Moderately critical · 221,221 sites report using it · SA-CONTRIB-2026-113 · on drupal.org
This module provides a standard way for the website to manage and interact with different pieces of content.
Anyone without logging in could use a data feed to view lists of content. This would allow them to read private information that should be hidden. They could not change any of this information.
- Who could do thisAnyone visiting the site. No login needed.
- Does it apply to youA site is affected if the data feed module is also turned on.
- Has it been used in attacksNo sign of it.
- How urgentDrupal rates this moderately critical. Include it in your next routine update, within the month.
Tell your developerUpdate Entity API to 8.x-1.8.
For developers: what the fix changed
Removes the default allowed access result when there are no conditions in entity_jsonapi_entity_filter_access within entity.module.
Also in this release Adds a functional test for JSON:API terms.
8.x-1.7 to 8.x-1.8 1 commit, 2 files including 1 test.
Full diff, 8.x-1.7 to 8.x-1.8
The comparison is against the release immediately before the fix. If your site is on an older release, more will have changed.
Moderately critical · 68,226 sites report using it · SA-CONTRIB-2026-117 · on drupal.org
This module provides a way to display images and media in a sliding gallery on a website.
An administrator account could add malicious code to the buttons of a sliding gallery. This code would run in the browser of anyone visiting the page. The administrator could use this to read hidden information or change content on the website.
- Who could do thisOnly someone with an administrator login.
- Does it apply to youAny site using this module.
- Has it been used in attacksNo sign of it.
- How urgentDrupal rates this moderately critical. Include it in your next routine update, within the month.
Tell your developerUpdate Slick Carousel to the latest release.
For developers: what the fix changed
The code change for this release could not be fetched from git.drupalcode.org.
Moderately critical · 11,733 sites report using it · SA-CONTRIB-2026-107 · on drupal.org
This module sends automatic emails to specific users or authors when a piece of content moves through an approval process.
An administrator account could be given the access right to edit email templates without realising this grants deep access to the system. The user could then run malicious code within those templates to read highly sensitive information or change anything on the website.
- Who could do thisOnly someone with an administrator login.
- Does it apply to youAny site using this module.
- Has it been used in attacksNo sign of it.
- How urgentDrupal rates this moderately critical. Include it in your next routine update, within the month.
Tell your developerUpdate Content Moderation Notifications to 8.x-3.9.
For developers: what the fix changed
Adds the restrict access flag to the administer content moderation notifications permission in content_moderation_notifications.permissions.yml.
8.x-3.8 to 8.x-3.9 1 commit, 1 file.
content_moderation_notifications.permissions.yml +2 −1 fix
Full diff, 8.x-3.8 to 8.x-3.9
The comparison is against the release immediately before the fix. If your site is on an older release, more will have changed.
Moderately critical · 1,613 sites report using it · 2 security fixes
This module hides the standard website login screen from visitors unless they know a secret web address.
2 security fixes in one update. Disable Login Page fixed 2 separate security bugs this week: 2 access bypass. One update covers all of them. The most serious, SA-CONTRIB-2026-111, is explained here and the full list is at the end of the card.
Anyone without logging in could still reach the login screen if a copy of it was saved by the website performance system before the restriction was turned on. They could not read any private data or change anything on the site.
- Who could do thisAnyone visiting the site. No login needed.
- Does it apply to youAny site using this module.
- Has it been used in attacksA working example has been published, so assume someone will try.
- How urgentDrupal rates this moderately critical. Include it in your next routine update, within the month.
Tell your developerUpdate Disable Login Page to the latest release.
For developers: what the fix changed
The code change for this release could not be fetched from git.drupalcode.org.
All 2 security bugs this update fixes, worst first. Each link is the drupal.org notice for that one.
Moderately critical · 907 sites report using it · SA-CONTRIB-2026-112 · on drupal.org
This module provides a visual tool and artificial intelligence features for building pages on the website.
Anyone without logging in could look at the background settings of a page and find the secret digital key used for the artificial intelligence services. This would allow them to read private subscription details. They could not change any settings or content.
- Who could do thisAnyone visiting the site. No login needed.
- Does it apply to youA site is affected if it has the artificial intelligence features turned on and configured with a secret key.
- Has it been used in attacksNo sign of it.
- How urgentDrupal rates this moderately critical. Include it in your next routine update, within the month.
Tell your developerUpdate DXPR Builder: The Best Editing (AI) Experience for Drupal to 2.8.1.
For developers: what the fix changed
Wraps the inclusion of AI settings and the API key in an `if ($enable_editor)` check within `DxprBuilderFormatter.php` to prevent exposing credentials to non-editors, and adds the `user.roles:authenticated` cache context.
Also in this release Fixed image style selection logic, added file usage tracking for uploaded files, and resolved various PHPStan warnings.
2.8.0 to 2.8.1 2 commits, 14 files.
dxpr_builder.info.yml +1 −1dxpr_builder.install +0 −2dxpr_builder/dxpr_frontend.min.js +0 −0js/image-select.js +6 −0js/image-utils.js +4 −4modules/dxpr_builder_block/dxpr_builder_block.info.yml +1 −1modules/dxpr_builder_page/dxpr_builder_page.info.yml +1 −1src/Controller/AjaxController.php +0 −2src/Controller/UploadFileController.php +9 −0src/Form/DxprBuilderSettingsForm.php +0 −1src/Form/DxprBuilderUserTemplateForm.php +2 −1src/Plugin/Field/FieldFormatter/DxprBuilderFormatter.php +184 −184 fix
Full diff, 2.8.0 to 2.8.1
The comparison is against the release immediately before the fix. If your site is on an older release, more will have changed.
