Advisory Catalog

Waline login accepts a non-string email as a match-all MongoDB query

LangGraph JavaScript custom authentication may permit cross-user Store access

filelock: StrictSoftFileLock creates its claim directories without the lock mode, so another local user with a write bit on them can end a live hold

filelock: WindowsFileLock ignores mode: a 0o600 lock file and the ReadWriteLock database inherit the directory ACL

filelock: StrictSoftFileLock follows a symbolic link swapped in at <path>.filelock and creates claim files in a directory another local user chooses

Happy DOM: SSRF via iframe and link stylesheet when parsing untrusted HTML

Happy DOM has cookie scope forgery: no DNS-label boundary on Domain= matching , attacker origin sets victim cookies

LangGraph: Unencoded identifiers in LangGraph SDK v3 streaming can redirect authenticated GET requests

GraphQL Tools: Per-request connection parameters persist into later users' WebSocket authentications

GraphQL Tools: Shared legacy executor routes one subscription's results to a different caller

@hono/node-server: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths

mcp-sanitizer: URL sanitizer allows localhost/IPv6 loopback SSRF bypass via explicit port or bracketed IPv6

mcp-sanitizer: File Path Sanitizer Permits Arbitrary User-Home Absolute Paths

rucio has an Authorization Bypass on REST API endpoint for signing URLs

i18next-http-backend: Query-parameter injection through & and = in lng when loadPath/addPath puts {{lng}} in the query string

Vue I18n: escapeParameter does not prevent XSS through srcdoc in translation messages

Vue I18n: `escapeParameter` does not escape named values when the same call also passes a list

Highcharts Grid: `javascript:` URL in credits.href runs script on click

Highcharts Grid parses pagination language options as HTML

Highcharts Dashboards parses fullscreen labels as HTML

Highcharts Dashboards parses sidebar component labels as HTML

Highcharts: `javascript:` URL in credits.href runs script on click

Highcharts: dotted series.keys paths write to Object.prototype

Highcharts: series column construction writes to Object.prototype

Highcharts Dashboards / Grid Pro: `DataTable.setCell` and column writers treat `__proto__` as an existing column.

Highcharts Core: `breadcrumbs.style` keys become SVG event-handler attributes

Highcharts Dashboards: `chartConstructor` is an unchecked lookup into the Highcharts namespace

Highcharts Core: HTML text parsing falls back to unfiltered `innerHTML` during printing

Highcharts Dashboards: `__proto__` data table id writes sync listeners to `Object.prototype`

Highcharts Grid: custom icon definition objects written with raw `setAttribute` on `<path>`

Highcharts Grid Pro: cell-renderer `attributes` map written with raw `setAttribute`

Highcharts Core: `javascript:` URL in an `xlink:href` attribute survives text filtering and reaches exported charts

RE2JS: Quadratic-time denial of service in re2js lookbehind matching

This module allows for direct viewing of a file with the URL alias. This is a followup advisory to [SA-CONTRIB-2026-245](https://www.drupal.org/sa-contrib-2026-245), which did not fully resolve the underlying vulnerability. In some cases, files may be served with the HTTP header `Cache-Control: pu

This module enables you to share and reuse content across websites. The module did not sufficiently encrypt the password of the system user used when synchronizing content. This can potentially allow unprivileged users to view the password. This vulnerability is mitigated by the fact that an attac

This module lets you manage system-wide OAuth2 access and refresh tokens for Box, Quip, and Slack integrations through Drush and an OAuth2 validation callback. The module doesn't restrict access to its OAuth2 routes, allowing an an anonymous visitor to potentially connect the site's integration to

The Field Permissions module enables you to set field-level permissions for viewing and editing fields, including a "Private" setting. The module does not sufficiently restrict access to "Private" fields on entity types that have no field for an author (user account or owner). As a result, a field

This module enables you to set field-level permissions to create, update or view individual fields. The module does not sufficiently verify administrative privileges when checking access to protected fields, potentially allowing users with a role named `administrator` to bypass field-level access r

The module enables authentication via the OpenID Connect (oAuth2) protocol. When a new user logs in via OpenID Connect, the module tries to link the user to an existing account with the same email address. Doing so it allows to take over any existing Drupal account (except user 1) that has not yet

Stage File Proxy is a general solution for getting production files on a development server on demand. **It is not intended for usage on production sites.** The module doesn't sufficiently check file URL for malicious content when attempting to do fallback retrieval leading to a cross-site scriptin

This module enables users to create and save signatures as SVG images. The module did not sufficiently sanitize user-supplied content before saving it to the public file system. Under certain scenarios, a maliciously crafted file could contain active or otherwise unsafe content and may result in a

This module enables you to log in to your Drupal site using any OAuth 2.0 or OpenID Connect compliant identity provider. The module doesn't sufficiently check access on a configuration route, or check whether the identity provider has verified the email address it returns. Together, these let an at

This module provides a bulk form for assigning or removing roles on multiple user accounts at once. The bulk update form does not prevent access to users who do not have permission to assign roles. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "a

S3 File System (s3fs) provides an additional file system to your Drupal site that stores files in Amazon's Simple Storage Service (S3) storage. The module doesn't sufficiently isolate upload context between separate object(file) operations in the same request resulting in the potential for objects

This module enables you to quickly toggle the publication status, promotion and stickiness of nodes, and the publication status of comments, from links on the page. The module doesn't sufficiently protect against cross-site request forgery (CSRF) on its toggle URL, under the scenario where a user w

This module enables you to quickly toggle the publication status, promotion and stickiness of nodes, and the publication status of comments, from links on the page. The module doesn't sufficiently check access to the entity being toggled, under the scenario where a user with the "Use Fasttoggle" pe

The CAPTCHA module places a configurable challenge on forms to block automated submissions. To skip the challenge on later steps of the same multi-step form, the module remembers that a CAPTCHA session has been solved. The module does not fully invalidate a solved CAPTCHA session. As a result, a pr