-
High react/http 30M installs
react/http: Unbounded HTTP Client Response Header Buffering Leads to Memory Exhaustion DoS
Fixed in 1.11.1 · CVE-2026-104827
-
High leantime/leantime 4K installs
Leantime: Any Authenticated User Can Self-Escalate to Admin via Unauthorized JSON-RPC Methods
Fixed in 3.10.0 · CVE-2026-85990
-
Medium yourls/yourls 28K installs
YOURLS: Unauthenticated File Inclusion
Fixed in 1.10.5 · CVE-2026-62858
-
Not rated drupal/core 71M installs
A remote code execution vulnerability exists within the Field UI module in Drupal core. The vulnerability is not directly exploitable with core alone, but mult...
Fixed in 10.6.19, 11.3.19, 11.4.10, 12.0.0-beta2 · CVE-2026-108097
-
Not rated drupal/core 71M installs
The Drupal core Link module provides a field type that can be used for internal and external URLs. The module does not sufficiently sanitize certain markup in...
Fixed in 10.6.19, 11.3.19, 11.4.10, 12.0.0-beta2 · CVE-2026-108515
-
Not rated drupal/core 71M installs
The Navigation module doesn't sufficiently sanitize certain attributes, which can lead to a cross-site scripting (XSS) vulnerability. This vulnerability is mit...
Fixed in 10.6.19, 11.3.19, 11.4.10, 12.0.0-beta2 · CVE-2026-108514
Drupal contributed modules: 2 advisories
-
Not rated drupal/entity_list
The Entity List module provides a way to create lists of entities without Views. The module has a remote code execution vulnerability. The vulnerability is no...
Fixed in 3.0.10 · CVE-2026-108099
-
Not rated drupal/gin
Gin is an administration theme that provides a modern, clean, and customizable backend UI for editors and site administrators. The module doesn't sufficiently...
Fixed in 4.1.4, 5.0.16 · CVE-2026-110738
Advisories from OSV.dev, which gathers the GitHub Advisory Database, FriendsOfPHP and Drupal security advisories; summaries are theirs. "Exploited in the wild" means the CVE is in CISA's Known Exploited Vulnerabilities catalogue when the digest was drafted. Ordered by that, then severity, then installs on Packagist.