Sign in
Deutsch English Español Polski
Vulnerability archive

Understand vulnerabilities. Protect your applications.

Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.

Vulnerability archive 54

Reset filters
Unrated
CVE-2026-114532

drupal/ui_icons - SA-CONTRIB-2026-230

A cross-site scripting vulnerability in the Drupal UI Icons module allows attackers with permission to edit content using an authorized text format to execute arbitrary scripts via the CKEditor widget under uncommon situations.

Composer Drupal

drupal/ui_icons, ui_icons

Unrated
CVE-2026-114523

drupal/ffmpeg_image_toolkit - SA-CONTRIB-2026-220

A vulnerability in the FFmpeg Image Toolkit module allows unsanitized file names to be passed to the ffmpeg command-line tool. An attacker must have permission to upload images to exploit this flaw.

Composer Drupal

drupal/ffmpeg_image_toolkit, ffmpeg_image_toolkit

Unrated
CVE-2026-114553

drupal/frontend_editing - SA-CONTRIB-2026-241

A vulnerability in the Drupal Frontend Editing module fails to properly enforce field access permissions when modifying paragraph items, requiring specific editing roles to exploit.

Composer Drupal

drupal/frontend_editing, frontend_editing

Unrated
CVE-2026-114525

drupal/abc - SA-CONTRIB-2026-224

The ABC theme for Drupal does not sufficiently sanitize menu link titles before inserting them into HTML class attributes. An attacker with permissions to create or modify menu link titles could exploit this issue.

Composer Drupal

drupal/abc, abc

Unrated
CVE-2026-114541

drupal/frontend_editing - SA-CONTRIB-2026-240

A Cross-Site Request Forgery vulnerability in the Drupal frontend_editing module allows attackers to trick an authenticated editor into deleting or reordering paragraphs on a node.

Composer Drupal

drupal/frontend_editing, frontend_editing

Unrated
CVE-2026-114534

drupal/block_attributes - SA-CONTRIB-2026-232

A cross-site scripting vulnerability in the Drupal Block Attributes module allows attackers with specific permissions to inject malicious attributes into blocks due to insufficient sanitization.

Composer Drupal

drupal/block_attributes, block_attributes

Unrated
CVE-2026-114544

drupal/media_bulk_upload - SA-CONTRIB-2026-243

The Drupal Media Bulk Upload module does not sufficiently verify permissions to create specific media types when using the bulk upload form. An attacker must have the bulk upload form permission to exploit this vulnerability.

Composer Drupal

drupal/media_bulk_upload, media_bulk_upload

Unrated
CVE-2026-107260

drupal/sector - SA-CONTRIB-2026-229

A module in the Sector distribution for Drupal does not sufficiently sanitize media names, potentially allowing users with media creation or editing permissions to conduct cross-site scripting attacks.

Composer Drupal

drupal/sector, sector

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.