Critical: PHP has an open critical advisory
Read the advisory →Drupal stack security advisories
The tools a typical Drupal app runs on, in one list: PHP, Drupal, Symfony components, Twig, Guzzle and Composer.
15 advisories affect supported versions.
Tools in the stack
Each has its own page, with its supported branches and a check for your version.
Advisories across the stack
298 advisories, newest first.
-
high CVE-2026-118514 Reviewed
Symfony Security: HEAD Requests Skip access_control Rules Limited to GET
Lets HEAD requests reach pages that access_control rules or firewalls protect only for GET, running the controller without the check.
Update Symfony to
8.1.x 8.1.11 7.4.x 7.4.23 6.4.x 6.4.50 5.4.x 5.4.56 -
high CVE-2026-118515 Reviewed
Symfony Serializer: Fake UploadedFile Data Can Point at Any Server File
Lets a client make an app treat any server file as an upload in apps that deserialize request data into UploadedFile properties.
Update Symfony to
8.1.x 8.1.11 7.4.x 7.4.23 6.4.x 6.4.50 5.4.x 5.4.56 -
high CVE-2026-118516 Reviewed
Symfony Routing: Host Placeholders Can Bypass Path-Based Access Rules
Lets requests reach controllers that path-based access_control rules protect, in apps with routes that use host placeholders.
Update Symfony to
8.1.x 8.1.11 7.4.x 7.4.23 6.4.x 6.4.50 5.4.x 5.4.56 -
medium CVE-2026-123125 Reviewed
Symfony Validator: Ip Constraint Accepts Some Internal Addresses as Public
Lets internal addresses pass #[Assert\Ip] public or no-private checks, getting past SSRF guards built on the Ip constraint.
Update Symfony to
8.1.x 8.1.11 7.4.x 7.4.23 6.4.x 6.4.50 5.4.x 5.4.56 -
low Reviewed
Symfony HttpFoundation: Paths Glued to index.php Bypass Web Server Path Rules
Lets requests get past nginx, Apache, CDN or WAF rules on a path like /admin, while Symfony still routes them to that path.
Update Symfony to
8.1.x 8.1.11 7.4.x 7.4.23 6.4.x 6.4.50 5.4.x 5.4.56 -
medium Reviewed
Symfony: private_ranges Trusted Proxies Setting Trusts Some Remote Clients
Lets some IPv6 clients pass as trusted proxies and set X-Forwarded headers in apps that use trusted_proxies: private_ranges.
Update Symfony to
8.1.x 8.1.11 7.4.x 7.4.23 -
medium Reviewed
Symfony HttpFoundation: Crafted Links Make Generated URLs Point Elsewhere
Lets a crafted link make an app's links, forms and redirects point to another host, when its front controller sits in a subdirectory.
Update Symfony to
8.1.x 8.1.11 7.4.x 7.4.23 6.4.x 6.4.50 5.4.x 5.4.56 -
high CVE-2026-123792 Reviewed
Symfony Yaml: Small Documents Can Tie Up the Parser for Minutes
Lets an attacker keep a PHP worker busy with one small YAML document in apps that parse untrusted YAML, including some #[MapRequestPayload] endpoints.
Update Symfony to
8.1.x 8.1.11 7.4.x 7.4.23 6.4.x 6.4.50 5.4.x 5.4.56 -
high CVE-2026-121623 Reviewed
Symfony Serializer: Data URIs Can Read Any File on the Server
Lets a client read any file PHP can read in apps that deserialize client data into SplFileObject, SplFileInfo or File properties.
Update Symfony to
8.1.x 8.1.11 7.4.x 7.4.23 6.4.x 6.4.50 5.4.x 5.4.56 -
medium CVE-2026-122053 Reviewed
Symfony Serializer: Nested Properties Marked #[Ignore] Can Still Be Set
Lets a client set #[Ignore] properties on nested objects in apps that deserialize input with ObjectNormalizer, such as #[MapRequestPayload].
Update Symfony to
8.1.x 8.1.11 7.4.x 7.4.23 6.4.x 6.4.50 5.4.x 5.4.56+ 1 older release
-
low CVE-2026-123339 Reviewed
Symfony HttpKernel: Inline Fragments Let Forwarded Headers Change URLs
Lets client headers set the host of absolute URLs after an inline fragment renders, in apps reached from 127.0.0.1 without it as a trusted proxy.
Update Symfony to
8.1.x 8.1.11 7.4.x 7.4.23 6.4.x 6.4.50 5.4.x 5.4.56+ 2 older releases
-
high Reviewed
Symfony Filesystem: Crafted Paths Can Escape Their Base Directory
Lets an attacker read or write files outside an allowed folder in apps that check user paths with Path, and lets packages write outside assets/vendor.
Update Symfony to
8.1.x 8.1.11 7.4.x 7.4.23 6.4.x 6.4.50 5.4.x 5.4.56 -
medium CVE-2026-45070 Reviewed
Symfony Mime: Header Injection Through Mime Parameter Names
Lets an attacker add extra email headers in apps that build a Content-Type or Content-Disposition parameter name from user input.
Update Symfony to
8.1.x 8.1.10 7.4.x 7.4.22 6.4.x 6.4.49 5.4.x 5.4.55 -
critical CVE-2026-109618
RCE via OOM corruption
Update PHP to
8.5.x 8.5.12 8.4.x 8.4.27 8.3.x 8.3.36 8.2.x 8.2.35 -
critical CVE-2026-109619
RCE via stale global state
Update PHP to
8.5.x 8.5.12 8.4.x 8.4.27 8.3.x 8.3.36 8.2.x 8.2.35 -
medium CVE-2026-59944 Reviewed
Composer: Malicious Package Can Change File Permissions Outside Vendor
Lets a malicious dependency make a file outside its own folder readable and runnable by anyone, getting around the earlier GHSA-gjfg-22fp-rrxx fix.
Update Composer to
2.10.x 2.10.3+ 1 older release
-
medium CVE-2026-93682
Out-of-bounds read in the HTTP stream wrapper when following a redirect with an empty Location header
Update PHP to
8.5.x 8.5.11 8.4.x 8.4.26 8.3.x 8.3.35 8.2.x 8.2.34 -
medium CVE-2026-92842
OOB read / info leak in convert.* stream filters when line-break-chars contains NUL
Update PHP to
8.5.x 8.5.11 8.4.x 8.4.26 8.3.x 8.3.35 8.2.x 8.2.34 -
Update PHP to
8.5.x 8.5.10 8.4.x 8.4.25 8.3.x 8.3.35 8.2.x 8.2.34 -
medium CVE-2026-91768
IPv6 ACL bypass in FastCGI listen.allowed_clients due to partial address comparison (memcmp 12 bytes)
Update PHP to
8.5.x 8.5.11 8.4.x 8.4.26 8.3.x 8.3.35 8.2.x 8.2.34 -
medium CVE-2026-91769
TLS Hostname Verification Falls Back to CN After SAN Mismatch
Update PHP to
8.5.x 8.5.11 8.4.x 8.4.26 8.3.x 8.3.35 8.2.x 8.2.34 -
medium CVE-2026-91767
Heap-buffer-overflow in php_openssl_matches_wildcard_name on crafted server cert wildcard CN
Update PHP to
8.5.x 8.5.11 8.4.x 8.4.26 8.3.x 8.3.35 8.2.x 8.2.34 -
low CVE-2025-1218
Various packet overreads in mysqlnd_writeprotocol.c
Update PHP to
8.5.x 8.5.11 8.4.x 8.4.26 8.3.x 8.3.35 8.2.x 8.2.34 -
medium CVE-2026-91766
Cross-origin credential leak in HTTP stream wrapper redirects
Update PHP to
8.5.x 8.5.11 8.4.x 8.4.26 8.3.x 8.3.35 8.2.x 8.2.34 -
high CVE-2026-91765
SOAP: Unbounded Recursion in Server-Side cleanup_xml_node
Update PHP to
8.5.x 8.5.11 8.4.x 8.4.26 8.3.x 8.3.35 8.2.x 8.2.34 -
medium CVE-2025-14181
Integer overflow to buffer overflow in soap HTTP parsing
Update PHP to
8.5.x 8.5.11 8.4.x 8.4.26 8.3.x 8.3.35 8.2.x 8.2.34 -
medium CVE-2026-6103
Phar TAR phar_tar_number() Integer Overflow - Archive Entry Injection
Update PHP to
8.5.x 8.5.11 8.4.x 8.4.26 8.3.x 8.3.35 8.2.x 8.2.34 -
medium CVE-2026-17545
PHP on Windows: Reserved Device Names Are Not Rejected Before File/Stream I/O which can cause DoS
Update PHP to
8.5.x 8.5.11 8.4.x 8.4.26 8.3.x 8.3.35 8.2.x 8.2.34 -
high CVE-2026-108082 Reviewed
Symfony HttpFoundation: Crafted Cache-Control Header Ties Up the CPU
Lets an unauthenticated attacker burn close to a second of CPU per request with a crafted Cache-Control header, in any app built on HttpFoundation.
