PatchClock

PHP security digest · Advisories

Security advisories for Composer packages

222 advisories we have followed since September 2026, newest first. Each page says who is affected, which versions fix it and how to check your project.

Advisory Severity
Laravel TokenGuard authentication bypass through non-string API credentials laravel/framework · CVE-2026-114509 · 23 Oct 2026 Critical
Laravel relationship inclusion can trigger unauthorized data destruction laravel/framework · CVE-2026-114508 · 23 Oct 2026 Medium
Livewire: Authorization bypass in #[Authorize] via reordered parameter keys and #[Json] execution order livewire/livewire · GHSA-mhf7-xp6r-6qrc · 23 Oct 2026 Medium
This module enables you to create one or more multisites with highly granular page permissions. The included RSS Page submodule allows you to create nodes which... drupal/monster_menus · CVE-2026-114573 · 21 Oct 2026 Not rated
Rabbit Hole lets site builders control what happens when an entity's page is viewed: show it, return an access denied or not found response, or redirect the vis... drupal/rabbit_hole · CVE-2026-114571 · 21 Oct 2026 Not rated
The AI File to Text module extracts text from uploaded documents, including Word, PDF, OpenDocument, CSV, Markdown and plain text files, and exposes that extr... drupal/ai_file_to_text · CVE-2026-114554 · 21 Oct 2026 Not rated
Data Field allows you to create custom fields with multiple values under the default table form. The `file_uri` formatter does not properly escape filenames wh... drupal/datafield · CVE-2026-114555 · 21 Oct 2026 Not rated
This module enables you to restrict user logins on a multi-domain site built with the Domain module, so that users can only log in on the domains assigned to th... drupal/domain_login_restrict · CVE-2026-114572 · 21 Oct 2026 Not rated
The Shield module enables you to protect a site behind an HTTP basic authentication prompt, so that an unfinished or non-public site cannot be viewed, crawled o... drupal/shield · CVE-2026-107256 · 21 Oct 2026 Not rated
This module enables you to generate and serve WebP derivatives of image style images, overriding Drupal core's image style download controller to serve them. T... drupal/imageapi_optimize_webp · CVE-2026-114548 · 21 Oct 2026 Not rated
TinyPNG uses smart lossy compression techniques to reduce the file size of your PNG files. The module doesn't sufficiently check access to image style derivati... drupal/tinypng · DRUPAL-CONTRIB-2026-246 · 21 Oct 2026 Not rated
This module allows for direct viewing of a file with the URL alias. In some cases, files may be served with the HTTP header `Cache-Control: public` when they s... drupal/media_alias_display · CVE-2026-114546 · 21 Oct 2026 Not rated
This module provides a View plugin that integrates a calendar view format powered by FullCalendar JavaScript library. This module has an access bypass vulnerab... drupal/fullcalendar_view · CVE-2026-114545 · 21 Oct 2026 Not rated
This module enables users to upload files and create media items in bulk. The module doesn't sufficiently check user permission to create specific media types... drupal/media_bulk_upload · CVE-2026-114544 · 21 Oct 2026 Not rated
This module introduces an OAuth 2.0 authorization server, which can be configured to protect your Drupal instance with access tokens, or allow clients to reques... drupal/simple_oauth · CVE-2026-114542 · 21 Oct 2026 Not rated
This module enables editors to edit content, including paragraphs, directly on the rendered page. The module doesn't sufficiently check field access permission... drupal/frontend_editing · CVE-2026-114553 · 21 Oct 2026 Not rated
This module enables editors to edit content, including paragraphs, directly on the rendered page. The module doesn't sufficiently protect the routes used to de... drupal/frontend_editing · CVE-2026-114541 · 21 Oct 2026 Not rated
This module lets non-administrators approve, deactivate and delete users, limited by the roles they can delegate through Role Delegation. The module doesn't su... drupal/simple_user_management · CVE-2026-114543 · 21 Oct 2026 Not rated
This module enables you to share users, content and configuration across a group of domains from a single Drupal installation. Its Domain Access submodule contr... drupal/domain · DRUPAL-CONTRIB-2026-238 · 21 Oct 2026 Not rated
Provides the Bootstrap front-end framework as a Drupal theme. Bootstrap theme did not sufficiently filter certain attributes, which could lead to a cross-site... drupal/bootstrap · CVE-2026-114538 · 21 Oct 2026 Not rated
This module allows granting access to unpublished nodes per content type. For nodes with at least one unpublished translation, the module grants every user wit... drupal/view_unpublished · CVE-2026-114537 · 21 Oct 2026 Not rated
This module provides a suite of Paragraphs bundles that works within the USWDS framework. The module's twig templates do not sufficiently sanitize values passe... drupal/uswds_paragraph_components · CVE-2026-114536 · 21 Oct 2026 Not rated
Swiper is mobile first, layout and gestures wise, it provides great amount of options for designing your own widget and related events. This module provides a... drupal/swiper_formatter · CVE-2026-114535 · 21 Oct 2026 Not rated
