Drupal Security
Entity Browser - Moderately critical - Cross site scripting - SA-CONTRIB-2026-094
The Entity Browser module allows you to select entities from entity reference fields using a custom entity browser widget.
The module doesn't sufficiently sanitize the the tab titles, resulting in a stored cross-site scripting (XSS) vulnerability.
The vulnerability is mitigated by the fact an attacker must be able to insert HTML with specific attributes on a page that is displaying an entity browser.
Solution:Install the latest version:
- If you use the Entity Browser module, upgrade to Entity Browser 8.x-2.16
- Pierre Rudloff (prudloff) of the Drupal Security Team
- Julian Pustkuchen (anybody)
- Sascha Grossenbacher (berdir)
- Pierre Rudloff (prudloff) of the Drupal Security Team
- Greg Knaddison (greggles) of the Drupal Security Team
- Drew Webber (mcdruid) of the Drupal Security Team
- Pierre Rudloff (prudloff) of the Drupal Security Team
Edit in-place field - Moderately critical - Access bypass - SA-CONTRIB-2026-093
This module provides formatters to allow in-place editing in a View or other display (full content, teaser...).
The module doesn't sufficiently check access when editing entities. A malicious user could craft requests to allow them to modify any field on any entity.
This vulnerability is mitigated by the fact that an attacker must have a role with the permission "edit in place field editing permission".
Solution:Install the latest version:
- If you use the Edit in-place field module for Drupal, upgrade to 2.1.1
- Drew Webber (mcdruid) of the Drupal Security Team
- Neil Drumm (drumm) of the Drupal Security Team
- Greg Knaddison (greggles) of the Drupal Security Team
Powerful Surveys - Critical - Unsupported - SA-CONTRIB-2026-092
The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai...
Solution:If you use this project, you should uninstall it. To take over maintainership, please read https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai...
Disable Login Page - Critical - Unsupported - SA-CONTRIB-2026-091
The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai...
Solution:If you use this project, you should uninstall it. To take over maintainership, please read https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai...
Token Content Access - Moderately critical - Access bypass - SA-CONTRIB-2026-090
The Token Content Access module enables site administrators to provide access to content using access tokens.
The module does not sufficiently protect access token comparison in some cases. This could allow a persistent attacker to use a timing attack to guess a valid access token and bypass access restrictions for content protected by this module.
This vulnerability is mitigated by the fact that an attacker must know or discover a URL for content protected by Token Content Access, and exploiting the issue requires measuring timing differences in token comparison responses.
Solution:Install the latest version:
- If you use the Token Content Access module for Drupal 10.x/11.x, upgrade to Token Content Access 3.1.2
- Bram Driesen (bramdriesen) of the Drupal Security Team
- cilefen (cilefen) of the Drupal Security Team
- Greg Knaddison (greggles) of the Drupal Security Team
- Juraj Nemec (poker10) of the Drupal Security Team
- Swan Kalata (akalata) of the Drupal Security Team
Development Environment - Critical - Unsupported - SA-CONTRIB-2026-089
The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai...
Solution:If you use this project, you should uninstall it. To take over maintainership, please read https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai...
PhotoSwipe - Responsive JavaScript Modal Image Gallery - Moderately critical - Access bypass - SA-CONTRIB-2026-088
The Photoswipe Drupal module provides integration for the widely used PhotoSwipe lightbox library to display / zoom images in lightbox galleries using the provided image formatters.
The module didn't sufficiently check access permissions, when viewing an image using the photoswipe image gallery display formatter, in versions < 3.0.4 (Drupal 8) or < 3.2.0 (Drupal 9 / Drupal 10).
This vulnerability is mitigated by the fact that it only affects sites limiting access to the images shown in photoswipe (the most common use case for photoswipe lightboxes public images).
Solution:Drupal 8 compatible version (3.0x.): Update to version 3.0.4 of the Photoswipe module.
Drupal 9 / Drupal 10 compatible version (3.1.x / 3.2.x): Ensure you're using version 3.2.0 or higher. 3.1.x is deprecated and should not be used anymore.
- cilefen (cilefen) of the Drupal Security Team
- Damien McKenna (damienmckenna) of the Drupal Security Team
- Neil Drumm (drumm) of the Drupal Security Team
- Greg Knaddison (greggles) of the Drupal Security Team
- Juraj Nemec (poker10) of the Drupal Security Team
Webform REST - Moderately critical - Access bypass - SA-CONTRIB-2026-087
This module enables you to retrieve and submit webform submissions via REST endpoints.
The module doesn't sufficiently check the parent webform's permissions for creating, viewing and updating permissions.
This vulnerability is mitigated by the fact that an attacker must already have permissions to use the rest resource.