Update Symfony to
8.1.x 8.1.7 7.4.x 7.4.19 6.4.x 6.4.46 5.4.x 5.4.54 -
high CVE-2026-84361 Reviewed
Composer: Malicious Package Can Run Commands via a Perforce Source URL
Lets a malicious package run commands during composer install on machines with the p4 client, when it comes from a repository other than Packagist.org.
Update Composer to
2.10.x 2.10.3+ 1 older release
-
high CVE-2026-109413 Reviewed
Symfony Yaml: Deeply Nested Inline YAML Crashes the Process
Lets an attacker crash the PHP process with one YAML document in apps that parse untrusted YAML, including some #[MapRequestPayload] endpoints.
Update Symfony to
8.1.x 8.1.6 7.4.x 7.4.18 6.4.x 6.4.45 5.4.x 5.4.54 -
high CVE-2026-69246 Reviewed
Guzzle: Oddly Written Hosts Can Slip Past Host-Based Checks
Lets an attacker reach hosts an app meant to block, such as loopback, when the app builds Guzzle request URLs from user input and checks the host first.
Update Guzzle to
8.0.x 8.0.1 7.15.x 7.15.2 -
medium CVE-2026-69245 Reviewed
Guzzle: Cookies for Numeric or Escaped Domains Leak to Other Hosts
Can leak cookies set for an IP-style Domain to other hosts in apps that use Guzzle's cookie jar, exposing session ids or tokens.
Update Guzzle to
8.0.x 8.0.1 7.15.x 7.15.2 -
medium CVE-2026-7260
Stack overflow in phar with circular symlinks
Update PHP to
8.5.x 8.5.9 8.4.x 8.4.24 8.3.x 8.3.33 8.2.x 8.2.33 -
high CVE-2026-17544
Out-of-bounds write in bccomp() via crafted operand and scale
Update PHP to
8.5.x 8.5.9 8.4.x 8.4.24 -
high CVE-2026-17543
SQL injection in ext-pgsql via E'...' backslash breakout
Update PHP to
8.5.x 8.5.9 8.4.x 8.4.24 8.3.x 8.3.33 8.2.x 8.2.33 -
medium CVE-2026-59882 Reviewed
guzzlehttp/psr7: Malformed URI Hosts Can Fool Host Checks
Lets an attacker get past host allowlists or SSRF checks in apps that build a psr7 Uri from user input and trust getHost().
Update Guzzle to
2.12.x 2.12.3 -
medium CVE-2026-67354 Reviewed
Guzzle: Redirects Can Leak URL Fragments in the Referer Header
Can leak secrets kept in a URL fragment to a redirect target, in apps that turn on Guzzle's referer redirect option.
Update Guzzle to
7.15.x 7.15.1 -
medium CVE-2026-67355 Reviewed
Guzzle: Host-Only Cookies Are Sent to Subdomains
Can send a parent host's session cookies to its subdomains in apps that reuse one Guzzle cookie jar across hosts.
Update Guzzle to
7.15.x 7.15.1 -
medium CVE-2026-67353 Reviewed
Guzzle: Malicious Server Can Flood the Cookie Jar
Lets a malicious server fill Guzzle's cookie jar with large cookies, using memory and breaking later requests that share the jar.
Update Guzzle to
7.15.x 7.15.1 -
medium CVE-2026-59883 Reviewed
Guzzle: Cookies Set for IP Addresses Leak to Look-Alike Hosts
Can send cookies scoped to an IP address to other hosts, or let those hosts plant cookies, in apps that use Guzzle's cookie jar.
Update Guzzle to
7.12.x 7.12.3 -
medium CVE-2026-59946 Reviewed
Composer: Malicious Package Can Make Private Files World-Readable
Lets a malicious dependency change permissions on files outside its folder, making private files such as SSH keys readable by other users.
Update Composer to
2.10.x 2.10.2+ 1 older release
-
medium CVE-2026-59947 Reviewed
Composer: Tokens in Repository URLs Leak Into -vvv Debug Logs
Exposes access tokens placed in the username part of a repository URL to anyone who can read Composer's -vvv debug output.
Update Composer to
2.10.x 2.10.2+ 1 older release
-
medium CVE-2026-67339 Reviewed
Guzzle: Proxy Credentials Can Be Sent to the Destination Server
Can send Proxy-Authorization credentials to the target server when a request skips the HTTP proxy, with Guzzle's cURL handlers.
Update Guzzle to
7.14.x 7.14.2 -
high CVE-2026-59948 Reviewed
Composer: Malicious Package Name Can Write Files Outside Vendor
Lets a malicious package from a third-party repository write files anywhere the Composer user can, which can lead to running code.
Update Composer to
2.10.x 2.10.2+ 1 older release
-
high CVE-2026-12184
Failure to setup TLS with a remote server can result in a remote DoS
Update PHP to
8.5.x 8.5.6 8.4.x 8.4.21 8.3.x 8.3.32 -
medium CVE-2026-14355
ext/openssl: Memory corruption (zend_mm_heap corrupted) in openssl_encrypt with AES-WRAP-PAD
Update PHP to
8.5.x 8.5.8 8.4.x 8.4.23 8.3.x 8.3.32 8.2.x 8.2.32 -
high CVE-2026-49981 Reviewed
Twig Sandbox: Allow-List Bypass When Sandbox State Changes
Lets an untrusted template use forbidden filters, tags and functions when one Twig environment renders both sandboxed and normal templates.
No fixed release listed yet
-
medium CVE-2026-55767 Reviewed
Guzzle: Cookies With a Dot-Only Domain Are Sent to Every Host
Lets a malicious server plant a cookie that Guzzle then sends to every other host using the same cookie jar.
Update Guzzle to
7.12.x 7.12.1 -
medium CVE-2026-55568 Reviewed
Guzzle: HTTPS Proxy Silently Falls Back to Cleartext on Old libcurl
Can send proxy traffic unencrypted when Guzzle is set to use an https:// proxy and the server's libcurl is older than 7.50.2.
Update Guzzle to
7.12.x 7.12.1 -
medium CVE-2026-55766 Reviewed
guzzlehttp/psr7: Header Injection Through the Method or Reason Phrase
Lets an attacker inject HTTP headers when an app puts user input in a psr7 method, protocol or reason phrase and serializes the message.
Update Guzzle to
2.12.x 2.12.1 -
medium CVE-2026-47767 Reviewed
Symfony Runtime: Web Requests Can Still Switch APP_ENV and APP_DEBUG
Lets an unauthenticated request change the app environment or debug mode on servers with register_argc_argv=On, bypassing the CVE-2024-50340 fix.
