-
Critical contao/comments-bundle 1M installs
Contao: Cross-site scripting in the comments bundle
Fixed in 5.3.50, 5.7.12 · CVE-2026-107845
-
High kunstmaan/media-bundle, kunstmaan/bundles-cms 138K installs
Kunstmaan CMS: MediaBundle extension blacklist bypass allows authenticated administrators to upload executable PHP files leading to remote code execution
Fixed in 7.3.2 · CVE-2026-104890
-
Medium mongodb/mongodb 74M installs
MongoDB: GridFS data disclosure and deletion via query-operator injection in file IDs
Fixed in 1.24.5, 2.4.2 · CVE-2026-88023
-
Medium enshrined/svg-sanitize 53M installs
svg-sanitizer: Mixed-case xlink:HrEf skips the `<use>` nesting-DoS check in Resolver::processReferences
Fixed in 1.0.0 · CVE-2026-107381
-
Medium enshrined/svg-sanitize 53M installs
enshrined/svg-sanitize: Denial of Service via DTD Attribute Declaration Crash
Fixed in 1.0.0 · CVE-2026-107379
-
Medium enshrined/svg-sanitize 53M installs
enshrined/svg-sanitize: Stored XSS via DTD Entity / HTML5 Named Character Reference Collision
Fixed in 1.0.0 · CVE-2026-107380
-
Medium filament/filament 45M installs
Filament: Multi-factor authentication (app) management actions do not require password reauthentication
Fixed in 4.13.3, 5.8.3 · CVE-2026-104181
-
Medium contao/core-bundle 2M installs
Contao: Protected page content is disclosed to anonymous visitors after contao.search.index_protected is disabled
Fixed in 5.3.50, 5.7.12 · CVE-2026-107842
-
Medium contao/core-bundle 2M installs
Contao: Improper access control in the preview links module
Fixed in 5.7.12 · CVE-2026-107850
-
Medium contao/core-bundle 2M installs
Contao: Path traversal in the images controller
Fixed in 5.3.50, 5.7.12 · CVE-2026-107844
-
Medium contao/core-bundle 2M installs
Contao: The registration module re-sends activation mails
Fixed in 5.3.50, 5.7.12 · CVE-2026-107843
-
Medium contao/core-bundle 2M installs
Contao: Improper access control in the table access voter
Fixed in 5.7.12 · CVE-2026-107851
-
Low contao/core-bundle 2M installs
Contao: Cross-site request forgery in custom backend actions
Fixed in 5.3.50, 5.7.12 · CVE-2026-107848
Drupal contributed modules: 26 advisories
-
Not rated drupal/block_ajax
The Block AJAX module enables you to load blocks asynchronously via Ajax. The module doesn't sufficiently validate user-supplied data which is used to construc...
Fixed in 3.0.2 · CVE-2026-107249
-
Not rated drupal/examples
The Examples for Developers project aims to provide high-quality, well-documented API examples for a broad range of Drupal core functionality. The "Email Examp...
Fixed in 4.0.7 · CVE-2026-107312
-
Not rated drupal/auth_login_plus
This module provides TOTP-based two-factor authentication (2FA) for Drupal. The module doesn't enforce the second factor when a user logs in with Drupal core's...
Fixed in 1.0.1 · CVE-2026-107254
-
Not rated drupal/views_share
This module enables you to "share" a view display within another website via an iframe. The module doesn't sufficiently block access to view displays. Although...
Fixed in 2.0.1 · CVE-2026-107266
-
Not rated drupal/auth_login_plus
This module provides TOTP-based two-factor authentication (2FA) for Drupal, with an optional setting to enforce 2FA for all users site-wide. The module may all...
Fixed in 1.0.1 · CVE-2026-107261
-
Not rated drupal/xray_audit
This module enables you to audit a Drupal site by generating reports about its content, entities, display modes and configuration. The module doesn't sufficien...
Fixed in 1.6.3, 2.0.4, 3.1.1 · CVE-2026-96389
-
Not rated drupal/gutenberg
This module provides a new UI experience for node editing using the Gutenberg Editor library. The module does not sufficiently check entity access in several e...
Fixed in 2.15.0, 3.0.7 · CVE-2026-107263
-
Not rated drupal/freelinking
This module enables you to configure a WIKI-like input filter that allows users to create links to site and external content. The module doesn’t sufficiently p...
