-
Critical predis/predis 359M installs
Predis: Redis command injection and denial of service via CRLF smuggling in pipelined commands on aggregate connections
Fixed in 3.3.0 · CVE-2026-84372
-
Critical cakephp/cakephp, cakephp/database 21M installs
CakePHP: FunctionsBuilder::jsonValue() vulerable to SQL injection with PostgresDriver
Fixed in 5.3.7, 5.2.15, 5.1.10 · CVE-2026-77635
-
High composer/composer 211M installs
Composer arbitrary command execution via a malicious package's Perforce source URL
Fixed in 2.10.3, 2.2.30 · CVE-2026-84361
-
High maatwebsite/excel 179M installs
Laravel Excel writes exports outside the configured filesystem disk when given a caller-controlled path
Fixed in 3.1.70 · CVE-2026-84374
-
High mongodb/mongodb 74M installs
mongodb: Reject "." and NUL bytes in database and collection names
Fixed in 1.21.4, 2.4.1 · CVE-2026-81525
-
High cakephp/cakephp 21M installs
CakePHP: SmtpTransport vulnerable to CRLF header injection
Fixed in 4.5.12, 4.6.5, 5.1.9, 5.2.14 · CVE-2026-77634
-
High pimcore/pimcore 4M installs
Pimcore: SQL Injection in Custom Reports via Malicious Report Configuration
Fixed in 2026.1.6, 12.3.10, 11.5.19 · CVE-2026-55416
-
High shopper/framework 18K installs
Shopper: privilege escalation via improper Livewire admin component authorization
Fixed in 2.9.2 · CVE-2026-56828
-
High shopper/framework 18K installs
Shopper: Missing authorization on product removal actions in CollectionProducts component
Fixed in 2.9.2 · CVE-2026-56825
-
High shopper/framework 18K installs
Shopper: Unauthorized inventory stock manipulation via unlocked variant property in VariantStock component
Fixed in 2.9.2 · CVE-2026-56829
-
High shopper/framework 18K installs
Shopper: Authorization bypass in Filament bulk actions allows browse-only staff to mass-delete attributes/tags and mass-toggle visibility of brands/categories/suppliers
Fixed in 2.9.2 · CVE-2026-56827
-
Medium phpseclib/phpseclib 515M installs
phpseclib — non-constant-time X25519 scalar multiplication permits full private-key recovery
Fixed in 3.0.57, 4.0.1 · CVE-2026-84308
-
Medium shopper/framework 18K installs
Shopper: Negative discount values accepted and propagated through order calculation pipeline
Fixed in 2.9.0 · CVE-2026-56831
-
Medium shopper/framework 18K installs
Shopping privilege escalation through missing authorization in Settings components
Fixed in 2.9.2 · CVE-2026-56826
-
Medium shopper/framework 18K installs
Shopper: Media sub-form store() still lacks authorization (Incomplete fix for GHSA-h4mp-g9c6-xwph)
Fixed in 2.9.2 · CVE-2026-56830
Drupal contributed modules: 19 advisories
-
Not rated drupal/ai_provider_amazeeio
**Update 2026-09-11:** Increased risk score to reflect publicly documented methods for developing exploits. This module integrates amazee.ai's AI services into...
Fixed in 1.3.7, 1.4.3 · CVE-2026-87936
-
Not rated drupal/miniorange_saml
This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider. The m...
Fixed in 3.2.0 · CVE-2026-87947
-
Not rated drupal/miniorange_saml
This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider. The m...
Fixed in 3.2.0 · CVE-2026-87946
-
Not rated drupal/miniorange_saml
This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider. The m...
Fixed in 3.2.0 · CVE-2026-87950
-
Not rated drupal/miniorange_saml
This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider. The m...
Fixed in 3.2.0 · CVE-2026-87945
-
Not rated drupal/miniorange_saml
This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider. The m...
Fixed in 3.2.0 · CVE-2026-87949
-
Not rated drupal/miniorange_saml
This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider. The m...
Fixed in 3.2.0 · CVE-2026-87952
-
Not rated drupal/miniorange_saml
This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider. The m...
Fixed in 3.2.0 · CVE-2026-87948
-
Not rated drupal/cas_server
This module enables you to turn a Drupal install into the Central Authentication System (CAS) Server. It makes your database the primary location for other syst...
Fixed in 2.0.4, 2.1.3 · CVE-2026-87937
-
Not rated drupal/safedelete
This module enables you to manage content deletion and provides reports for identifying orphaned content. The module doesn't sufficiently sanitize node titles...
Fixed in 1.0.88 · CVE-2026-87942
-
Not rated drupal/feed_block
The Feed Block module provides a block content type that displays items pulled from a remote RSS/Atom feed. The module does not sufficiently validate or saniti...
Fixed in 2.0.2, 3.0.2 · CVE-2026-87939
-
Not rated drupal/csp_log
The CSP Log module enhances any module that adds the CSP header to a site, by providing a reporting endpoint, custom storage, and aggregated reports that can be...
Fixed in 1.0.2 · CVE-2026-87938
-
Not rated drupal/term_glossary
This module adds automatic highlighting of taxonomy terms in content. The module doesn't sufficiently check access on taxonomy terms. As a result, anonymous us...
Fixed in 4.6.0 · CVE-2026-87954
-
Not rated drupal/ultimate_table_field
The Ultimate Table Field module enables you to store table data in a field and edit each table cell through a dialog, using cell field plugins such as text, lin...
Fixed in 1.1.1, 2.0.1 · CVE-2026-87955
-
Not rated drupal/key_auth
This module enables you to add key-based authentication on a per-user basis. The module doesn't cache per user, potentially allowing an attacker to view anot...
Fixed in 2.2.4 · CVE-2026-87940
-
Not rated drupal/miniorange_saml
This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider. The m...
Fixed in 3.2.0 · CVE-2026-87953
-
Not rated drupal/miniorange_saml
This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider. The m...
Fixed in 3.2.0 · CVE-2026-87944
-
Not rated drupal/miniorange_saml
This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider. The m...
Fixed in 3.2.0 · CVE-2026-87951
-
Not rated drupal/miniorange_saml
This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider. The m...
Fixed in 3.2.0 · CVE-2026-87943
Advisories from OSV.dev, which gathers the GitHub Advisory Database, FriendsOfPHP and Drupal security advisories; summaries are theirs. "Exploited in the wild" means the CVE is in CISA's Known Exploited Vulnerabilities catalogue when the digest was drafted. Ordered by that, then severity, then installs on Packagist.