Newsfeed-Generator

Project: Media FoldersDate: 2026-July-22Security risk: Moderately critical 14 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Cross site scriptingAffected versions: <1.0.8CVE IDs: CVE-2026-16638Description: 

This module provides a better UI for managing and selecting Media entities in a folder structure.

The module doesn't sufficiently sanitize the names and descriptions of media items and folders when they are displayed in the media browser, resulting in a stored cross-site scripting (XSS) vulnerability.

This vulnerability is mitigated by the fact that an attacker must have a role with permission to create or edit media items or folders.

Solution: 

Install the latest version:

• If you use the Media Folders module, upgrade to Media Folder 1.0.8

Reported By: 

• Drew Webber (mcdruid) of the Drupal Security Team

Fixed By: 

• João Mauricio (jmauricio)

Coordinated By: 

• Juraj Nemec (poker10) of the Drupal Security Team

Project: Drupal coreDate: 2026-July-15Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:DefaultVulnerability: Cross-site scriptingAffected versions: <10.6.13 || >=11.3.0 <11.3.14 || >=11.4.0 <11.4.4 || 11.0.* || 11.1.* || 11.2.*CVE IDs: CVE-2026-55805Description: 

The Layout Builder module doesn't sufficiently sanitize block labels in certain scenarios, which can lead to a cross-site scripting (XSS) vulnerability.

This is mitigated by the fact that both the attacker and the targeted user need to be using the Layout Builder editing interface.

Solution: 

Install the latest version:

Drupal 11

• If you use Drupal 11.4.x, update to Drupal 11.4.4.
• If you use Drupal 11.3.x, update to Drupal 11.3.14.
• Drupal 11.2.x and below are end-of-life and do not receive security coverage.

Drupal 10

• If you use Drupal 10.6.x, update to Drupal 10.6.13.
• Drupal 10.5.x and below are end-of-life and do not receive security coverage.

Drupal 8 and Drupal 9 have both reached end-of-life.

Reported By: 

• haii haii (hai27ii2o)

Fixed By: 

• danielveza
• Lee Rowlands (larowlan) of the Drupal Security Team
• Mingsong (mingsong) provisional member of the Drupal Security Team
• James Gilliland (neclimdul) of the Drupal Security Team

Coordinated By: 

• Greg Knaddison (greggles) of the Drupal Security Team
• Lee Rowlands (larowlan) of the Drupal Security Team
• Dave Long (longwave) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team

Project: Drupal coreDate: 2026-July-15Security risk: Moderately critical 14 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Cross-site scriptingAffected versions: >=11.3.0 <11.3.14 || >=11.4.0 <11.4.4 || 11.2.*CVE IDs: CVE-2026-15917Description: 

Drupal core 11.2 and above integrate the HTMX JavaScript library.

Drupal core's XSS filter does not sufficiently sanitize certain HTMX attributes, which can lead to a cross-site scripting (XSS) vulnerability.

The vulnerability is mitigated by the fact an attacker must be able to insert HTML with specific attributes.

Solution: 

Install the latest version:

Drupal 11

• If you use Drupal 11.4.x, update to Drupal 11.4.4.
• If you use Drupal 11.3.x, update to Drupal 11.3.14.
• Drupal 11.2.x and below are end-of-life and do not receive security coverage.

Drupal 10

• Drupal 10 core is not affected. However, certain contributed modules may be affected, so a Drupal 10.6 fix is included as hardening.

Drupal 8 and Drupal 9 have both reached end-of-life.

Reported By: 

• Pierre Rudloff (prudloff) of the Drupal Security Team

Fixed By: 

• Shawn Duncan (fathershawn)
• Pierre Rudloff (prudloff) of the Drupal Security Team

Coordinated By: 

• catch (catch) of the Drupal Security Team
• Lee Rowlands (larowlan) of the Drupal Security Team
• Dave Long (longwave) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team

Project: Drupal coreDate: 2026-July-15Security risk: Moderately critical 10 ∕ 25 AC:Complex/A:None/CI:Some/II:None/E:Theoretical/TD:UncommonVulnerability: Information disclosureAffected versions: <10.6.13 || >=11.3.0 <11.3.14 || >=11.4.0 <11.4.4 || 11.0.* || 11.1.* || 11.2.*CVE IDs: CVE-2026-15916Description: 

The Image module allows you to define and configure image fields.

