Cross Site Request Forgery vulnerability in Drupal Core Form API does not properly handle certain form input from cross-site requests, which can lead to other vulnerabilities

Arbitrary PHP code execution vulnerability in Drupal Core under certain circumstances

The User module in Drupal 7.x before 7.44 allows remote authenticated users to gain privileges via vectors involving contributed or custom code that triggers a rebuild of the user…

Edit in-place field - Moderately critical - Access bypass - SA-CONTRIB-2026-093

Tealium iQ Tag Management - Critical - PHP object injection - SA-CONTRIB-2026-064

Plotly.js Graphing - Critical - PHP object injection - SA-CONTRIB-2026-050

Flag attendance field - Critical - PHP object injection - SA-CONTRIB-2026-049

A vulnerability in Drupal Core allows Privilege Escalation.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8

Guzzle is a PHP HTTP client

In Drupal versions 8.4.x versions before 8.4.5 when using node access controls with a multilingual site, Drupal marks the untranslated version of a node as the default fallback…

In Drupal versions 8.4.x versions before 8.4.5 users with permission to post comments are able to view content and comments they do not have access to, and are also able to add…

A 3rd party development library including with Drupal 8 development dependencies is vulnerable to remote code execution

PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect applications from the presence of untrusted client data in…

Drupal 6.x before 6.38, when used with PHP before 5.4.45, 5.5.x before 5.5.29, or 5.6.x before 5.6.13, might allow remote attackers to execute arbitrary code via vectors related…

The User module in Drupal 6.x before 6.38 and 7.x before 7.43 allows remote attackers to gain privileges by leveraging contributed or custom code that calls the user_save function…

The File module in Drupal 7.x before 7.43 and 8.x before 8.0.4 allows remote authenticated users to bypass access restrictions and read, delete, or substitute a link to a file…

third-party PEAR Archive_Tar library updates

Archive_Tar through 1.4.10 allows an unserialization attack because phar: is blocked but PHAR: is not blocked

Webform - Less critical - Denial of service - SA-CONTRIB-2026-170

Token Content Access - Moderately critical - Access bypass - SA-CONTRIB-2026-090

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection.This issue affects Drupal core: from…

File Entity (fieldable files) - Moderately critical - Information Disclosure - SA-CONTRIB-2024-040

Opigno TinCan Question Type - Critical - Arbitrary PHP code execution - SA-CONTRIB-2024-031

Opigno Learning path - Critical - Arbitrary PHP code execution - SA-CONTRIB-2024-029

Image Sizes - Moderately critical - Access bypass - SA-CONTRIB-2024-023

Email Contact - Moderately critical - Access bypass - SA-CONTRIB-2024-020

RESTful Web Services - Critical - Access bypass - SA-CONTRIB-2024-019

REST Views - Moderately critical - Information Disclosure - SA-CONTRIB-2024-018

Open Social - Moderately critical - Access bypass - SA-CONTRIB-2024-004

A vulnerability in Drupal Core allows Excessive Allocation.This issue affects Drupal Core: from 10.2.0 before 10.2.2, from 10.1.0 before 10.1.8

Drupal contains a vulnerability with improper handling of structural elements

In certain scenarios, Drupal's JSON:API module will output error backtraces

In some situations, the Image module does not correctly check access to image files not stored in the standard public files directory when generating derivative images using the…

Drupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to improper input validation

Twig is a template language for PHP

Guzzle is an open source PHP HTTP client

Guzzle is an open source PHP HTTP client

guzzlehttp/psr7 is a PSR-7 HTTP message library

CKEditor4 is an open source what-you-see-is-what-you-get HTML editor

Drupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to improper input validation

Under some circumstances, the Drupal core JSON:API module does not properly restrict access to certain content, which may result in unintended access bypass

Information Disclosure vulnerability in file module of Drupal Core allows an attacker to gain access to the file metadata of a permanent private file that they do not have access…

An access bypass issue was found in Drupal 7.x before version 7.5

In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, a vulnerability would allow an attacker to authenticate as a…

Drupal 8 before 8.2.8 and 8.3 before 8.3.1 allows critical access bypass by authenticated users if the RESTful Web Services (rest) module is enabled and the site allows PATCH…

Some administrative paths in Drupal 8.2.x before 8.2.7 did not include protection for CSRF

When adding a private file via the editor in Drupal 8.2.x before 8.2.7, the editor will not correctly check access for the file being attached, resulting in an access bypass

The user password reset form in Drupal 8.x before 8.2.3 allows remote attackers to conduct cache poisoning attacks by leveraging failure to specify a correct cache context

The Form API in Drupal 6.x before 6.38 ignores access restrictions on submit buttons, which might allow remote attackers to bypass intended access restrictions by leveraging…

The XML-RPC system in Drupal 6.x before 6.38 and 7.x before 7.43 might make it easier for remote attackers to conduct brute-force attacks via a large number of calls made at once…