Update Symfony to
6.4.x 6.4.40 5.4.x 5.4.52+ 2 older releases
-
medium CVE-2026-53723 Reviewed
Guzzle Services: XML Injection in Outgoing Request Bodies
Lets user input add XML markup to request bodies in apps that use guzzle-services to send XML built from that input.
Update Guzzle to
1.5.x 1.5.4 -
medium CVE-2026-48808 Reviewed
Twig Sandbox: column Filter Reads Blocked Properties Under a Source Policy
Lets an untrusted template read blocked object properties with the column filter when the sandbox is set by a source policy.
Update Twig to
3.27.x 3.27.0 -
low CVE-2026-48805 Reviewed
Twig Sandbox: Deprecated Helper Functions Skip Sandbox Checks
Lets sandboxed templates get around callable checks through deprecated Twig helper functions still used by older third-party code.
Update Twig to
3.27.x 3.27.0 -
high CVE-2026-46636 Reviewed
Twig Sandbox: Allow-List Bypass When Sandbox State Changes
Lets an untrusted template use forbidden filters, tags and functions when one Twig environment renders both sandboxed and normal templates.
Update Twig to
3.27.x 3.27.0 -
medium CVE-2026-48806 Reviewed
Twig Sandbox: __toString() Bypass via Dynamic Mapping Keys
Lets an untrusted template call __toString() on objects the sandbox policy blocks, a leftover gap from the GHSA-pr2w-4gpj-cpq4 fix.
Update Twig to
3.27.x 3.27.0 -
medium CVE-2026-48807 Reviewed
Twig Sandbox: __toString() Bypass via join, replace and in
Lets an untrusted template call __toString() on objects the sandbox policy blocks, a leftover gap from the GHSA-pr2w-4gpj-cpq4 fix.
Update Twig to
3.27.x 3.27.0 -
medium CVE-2026-48736 Reviewed
Symfony HttpClient: IPv6 Transition Addresses Bypass Private Network Block
Lets an attacker reach private network hosts through NoPrivateNetworkHttpClient by using IPv6 addresses that wrap a private IPv4 address.
Update Symfony to
7.4.x 7.4.13 6.4.x 6.4.41 5.4.x 5.4.53+ 1 older release
-
medium CVE-2026-48784 Reviewed
Symfony Routing: Chained ../ in Parameters Escape Generated URLs
Can make URLs built by UrlGenerator point to a different path than intended when a route parameter holds a chain of ../ or ./ segments.
Update Symfony to
7.4.x 7.4.13 6.4.x 6.4.41 5.4.x 5.4.53+ 1 older release
-
low CVE-2026-46644 Reviewed
Symfony Polyfill IDN: Invalid xn-- Labels Treated as Normal Domains
Can let two different domain names compare as equal, getting past domain blocklists, on PHP installs without the intl extension.
Only affects branches that no longer get security fixes
-
medium CVE-2026-49214 Reviewed
guzzlehttp/psr7: Header Injection Through the URI Host
Lets an attacker inject HTTP headers when an app builds a psr7 request from a user URL and serializes it as raw HTTP.
Update Guzzle to
2.10.x 2.10.2 -
medium CVE-2026-48998 Reviewed
guzzlehttp/psr7: Crafted Host Header Changes the Request's Host
Lets an attacker make an incoming request's URI host differ from its Host header in apps that build server requests with guzzlehttp/psr7.
Update Guzzle to
2.10.x 2.10.2 -
critical CVE-2026-9082 Reviewed
Drupal Core: SQL Injection
Allows SQL injection in Drupal core from 8.9.0 up to the fixed 10.4, 10.5, 10.6, 11.1, 11.2 and 11.3 releases.
Update Drupal to
11.3.x 11.3.10 10.6.x 10.6.9+ 4 older releases
-
low CVE-2026-45304 Reviewed
Symfony Yaml: Alias Expansion Can Use Up All Memory
Lets a small YAML document expand into gigabytes of data through aliases, in apps that parse untrusted YAML.
Update Symfony to
7.4.x 7.4.12 6.4.x 6.4.40 5.4.x 5.4.52+ 1 older release
-
medium CVE-2026-45068 Reviewed
Symfony Mailer: Recipient Addresses Can Become Sendmail Options
Lets a recipient address starting with a dash pass options to sendmail, in apps using SendmailTransport in -t mode.
Update Symfony to
7.4.x 7.4.12 6.4.x 6.4.40 5.4.x 5.4.52+ 1 older release
-
low CVE-2026-45305 Reviewed
Symfony Yaml: Crafted Header Line Makes the Parser Hang
Lets an attacker tie up the parser for a long time with one crafted YAML header or comment line, in apps that parse untrusted YAML.
Update Symfony to
7.4.x 7.4.12 6.4.x 6.4.40 5.4.x 5.4.52+ 1 older release
-
medium CVE-2026-45065 Reviewed
Symfony Routing: Loose Route Requirements Let Links Point Off-Site
Lets a crafted parameter value pass a route requirement written as a list of options, so path() or url() builds a link to another host.
Update Symfony to
7.4.x 7.4.12 6.4.x 6.4.40 5.4.x 5.4.52+ 1 older release
-
medium CVE-2026-46626 Reviewed
Symfony Runtime: Web Requests Can Still Switch APP_ENV and APP_DEBUG
Lets an unauthenticated request change the app environment or debug mode on servers with register_argc_argv=On, bypassing the CVE-2024-50340 fix.
Update Symfony to
7.4.x 7.4.12 6.4.x 6.4.40 5.4.x 5.4.52+ 1 older release
-
high CVE-2026-45067 Reviewed
Symfony Mime: Line Breaks in Addresses Allow Email Header Injection
Lets an attacker add email headers or SMTP commands through a crafted address in apps that pass user addresses to Symfony Mailer.
Update Symfony to
7.4.x 7.4.12 6.4.x 6.4.40 5.4.x 5.4.52+ 1 older release
-
low CVE-2026-45133 Reviewed
Symfony Yaml: Deeply Nested YAML Crashes the Process
Lets an attacker crash the PHP worker with one deeply nested YAML document in apps that parse untrusted YAML.
Update Symfony to
7.4.x 7.4.12 6.4.x 6.4.40 5.4.x 5.4.52+ 1 older release
-
high CVE-2026-45075 Reviewed
Symfony Security: HEAD Requests Skip Checks Limited to GET
Lets HEAD requests skip #[IsGranted], #[IsSignatureValid] and #[IsCsrfTokenValid] checks that set methods: ['GET'].
Update Symfony to
7.4.x 7.4.12+ 1 older release
-
high CVE-2026-46640 Reviewed
Twig: Code Execution Through Dynamic Macro References on _self
Lets anyone who can write a template run PHP code on the server, bypassing even a strict sandbox, in Twig 3.15 to 3.25.
Update Twig to
3.26.x 3.26.0 -
low CVE-2026-46628 Reviewed
Twig: spaceless Filter Output Skips Autoescaping
Can allow cross-site scripting when templates apply the deprecated spaceless filter to user input with autoescape on.
Update Twig to
3.26.x 3.26.0 -
critical CVE-2026-46633 Reviewed
Twig: Code Execution Through a Crafted {% use %} Template Name
Lets anyone who can write a template, even a sandboxed one, run PHP code on the server through the {% use %} tag.
Update Twig to
3.26.x 3.26.0 -
low CVE-2026-47730 Reviewed
Twig Profiler: Cross-Site Scripting in HtmlDumper Output
Lets attacker-controlled template names inject HTML into Twig profiler dumps rendered with HtmlDumper.