The module doesn't sufficiently check access to image style derivatives when those files are served via a file stream other than private://.

This vulnerability is mitigated by the fact that Drupal must be configured to use a contributed (non-core) file scheme to serve private derived images.

Information disclosure issues like this one are not generally given security advisories (as described in PSA-2023-07-12)). This fix is provided as a hardening. Contributed modules implementing custom stream wrappers may need to add similar hardenings.

Solution: 

Install the latest version:

Drupal 11

• If you use Drupal 11.4.x, update to Drupal 11.4.4.
• If you use Drupal 11.3.x, update to Drupal 11.3.14.
• Drupal 11.2.x and below are end-of-life and do not receive security coverage.

Drupal 10

• If you use Drupal 10.6.x, update to Drupal 10.6.13.
• Drupal 10.5.x and below are end-of-life and do not receive security coverage.

Drupal 8 and Drupal 9 have both reached end-of-life.

Reported By: 

• offensive-ai

Fixed By: 

• Benji Fisher (benjifisher) of the Drupal Security Team
• Kim Pepper (kim.pepper)
• Mohit Aghera (mohit_aghera)

Coordinated By: 

• Benji Fisher (benjifisher) of the Drupal Security Team
• catch (catch) of the Drupal Security Team
• Lee Rowlands (larowlan) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team

Project: Commerce guest registrationDate: 2026-July-08Security risk: Critical 16 ∕ 25 AC:Complex/A:Admin/CI:All/II:All/E:Theoretical/TD:AllVulnerability: UnsupportedAffected versions: *CVE IDs: CVE-2026-15089Description: 

The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai...

Solution: 

If you use this project, you should uninstall it.

To take over maintainership, please read https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai...

You may also find that the feature to register guests in commerce core matches the feature of this module. Read more documentation on enabling account registration in checkout.

Project: Clean RESTfulDate: 2026-July-08Security risk: Critical 16 ∕ 25 AC:Complex/A:Admin/CI:All/II:All/E:Theoretical/TD:AllVulnerability: UnsupportedAffected versions: *CVE IDs: CVE-2026-15087Description: 

The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai...

Solution: 

If you use this project, you should uninstall it. To take over maintainership, please read https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai...

Project: Raw Formatter [Meta Tag Formatter]Date: 2026-July-08Security risk: Critical 16 ∕ 25 AC:Complex/A:Admin/CI:All/II:All/E:Theoretical/TD:AllVulnerability: UnsupportedAffected versions: *CVE IDs: CVE-2026-15086Description: 

The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai...

Solution: 

If you use this project, you should uninstall it. To take over maintainership, please read https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai...

Project: AI SEO/GEO AnalyzerDate: 2026-July-08Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:DefaultVulnerability: Cross-site ScriptingAffected versions: <1.1.3CVE IDs: CVE-2026-15085Description: 

The AI SEO/GEO Analyzer module generates SEO/GEO analysis reports by sending content of an entity (including its comments) to an LLM, then converts the model's Markdown response to HTML and stores it for display to privileged users.

The generated HTML was rendered without passing through Drupal's filtering pipeline, so it relied on the LLM output being safe. Under certain circumstances a crafted prompt injection — planted in content that is included in the analysis — can cause the LLM to emit markup that results in stored Cross-site Scripting when the report is later viewed.

This vulnerability is mitigated by the fact that an attacker must be able to inject text into the content that is sent to the LLM, and that prompt injection is non-deterministic and not guaranteed to succeed on a given attempt.

Solution: 

Install the latest version:

• If you use the AI SEO/GEO Analyzer module 1.1.x, upgrade to ai_seo 1.1.3

Reported By: 

• Drew Webber (mcdruid) of the Drupal Security Team

Fixed By: 

• Juhani Väätäjä (j-vee)

Coordinated By: 

• Greg Knaddison (greggles) of the Drupal Security Team
• Drew Webber (mcdruid) of the Drupal Security Team

Project: UI Patterns (SDC in Drupal UI)Date: 2026-July-08Security risk: Moderately critical 14 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Cross site scriptingAffected versions: >=2.0.0 <2.0.17CVE IDs: CVE-2026-15084Description: 

This module enables you to use Single Directory Components in site building (views, field formatters, blocks, layouts) and it improves the Developer Experience (DX) with SDC.