This advisory only affects already-unsupported versions 4.0.3 and earlier.
Solution:Install the latest version:
- If you use the Webform Rest module for Drupal 8.x, upgrade to Webform Rest 4.1.0
- Version 4.2.0 already has the fix included so no action needed if you use that version
- Dan Chadwick (danchadwick)
- Giuseppe (giuseppe87)
- Jacob Rockowitz (jrockowitz)
- Liam Morland (liam morland)
- Nelson Alves (nsalves)
- Anna Kalata (akalata) of the Drupal Security Team
- cilefen (cilefen) of the Drupal Security Team
- Greg Knaddison (greggles) of the Drupal Security Team
- Michael Hess (mlhess) of the Drupal Security Team
- Juraj Nemec (poker10) of the Drupal Security Team
Security advisory coverage removed - QA Accounts - PSA-2026-07-22
QA Accounts enables you to login to a Drupal site using a well known username/password combination. When 1.0 was released, it also was marked for security coverage. The module prioritizes ease of use rather than security and is only intended to be used on sites that are not accessible on the internet (e.g. behind firewall or other protection). The maintainers are choosing to remove security coverage.
Solution:Ensure qa_accounts is not enabled on any publicly available site.
Reported By: Fixed By:Lunr exposed filters - Critical - Unsupported - SA-CONTRIB-2026-086
The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai...
Solution:If you use this project, you should uninstall it. To take over maintainership, please read https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai...
Email Login OTP - Critical - Unsupported - SA-CONTRIB-2026-085
The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai...
Solution:If you use this project, you should uninstall it. To take over maintainership, please read https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai...
Reported By:- Pierre Rudloff (prudloff) of the Drupal Security Team
Commerce Elavon - Critical - Unsupported - SA-CONTRIB-2026-084
The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai...
Solution:If you use this project, you should uninstall it. To take over maintainership, please read https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai...
PanKM - Critical - Unsupported - SA-CONTRIB-2026-083
The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai...
Solution:If you use this project, you should uninstall it. To take over maintainership, please read https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai...
Search API Autocomplete - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-082
This module enables you to add autocomplete suggestions for search forms created with the Search API module.
The module ships with a test script that is accessible to anonymous users and doesn't sufficiently validate user input, leading to a Cross Site Scripting vulnerability.
This vulnerability is mitigated by the fact that the web server must be configured to display warning messages to users.
Solution:Install the latest version:
- If you use the Search API Autocomplete module, upgrade to Search API Autocomplete 8.x-1.12
Another option for sites unable to update is to set display_errors: off in php.ini (or similar settings) to disable the exploit.
Reported By: Fixed By: Coordinated By:- Greg Knaddison (greggles) of the Drupal Security Team
- Lee Rowlands (larowlan) of the Drupal Security Team
- Drew Webber (mcdruid) of the Drupal Security Team
- Juraj Nemec (poker10) of the Drupal Security Team
Internationalization Single Sign-On - Critical - Access bypass - SA-CONTRIB-2026-081
In a scenario of a multilingual website with different domain names per language, this module enables you to be automatically connected across the language domains if you are logged on the main language domain.
The module doesn't sufficiently validate a short-lived token, allowing an attacker to bypass access control and authenticate as a victim user.
This vulnerability is mitigated by the fact that an attacker must appear to originate from the same client IP as the victim.
Solution:Install the latest version:
- If you use the Internationalization Single Sign-On module upgrade to i18n_sso 8.x-1.8
- Drew Webber (mcdruid) of the Drupal Security Team
- Florent Torregrosa (grimreaper)
- Drew Webber (mcdruid) of the Drupal Security Team
- Bram Driesen (bramdriesen) of the Drupal Security Team
- Greg Knaddison (greggles) of the Drupal Security Team
- Drew Webber (mcdruid) of the Drupal Security Team
- Juraj Nemec (poker10) of the Drupal Security Team
Media Folders - Moderately critical - Cross site scripting - SA-CONTRIB-2026-080
This module provides a better UI for managing and selecting Media entities in a folder structure.
The module doesn't sufficiently sanitize the names and descriptions of media items and folders when they are displayed in the media browser, resulting in a stored cross-site scripting (XSS) vulnerability.
This vulnerability is mitigated by the fact that an attacker must have a role with permission to create or edit media items or folders.
Solution:Install the latest version:
- If you use the Media Folders module, upgrade to Media Folder 1.0.8
- Drew Webber (mcdruid) of the Drupal Security Team
- Juraj Nemec (poker10) of the Drupal Security Team
Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-012
The Layout Builder module doesn't sufficiently sanitize block labels in certain scenarios, which can lead to a cross-site scripting (XSS) vulnerability.