Update Twig to
3.26.x 3.26.0 -
high CVE-2026-46639 Reviewed
Twig Sandbox: Object Destructuring Skips Property and Method Checks
Lets a sandboxed template read any public property or call any public getter through object destructuring, in Twig 3.24 and 3.25.
Update Twig to
3.26.x 3.26.0 -
low CVE-2026-46627 Reviewed
Twig Sandbox: Untrusted Templates Can Use Unlimited CPU and Memory
Allows a sandboxed Twig template to use as much CPU, memory and time as it likes; Twig now documents limiting this at the process level.
Update Twig to
3.26.x 3.26.0 -
low CVE-2026-46635 Reviewed
Twig Sandbox: column Filter Reads Blocked Object Properties
Lets an untrusted template read object properties the sandbox policy blocks, when the column filter is allowed.
Update Twig to
3.26.x 3.26.0 -
medium CVE-2026-46638 Reviewed
Twig Sandbox: {% sandbox %} Include Skips Checks on Cached Templates
Lets an included template use any tag, filter or function if it was loaded outside the sandbox first, through the {% sandbox %} tag.
Update Twig to
3.26.x 3.26.0 -
high CVE-2026-24425 Reviewed
Twig Sandbox: Callback Filters Accept Any PHP Callable Under a Source Policy
Lets a sandboxed template pass any PHP callable to sort, filter, map or reduce when the sandbox is set by a source policy.
Update Twig to
3.26.x 3.26.0+ 1 older release
-
high CVE-2026-47732 Reviewed
Twig Sandbox: Several Ways to Call Blocked __toString() Methods
Lets an untrusted template call __toString() on objects the sandbox policy blocks, through operators and expressions the sandbox didn't check.
Update Twig to
3.26.x 3.26.0 -
medium CVE-2026-46634 Reviewed
Twig Sandbox: template_from_string Escapes a Source Policy Sandbox
Lets a sandboxed template run any tag, filter or function when the sandbox is set by a source policy and template_from_string is allowed.
Update Twig to
3.26.x 3.26.0 -
low CVE-2026-46637 Reviewed
Twig Extras: Some Filters Skip Escaping in Every Context
Can allow cross-site scripting when output from filters like html_to_markdown or markdown_to_html is used in templates without escaping.
Update Twig to
3.26.x 3.26.0 -
low CVE-2026-46629 Reviewed
Twig Intl Extra: Formatter Cache Can Grow Without Limit
Lets a template use up memory outside memory_limit by passing many distinct formats to Twig's intl filters, mainly on long-running workers.
Update Twig to
3.26.x 3.26.0 -
medium CVE-2026-6367 Reviewed
Drupal 11.3 CKEditor 5: Stored XSS Through Link Entity Suggestions
Lets a malicious user store scripts that run in another user's browser through CKEditor 5's entity suggestions when adding a link.
Update Drupal to
11.3.x 11.3.7 -
medium CVE-2026-6365 Reviewed
Drupal Core: Cross-Site Scripting Through AJAX Modal Dialog Options
Can let an attacker run scripts in a visitor's browser because Drupal's jQuery AJAX modal dialog code doesn't sanitize some options.
Update Drupal to
11.3.x 11.3.7 10.6.x 10.6.7+ 2 older releases
-
medium CVE-2026-6366 Reviewed
Drupal Core: Gadget Chain Can Turn Another Unserialize Bug Into Code Execution
Gives attackers a path to code execution or SQL injection on Drupal sites that already have another flaw passing untrusted data to unserialize().
Update Drupal to
11.3.x 11.3.7 10.6.x 10.6.7+ 2 older releases
-
high CVE-2026-45793 Reviewed
Composer: GitHub Tokens With Hyphens Printed in Full to CI Logs
Exposes GitHub Actions GITHUB_TOKEN values, and other GitHub tokens containing a hyphen, in Composer's error output and CI logs.
Update Composer to
2.9.x 2.9.8 1.10.x 1.10.28+ 1 older release
-
medium CVE-2026-7262
NULL pointer dereference in SOAP apache:Map decoder with missing <value>
Update PHP to
8.5.x 8.5.6 8.4.x 8.4.21 8.3.x 8.3.31 8.2.x 8.2.31 -
medium CVE-2026-7261
SoapServer session-persisted object use-after-free via SOAP header fault
Update PHP to
8.5.x 8.5.6 8.4.x 8.4.21 8.3.x 8.3.31 8.2.x 8.2.31 -
Update PHP to
8.5.x 8.5.6 8.4.x 8.4.21 8.3.x 8.3.31 8.2.x 8.2.31 -
medium CVE-2026-6735
XSS within PHP-FPM status endpoint
Update PHP to
8.5.x 8.5.6 8.4.x 8.4.21 8.3.x 8.3.31 8.2.x 8.2.31 -
high CVE-2026-6722
Use-After-Free in SOAP using Apache map with Remote Code Execution
Update PHP to
8.5.x 8.5.6 8.4.x 8.4.21 8.3.x 8.3.31 8.2.x 8.2.31 -
medium CVE-2026-7258
Out-of-bounds read in urldecode()
Update PHP to
8.5.x 8.5.6 8.4.x 8.4.21 8.3.x 8.3.31 8.2.x 8.2.31 -
medium CVE-2026-6104
Global buffer over-read in mb_convert_encoding() with attacker-supplied encoding
Update PHP to
8.5.x 8.5.6 8.4.x 8.4.21 -
high CVE-2025-14179
SQL injection in pdo_firebird via NUL bytes in quoted strings
Update PHP to
8.5.x 8.5.6 8.4.x 8.4.21 8.3.x 8.3.31 8.2.x 8.2.31 -
low CVE-2026-7568
Signed integer overflow in metaphone()
Update PHP to
8.5.x 8.5.6 8.4.x 8.4.21 8.3.x 8.3.31 8.2.x 8.2.31 -
high CVE-2026-7263
DoS attack via DOMNode::C14N()
Update PHP to
8.5.x 8.5.6 8.4.x 8.4.21 -
high CVE-2026-40261 Reviewed
Composer: Malicious Perforce Package Metadata Can Run Commands on Install
Lets a malicious or compromised package repository run commands when Composer installs packages from source, even without Perforce installed.
Update Composer to
2.9.x 2.9.6+ 1 older release
-
high CVE-2026-40176 Reviewed
Composer: Perforce Settings in an Untrusted composer.json Can Run Commands
Lets a malicious project's composer.json run commands on your machine when you run Composer in it, even without Perforce installed.
Update Composer to
2.9.x 2.9.6+ 1 older release
-
medium CVE-2026-24739 Reviewed
Symfony Process on Windows: Git Bash Can Mangle Arguments and Hit Wrong Paths
Can make file commands run through Symfony Process act on the wrong path, up to deleting a whole directory, when PHP runs from Git Bash.
Update Symfony to
7.4.x 7.4.5 6.4.x 6.4.33 5.4.x 5.4.51+ 2 older releases
-
low CVE-2025-67746 Reviewed
Composer: Remote Sources Can Inject Terminal Control Codes Into Output
Lets a source Composer downloads from inject ANSI control characters that garble Composer's terminal output.
Update Composer to
2.9.x 2.9.3+ 1 older release
-
Update PHP to
8.5.x 8.5.1 8.4.x 8.4.16 8.3.x 8.3.29 8.2.x 8.2.30+ 1 older release
-
medium CVE-2025-14180
NULL Pointer Dereference in PDO quoting
Update PHP to
8.5.x 8.5.1 8.4.x 8.4.16 8.3.x 8.3.29 8.2.x 8.2.30+ 1 older release
-
medium CVE-2025-14178
Heap buffer overflow in array_merge()
Update PHP to
8.5.x 8.5.1 8.4.x 8.4.16 8.3.x 8.3.29 8.2.x 8.2.30+ 1 older release
-
medium CVE-2025-14177
Information Leak of Memory in getimagesize
Update PHP to
8.5.x 8.5.1 8.4.x 8.4.16 8.3.x 8.3.29 8.2.x 8.2.30+ 1 older release
-
low CVE-2025-13083 Reviewed
Drupal Core: Private Files Can Be Cached and Served to Other Users
Can leak private files through Varnish or a CDN on Drupal sites that serve non-public files through a module adding its own file scheme.