The module doesn't sufficiently sanitize the markup passed to components under certain scenarios.

This vulnerability is mitigated by the fact that an attacker must be able to create or update content rendered by UI Patterns.

Solution: 

Install the latest version:

• If you use the UI Patterns module on version 2, upgrade to UI Patterns 2.0.17

Reported By: 

• Hervé Donner (herved)

Fixed By: 

• Florent Torregrosa (grimreaper)
• Hervé Donner (herved)
• Mikael Meulle (just_like_good_vibes)
• Pierre Dureau (pdureau)

Coordinated By: 

• Neil Drumm (drumm) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team
• Dave Long (longwave) of the Drupal Security Team

Project: ECA: Event - Condition - ActionDate: 2026-July-08Security risk: Less critical 8 ∕ 25 AC:Complex/A:User/CI:Some/II:None/E:Theoretical/TD:UncommonVulnerability: Information disclosureAffected versions: <2.1.20 || >=3.0.0 <3.0.12 || >=3.1.0 <3.1.4CVE IDs: CVE-2026-15083Description: 

The Events, Conditions, Actions (ECA) module's Render submodule enables you to build render arrays and render inline Twig templates as part of no-code ECA models.

The module doesn't sufficiently sanitize template code when rendering, which can lead to information disclosure.

This vulnerability is mitigated by the fact that a site must be running an ECA model that uses the "Render: Twig" action on a data flow.

Solution: 

Install the latest version:

• If you use the ECA 3.1 for Drupal 10.x or 11.x, upgrade to ECA 3.1.4
• If you use the ECA 3.0 for Drupal 10.x or 11.x, upgrade to ECA 3.0.12
• If you use the ECA 1.2 for Drupal 10.x or 11.x, upgrade to ECA 2.1.20

Reported By: 

• Changhai Qi (qichanghai)

Fixed By: 

• Jürgen Haas (jurgenhaas)

Coordinated By: 

• Neil Drumm (drumm) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Dave Long (longwave) of the Drupal Security Team

Project: Siteimprove AnalyticsDate: 2026-July-08Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Cross-site ScriptingAffected versions: <2.0.1CVE IDs: CVE-2026-15082Description: 

The module doesn't sufficiently sanitize the Siteimprove Analytics identification code when inserting the JavaScript tracking code; this could be exploited to achieve Cross-Site Scripting (XSS).

This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer siteimprove_analytics".

Solution: 

Install the latest version:

• If you use the siteimprove_analytics module for Drupal verision prior 10.3, upgrade to siteimprove_analytics 2.0.1

Reported By: 

• Pierre Rudloff (prudloff) of the Drupal Security Team

Fixed By: 

• Bohdan Artemchuk (bohart)
• Andriy Parkhomiuk (grask0)

Coordinated By: 

• Greg Knaddison (greggles) of the Drupal Security Team
• Pierre Rudloff (prudloff) of the Drupal Security Team

Project: Location SelectorDate: 2026-July-08Security risk: Critical 19 ∕ 25 AC:Basic/A:None/CI:All/II:All/E:Theoretical/TD:DefaultVulnerability: SQL InjectionAffected versions: <1.3.0CVE IDs: CVE-2026-15081Description: 

The Location Selector module provides a Views filter for selecting location values.

One of the provided Views filters does not sufficiently sanitize values that may come from user input, resulting in a SQL injection vulnerability.

This vulnerability is mitigated by the fact that a View must exist that uses the affected filter and is configured to accept user input.

