Drupal Security Team

Monster Menus - Critical - PHP object injection - SA-CONTRIB-2026-253 Read post

Rabbit Hole - Moderately critical - Access Bypass - SA-CONTRIB-2026-252 Read post

AI File to Text - Moderately critical - Access bypass - SA-CONTRIB-2026-251 Read post

Data field - Moderately critical - Cross site scripting - SA-CONTRIB-2026-250 Read post

Domain Login Restrict - Moderately critical - Access bypass - SA-CONTRIB-2026-249 Read post

Shield - Moderately critical - Access bypass - SA-CONTRIB-2026-248 Read post

ImageAPI Optimize WebP - Moderately critical - Information disclosure - SA-CONTRIB-2026-247 Read post

TinyPNG - Moderately critical - Information disclosure - SA-CONTRIB-2026-246 Read post

Media Alias Display - Moderately critical - Information disclosure - SA-CONTRIB-2026-245 Read post

Fullcalendar View - Moderately critical - Access bypass - SA-CONTRIB-2026-244 Read post

Media Bulk Upload - Moderately critical - Access bypass - SA-CONTRIB-2026-243 Read post

Simple OAuth (OAuth2) & OpenID Connect - Moderately critical - Access bypass - SA-CONTRIB-2026-242 Read post

Frontend Editing - Less critical - Access bypass - SA-CONTRIB-2026-241 Read post

Frontend Editing - Moderately critical - Cross-Site Request Forgery (CSRF) - SA-CONTRIB-2026-240 Read post

Simple User Management - Moderately critical - Access bypass - SA-CONTRIB-2026-239 Read post

Domain - Moderately critical - Access bypass - SA-CONTRIB-2026-238 Read post

DocCheck Basic - Moderately critical - Access bypass - SA-CONTRIB-2026-237 Read post

Bootstrap - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-236 Read post

View Unpublished - Moderately critical - Access bypass - SA-CONTRIB-2026-235 Read post

USWDS Paragraph Components - Moderately critical - Cross site scripting - SA-CONTRIB-2026-234 Read post

Swiper formatter - Moderately critical - Information disclosure - SA-CONTRIB-2026-233 Read post

Block Attributes - Moderately critical - Cross site Scripting - SA-CONTRIB-2026-232 Read post

Ágora Transparency Theme - Moderately critical - Information disclosure - SA-CONTRIB-2026-231 Read post

UI Icons - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-230 Read post

Sector Distribution - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-229 Read post

Swiper formatter - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-228 Read post

Dopup - Critical - Information disclosure - SA-CONTRIB-2026-227 Read post

CSV Field - Moderately critical - Cross site Scripting - SA-CONTRIB-2026-226 Read post

Custom Formatters - Critical - Remote code execution - SA-CONTRIB-2026-225 Read post

ABC - Critical - Cross-site scripting - SA-CONTRIB-2026-224 Read post

Black Hole - Critical - Cross-site scripting - SA-CONTRIB-2026-223 Read post

Zero Point - Critical - Cross-site scripting - SA-CONTRIB-2026-222 Read post

UI Icons - Critical - Cross site scripting - SA-CONTRIB-2026-221 Read post

Ffmpeg Image Toolkit - Highly critical - Remote Code Execution - SA-CONTRIB-2026-220 Read post

Critical PHP update on Wednesday, October 21, 2026 (14:00 UTC) - PSA-2026-10-20 Read post

The PHP security team is giving advance notice: Upcoming security release Wed, Oct 21st 2026, 14:00UTC, two critical vulnerabilities, both rated CVSSv4 9.2. PHP users are encouraged to prepare to update. Earlier release if details become public or active exploit evidence.

Entity List - Critical - Remote code execution - SA-CONTRIB-2026-218 Read post

Gin Admin Theme - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-219 Read post

Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-016 Read post

Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-015 Read post

Drupal core - Critical - Remote code execution - SA-CORE-2026-014 Read post

Upcoming critical Drupal core release on October 14, 2026 - PSA-2026-10-12 Read post

Thrilled to announce that four provisional members have earned full membership on the Drupal Security Team! Welcome: 🇫🇷 Pierre Rudloff 🇦🇺 Joseph Zhao 🇧🇪 Bram Driesen 🇺🇸 Swan Kalata www.drupal.org/drupal-secur... #Drupal #OpenSource #Security

Advanced Filesystem - Moderately critical - Cross-Site Request Forgery - SA-CONTRIB-2026-217 Read post

Restrict route by IP - Critical - Access bypass - SA-CONTRIB-2026-216 Read post

Examples for Developers - Less critical - Allocation of resources without limits or throttling - SA-CONTRIB-2026-215 Read post

Permissions by Term - Moderately critical - Information disclosure - SA-CONTRIB-2026-214 Read post

Freelinking - Moderately critical - Information Disclosure - SA-CONTRIB-2026-213 Read post

Easy Breadcrumb - Moderately critical - Information disclosure - SA-CONTRIB-2026-212 Read post

Country - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-211 Read post