Fixed in 4.0.3 · CVE-2026-107310
-
Not rated drupal/miniorange_2fa
This module enables you to add an extra layer of verification for user login flow. The Two Factor Authentication - TFA / Passwordless Login module for Drupal c...
Fixed in 5.4.1, 5.5.2 · CVE-2026-107268
-
Not rated drupal/mathjax
This module integrates the MathJax library into your Drupal site. MathJax is the modern JavaScript-based LaTeX rendering solution for the Internet. The module...
Fixed in 4.1.2 · CVE-2026-107252
-
Not rated drupal/menu_link_attributes
This module enables you to add HTML attributes to menu links and their container elements (`<li>`). The module doesn't sufficiently sanitize the attributes it...
Fixed in 1.8.0 · CVE-2026-107306
-
Not rated drupal/easy_breadcrumb
This module enables you to show a breadcrumb trail for taxonomy term hierarchies. The module doesn't sufficiently check for view access of parent terms before...
Fixed in 2.0.11 · CVE-2026-107309
-
Not rated drupal/orphans_media
The Drupal Security Team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you...
CVE-2026-107253
-
Not rated drupal/entity_reference_manager
Entity Reference Manager is an advanced administrative module for Drupal that allows site administrators to identify, analyze, and replace entity references acr...
Fixed in 1.0.3 · CVE-2026-107251
-
Not rated drupal/country
The module Country provides a dedicated field type for Drupal core's official country list. The module does not sufficiently escape user input in its autocompl...
Fixed in 2.1.3, 2.2.1 · CVE-2026-107308
-
Not rated drupal/restrict_route_by_ip
This module enables you to restrict access to routes by IP address. The module doesn't reliably restrict a subset of dynamic routes, leading to an access bypas...
Fixed in 1.3.1, 2.0.1 · CVE-2026-107255
-
Not rated drupal/eca_helper
The Drupal Security Team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you...
CVE-2026-107250
-
Not rated drupal/smartlinker_ai
This module adds a "Generate internal links" action to the AI CKEditor toolbar, letting editors select text and have the module search the site's content for re...
Fixed in 1.0.3 · CVE-2026-107307
-
Not rated drupal/inline_formatter_field
The Inline Formatter Field module allows site builders to template and style entities with a field. This module does not properly protect against template inje...
Fixed in 4.2.0 · CVE-2026-107264
-
Not rated drupal/leaflet
The Leaflet module provides integration with the Leaflet JS mapping library. Under certain circumstances, when the Leaflet field formatter builds a map it does...
Fixed in 10.4.13 · CVE-2026-107265
-
Not rated drupal/dkan
The DKAN module enables organizations and individuals to build open data portals in Drupal. The DKAN datastore imports tabular data files into database tables a...
Fixed in 4.0.4, 4.1.5 · CVE-2026-107267
-
Not rated drupal/actstream
Actstream (short for Activity Stream) aggregates a user's activity from external services (RSS feeds, etc.) into per-user activity stream entities. The configu...
Fixed in 2.0.1, 2.1.1 · CVE-2026-107257
-
Not rated drupal/permissions_by_term
This module enables you to restrict view access to single nodes via taxonomy terms. The module doesn't sufficiently check access rights when in "Permission mod...
Fixed in 3.1.41 · CVE-2026-107311
-
Not rated drupal/inline_entity_form_dialog
This module renders entity add/edit forms inside an AJAX dialog for use with entity reference fields. This module relies only on the "access administration pag...
Fixed in 1.0.6 · CVE-2026-107258
-
Not rated drupal/advanced_filesystem
Advanced File System turns Drupal's file storage into a manageable, observable and maintainable subsystem. The Advanced Filesystem: Backup submodule does not s...
Fixed in 1.0.28 · CVE-2026-107262
-
Not rated drupal/linked_field
This module enables you to link the output of a field to a URL or to the value of another field. The module doesn't sufficiently separate field content from te...
Fixed in 1.8.0 · CVE-2026-107259
Advisories from OSV.dev, which gathers the GitHub Advisory Database, FriendsOfPHP and Drupal security advisories; summaries are theirs. "Exploited in the wild" means the CVE is in CISA's Known Exploited Vulnerabilities catalogue when the digest was drafted. Ordered by that, then severity, then installs on Packagist.