Solution: 

Install the latest version:

• If you use the Location Selector module for Drupal, upgrade to Location Selector 8.x-1.3

Reported By: 

• Drew Webber (mcdruid) of the Drupal Security Team

Fixed By: 

• handkerchief

Coordinated By: 

• Greg Knaddison (greggles) of the Drupal Security Team
• Drew Webber (mcdruid) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team

Project: Ray Enterprise TranslationDate: 2026-July-08Security risk: Moderately critical 12 ∕ 25 AC:Complex/A:None/CI:None/II:Some/E:Theoretical/TD:AllVulnerability: Cross site request forgeryAffected versions: <4.0.4 || >=4.1.0 <4.1.4 || >=11.0.0 <11.0.4CVE IDs: CVE-2026-15080Description: 

The Lingotek Ray Enterprise Translation module provides multilingual site management.

The module fails to protect several state-changing administrative routes against Cross Site Request Forgery attacks. An attacker could trick a privileged user into visiting a crafted page that triggers actions such as updating callback settings, uploading or downloading translations, or changing translation state.

Solution: 

Install the latest version appropriate for your site

• If you use the Ray Enterprise Translation module, upgrade to Ray Enterprise Translation 11.0.4
• If you use the Ray Enterprise Translation module, upgrade to Ray Enterprise Translation 4.1.4
• If you use the Ray Enterprise Translation module, upgrade to Ray Enterprise Translation 4.0.4

Reported By: 

• Pierre Rudloff (prudloff) of the Drupal Security Team

Fixed By: 

• Naresh Bavaskar (naresh_bavaskar)

Coordinated By: 

• Greg Knaddison (greggles) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team
• Pierre Rudloff (prudloff) of the Drupal Security Team

Project: Login DisableDate: 2026-July-08Security risk: Moderately critical 14 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Access bypassAffected versions: <2.1.4CVE IDs: CVE-2026-15079Description: 

The Login Disable module prevents users from logging in to your Drupal site unless they know the secret key to add to the end of the login form page.

The module doesn't sufficiently protect the disabled login form from brute force attacks. Depending on the length of the key this could allow an attacker to use a brute force attack to bypass the protection provided by this module. The security fix blocks these attempts with flood control.

This vulnerability is mitigated by the fact that an attacker must obtain a valid username & password.

Solution: 

Install the latest version:

• If you use the Login Disable module, upgrade to Login Disable 2.1.4

Reported By: 

• Pierre Rudloff (prudloff) of the Drupal Security Team

Fixed By: 

• Boris Doesborg (batigolix)

Coordinated By: 

• Greg Knaddison (greggles) of the Drupal Security Team
• Pierre Rudloff (prudloff) of the Drupal Security Team

Project: ColorboxDate: 2026-July-01Security risk: Moderately critical 12 ∕ 25 AC:Complex/A:User/CI:Some/II:Some/E:Theoretical/TD:DefaultVulnerability: Cross-site scriptingAffected versions: < 2.1.5 || 2.2.0CVE IDs: CVE-2026-58591Description: 

The Colorbox module integrates with the Colorbox JavaScript library to display content in an overlay above the page.

The module doesn't sufficiently protect against injection of malicious JavaScript under certain scenarios.

This vulnerability is mitigated by the fact that an attacker must have a role that permits them to enter HTML content.

Solution: 

Install the latest version:

• If you use Colorbox 2.1.x, upgrade to: Colorbox 2.1.5
• If you use Colorbox 2.2.x, upgrade to: Colorbox 2.2.1

Reported By: 

• Pierre Rudloff (prudloff) of the Drupal Security Team

Fixed By: 

• Paul McKibben (paulmckibben)

Coordinated By: 

• Pierre Rudloff (prudloff) of the Drupal Security Team

Project: FlowDropDate: 2026-July-01Security risk: Moderately critical 12 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:UncommonVulnerability: Access bypassAffected versions: <1.6.0CVE IDs: CVE-2026-58590Description: 

This module enables you to test and run AI-driven workflows interactively through a chat interface.

The module doesn't sufficiently re-evaluate a human-in-the-loop approval gate where the workflow iterates more than once. This may result in execution of workflows that were not intended by the user.

This vulnerability is mitigated by the fact that an attacker must have a role with the permission "Administer FlowDrop workflows" (or the equivalent "Create FlowDrop workflows" / "Edit FlowDrop workflows" permissions).

