-
Critical fof/oauth 159K installs
FriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth provider
Fixed in 1.7.4, 2.0.0-beta.4 · CVE-2026-92161
-
High zbateson/mail-mime-parser 61M installs
zbateson/mail-mime-parser has uncontrolled resource consumption (CPU/memory DoS) parsing untrusted MIME
Fixed in 3.0.6, 4.0.2 · CVE-2026-61816
-
High zbateson/mail-mime-parser 61M installs
zbateson/mail-mime-parser has CRLF header injection via attachment filename
Fixed in 3.0.6, 4.0.2 · CVE-2026-61815
-
High verbb/formie 427K installs
Formie: Integration form-settings action allows SSRF and exfiltration of stored integration credentials
Fixed in 3.1.31, 2.2.23 · CVE-2026-76086
-
High verbb/formie 427K installs
Formie: Missing authorization on sent notification resend modal exposes submission PII
Fixed in 3.1.31, 2.2.23 · CVE-2026-76089
-
High verbb/formie 427K installs
Formie: Unauthenticated users can overwrite incomplete submissions via submit action
Fixed in 3.1.31, 2.2.23 · CVE-2026-76087
-
High code16/sharp 69K installs
code16 Sharp vulnerable to stored XSS via iframe srcdoc Attribute
Fixed in 9.22.5 · CVE-2026-61823
-
High code16/sharp 69K installs
code16/sharp has a stored XSS via data-html-content Sanitizer Bypass
Fixed in 9.22.5 · CVE-2026-61825
-
High starcitizenwiki/embedvideo 14K installs
Mediawiki EmbedVideo Extension has stored XSS via malformed src url with $wgEmbedVideoRequireConsent disabled
Fixed in 4.1.0 · CVE-2026-57440
-
High snipe/snipe-it 731 installs
Snipe-IT: Stored XSS via Inline XML Rendering in the Uploaded Files API
Fixed in 8.7.0 · CVE-2026-63498
-
High snipe/snipe-it 731 installs
Snipe-IT: Stored XSS via Custom Field name in asset-list column headers
Fixed in 8.7.0 · CVE-2026-62368
-
High snipe/snipe-it 731 installs
Snipe-IT: 2FA bypass via the API token flow
Fixed in 8.7.0 · CVE-2026-63493
-
High thorsten/phpmyfaq, phpmyfaq/phpmyfaq 151 installs
phpMyFAQ has Stored XSS in Admin FAQ Editor via HTML Entity Bypass in Frontend FAQ Submission
Fixed in 4.2.0-alpha · CVE-2026-56736
-
High thorsten/phpmyfaq, phpmyfaq/phpmyfaq 151 installs
phpMyFAQ's two-factor authentication login bypasses the password factor
Fixed in 4.1.6 · CVE-2026-56737
-
High phpmyfaq/phpmyfaq, thorsten/phpmyfaq 90 installs
phpMyFAQ has SQL Injection in `StopWords::add()` — Unescaped Stop Word Insertion
Fixed in 4.1.6 · CVE-2026-56738
-
Medium sulu/sulu 1M installs
Sulu: JCR-SQL2 injection via `categories` query parameter (unauthenticated)
Fixed in 2.6.25, 3.0.8 · CVE-2026-92692
-
Medium solspace/craft-freeform 705K installs
Solspace Freeform: Limited Twig template injection via submitted field values
Fixed in 5.10.14 · CVE-2026-73858
-
Medium wp-graphql/wp-graphql 420K installs
WPGraphQL: Contributor can publish and modify posts without the required capabilities via updatePost
CVE-2026-88974
-
Medium redaxo/source 24K installs
REDAXO: Unwhitelisted ORDER BY Column in rex_list Allows Authenticated Column Enumeration
Fixed in 5.21.2 · CVE-2026-62998
-
Medium redaxo/source 24K installs
REDAXO: Missing CSRF Protection on Package Update Action Allows Forced Addon Updates
Fixed in 5.21.2 · CVE-2026-63000
-
Medium redaxo/source 24K installs
REDAXO: Stored XSS via Unescaped Media Manager Type Name in `mediaIsInUse()`
Fixed in 5.21.2 · CVE-2026-63001
-
Medium redaxo/source 24K installs
REDAXO: Stored XSS in Mediapool Sync Page via Unescaped Filesystem Filenames
Fixed in 5.21.2 · CVE-2026-63002
-
Low contao/contao, contao/core-bundle 15K installs
Contao: Server-Side Request Forgery (SSRF) via Unvalidated RSS Feed URL in Feed Reader Module
Fixed in 5.3.48, 5.7.9 · CVE-2026-57232
Drupal contributed modules: 36 advisories
-
Not rated drupal/webform
The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. Form submissions may include up...