This module allows you to define custom attributes for a block. You can specify an attribute name to be added to the block in a predefined format. The module d... drupal/block_attributes · CVE-2026-114534 · 21 Oct 2026 Not rated
This theme provides a front-end design for transparency and open-government sites, including a table preview of CSV files attached to content. The theme doesn'... drupal/agora_theme · CVE-2026-114533 · 21 Oct 2026 Not rated
This module provides a user interface to select and configure icons, including a CKEditor 5 button and widget that embed an icon in formatted text. Under uncom... drupal/ui_icons · CVE-2026-114532 · 21 Oct 2026 Not rated
Sector is a distribution targeted towards Drupal site builders and site owners who are looking for a fully configured Drupal project out of the box. A module s... drupal/sector · CVE-2026-107260 · 21 Oct 2026 Not rated
The module provides integration with third party JS library SwiperJs. User-entered text is used as part of the slide without appropriate filtering leading to a... drupal/swiper_formatter · CVE-2026-114531 · 21 Oct 2026 Not rated
The Dopup module provides functionality for selecting and working with Webforms. The module does not perform sufficient entity access checking in some cases an... drupal/dopup · CVE-2026-114530 · 21 Oct 2026 Not rated
This module enables you to upload CSV files to a field and display them as an interactive, sortable and searchable table. The module doesn't sufficiently escap... drupal/csv_field · CVE-2026-114529 · 21 Oct 2026 Not rated
The Custom Formatters module allows users to easily create custom Field Formatters through an admin UI without writing a custom module. The PHP formatter engin... drupal/custom_formatters · CVE-2026-114524 · 21 Oct 2026 Not rated
The ABC theme provides configurable layouts and visual styling for Drupal websites, including support for Font Awesome icons in navigation menus. The theme doe... drupal/abc · CVE-2026-114525 · 21 Oct 2026 Not rated
The Black Hole theme provides configurable layouts and visual styling for Drupal websites, including support for Font Awesome icons in navigation menus. The th... drupal/black_hole · CVE-2026-114526 · 21 Oct 2026 Not rated
The ZeroPoint theme provides configurable layouts and visual styling for Drupal websites, including support for Font Awesome icons in navigation menus. The the... drupal/zeropoint · CVE-2026-114528 · 21 Oct 2026 Not rated
This module provides a user interface to select and configure icons, including a form element, a text format filter and several integrations. The module doesn'... drupal/ui_icons · CVE-2026-114527 · 21 Oct 2026 Not rated
This module enables you to use ffmpeg for image conversion The module doesn't sufficiently sanitize file names passed to the ffmpeg cli tool. This vulnerabili... drupal/ffmpeg_image_toolkit · CVE-2026-114523 · 21 Oct 2026 Not rated
Cachet has Stored XSS in Incident Component cachethq/cachet · CVE-2026-113712 · 20 Oct 2026 Medium
Leantime: Any Authenticated User Can Self-Escalate to Admin via Unauthorized JSON-RPC Methods leantime/leantime · CVE-2026-85990 · 15 Oct 2026 High
YOURLS: Unauthenticated File Inclusion yourls/yourls · CVE-2026-62858 · 15 Oct 2026 Medium
react/http: Unbounded HTTP Client Response Header Buffering Leads to Memory Exhaustion DoS react/http · CVE-2026-104827 · 15 Oct 2026 High
The Entity List module provides a way to create lists of entities without Views. The module has a remote code execution vulnerability. The vulnerability is no... drupal/entity_list · CVE-2026-108099 · 14 Oct 2026 Not rated
The Navigation module doesn't sufficiently sanitize certain attributes, which can lead to a cross-site scripting (XSS) vulnerability. This vulnerability is mit... drupal/core · CVE-2026-108514 · 14 Oct 2026 Not rated
The Drupal core Link module provides a field type that can be used for internal and external URLs. The module does not sufficiently sanitize certain markup in... drupal/core · CVE-2026-108515 · 14 Oct 2026 Not rated
Gin is an administration theme that provides a modern, clean, and customizable backend UI for editors and site administrators. The module doesn't sufficiently... drupal/gin · CVE-2026-110738 · 14 Oct 2026 Not rated
A remote code execution vulnerability exists within the Field UI module in Drupal core. The vulnerability is not directly exploitable with core alone, but mult... drupal/core · CVE-2026-108097 · 14 Oct 2026 Not rated
Contao: Protected page content is disclosed to anonymous visitors after contao.search.index_protected is disabled contao/core-bundle · CVE-2026-107842 · 9 Oct 2026 Medium
Contao: The registration module re-sends activation mails contao/core-bundle · CVE-2026-107843 · 9 Oct 2026 Medium
Contao: Cross-site request forgery in custom backend actions contao/core-bundle · CVE-2026-107848 · 9 Oct 2026 Low
Contao: Path traversal in the images controller contao/core-bundle · CVE-2026-107844 · 9 Oct 2026 Medium
Contao: Cross-site scripting in the comments bundle contao/comments-bundle · CVE-2026-107845 · 9 Oct 2026 Critical