isdrupalsecure.org — receipts https://isdrupalsecure.org/receipts Drupal security advisories, indexed and sourced. en htmLawed — Moderately critical — SA-CONTRIB-2026-315 https://www.drupal.org/sa-contrib-2026-315 SA-CONTRIB-2026-315 Wed, 04 Nov 2026 12:00:00 GMT Moderately critical risk 14/25 · CVE-2026-122079. htmLawed - Moderately critical - Cross-site scripting. htmLawed — Moderately critical — SA-CONTRIB-2026-314 https://www.drupal.org/sa-contrib-2026-314 SA-CONTRIB-2026-314 Wed, 04 Nov 2026 12:00:00 GMT Moderately critical risk 11/25 · CVE-2026-122080. htmLawed - Moderately critical - Cross-site scripting. Islandora — Moderately critical — SA-CONTRIB-2026-313 https://www.drupal.org/sa-contrib-2026-313 SA-CONTRIB-2026-313 Wed, 04 Nov 2026 12:00:00 GMT Moderately critical risk 10/25 · CVE-2026-122081. Islandora - Moderately critical - Access bypass leading to arbitrary file overwrite. Mime Mail — Moderately critical — SA-CONTRIB-2026-312 https://www.drupal.org/sa-contrib-2026-312 SA-CONTRIB-2026-312 Wed, 04 Nov 2026 12:00:00 GMT Moderately critical risk 10/25 · CVE-2026-122082. Mime Mail - Moderately critical - Information disclosure. AdobeAnalytics — Moderately critical — SA-CONTRIB-2026-311 https://www.drupal.org/sa-contrib-2026-311 SA-CONTRIB-2026-311 Wed, 04 Nov 2026 12:00:00 GMT Moderately critical risk 13/25 · CVE-2026-122083. AdobeAnalytics - Moderately critical - Cross-site scripting. WordsOnline Connector — Moderately critical — SA-CONTRIB-2026-310 https://www.drupal.org/sa-contrib-2026-310 SA-CONTRIB-2026-310 Wed, 04 Nov 2026 12:00:00 GMT Moderately critical risk 12/25 · CVE-2026-122084. WordsOnline Connector - Moderately critical - SQL injection. Extended HTML Filter — Moderately critical — SA-CONTRIB-2026-309 https://www.drupal.org/sa-contrib-2026-309 SA-CONTRIB-2026-309 Wed, 04 Nov 2026 12:00:00 GMT Moderately critical risk 14/25 · CVE-2026-122078. Extended HTML Filter - Moderately critical - Cross-site scripting. Allowed Languages — Less critical — SA-CONTRIB-2026-308 https://www.drupal.org/sa-contrib-2026-308 SA-CONTRIB-2026-308 Wed, 04 Nov 2026 12:00:00 GMT Less critical risk 7/25 · CVE-2026-122077. Allowed Languages - Less critical - Access bypass. Password Separate Form — Moderately critical — SA-CONTRIB-2026-307 https://www.drupal.org/sa-contrib-2026-307 SA-CONTRIB-2026-307 Wed, 04 Nov 2026 12:00:00 GMT Moderately critical risk 10/25 · CVE-2026-122076. Password Separate Form - Moderately critical - Access bypass. Scheduler — Moderately critical — SA-CONTRIB-2026-306 https://www.drupal.org/sa-contrib-2026-306 SA-CONTRIB-2026-306 Wed, 04 Nov 2026 12:00:00 GMT Moderately critical risk 13/25 · CVE-2026-122075. Scheduler - Moderately critical - Access bypass. Reset Password Email/SMS OTP — Critical — SA-CONTRIB-2026-305 https://www.drupal.org/sa-contrib-2026-305 SA-CONTRIB-2026-305 Wed, 04 Nov 2026 12:00:00 GMT Critical risk 15/25 · CVE-2026-122074. Reset Password Email/SMS OTP - Critical - Access bypass. Name Field — Moderately critical — SA-CONTRIB-2026-304 https://www.drupal.org/sa-contrib-2026-304 SA-CONTRIB-2026-304 Wed, 04 Nov 2026 12:00:00 GMT Moderately critical risk 12/25 · CVE-2026-122073. Name Field - Moderately critical - Cross-site scripting. Forum Access — Moderately critical — SA-CONTRIB-2026-303 https://www.drupal.org/sa-contrib-2026-303 