Advisory Catalog

This module provides a framework for integrating AI providers and features into Drupal. Audio for every speech-to-text request is written to the same file in the temporary directory and does not delete it afterwards. As a result, an attacker who can read the site's temporary directory could get the

This module provides a framework for integrating Drupal with AI providers. Its AI Search submodule provides a Search API backend that stores content in a vector database for semantic search. The AI Search submodule has always been marked as 'experimental' but more importantly is deprecated. You may

This AI module enables you to interact with AI providers. It has a service that helps any consumer of the module to stop cross site scripting elements from appearing. The module does not sufficiently validate Markdown links under certain conditions, potentially allowing cross-site scripting (XSS).

This module enables you to use AI on the website. It also enables you to interact with AI providers. The module does not sufficiently validate links under certain conditions, potentially allowing the exfiltration of sensitive information to external sites. This vulnerability is mitigated by the fa

This module enables you to use AI on the website. It includes an AI Chatbot submodule allows you to setup a chatbot. Under certain configurations, the chatbot does not sufficiently filter user input before rendering it, potentially allowing cross-site scripting (XSS). This vulnerability is mitigat

This module enables you to use AI on the website. The module does not sufficiently restrict HTML rendering, allowing cross-site scripting (XSS) under certain conditions. This vulnerability is mitigated by the fact that an attacker must have access to a text format that can render HTML.

This module enables you to use the Stripe Connect API to quickly configure your Drupal Commerce store to take payments via multiple Stripe APIs. Under certain rare circumstances, the module may expose a cross-site scripting vulnerability. This vulnerability is mitigated by the fact that an attacke

This module enables you to take payments via multiple Stripe APIs. The module doesn't sufficiently verify the cryptographic signature of a webhook event when a signing secret has not been properly configured in the payment gateway settings. This vulnerability is mitigated by the fact that not all

This module enables you to use the Stripe Connect API to quickly configure your Drupal Commerce store to take payments via multiple Stripe APIs. When redirecting to Stripe Connect to generate an authorization code, the module does not incorporate a CSRF token into the return URI. This could allow a

This module enables you to sell tangible products via Drupal Commerce that are organized into shipments for fulfillment. The module doesn't sufficiently check access on the form to resend receipts. Under certain configurations, this allows some users to gain access to receipts and customer informat

This module enables you to sell tangible products via Drupal Commerce that are organized into shipments for fulfillment. The module doesn't sufficiently protect shipment references and shipment entity fields, leading to an access bypass that can result in inappropriately modified shipment states or

This module enables you to sell licenses granting access to resources, such as user roles, files, or protected content. The module doesn't sufficiently restrict access to license fields for users with the "update own commerce\_license" permission. A license owner can change the rights granted by th

This module enables you to sell goods and services to customers through a shopping cart and checkout form. The module doesn't sufficiently restrict the product variations returned by entity queries to the variations the current user can view. When the core JSON:API module is enabled, a visitor can

This module enables you to sell goods and services to customers through a shopping cart and checkout form. It shows an inbox on the Commerce dashboard with announcements from the Drupal Commerce project, including notices about security updates. Routes for the inbox do not check for a CSRF token. A

This module enables you to sell goods and services to customers through a shopping cart and checkout form. Sites can also create multiple online stores that are managed by different users. The module doesn't check access properly when a store is saved. A user who can either create stores or edit th

This module enables you to sell goods and services to customers through a shopping cart and checkout form. It includes a feature to manage promotions and the coupons that apply them. The module doesn't sufficiently check access to the relationship between promotions and coupons. A user who is only

This module enables you to sell goods and services to customers through a shopping cart and checkout form. When Drupal Commerce is used with the JSON:API module, it is possible for unpublished product variations to be accessible to users without permission. This vulnerability is mitigated by only

This module enables you to sell goods and services to customers through an included shopping cart and checkout form or through decoupled applications via APIs. The module doesn't sufficiently protect certain routes and entity fields, leading to an access bypass that may financially impact the vendo

MLflow vulnerable to remote code execution on unauthenticated servers via third-party scorer deserialization importing caller-placed artifact modules

dd-trace: ReDOS in URL query string obfuscation

OpenTelemetry Python: Unbounded memory allocation in Jaeger baggage propagation

MLflow CrewAI autologging records LLM provider API keys in logged trace spans

MLflow vulnerable to arbitrary file read on unauthenticated servers via prompt model version source

CKEditor: Cross-site scripting (XSS) in the engine package

CKEditor: Cross-site scripting (XSS) in the engine package

Model Context Protocol Python SDK: Client fetched server-chosen $ref URLs while validating tool results against output schemas

Model Context Protocol Python SDK: HTTP client transports followed cross-origin redirects carrying custom headers and bodies

Model Context Protocol Python SDK: Server bearer-token authentication accepts tokens issued for a different resource server

MCP TypeScript SDK: HTTP server transports and handlers did not limit request body size or JSON-RPC batch length

TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` serialization

systeminformation has prototype pollution in `networkStats()` via the interface name

systeminformation has path traversal in Linux networkStats() that allows symlink-based file disclosure outside /sys/class/net