This is mitigated by the fact that both the attacker and the targeted user need to be using the Layout Builder editing interface.
Solution:Install the latest version:
Drupal 11
- If you use Drupal 11.4.x, update to Drupal 11.4.4.
- If you use Drupal 11.3.x, update to Drupal 11.3.14.
- Drupal 11.2.x and below are end-of-life and do not receive security coverage.
Drupal 10
- If you use Drupal 10.6.x, update to Drupal 10.6.13.
- Drupal 10.5.x and below are end-of-life and do not receive security coverage.
Drupal 8 and Drupal 9 have both reached end-of-life.
Reported By: Fixed By:- danielveza
- Lee Rowlands (larowlan) of the Drupal Security Team
- Mingsong (mingsong) provisional member of the Drupal Security Team
- James Gilliland (neclimdul) of the Drupal Security Team
- Greg Knaddison (greggles) of the Drupal Security Team
- Lee Rowlands (larowlan) of the Drupal Security Team
- Dave Long (longwave) of the Drupal Security Team
- Jess (xjm) of the Drupal Security Team
Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-011
Drupal core 11.2 and above integrate the HTMX JavaScript library.
Drupal core's XSS filter does not sufficiently sanitize certain HTMX attributes, which can lead to a cross-site scripting (XSS) vulnerability.
The vulnerability is mitigated by the fact an attacker must be able to insert HTML with specific attributes.
Solution:Install the latest version:
Drupal 11
- If you use Drupal 11.4.x, update to Drupal 11.4.4.
- If you use Drupal 11.3.x, update to Drupal 11.3.14.
- Drupal 11.2.x and below are end-of-life and do not receive security coverage.
Drupal 10
- Drupal 10 core is not affected. However, certain contributed modules may be affected, so a Drupal 10.6 fix is included as hardening.
Drupal 8 and Drupal 9 have both reached end-of-life.
Reported By:- Pierre Rudloff (prudloff) of the Drupal Security Team
- Shawn Duncan (fathershawn)
- Pierre Rudloff (prudloff) of the Drupal Security Team
- catch (catch) of the Drupal Security Team
- Lee Rowlands (larowlan) of the Drupal Security Team
- Dave Long (longwave) of the Drupal Security Team
- Jess (xjm) of the Drupal Security Team
Drupal core - Moderately critical - Information disclosure - SA-CORE-2026-010
The Image module allows you to define and configure image fields.
The module doesn't sufficiently check access to image style derivatives when those files are served via a file stream other than private://.
This vulnerability is mitigated by the fact that Drupal must be configured to use a contributed (non-core) file scheme to serve private derived images.
Information disclosure issues like this one are not generally given security advisories (as described in PSA-2023-07-12)). This fix is provided as a hardening. Contributed modules implementing custom stream wrappers may need to add similar hardenings.
Solution:Install the latest version:
Drupal 11
- If you use Drupal 11.4.x, update to Drupal 11.4.4.
- If you use Drupal 11.3.x, update to Drupal 11.3.14.
- Drupal 11.2.x and below are end-of-life and do not receive security coverage.
Drupal 10
- If you use Drupal 10.6.x, update to Drupal 10.6.13.
- Drupal 10.5.x and below are end-of-life and do not receive security coverage.
Drupal 8 and Drupal 9 have both reached end-of-life.
Reported By: Fixed By:- Benji Fisher (benjifisher) of the Drupal Security Team
- Kim Pepper (kim.pepper)
- Mohit Aghera (mohit_aghera)
- Benji Fisher (benjifisher) of the Drupal Security Team
- catch (catch) of the Drupal Security Team
- Lee Rowlands (larowlan) of the Drupal Security Team
- Juraj Nemec (poker10) of the Drupal Security Team
- Jess (xjm) of the Drupal Security Team
Commerce guest registration - Critical - Unsupported - SA-CONTRIB-2026-079
The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai...
Solution:If you use this project, you should uninstall it.
To take over maintainership, please read https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai...
You may also find that the feature to register guests in commerce core matches the feature of this module. Read more documentation on enabling account registration in checkout.
- 1
- 2
- 3
- 4
- 5
- 6
- 7
- nächste Seite ›
- letzte Seite »
Neue Kommentare
vor 6 Wochen 2 Tagen
vor 6 Wochen 6 Tagen
vor 6 Wochen 6 Tagen
vor 9 Wochen 2 Tagen
vor 9 Wochen 4 Tagen
vor 9 Wochen 5 Tagen
vor 10 Wochen 10 Stunden
vor 13 Wochen 2 Tagen
vor 13 Wochen 1 Tag
vor 13 Wochen 1 Tag