Only affects branches that no longer get security fixes
-
low CVE-2025-13082 Reviewed
Drupal Core: Crafted Links Can Show Visitors a Defaced Page
Lets an attacker show a defaced page to anyone they trick into opening a crafted link to a Drupal site. Nothing is stored on the site.
Only affects branches that no longer get security fixes
-
low CVE-2025-13080 Reviewed
Drupal Core: Request Overrides Can Poison the Page Cache
Lets an anonymous attacker make Drupal cache the wrong response, so later visitors get broken or unstyled pages.
Only affects branches that no longer get security fixes
-
medium CVE-2025-13081 Reviewed
Drupal Core: Gadget Chain Could Turn an Unserialize Bug Into Code Execution
Gives an attacker a path to run code on a Drupal site, but only if a separate flaw already lets them pass untrusted data to unserialize().
Only affects branches that no longer get security fixes
-
high CVE-2025-64500 Reviewed
Symfony HttpFoundation: Malformed Paths Can Slip Past Access Rules
Lets an attacker reach some URLs that path-based access rules should block, in apps whose rules assume every path starts with a slash.
Update Symfony to
6.4.x 6.4.29 5.4.x 5.4.50+ 1 older release
-
medium CVE-2025-1735
pgsql extension does not check for errors during escaping
Update PHP to
8.4.x 8.4.10 8.3.x 8.3.23 8.2.x 8.2.29+ 1 older release
-
medium CVE-2025-6491
NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix
Update PHP to
8.4.x 8.4.10 8.3.x 8.3.23 8.2.x 8.2.29+ 1 older release
-
low CVE-2025-1220
Null byte termination in hostnames
Update PHP to
8.4.x 8.4.10 8.3.x 8.3.23 8.2.x 8.2.29+ 1 older release
-
medium CVE-2025-3057 Reviewed
Drupal Core: Unfiltered Error Messages Allow Reflected XSS
Lets an attacker run script in a visitor's browser on a Drupal site by getting them to open a crafted link.
Only affects branches that no longer get security fixes
-
medium CVE-2025-31674 Reviewed
Drupal Core: Gadget Chain Could Let an Unserialize Bug Include Files
Gives an attacker a path to include files, and possibly run code, on a Drupal site, but only if another flaw lets them pass data to unserialize().
Only affects branches that no longer get security fixes
-
low CVE-2025-31675 Reviewed
Drupal Core Link Fields: Unsanitized Attributes Allow XSS
Lets a user who can set Link field attributes run script in other visitors' browsers on Drupal sites that use Link fields.
Only affects branches that no longer get security fixes
-
medium CVE-2025-31673 Reviewed
Drupal Core: Bulk Actions Let Users Publish Content Without Permission
Lets users who can reach /admin/content and edit nodes publish, unpublish, promote or make content sticky without permission to do so.
Only affects branches that no longer get security fixes
-
medium CVE-2024-11235
Reference counting in php_request_shutdown causes Use-After-Free
Update PHP to
8.4.x 8.4.5 8.3.x 8.3.19 -
Update PHP to
8.4.x 8.4.5 8.3.x 8.3.19 8.2.x 8.2.28+ 1 older release
-
medium CVE-2025-1219
libxml streams use wrong `content-type` header when requesting a redirected resource
Update PHP to
8.4.x 8.4.5 8.3.x 8.3.19 8.2.x 8.2.28+ 1 older release
-
medium CVE-2025-1736
Stream HTTP wrapper header check might omit basic auth header
Update PHP to
8.4.x 8.4.5 8.3.x 8.3.19 8.2.x 8.2.28+ 1 older release
-
medium CVE-2025-1861
Stream HTTP wrapper truncate redirect location to 1024 bytes
Update PHP to
8.4.x 8.4.5 8.3.x 8.3.19 8.2.x 8.2.28+ 1 older release
-
medium CVE-2025-1734
Streams HTTP wrapper does not fail for headers with invalid name and no colon
Update PHP to
8.4.x 8.4.5 8.3.x 8.3.19 8.2.x 8.2.28+ 1 older release
-
medium CVE-2025-1217
Header parser of `http` stream wrapper does not handle folded headers
Update PHP to
8.4.x 8.4.5 8.3.x 8.3.19 8.2.x 8.2.28+ 1 older release
-
medium CVE-2025-24374 Reviewed
Twig: Null Coalesce Operator Skips Output Escaping
Leaves the left side of a ?? expression unescaped in Twig templates, so user input there can carry HTML or script into the page.
Update Twig to
3.19.x 3.19.0 -
medium CVE-2025-21617 Reviewed
Guzzle OAuth Subscriber: Weak Nonces Can Allow Replayed OAuth 1 Requests
Generates weak OAuth 1 nonces, which can leave the servers your app calls open to replayed requests when the connection doesn't use TLS.
Update Guzzle to
0.8.x 0.8.1 -
high CVE-2024-55638 Reviewed
Drupal Core: Object Injection Could Lead to Code Execution With Another Bug
Can lead to remote code execution on a Drupal site, but only when a separate flaw lets an attacker pass unsafe input to unserialize().
Only affects branches that no longer get security fixes
-
medium CVE-2024-55634 Reviewed
Drupal Core: Users Can Register With an Email Address Already in Use
Lets a user sign up with an email address another account already has, written in different letter case, on some Drupal database setups.
Only affects branches that no longer get security fixes
-
medium CVE-2024-12393 Reviewed
Drupal Core: Ajax Status Messages Can Run Injected Scripts
Lets a logged-in user get script into status messages that Drupal renders with JavaScript, in some site configurations.
Only affects branches that no longer get security fixes
-
high CVE-2024-11941 Reviewed
Drupal Comment Module: Crafted Reply Requests Can Take a Site Down
Lets an attacker cause a denial of service with comment reply requests on Drupal sites that use the core Comment module.
Only affects branches that no longer get security fixes
-
medium CVE-2024-11942 Reviewed
Drupal CKEditor 5: Some Image Uploads Can Move the Whole Webroot
Lets a malicious user take a Drupal 10 site offline through a CKEditor 5 image upload, on sites with several uncommon settings combined.
Only affects branches that no longer get security fixes
-
high CVE-2024-8929
[Mysqlnd] Leak partial content of the heap through heap buffer over-read
Update PHP to
8.3.x 8.3.14 8.2.x 8.2.26+ 1 older release
-
medium CVE-2024-8932
OOB access in ldap_escape
Update PHP to
8.3.x 8.3.14 8.2.x 8.2.26+ 1 older release
-
medium CVE-2024-11234
Configuring a proxy in a stream context might allow for CRLF injection in URIs
Update PHP to
8.3.x 8.3.14 8.2.x 8.2.26+ 1 older release
-
medium CVE-2024-11236
Integer overflow in the firebird and dblib quoters causing OOB writes
Update PHP to
8.3.x 8.3.14 8.2.x 8.2.26+ 1 older release
-
medium CVE-2024-11233
Single byte overread with convert.quoted-printable-decode filter
Update PHP to
8.3.x 8.3.14 8.2.x 8.2.26+ 1 older release
-
Update PHP to
8.3.x 8.3.14 8.2.x 8.2.26+ 1 older release
-
low CVE-2024-51754 Reviewed
Twig Sandbox: __toString() Runs on Objects in Arrays Without a Check
Lets untrusted templates call __toString() on objects the sandbox policy blocks, when the object sits in an array or an argument list.