Fixed in 6.2.12, 6.3.1 · CVE-2026-96357
-
Not rated drupal/rest_api_authentication
This module enables you to add an extra authentication layer to the API. The module does not sufficiently validate authentication requirements for all API requ...
Fixed in 3.2.0 · CVE-2026-96385
-
Not rated drupal/css_usage_analyzer
This module lets a frontend scanner post CSS-usage measurements to the site so admin reports can show real-page statistics. This module doesn't sufficiently pr...
Fixed in 1.0.2 · CVE-2026-96380
-
Not rated drupal/commerce_decoupled_checkout
This module enables REST endpoints for a decoupled Commerce experience which allow for remote order creation. The module doesn't sufficiently sanitize order da...
Fixed in 1.8.0 · CVE-2026-96378
-
Not rated drupal/ai_ckeditor
This module enables you to use AI to fill in or replace text in CKEditor. The module doesn't sufficiently mitigate Twig template injections in certain AI CKEdi...
Fixed in 1.4.3 · CVE-2026-96392
-
Not rated drupal/combined_image_style
This module enables you to combine multiple image styles into a single image derivative. The module does not sufficiently validate image style names when gener...
Fixed in 1.0.7 · CVE-2026-96377
-
Not rated drupal/editoria11y
This module runs a client-side accessibility checker that automatically reports results to dashboard views over an API. The module incorrectly described a perm...
Fixed in 2.2.23, 3.0.9 · CVE-2026-96390
-
Not rated drupal/mermaid_diagram_field
This module enables you to add mermaid diagram that displays either inline on an entity or optionally in a modal. The module doesn't sufficiently respect defau...
Fixed in 1.0.9 · CVE-2026-96384
-
Not rated drupal/stop_admin
This module enables sites to block access for the administrative user account (user 1) or users with the administrator role. The module does not sufficiently e...
Fixed in 1.6.0 · CVE-2026-96387
-
Not rated drupal/cloud
The Cloud module enables users to manage cloud infrastructure through Drupal. The Kubernetes and VMware integrations do not properly validate TLS certificates...
Fixed in 7.0.1 · CVE-2026-96375
-
Not rated drupal/tawk_to
This module provides integration of the tawk.to live chat for Drupal sites. The module does not sufficiently validate certain requests. This may allow an attac...
Fixed in 3.0.4 · CVE-2026-96388
-
Not rated drupal/diba_carousel
The Diba Carousel Slider adds a Bootstrap carousel slider block that can be used directly without creating a View or custom integration. When the "Allow HTML d...
Fixed in 3.0.2 · CVE-2026-96382
-
Not rated drupal/webform_rest
This module enables you to retrieve and submit webforms via REST. The module doesn't sufficiently check permission to webform and webform submission entities w...
Fixed in 4.2.1 · CVE-2026-96391
-
Not rated drupal/cloud
The Cloud module enables users to manage cloud resources through Drupal. The module does not sufficiently sanitize user-controlled Git branch and repository UR...
