Advisory Catalog

This module enables you to "share" a view display within another website via an iframe. The module doesn't sufficiently block access to view displays. Although the views data is not displayed, resource-intensive views could still be executed which could affect site performance. This vulnerability

The Leaflet module provides integration with the Leaflet JS mapping library. Under certain circumstances, when the Leaflet field formatter builds a map it does not filter content titles, leading to a stored cross-site scripting vulnerability. This vulnerability is mitigated by the fact an attacker

The Inline Formatter Field module allows site builders to template and style entities with a field. This module does not properly protect against template injection when parsing, allowing users to render protected data or execute unsafe Twig commands.

This module provides a new UI experience for node editing using the Gutenberg Editor library. The module does not sufficiently check entity access in several editor endpoints. This vulnerability is mitigated by the fact that an attacker must have a role with the “use gutenberg” permission.

This module provides TOTP-based two-factor authentication (2FA) for Drupal, with an optional setting to enforce 2FA for all users site-wide. The module may allow a user log in with only a password even when site-wide enforcement of 2FA is turned on.

This module enables you to link the output of a field to a URL or to the value of another field. The module doesn't sufficiently separate field content from template code when rendering linked field output. Depending on the Twig extensions installed on the site, this can be used to expose site conf

Backstage has improper input validation in TechDocs Markdown extension configuration

This module renders entity add/edit forms inside an AJAX dialog for use with entity reference fields. This module relies only on the "access administration pages" permission, without checking whether the current user had create or update access to the entity itself. This vulnerability is mitigated

Actstream (short for Activity Stream) aggregates a user's activity from external services (RSS feeds, etc.) into per-user activity stream entities. The configuration route does not sufficiently check that the user editing it is the account owner (or a user administrator) leading to an access bypass

This module provides TOTP-based two-factor authentication (2FA) for Drupal. The module doesn't enforce the second factor when a user logs in with Drupal core's one-time login link. This vulnerability is mitigated by the fact that an attacker must have access to a valid one-time login link for a vi

Flowise NodeVM sandbox escape via puppeteer allowlist - authenticated RCE and arbitrary file read via Chromium

The Drupal Security Team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, read the documentation on [becoming the maintainer of a project that is unsupported for security reaso

This module integrates the MathJax library into your Drupal site. MathJax is the modern JavaScript-based LaTeX rendering solution for the Internet. The module ships with library configurations that do not escape JavaScript within the TeX it formats. **Notice:** This release updates CDN URLs where

Entity Reference Manager is an advanced administrative module for Drupal that allows site administrators to identify, analyze, and replace entity references across the system. The module does not sufficiently restrict access to all entity management operations. Users who can view content can access

The Drupal Security Team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, read the documentation on [becoming the maintainer of a project that is unsupported for security reaso

The Block AJAX module enables you to load blocks asynchronously via Ajax. The module doesn't sufficiently validate user-supplied data which is used to construct a block. In the worst case scenario, this can lead to PHP Object Injection and Remote Code Execution. The vulnerability is mitigated by t

Quasar Framework: App Vite SSG page output paths can escape the configured distribution directory

PraisonAI: Code Injection via f-string Interpolation in Deploy API Server Generation

Backstage: Improper entity validation in deprecated Kubernetes services endpoint

Backstage has incorrect authorization in search engine permission filtering

Backstage has a sensitive information disclosure in Kubernetes resource queries

Backstage: Improper repository path validation in a Scaffolder backend module

Backstage: Improper input validation in Confluence to Markdown scaffolder module

Backstage: Improper validation of TechDocs MkDocs configuration

Backstage: Remote code execution via crafted markdown_extensions in TechDocs mkdocs.yml

PraisonAI: Platform members can delete owner issue dependencies through member-owned related issues

wger: Cross-User Data Corruption via Missing Ownership Check on WorkoutLog.slot_entry

wger: Trainer Privilege Escalation - Improper Privilege Management

wger: API credentials remain valid after logout/password change

wger: trainer_login accepts GET - CSRF bypass enables forced session rebinding

wger: cross-tenant admin notes/contracts leak via gym=None bypass (5 views)

LMCache: Remote code execution via unsafe deserialization in multiprocess mode transport

Backstage: Improper validation of MkDocs theme configuration in TechDocs

Backstage has potential file exposure through local TechDocs publisher

Backstage has improper input validation in scaffolder task list ordering

Backstage: Bypass of MkDocs configuration sanitizer in TechDocs backend

Backstage has sensitive information exposure in scaffolder task logs

Backstage: Scaffolder action input authorization bypass

Backstage may expose sensitive information in Scaffolder task failure events

Backstage: Sensitive information exposure in Scaffolder