Update Twig to
3.14.x 3.14.1+ 1 older release
-
low CVE-2024-51755 Reviewed
Twig Sandbox: Array-Like Objects Skip the Security Policy
Lets untrusted templates read properties of ArrayAccess objects that the sandbox policy should block, in apps that run user templates in Twig's sandbox.
Update Twig to
3.14.x 3.14.1+ 1 older release
-
low CVE-2024-50345 Reviewed
Symfony HttpFoundation: Malformed URLs Can Slip Past Redirect Checks
Lets an attacker send users to another domain when an app checks redirect targets with the Request class, which parsed some URLs unlike browsers.
Update Symfony to
6.4.x 6.4.14 5.4.x 5.4.46+ 1 older release
-
high CVE-2024-51736 Reviewed
Symfony Process on Windows: A cmd.exe in the Working Directory Gets Run
Lets a cmd.exe file in the current working directory run instead of the real one when Symfony's Process class runs commands on Windows.
Update Symfony to
6.4.x 6.4.14 5.4.x 5.4.46+ 1 older release
-
medium CVE-2024-50340 Reviewed
Symfony Runtime: Query Strings Can Change the Environment and Debug Mode
Lets anyone switch the environment or debug mode of a Symfony app for a request, on servers where PHP's register_argc_argv is On.
Update Symfony to
6.4.x 6.4.14 5.4.x 5.4.46+ 1 older release
-
high CVE-2024-4577
PHP RCE: A Bypass of CVE-2012-1823, Argument Injection in PHP-CGI
Update PHP to
8.3.x 8.3.8 8.2.x 8.2.20+ 1 older release
-
medium CVE-2024-8927
cgi.force_redirect configuration is bypassable due to the environment variable collision
Update PHP to
8.3.x 8.3.12 8.2.x 8.2.24+ 1 older release
-
medium CVE-2024-8926
PHP CGI Parameter Injection Vulnerability (CVE-2024-4577 bypass)
Update PHP to
8.3.x 8.3.12 8.2.x 8.2.24+ 1 older release
-
low CVE-2024-8925
Erroneous parsing of multipart form data
Update PHP to
8.3.x 8.3.12 8.2.x 8.2.24+ 1 older release
-
low CVE-2024-9026
[PHP-FPM] Logs from childrens may be altered
Update PHP to
8.3.x 8.3.12 8.2.x 8.2.24+ 1 older release
-
medium CVE-2024-45411 Reviewed
Twig Sandbox: Templates Included in Sandbox Mode Can Skip Its Checks
Lets user-written templates escape sandbox rules when the sandbox is off globally and turned on only through a sandboxed include().
Update Twig to
3.14.x 3.14.0 2.16.x 2.16.0+ 2 older releases
-
low CVE-2024-50343 Reviewed
Symfony Validator: Values Ending in a Newline Pass Regex-Based Checks
Lets values with a trailing newline pass constraints such as Email, Url, Date and Time that Symfony checks with a regular expression.
Update Symfony to
6.4.x 6.4.11 5.4.x 5.4.43+ 1 older release
-
medium CVE-2024-45440 Reviewed
Drupal Core: Error Pages Can Reveal the Site's Full Server Path
Can show anyone the full server path of a Drupal site when settings.php raises a PHP error on pages like core/authorize.php.
Only affects branches that no longer get security fixes
-
high CVE-2024-35241 Reviewed
Composer: Malicious Git Branch Names Can Run Code on status or remove
Lets a malicious package repository run commands on your machine when you run composer status, reinstall or remove on source installs.
Update Composer to
2.7.x 2.7.7+ 1 older release
-
high CVE-2024-35242 Reviewed
Composer: Malicious Git or Hg Branch Names Can Run Code on composer install
Lets an untrusted repository run commands on your machine when you clone it and run composer install inside it.
Update Composer to
2.7.x 2.7.7+ 1 older release
-
high CVE-2024-5585
bypass CVE-2024-1874
Update PHP to
8.3.x 8.3.8 8.2.x 8.2.20+ 1 older release
-
medium CVE-2024-5458
Filter bypass in filter_var (FILTER_VALIDATE_URL)
Update PHP to
8.3.x 8.3.8 8.2.x 8.2.20+ 1 older release
-
high CVE-2024-2757
mb_encode_mimeheader runs endlessly for some inputs
Update PHP to
8.3.x 8.3.6 -
low CVE-2024-3096
password_verify can erroneously return true, opening ATO risk
Update PHP to
8.3.x 8.3.6 8.2.x 8.2.18+ 1 older release
-
critical CVE-2024-1874
Command injection via array-ish $command parameter of proc_open even if bypass_shell option enabled on Windows
Update PHP to
8.3.x 8.3.6 8.2.x 8.2.18+ 1 older release
-
medium CVE-2024-2756
__Host-/__Secure- cookie bypass due to partial CVE-2022-31629 fix
Update PHP to
8.3.x 8.3.6 8.2.x 8.2.18+ 1 older release
-
high CVE-2024-24821 Reviewed
Composer: Tampered vendor/composer Files Run Code When Composer Runs
Lets code planted in a project's vendor/composer files run as whoever runs Composer there, including root when Composer runs with sudo.
Update Composer to
2.7.x 2.7.0+ 1 older release
-
medium Reviewed
Drupal Comment Module: Reply Requests Can Cause a Denial of Service
Lets an attacker trigger a denial of service with comment reply requests on Drupal sites that use the core Comment module.
Only affects branches that no longer get security fixes
-
medium CVE-2024-22362 Reviewed
Drupal Core 9.3.6: Denial of Service Reported in an End-of-Life Release
Lets an attacker cause a denial of service on Drupal 9.3.6, per JPCERT; Drupal could not reproduce it on 9.5.x or the 10 series.
No fixed release listed yet
-
high CVE-2023-43655 Reviewed
Composer: A Web-Accessible composer.phar Can Let Attackers Run Code
Lets an attacker run code on a server that publishes composer.phar where PHP executes it and register_argc_argv is enabled.
Update Composer to
2.6.x 2.6.4 1.10.x 1.10.27+ 1 older release
-
critical CVE-2023-5256 Reviewed
Drupal JSON:API: Cached Error Backtraces Can Expose Data to Anonymous Users
Can cache error backtraces with sensitive data and serve them to anonymous users on Drupal sites with the JSON:API module enabled.
Only affects branches that no longer get security fixes
-
low CVE-2023-3247
Missing error check and insufficient random bytes in HTTP Digest authentication for SOAP
Update PHP to
8.2.x 8.2.7+ 1 older release
-
critical CVE-2023-31250 Reviewed
Drupal Core: File Downloads Can Expose Private Files
Lets users reach private files they should not have access to, because file download paths were not fully sanitized.
Only affects branches that no longer get security fixes
-
high CVE-2022-25273 Reviewed
Drupal Form API: Some Module Forms Accept Disallowed Values
Allows an attacker to inject disallowed values or overwrite data through certain forms in contributed or custom modules.
Only affects branches that no longer get security fixes
-
medium CVE-2022-25276 Reviewed
Drupal Media oEmbed: Iframe Domain Not Checked, Allowing Cross-Site Scripting
Can let oEmbed content load on the site's main domain, which may lead to cross-site scripting or leaked cookies on sites using Media.
Only affects branches that no longer get security fixes
-
medium CVE-2023-29197 Reviewed
Guzzle PSR-7: Newlines Allowed in Header Names and Values
Allows header injection when untrusted input containing a newline ends up in header names or values built with guzzlehttp/psr7.