SA-CONTRIB-2026-303 Wed, 04 Nov 2026 12:00:00 GMT Moderately critical risk 10/25 · CVE-2026-122072. Forum Access - Moderately critical - Access bypass. Commerce Escrow — Moderately critical — SA-CONTRIB-2026-302 https://www.drupal.org/sa-contrib-2026-302 SA-CONTRIB-2026-302 Wed, 04 Nov 2026 12:00:00 GMT Moderately critical risk 13/25 · CVE-2026-122071. Commerce Escrow - Moderately critical - Access bypass. Commerce Product Alternative — Critical — SA-CONTRIB-2026-301 https://www.drupal.org/sa-contrib-2026-301 SA-CONTRIB-2026-301 Wed, 04 Nov 2026 12:00:00 GMT Critical risk 16/25 · CVE-2026-122070. Commerce Product Alternative - Critical - Access bypass. AlternativeCommerce PayPal Checkout — Moderately critical — SA-CONTRIB-2026-300 https://www.drupal.org/sa-contrib-2026-300 SA-CONTRIB-2026-300 Wed, 04 Nov 2026 12:00:00 GMT Moderately critical risk 13/25 · CVE-2026-122069. AlternativeCommerce PayPal Checkout - Moderately critical - Access bypass. Highlight Js syntax highlighter — Critical — SA-CONTRIB-2026-299 https://www.drupal.org/sa-contrib-2026-299 SA-CONTRIB-2026-299 Wed, 04 Nov 2026 12:00:00 GMT Critical risk 16/25 · CVE-2026-122068. Highlight Js syntax highlighter - Critical - Cross-site scripting. REST & JSON API Authentication for Drupal — Critical — SA-CONTRIB-2026-298 https://www.drupal.org/sa-contrib-2026-298 SA-CONTRIB-2026-298 Wed, 04 Nov 2026 12:00:00 GMT Critical risk 17/25 · CVE-2026-122067. REST & JSON API Authentication for Drupal - Critical - Access bypass. Workflow Notifications — Critical — SA-CONTRIB-2026-297 https://www.drupal.org/sa-contrib-2026-297 SA-CONTRIB-2026-297 Wed, 04 Nov 2026 12:00:00 GMT Critical risk 16/25 · CVE-2026-122066. Workflow Notifications - Critical - Access bypass. Simple OAuth (OAuth2) & OpenID Connect — Critical — SA-CONTRIB-2026-296 https://www.drupal.org/sa-contrib-2026-296 SA-CONTRIB-2026-296 Wed, 04 Nov 2026 12:00:00 GMT Critical risk 15/25 · CVE-2026-122058. Simple OAuth (OAuth2) & OpenID Connect - Critical - Access bypass. S3 File System CORS Upload — Critical — SA-CONTRIB-2026-295 https://www.drupal.org/sa-contrib-2026-295 SA-CONTRIB-2026-295 Wed, 04 Nov 2026 12:00:00 GMT Critical risk 16/25 · CVE-2026-122057. S3 File System CORS Upload - Critical - Access bypass. Content Synchronizer — Moderately critical — SA-CONTRIB-2026-294 https://www.drupal.org/sa-contrib-2026-294 SA-CONTRIB-2026-294 Wed, 04 Nov 2026 12:00:00 GMT Moderately critical risk 14/25 · CVE-2026-118566. Content Synchronizer - Moderately critical - Cross-site scripting. Content Synchronizer — Critical — SA-CONTRIB-2026-293 https://www.drupal.org/sa-contrib-2026-293 SA-CONTRIB-2026-293 Wed, 04 Nov 2026 12:00:00 GMT Critical risk 17/25 · CVE-2026-118547. Content Synchronizer - Critical - Remote code execution. GroupEx PRO ( Daxko ) integration — Critical — SA-CONTRIB-2026-278 https://www.drupal.org/sa-contrib-2026-278 SA-CONTRIB-2026-278 Wed, 04 Nov 2026 12:00:00 GMT Critical risk 17/25 · CVE-2026-118565. GroupEx PRO ( Daxko ) integration - Critical - PHP object injection. Media Alias Display — Moderately critical — SA-CONTRIB-2026-292 https://www.drupal.org/sa-contrib-2026-292 SA-CONTRIB-2026-292 Wed, 28 Oct 2026 12:00:00 GMT Moderately critical risk 11/25 · CVE-2026-118571. Media Alias Display - Moderately critical - Information disclosure.