-
Critical laravel/framework 604M installs
Laravel TokenGuard authentication bypass through non-string API credentials
Fixed in 13.29.0, 12.68.0 · CVE-2026-114509 · What to do
-
Medium laravel/framework 604M installs
Laravel relationship inclusion can trigger unauthorized data destruction
Fixed in 12.68.0, 13.27.0 · CVE-2026-114508 · What to do
-
Medium livewire/livewire 117M installs
Livewire: Authorization bypass in #[Authorize] via reordered parameter keys and #[Json] execution order
Fixed in 4.4.8 · GHSA-mhf7-xp6r-6qrc · What to do
-
Medium cachethq/cachet 725 installs
Cachet has Stored XSS in Incident Component
CVE-2026-113712 · What to do
Drupal contributed modules: 33 advisories
-
Not rated drupal/sector 13K installs
Sector is a distribution targeted towards Drupal site builders and site owners who are looking for a fully configured Drupal project out of the box. A module s...
Fixed in 10.3.3, 10.4.2 · CVE-2026-107260 · What to do
-
Not rated drupal/monster_menus
This module enables you to create one or more multisites with highly granular page permissions. The included RSS Page submodule allows you to create nodes which...
Fixed in 9.5.6 · CVE-2026-114573 · What to do
-
Not rated drupal/swiper_formatter
Swiper is mobile first, layout and gestures wise, it provides great amount of options for designing your own widget and related events. This module provides a...
Fixed in 2.1.2, 3.1.0 · CVE-2026-114535 · What to do
-
Not rated drupal/media_alias_display
This module allows for direct viewing of a file with the URL alias. In some cases, files may be served with the HTTP header `Cache-Control: public` when they s...
Fixed in 2.1.2, 3.0.2 · CVE-2026-114546 · What to do
-
Not rated drupal/fullcalendar_view
This module provides a View plugin that integrates a calendar view format powered by FullCalendar JavaScript library. This module has an access bypass vulnerab...
Fixed in 5.2.6 · CVE-2026-114545 · What to do
-
Not rated drupal/rabbit_hole
Rabbit Hole lets site builders control what happens when an entity's page is viewed: show it, return an access denied or not found response, or redirect the vis...
Fixed in 1.3.0 · CVE-2026-114571 · What to do
-
Not rated drupal/imageapi_optimize_webp
This module enables you to generate and serve WebP derivatives of image style images, overriding Drupal core's image style download controller to serve them. T...
Fixed in 2.1.2 · CVE-2026-114548 · What to do
-
Not rated drupal/ai_file_to_text
The AI File to Text module extracts text from uploaded documents, including Word, PDF, OpenDocument, CSV, Markdown and plain text files, and exposes that extr...
Fixed in 1.0.1 · CVE-2026-114554 · What to do
-
Not rated drupal/domain_login_restrict
This module enables you to restrict user logins on a multi-domain site built with the Domain module, so that users can only log in on the domains assigned to th...
Fixed in 1.5.0 · CVE-2026-114572 · What to do
-
Not rated drupal/datafield
Data Field allows you to create custom fields with multiple values under the default table form. The `file_uri` formatter does not properly escape filenames wh...
Fixed in 2.0.14 · CVE-2026-114555 · What to do
-
Not rated drupal/tinypng
TinyPNG uses smart lossy compression techniques to reduce the file size of your PNG files. The module doesn't sufficiently check access to image style derivati...
Fixed in 2.0.2 · DRUPAL-CONTRIB-2026-246 · What to do
-
Not rated drupal/swiper_formatter
The module provides integration with third party JS library SwiperJs. User-entered text is used as part of the slide without appropriate filtering leading to a...
Fixed in 2.1.2, 3.1.0 · CVE-2026-114531 · What to do
-
Not rated drupal/shield
The Shield module enables you to protect a site behind an HTTP basic authentication prompt, so that an unfinished or non-public site cannot be viewed, crawled o...
Fixed in 1.9.0 · CVE-2026-107256 · What to do
-
Not rated drupal/simple_user_management
This module lets non-administrators approve, deactivate and delete users, limited by the roles they can delegate through Role Delegation. The module doesn't su...
Fixed in 1.11.0 · CVE-2026-114543 · What to do
-
Not rated drupal/view_unpublished
This module allows granting access to unpublished nodes per content type. For nodes with at least one unpublished translation, the module grants every user wit...
Fixed in 1.5.0 · CVE-2026-114537 · What to do
-
Not rated drupal/bootstrap
Provides the Bootstrap front-end framework as a Drupal theme. Bootstrap theme did not sufficiently filter certain attributes, which could lead to a cross-site...
