous visitors' carts,...

DRUPAL-CONTRIB-2026-300

The AlternativeCommerce PayPal Checkout module provides an AlternativeCommerce method to embed payment services from PayPal. The module does not sufficiently validate incoming PayPal webhook requests. An unauthenticated attacker can submit a crafted request that references a payment record, causi...

DRUPAL-CONTRIB-2026-299

This module enables you to add syntax-highlighted code snippets to content using CKEditor 5. The module doesn't sufficiently validate input passed to its CKEditor 5 preview endpoint, leading to a reflected cross-site scripting XSS vulnerability...

DRUPAL-CONTRIB-2026-298

The REST & JSON API Authentication module provides API authentication for Drupal sites. The module does not properly reject requests when an API key is unconfigured, allowing unauthenticated attackers to bypass authentication and potentially access or modify protected resources. Sites are affecte...

DRUPAL-CONTRIB-2026-297

This module enables you to send messages "Notifications" to users upon a certain Workflow state change. The module doesn't sufficiently protect the Notification settings page where an attacker can make unauthorized changes...

DRUPAL-CONTRIB-2026-296

This module introduces an OAuth 2.0 authorization server, which can be configured to protect your Drupal instance with access tokens, or allow clients to request new access tokens and refresh them. The module doesn't sufficiently restrict access to consumer configuration. Users who can create or...

DRUPAL-CONTRIB-2026-295

This module enables you to upload files from the browser directly to Amazon S3 and register them as Drupal files, bypassing normal PHP file size and timeout limits. The module doesn't sufficiently check access to file uploads. Under certain scenarios, users can delete files they should not have...

DRUPAL-CONTRIB-2026-294

The Content Synchronizer module allows content to be exported and imported between Drupal sites via uploaded archive files. The module doesn't sufficiently sanitize input passed to its client-side code, leading to a DOM-based cross-site scripting XSS vulnerability...

DRUPAL-CONTRIB-2026-293

The Content Synchronizer module allows content to be exported and imported between Drupal sites via uploaded archive files. A maliciously crafted import file can cause untrusted data to be deserialized PHP Object Injection, CWE-502, potentially leading to remote code execution...

DRUPAL-CONTRIB-2026-278

Integration with GroupEx PRO system, decoupled from Open Y. The module does not sufficiently validate user inputs in some scenarios, potentially leading to arbitrary remote code execution. Note: This project was marked as Unsupported by the Drupal Security Team on 2026-10-28 but a fix was release...

DRUPAL-CONTRIB-2026-292

This module allows for direct viewing of a file with the URL alias. This is a followup advisory to SA-CONTRIB-2026-245, which did not fully resolve the underlying vulnerability. In some cases, files may be served with the HTTP header Cache-Control: public when they should be uncacheable. This can...

DRUPAL-CONTRIB-2026-291

This module enables you to share and reuse content across websites. The module did not sufficiently encrypt the password of the system user used when synchronizing content. This can potentially allow unprivileged users to view the password. This vulnerability is mitigated by the fact that an...

DRUPAL-CONTRIB-2026-290

This module lets you manage system-wide OAuth2 access and refresh tokens for Box, Quip, and Slack integrations through Drush and an OAuth2 validation callback. The module doesn't restrict access to its OAuth2 routes, allowing an an anonymous visitor to potentially connect the site's integration t...

DRUPAL-CONTRIB-2026-289

The Field Permissions module enables you to set field-level permissions for viewing and editing fields, including a "Private" setting. The module does not sufficiently restrict access to "Private" fields on entity types that have no field for an author user account or owner. As a result, a field...

DRUPAL-CONTRIB-2026-288

This module enables you to set field-level permissions to create, update or view individual fields. The module does not sufficiently verify administrative privileges when checking access to protected fields, potentially allowing users with a role named administrator to bypass field-level access...

DRUPAL-CONTRIB-2026-287

The module enables authentication via the OpenID Connect oAuth2 protocol. When a new user logs in via OpenID Connect, the module tries to link the user to an existing account with the same email address. Doing so it allows to take over any existing Drupal account except user 1 that has not yet be...

DRUPAL-CONTRIB-2026-286

Stage File Proxy is a general solution for getting production files on a development server on demand. It is not intended for usage on production sites. The module doesn't sufficiently check file URL for malicious content when attempting to do fallback retrieval leading to a cross-site scripting...

DRUPAL-CONTRIB-2026-285

This module enables users to create and save signatures as SVG images. The module did not sufficiently sanitize user-supplied content before saving it to the public file system. Under certain scenarios, a maliciously crafted file could contain active or otherwise unsafe content and may result in ...