Solution: 

Install the latest version:

• If you use the FlowDrop module for Drupal 11.x, upgrade to FlowDrop 1.6.0

Reported By: 

• Aincient Labs (aincient labs)

Fixed By: 

• Shibin Das (d34dman)

Coordinated By: 

• Greg Knaddison (greggles) of the Drupal Security Team
• Neil Drumm (drumm) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team
• Dave Long (longwave) of the Drupal Security Team

Project: FlowDropDate: 2026-July-01Security risk: Moderately critical 12 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:UncommonVulnerability: Access bypassAffected versions: <1.6.0CVE IDs: CVE-2026-58589Description: 

This module enables you to test and run AI-driven workflows interactively through a chat interface.

The module doesn't sufficiently enforce permissions on certain endpoints. Attackers may be able to trigger workflow execution (incurring LLM spend and tool side effects) or send messages into other user's sessions.

This vulnerability is mitigated by the fact that an attacker must have the permission "View any session", which is not granted to anonymous or authenticated users by default.

Solution: 

Install the latest version:

• If you use the FlowDrop module for Drupal 11.x, upgrade to FlowDrop 1.6.0

Driving a session now additionally requires the "Execute session workflow" permission.

Reported By: 

• Aincient Labs (aincient labs)

Fixed By: 

• Shibin Das (d34dman)

Coordinated By: 

• Greg Knaddison (greggles) of the Drupal Security Team
• Neil Drumm (drumm) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team
• Dave Long (longwave) of the Drupal Security Team

Project: Drupal CanvasDate: 2026-July-01Security risk: Moderately critical 11 ∕ 25 AC:Complex/A:User/CI:Some/II:Some/E:Theoretical/TD:UncommonVulnerability: Improper validationAffected versions: <1.4.2 || >=1.5.0 <1.5.2 || >=1.6.0 <1.6.1 || >=1.7.0 <1.7.1CVE IDs: CVE-2026-58588Description: 

The Canvas module allow you to upload image files via a custom API.

The validation rules check the file extension of the uploaded file but not the file MIME type. This may allow a malicious user to upload a file that is not an image.

Certain web-server configurations may serve the uploaded file with its actual MIME type rather than an image type. This may lead to cross-site scripting (XSS) or other unexpected behavior.

Solution: 

Install the latest version:

• If you use the 1.4.1 version of Canvas, upgrade to 1.4.2
• If you use the 1.5.1 version of Canvas, upgrade to 1.5.2
• If you use the 1.6.0 version of Canvas, upgrade to 1.6.1
• If you use the 1.7.0 version of Canvas, upgrade to 1.7.1

Reported By: 

• Christian López Espínola (penyaskito)

Fixed By: 

• AKHIL BABU (akhil babu)
• Christian López Espínola (penyaskito)

Coordinated By: 

• Juraj Nemec (poker10) of the Drupal Security Team

Project: Drupal CanvasDate: 2026-July-01Security risk: Moderately critical 11 ∕ 25 AC:Complex/A:User/CI:Some/II:Some/E:Theoretical/TD:UncommonVulnerability: Improper validationAffected versions: <1.4.2 || >=1.5.0 <1.5.2 || >=1.6.0 <1.6.1 || >=1.7.0 <1.7.1CVE IDs: CVE-2026-58587Description: 

The Canvas AI submodule allows you to upload image files via a custom API to use within the AI web chat.

These file uploads are insufficiently validated before being written to Drupal's temporary directory. In some cases, this may lead to cross-site scripting (XSS).

Solution: 

Install the latest version:

• If you use the 1.4.1 version of Canvas, upgrade to 1.4.2
• If you use the 1.5.1 version of Canvas, upgrade to 1.5.2
• If you use the 1.6.0 version of Canvas, upgrade to 1.6.1
• If you use the 1.7.0 version of Canvas, upgrade to 1.7.1

Reported By: 

• AKHIL BABU (akhil babu)

Fixed By: 

• Alex Bronstein (effulgentsia) of the Drupal Security Team
• Christian López Espínola (penyaskito)

Coordinated By: 

• Juraj Nemec (poker10) of the Drupal Security Team

Mein persönlicher Jahresrückblick 2025: Wandel, Training, Reisen, Projekte und Menschen, die das Jahr geprägt haben.