Fixed in 3.45.0 · CVE-2026-114538 · What to do
-
Not rated drupal/domain
This module enables you to share users, content and configuration across a group of domains from a single Drupal installation. Its Domain Access submodule contr...
Fixed in 3.0.2 · DRUPAL-CONTRIB-2026-238 · What to do
-
Not rated drupal/uswds_paragraph_components
This module provides a suite of Paragraphs bundles that works within the USWDS framework. The module's twig templates do not sufficiently sanitize values passe...
Fixed in 3.1.3 · CVE-2026-114536 · What to do
-
Not rated drupal/csv_field
This module enables you to upload CSV files to a field and display them as an interactive, sortable and searchable table. The module doesn't sufficiently escap...
Fixed in 2.0.10, 3.0.7 · CVE-2026-114529 · What to do
-
Not rated drupal/custom_formatters
The Custom Formatters module allows users to easily create custom Field Formatters through an admin UI without writing a custom module. The PHP formatter engin...
Fixed in 4.2.1 · CVE-2026-114524 · What to do
-
Not rated drupal/agora_theme
This theme provides a front-end design for transparency and open-government sites, including a table preview of CSV files attached to content. The theme doesn'...
Fixed in 1.2.3 · CVE-2026-114533 · What to do
-
Not rated drupal/zeropoint
The ZeroPoint theme provides configurable layouts and visual styling for Drupal websites, including support for Font Awesome icons in navigation menus. The the...
Fixed in 1.30.0, 2.0.1 · CVE-2026-114528 · What to do
-
Not rated drupal/black_hole
The Black Hole theme provides configurable layouts and visual styling for Drupal websites, including support for Font Awesome icons in navigation menus. The th...
Fixed in 1.26.0, 2.0.1 · CVE-2026-114526 · What to do
-
Not rated drupal/simple_oauth
This module introduces an OAuth 2.0 authorization server, which can be configured to protect your Drupal instance with access tokens, or allow clients to reques...
Fixed in 6.1.3 · CVE-2026-114542 · What to do
-
Not rated drupal/ui_icons
This module provides a user interface to select and configure icons, including a CKEditor 5 button and widget that embed an icon in formatted text. Under uncom...
Fixed in 1.1.3, 2.0.2 · CVE-2026-114532 · What to do
-
Not rated drupal/ffmpeg_image_toolkit
This module enables you to use ffmpeg for image conversion The module doesn't sufficiently sanitize file names passed to the ffmpeg cli tool. This vulnerabili...
Fixed in 1.0.3 · CVE-2026-114523 · What to do
-
Not rated drupal/frontend_editing
This module enables editors to edit content, including paragraphs, directly on the rendered page. The module doesn't sufficiently check field access permission...
Fixed in 1.9.3 · CVE-2026-114553 · What to do
-
Not rated drupal/abc
The ABC theme provides configurable layouts and visual styling for Drupal websites, including support for Font Awesome icons in navigation menus. The theme doe...
Fixed in 1.25.0, 2.0.1 · CVE-2026-114525 · What to do
-
Not rated drupal/dopup
The Dopup module provides functionality for selecting and working with Webforms. The module does not perform sufficient entity access checking in some cases an...
Fixed in 1.0.7 · CVE-2026-114530 · What to do
-
Not rated drupal/frontend_editing
This module enables editors to edit content, including paragraphs, directly on the rendered page. The module doesn't sufficiently protect the routes used to de...
Fixed in 1.9.3 · CVE-2026-114541 · What to do
-
Not rated drupal/block_attributes
This module allows you to define custom attributes for a block. You can specify an attribute name to be added to the block in a predefined format. The module d...
Fixed in 2.1.0 · CVE-2026-114534 · What to do
-
Not rated drupal/media_bulk_upload
This module enables users to upload files and create media items in bulk. The module doesn't sufficiently check user permission to create specific media types...
Fixed in 3.0.6 · CVE-2026-114544 · What to do
-
Not rated drupal/ui_icons
This module provides a user interface to select and configure icons, including a form element, a text format filter and several integrations. The module doesn'...
Fixed in 1.1.3, 2.0.2 · CVE-2026-114527 · What to do
Advisories from OSV.dev, which gathers the GitHub Advisory Database, FriendsOfPHP and Drupal security advisories; summaries are theirs. "Exploited in the wild" means the CVE is in CISA's Known Exploited Vulnerabilities catalogue when the digest was drafted. Ordered by that, then severity, then installs on Packagist.