Update Guzzle to
2.4.x 2.4.5 1.9.x 1.9.1 -
low CVE-2023-0567
BCrypt hashes erroneously validate if the salt is cut short by `$`
Update PHP to
8.2.x 8.2.3+ 1 older release
-
high CVE-2023-0662
DoS vulnerability when parsing multipart request body
Update PHP to
8.2.x 8.2.3+ 1 older release
-
medium CVE-2022-24894 Reviewed
Symfony HttpCache: Session Cookies Can Be Cached and Served to Others
Can leak one user's session cookie to other visitors in apps that run Symfony's HttpCache reverse proxy.
Update Symfony to
5.4.x 5.4.20+ 4 older releases
-
high CVE-2022-39261 Reviewed
Twig Filesystem Loader: Template Names Can Reach Files Outside Its Directories
Lets an attacker read files outside the template directories in apps that pass user input as a template name to the filesystem loader.
Update Twig to
3.4.x 3.4.3 2.15.x 2.15.3+ 1 older release
-
high CVE-2022-25277 Reviewed
Drupal Core: .htaccess Uploads Can Lead to Code Execution on Apache
Can allow remote code execution on Apache when a file field is set to accept the htaccess extension, which needs a restricted permission.
Only affects branches that no longer get security fixes
-
high CVE-2022-25275 Reviewed
Drupal Image Styles: Derivatives Can Expose Non-Public Files
Can expose files from non-public file systems through image styles on sites that set allow_insecure_derivatives to TRUE.
Only affects branches that no longer get security fixes
-
medium CVE-2022-25278 Reviewed
Drupal Form API: Wrong Element Access Check Lets Users Change Data
Lets a user alter data they should not have access to, because the form API evaluated form element access incorrectly.
Only affects branches that no longer get security fixes
-
high CVE-2022-31091
Change in port should be considered a change in origin
Update Guzzle to
7.4.x 7.4.5 6.5.x 6.5.8 -
high CVE-2022-31090
CURLOPT_HTTPAUTH option not cleared on change of origin
Update Guzzle to
7.4.x 7.4.5 6.5.x 6.5.8 -
high CVE-2022-31043
Fix failure to strip Authorization header on HTTP downgrade
Update Guzzle to
7.4.x 7.4.4 6.5.x 6.5.7 -
high CVE-2022-31042
Failure to strip the Cookie header on change in host or HTTP downgrade
Update Guzzle to
7.4.x 7.4.4 6.5.x 6.5.7 -
high CVE-2022-29248
Cross-domain cookie leakage
Update Guzzle to
7.4.x 7.4.3 6.5.x 6.5.6 -
medium CVE-2020-13688
Drupal Core Cross-site scripting vulnerability
Only affects branches that no longer get security fixes
-
high CVE-2011-2687
Drupal Access Control Bypass
Only affects branches that no longer get security fixes
-
medium CVE-2016-9451
Drupal Open Redirect
Only affects branches that no longer get security fixes
-
critical CVE-2011-2715
Drupal SQL Injection vulnerability
No fixed release listed yet
-
medium CVE-2011-2714
Drupal Cross-Site Scripting vulnerability
No fixed release listed yet
-
high CVE-2022-24828
Missing input validation can lead to command execution in composer
Update Composer to
2.3.x 2.3.5 1.10.x 1.10.26+ 1 older release
-
medium CVE-2022-24775
Inproper parsing of HTTP headers
Update Guzzle to
2.1.x 2.1.1 1.8.x 1.8.4 -
high CVE-2022-25271
Improper input validation in Drupal core
Only affects branches that no longer get security fixes
-
medium CVE-2022-25270
Incorrect authorization in Drupal core
Only affects branches that no longer get security fixes
-
critical CVE-2020-13675
Unrestricted Upload of File with Dangerous Type in Drupal core
Only affects branches that no longer get security fixes
-
medium CVE-2020-13674
Cross-Site Request Forgery in Drupal core
Only affects branches that no longer get security fixes
-
high CVE-2020-13677
Drupal core access bypass vulnerability
Only affects branches that no longer get security fixes
-
medium CVE-2020-13676
Incorrect Authorization in Drupal core
Only affects branches that no longer get security fixes
-
high CVE-2022-23614
Disallow non closures in the sort filter
Update Twig to
3.3.x 3.3.8 2.14.x 2.14.11 -
medium CVE-2021-41270
CVE-2021-41270: Prevent CSV Injection via formulas
Only affects branches that no longer get security fixes
-
medium CVE-2021-41267
CVE-2021-41267: Webcache Poisoning via X-Forwarded-Prefix and sub-request
Only affects branches that no longer get security fixes
-
high CVE-2021-41116
Improper escaping of command arguments on Windows leading to command injection
Update Composer to
2.1.x 2.1.9 1.10.x 1.10.23 -
Only affects branches that no longer get security fixes
-
high CVE-2021-29472
Missing argument delimiter can lead to command execution via VCS repository URLs or source download URLs on systems with Mercurial
Update Composer to
2.0.x 2.0.13 1.10.x 1.10.22 -
medium CVE-2021-33829
Drupal core - Critical - Cross-site scripting - SA-CORE-2021-003
Only affects branches that no longer get security fixes
-
medium CVE-2020-13672
Drupal core - Critical - Cross-site scripting - SA-CORE-2021-002
Only affects branches that no longer get security fixes
-
Only affects branches that no longer get security fixes
-
high CVE-2020-13671
Drupal core - Critical - Remote code execution - SA-CORE-2020-012
Only affects branches that no longer get security fixes
-
medium CVE-2020-13667
Drupal core - Moderately critical - Access bypass - SA-CORE-2020-008
Only affects branches that no longer get security fixes
-
medium CVE-2020-13668
Drupal core - Critical - Cross-site scripting - SA-CORE-2020-009
Only affects branches that no longer get security fixes
-
medium CVE-2020-13669
Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2020-010
Only affects branches that no longer get security fixes
-
medium CVE-2020-13666
Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2020-007
Only affects branches that no longer get security fixes
-
high CVE-2020-13670
Drupal core - Moderately critical - Information disclosure - SA-CORE-2020-011
Only affects branches that no longer get security fixes
-
high CVE-2020-15094
CVE-2020-15094: Prevent RCE when calling untrusted remote with CachingHttpClient
Only affects branches that no longer get security fixes
-
high CVE-2020-13663
Drupal core - Critical - Cross Site Request Forgery - SA-CORE-2020-004
Only affects branches that no longer get security fixes
-
high CVE-2020-13664
Drupal core - Critical - Arbitrary PHP code execution - SA-CORE-2020-005
Only affects branches that no longer get security fixes
-
critical CVE-2020-13665
Drupal core - Less critical - Access bypass - SA-CORE-2020-006
Only affects branches that no longer get security fixes
-
medium CVE-2020-13662
Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2020-002
Only affects branches that no longer get security fixes
-
Only affects branches that no longer get security fixes
-
Only affects branches that no longer get security fixes
-
medium CVE-2020-5274
CVE-2020-5274: Fix Exception message escaping rendered by ErrorHandler
Only affects branches that no longer get security fixes
-
Only affects branches that no longer get security fixes
-
Only affects branches that no longer get security fixes
-
Only affects branches that no longer get security fixes
-
Only affects branches that no longer get security fixes
-
Only affects branches that no longer get security fixes
-
high CVE-2019-18888
CVE-2019-18888: Prevent argument injection in a MimeTypeGuesser
Only affects branches that no longer get security fixes
-
critical CVE-2019-11325
CVE-2019-11325: Fix escaping of strings in VarExporter
Only affects branches that no longer get security fixes
-
high CVE-2019-18887
CVE-2019-18887: Use constant time comparison in UriSigner
Only affects branches that no longer get security fixes
-
critical CVE-2019-6342
Critical - Access bypass
Only affects branches that no longer get security fixes
-
critical CVE-2019-11831
Moderately critical - Third-party libraries - SA-CORE-2019-007
Only affects branches that no longer get security fixes
-
critical CVE-2019-10910
CVE-2019-10910: Check service IDs are valid
Only affects branches that no longer get security fixes
-
critical CVE-2019-10913
CVE-2019-10913: Reject invalid HTTP method overrides
Only affects branches that no longer get security fixes
-
medium CVE-2019-6341
Moderately critical - Cross Site Scripting - SA-CORE-2019-004
Only affects branches that no longer get security fixes
-
low CVE-2019-9942
Sandbox Information Disclosure
Update Twig to
2.7.x 2.7.0 1.38.x 1.38.0 -
high CVE-2019-6340
Highly critical - Remote Code Execution
Only affects branches that no longer get security fixes
-
high CVE-2019-6338 Reviewed
Critical - Third Party Libraries
Only affects branches that no longer get security fixes
-
critical CVE-2019-6339
Critical - Arbitrary PHP code execution
Only affects branches that no longer get security fixes
-
Only affects branches that no longer get security fixes
-
Only affects branches that no longer get security fixes
-
Only affects branches that no longer get security fixes
-
Only affects branches that no longer get security fixes
-
Only affects branches that no longer get security fixes
-
medium CVE-2018-14773
CVE-2018-14773: Remove support for legacy and risky HTTP headers
Only affects branches that no longer get security fixes
-
medium CVE-2018-11386
CVE-2018-11386: Denial of service when using PDOSessionHandler
Only affects branches that no longer get security fixes
-
critical CVE-2018-7602
Critical - Remote Code Execution
Only affects branches that no longer get security fixes
-
medium CVE-2018-9861
Moderately critical - Cross Site Scripting
Only affects branches that no longer get security fixes
-
critical CVE-2018-7600
Highly critical - Remote Code Execution
Only affects branches that no longer get security fixes
-
medium CVE-2017-6927
JavaScript cross-site scripting prevention is incomplete.