DRUPAL-CONTRIB-2026-284

This module enables you to log in to your Drupal site using any OAuth 2.0 or OpenID Connect compliant identity provider. The module doesn't sufficiently check access on a configuration route, or check whether the identity provider has verified the email address it returns. Together, these let an...

DRUPAL-CONTRIB-2026-280

This module provides a bulk form for assigning or removing roles on multiple user accounts at once. The bulk update form does not prevent access to users who do not have permission to assign roles. This vulnerability is mitigated by the fact that an attacker must have a role with the permission...

DRUPAL-CONTRIB-2026-279

S3 File System s3fs provides an additional file system to your Drupal site that stores files in Amazon's Simple Storage Service S3 storage. The module doesn't sufficiently isolate upload context between separate objectfile operations in the same request resulting in the potential for objects to b...

DRUPAL-CONTRIB-2026-283

This module enables you to quickly toggle the publication status, promotion and stickiness of nodes, and the publication status of comments, from links on the page. The module doesn't sufficiently protect against cross-site request forgery CSRF on its toggle URL, under the scenario where a user...

DRUPAL-CONTRIB-2026-282

This module enables you to quickly toggle the publication status, promotion and stickiness of nodes, and the publication status of comments, from links on the page. The module doesn't sufficiently check access to the entity being toggled, under the scenario where a user with the "Use Fasttoggle"...

DRUPAL-CONTRIB-2026-281

The CAPTCHA module places a configurable challenge on forms to block automated submissions. To skip the challenge on later steps of the same multi-step form, the module remembers that a CAPTCHA session has been solved. The module does not fully invalidate a solved CAPTCHA session. As a result, a...

DRUPAL-CONTRIB-2026-277

The Drupal Security Team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, read the documentation on becoming the maintainer of a project that is unsupported for security...

DRUPAL-CONTRIB-2026-276

The Drupal Security Team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, read the documentation on becoming the maintainer of a project that is unsupported for security...

DRUPAL-CONTRIB-2026-275

Single Content Sync enables exporting and importing content, referenced entities, and files between Drupal sites. A maliciously crafted import file can cause untrusted data to be deserialized, potentially leading to remote code execution. This vulnerability is mitigated by the fact that an attack...

DRUPAL-CONTRIB-2026-274

Single Content Sync enables exporting and importing content, referenced entities, and files between Drupal sites. The module does not sufficiently validate file sources and destinations during content imports. An attacker can write arbitrary files, disclose sensitive local files accessible to the...

DRUPAL-CONTRIB-2026-273

The AI module includes a submodule, AI Automator. This submodule allows you to automatically fill out fields using AI, based on other fields. The module doesn't sufficiently check access to text formats, allowing users to author field data in text formats they should not have access to...

DRUPAL-CONTRIB-2026-272

This module provides a framework for integrating AI providers and features into Drupal. The module doesn't sufficiently sanitize certain HTMX attributes, which can lead to a cross-site scripting XSS vulnerability...

DRUPAL-CONTRIB-2026-271

This module provides a framework for integrating AI providers and features into Drupal. Audio for every speech-to-text request is written to the same file in the temporary directory and does not delete it afterwards. As a result, an attacker who can read the site's temporary directory could get t...

DRUPAL-CONTRIB-2026-270

This module provides a framework for integrating Drupal with AI providers. Its AI Search submodule provides a Search API backend that stores content in a vector database for semantic search. The AI Search submodule has always been marked as 'experimental' but more importantly is deprecated. You m...

DRUPAL-CONTRIB-2026-269

This AI module enables you to interact with AI providers. It has a service that helps any consumer of the module to stop cross site scripting elements from appearing. The module does not sufficiently validate Markdown links under certain conditions, potentially allowing cross-site scripting XSS...

DRUPAL-CONTRIB-2026-268

This module enables you to use AI on the website. It also enables you to interact with AI providers. The module does not sufficiently validate links under certain conditions, potentially allowing the exfiltration of sensitive information to external sites. This vulnerability is mitigated by the...

DRUPAL-CONTRIB-2026-267

This module enables you to use AI on the website. It includes an AI Chatbot submodule allows you to setup a chatbot. Under certain configurations, the chatbot does not sufficiently filter user input before rendering it, potentially allowing cross-site scripting XSS. This vulnerability is mitigate...

DRUPAL-CONTRIB-2026-266

This module enables you to use AI on the website. The module does not sufficiently restrict HTML rendering, allowing cross-site scripting XSS under certain conditions. This vulnerability is mitigated by the fact that an attacker must have access to a text format that can render HTML...