Fixed in 7.0.1 · CVE-2026-96376
-
Not rated drupal/project_browser
The Project Browser module enables you to apply recipes and enable modules from the web user interface. The module doesn't sufficiently validate admin actions...
Fixed in 2.0.3, 2.1.5 · CVE-2026-96374
-
Not rated drupal/cookiecuttr
This module enables you to provide information and options about cookie usage. The module does not sufficiently filter input submitted through the Cookiecuttr...
Fixed in 2.0.3 · CVE-2026-96379
-
Not rated drupal/smart_content
This module enables you to personalize content for anonymous and authenticated users by showing different blocks to visitors based on client-side conditions. T...
Fixed in 3.2.1 · CVE-2026-96386
-
Not rated drupal/webform
The Webform module enables site builders to create forms and collect submissions. The module does not sufficiently restrict access to configure Remote HTTP Ope...
Fixed in 6.2.12, 6.3.1 · CVE-2026-96372
-
Not rated drupal/webform
The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. The module provides JavaScript...
Fixed in 6.2.12, 6.3.1 · CVE-2026-96360
-
Not rated drupal/webform
The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. When Webform is used with JSON...
Fixed in 6.2.12, 6.3.1 · CVE-2026-96369
-
Not rated drupal/webform
The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. The module does not sufficient...
Fixed in 6.2.12, 6.3.1 · CVE-2026-96361
-
Not rated drupal/webform
The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. The module did not sufficientl...
Fixed in 6.2.12, 6.3.1 · CVE-2026-96359
-
Not rated drupal/webform
The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. Site builders may add tooltips...
Fixed in 6.2.12, 6.3.1 · CVE-2026-96368
-
Not rated drupal/webform
The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. The module does not sufficient...
Fixed in 6.2.12, 6.3.1 · CVE-2026-96367
-
Not rated drupal/webform
The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. The module does not sufficient...
Fixed in 6.2.12, 6.3.1 · CVE-2026-96371
-
Not rated drupal/webform
The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. The module does not sufficient...
Fixed in 6.2.12, 6.3.1 · CVE-2026-96373
-
Not rated drupal/webform
The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. The module includes a rating e...
Fixed in 6.2.12, 6.3.1 · CVE-2026-96358
-
Not rated drupal/webform
The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. The module includes a Webform...
Fixed in 6.2.12, 6.3.1 · CVE-2026-96370
-
Not rated drupal/webform
The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. Webform did not sufficiently g...
Fixed in 6.2.12, 6.3.1 · CVE-2026-96356
-
Not rated drupal/webform
The Webform module allows site builders to create forms, collect submissions, and render submitted values in configurable formats. Webform does not sufficientl...
Fixed in 6.2.12, 6.3.1 · CVE-2026-96355
-
Not rated drupal/webform
The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. The module did not sufficientl...
Fixed in 6.2.12, 6.3.1 · CVE-2026-96398
-
Not rated drupal/webform
The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. Site builders may also configu...
Fixed in 6.2.12, 6.3.1 · CVE-2026-96366
-
Not rated drupal/webform
The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. Site builders may also configur...
Fixed in 6.2.12, 6.3.1 · CVE-2026-96362
-
Not rated drupal/webform
The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. Site builders may also configur...
Fixed in 6.2.12, 6.3.1 · CVE-2026-96365
-
Not rated drupal/webform
The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. The Webform Share submodule ca...
Fixed in 6.2.12, 6.3.1 · CVE-2026-96364
-
Not rated drupal/webform
The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. Webform includes a submodule c...
Fixed in 6.2.12, 6.3.1 · CVE-2026-96363
Advisories from OSV.dev, which gathers the GitHub Advisory Database, FriendsOfPHP and Drupal security advisories; summaries are theirs. "Exploited in the wild" means the CVE is in CISA's Known Exploited Vulnerabilities catalogue when the digest was drafted. Ordered by that, then severity, then installs on Packagist.