Only affects branches that no longer get security fixes
-
high CVE-2017-6926
Comment reply form allows access to restricted content.
Only affects branches that no longer get security fixes
-
medium CVE-2017-6932
External link injection on 404 pages when linking to the current page.
Only affects branches that no longer get security fixes
-
high CVE-2017-6930
Language fallback can be incorrect on multilingual sites with node access restrictions.
Only affects branches that no longer get security fixes
-
medium CVE-2017-6931
Settings Tray access bypass.
Only affects branches that no longer get security fixes
-
medium CVE-2017-6928
Private file access bypass.
Only affects branches that no longer get security fixes
-
medium CVE-2017-6929
jQuery vulnerability with untrusted domains.
Only affects branches that no longer get security fixes
-
medium CVE-2017-6923
Views does not properly restrict access to the Ajax endpoint.
Only affects branches that no longer get security fixes
-
high CVE-2017-6924
REST API can bypass comment approval.
Only affects branches that no longer get security fixes
-
critical CVE-2017-6925
Entity access bypass for entities that do not have UUIDs or have protected revisions.
Only affects branches that no longer get security fixes
-
medium CVE-2017-6921
File REST resource does not properly validate
Only affects branches that no longer get security fixes
-
medium CVE-2017-6922
Files uploaded by anonymous users into a private file system can be accessed by other anonymous users
Only affects branches that no longer get security fixes
-
critical CVE-2017-6920
PECL YAML parser unsafe object handling
Only affects branches that no longer get security fixes
-
high CVE-2017-6919
Access bypass
Only affects branches that no longer get security fixes
-
high CVE-2017-6377
Editor module incorrectly checks access to inline private files
Only affects branches that no longer get security fixes
-
high CVE-2017-6379
Some admin paths were not protected with a CSRF token
Only affects branches that no longer get security fixes
-
high CVE-2017-6381
Remote code execution
Only affects branches that no longer get security fixes
-
high CVE-2016-9450
Incorrect cache context on password reset page
Only affects branches that no longer get security fixes
-
medium CVE-2016-9452
Denial of service via transliterate mechanism
Only affects branches that no longer get security fixes
-
medium CVE-2016-9449
Inconsistent name for term access query
Only affects branches that no longer get security fixes
-
medium CVE-2016-7570
Users without "Administer comments" can set comment visibility on nodes they can edit
Only affects branches that no longer get security fixes
-
medium CVE-2016-7572
Full config export can be downloaded without administrative permissions
Only affects branches that no longer get security fixes
-
medium CVE-2016-7571
Cross-site Scripting in http exceptions
Only affects branches that no longer get security fixes
-
high CVE-2016-5385
HTTP Proxy header vulnerability
Update Guzzle to
8.1.x 8.1.7 6.2.x 6.2.1 5.3.x 5.3.1+ 1 older release
-
high CVE-2016-6211
Saving user accounts can sometimes grant the user all roles
Only affects branches that no longer get security fixes
-
medium CVE-2016-6212
Views can allow unauthorized users to see Statistics information
Only affects branches that no longer get security fixes
-
medium CVE-2016-3166
HTTP header injection using line breaks
Only affects branches that no longer get security fixes
-
high CVE-2016-3164
Open redirect via path manipulation
Only affects branches that no longer get security fixes
-
medium CVE-2016-3168
Reflected file download vulnerability
Only affects branches that no longer get security fixes
-
high CVE-2016-3171
Session data truncation can lead to unserialization of user provided data
Only affects branches that no longer get security fixes
-
high CVE-2016-3162
File upload access bypass and denial of service
Only affects branches that no longer get security fixes
-
high CVE-2016-3167
Open redirect via double-encoded 'destination' parameter
Only affects branches that no longer get security fixes
-
high CVE-2016-3169
Saving user accounts can sometimes grant the user all roles
Only affects branches that no longer get security fixes
-
high CVE-2016-3165
Form API ignores access restrictions on submit buttons
Only affects branches that no longer get security fixes
-
medium CVE-2016-3170
Email address can be matched to an account
Only affects branches that no longer get security fixes
-
high CVE-2016-3163
Brute force amplification attacks via XML-RPC
Only affects branches that no longer get security fixes
-
high CVE-2015-8371
Composer Cache Injection vulnerability
Update Composer to
1.0.x 1.0.0-beta1 -
high CVE-2015-7809
Remote code execution in templates
Update Twig to
1.20.x 1.20.0 -
medium CVE-2015-4050
CVE-2015-4050: ESI unauthorized access
Only affects branches that no longer get security fixes
-
medium CVE-2015-2309
Unsafe methods in the Request class
Only affects branches that no longer get security fixes
-
medium CVE-2015-2308
Esi Code Injection
Only affects branches that no longer get security fixes
-
high CVE-2014-5245
Direct access of ESI URLs behind a trusted proxy
Only affects branches that no longer get security fixes
-
medium CVE-2014-6061
Security issue when parsing the Authorization header
Only affects branches that no longer get security fixes
-
high CVE-2014-5244
Denial of service with a malicious HTTP Host header
Only affects branches that no longer get security fixes
-
medium CVE-2013-5958
Possible DOS attack with long user-submitted passwords
Only affects branches that no longer get security fixes
-
medium CVE-2013-4752
Request::getHost() poisoning
Only affects branches that no longer get security fixes
-
high CVE-2013-4751
Validation metadata serialization and loss of information
Only affects branches that no longer get security fixes
-
Update Twig to
1.12.x 1.12.3 -
high CVE-2013-1397
Ability to enable/disable object support in YAML parsing and dumping
Only affects branches that no longer get security fixes
-
high CVE-2013-1348
Ability to enable/disable PHP parsing in Yaml::parse()
Only affects branches that no longer get security fixes
-
Only affects branches that no longer get security fixes
-
medium CVE-2012-6431
Routes behind a firewall are accessible even when not logged in
Only affects branches that no longer get security fixes
-
Only affects branches that no longer get security fixes