Moderately critical · 454 sites report using it · SA-CONTRIB-2026-114 · on drupal.org
This module allows the website to create a PDF document out of any piece of content.
An ordinary account on the site could ask the website to generate a PDF of a piece of content they are not normally allowed to view. This would let them read private information contained in that document. They could not change or add any information.
- Who could do thisOnly someone with a login on your site.
- Does it apply to youAny site using this module.
- Has it been used in attacksNo sign of it.
- How urgentDrupal rates this moderately critical. Include it in your next routine update, within the month.
Tell your developerUpdate Entity PDF to 2.1.5.
For developers: what the fix changed
The fix adds entity view access checks to the routing requirements in entity_pdf.routing.yml and to the access methods in PdfEntityController and EntityPdfDownload.
2.1.4 to 2.1.5 1 commit, 3 files.
entity_pdf.routing.yml +1 −0 fixsrc/Controller/PdfEntityController.php +2 −1 fixsrc/Plugin/Action/EntityPdfDownload.php +6 −3 fix
Full diff, 2.1.4 to 2.1.5
The comparison is against the release immediately before the fix. If your site is on an older release, more will have changed.
Moderately critical · 448 sites report using it · SA-CONTRIB-2026-115 · on drupal.org
This module allows people to log into the website using the same username and password they use for their organisation network.
Anyone without logging in could send specially crafted text to the search tool used for finding user accounts. This would allow them to discover extra information about the network that they should not normally be able to see. They could not change any information.
- Who could do thisAnyone visiting the site. No login needed.
- Does it apply to youAny site using this module.
- Has it been used in attacksA working example has been published, so assume someone will try.
- How urgentDrupal rates this moderately critical. Include it in your next routine update, within the month.
Tell your developerUpdate LDAP / Active Directory Integration to 2.2.1.
For developers: what the fix changed
The release diff is linked below. No summary of the fix has been written for this one.
2.2.0 to 2.2.1 0 commits, 0 files.
Full diff, 2.2.0 to 2.2.1
The comparison is against the release immediately before the fix. If your site is on an older release, more will have changed.
Moderately critical · 339 sites report using it · SA-CONTRIB-2026-108 · on drupal.org
This module allows administrators to create custom forms for storing structured information on the website.
Anyone without logging in could use a data feed to ask for specific stored information. This would allow them to read unpublished content or other private details. They could not change any of the information.
- Who could do thisAnyone visiting the site. No login needed.
- Does it apply to youAny site using this module.
- Has it been used in attacksNo sign of it.
- How urgentDrupal rates this moderately critical. Include it in your next routine update, within the month.
Tell your developerUpdate Data field to 2.0.13.
For developers: what the fix changed
The fix modifies `JsonController::json` to query and load entities using the entity storage with access checks (`$storage->getQuery()->accessCheck(TRUE)` and `$entity->access('view')`), rather than querying the database table directly.
Also in this release Added an export file name option for the data field table formatter, implemented plugin caching for performance improvements, and fixed minor typos.
2.0.12 to 2.0.13 3 commits, 9 files including 1 test.
config/schema/datafield.schema.yml +0 −0src/Controller/JsonController.php +60 −49 fixsrc/Plugin/DataFieldFormatterInterface.php +1 −1src/Plugin/DataFieldWidgetInterface.php +1 −1src/Plugin/Field/FieldFormatter/Base.php +8 −2src/Plugin/Field/FieldFormatter/DataFieldTable.php +32 −1src/Plugin/Field/FieldType/DataFieldItem.php +98 −82src/Plugin/Field/FieldWidget/Base.php +28 −16
Full diff, 2.0.12 to 2.0.13
The comparison is against the release immediately before the fix. If your site is on an older release, more will have changed.
Moderately critical · 256 sites report using it · SA-CONTRIB-2026-103 · on drupal.org
This module provides a search box that automatically suggests full addresses as a user types.
An ordinary account on the site could see malicious code run in their browser if they searched for an address that returned a poisoned suggestion. This could allow an attacker to read private data or change content on the site.
- Who could do thisOnly someone with a login on your site.
- Does it apply to youA site is affected if an attacker can inject malicious content into the address provider and a user searches for that specific suggestion.
- Has it been used in attacksNo sign of it.
- How urgentDrupal rates this moderately critical. Include it in your next routine update, within the month.
Tell your developerUpdate Address Suggestion to 1.0.25.
For developers: what the fix changed
The fix sanitises address suggestion data by escaping HTML entities in the `handleAutocomplete` method of `src/Controller/AddressSuggestion.php` and in `js/ckeditor5_plugins/addressSuggestion/src/InsertAddressCommand.js`. It also updates `js/address_suggestion.js` to use jQuery's `.text()` method instead of raw HTML concatenation when appending new options.
Also in this release The release also includes code style improvements, PHPCS/PHPStan fixes, and minor JavaScript refactoring.
1.0.24 to 1.0.25 5 commits, 22 files.
js/address_suggestion.js +69 −42 fixjs/build/addressSuggestion.js +1 −1 fixjs/ckeditor5_plugins/addressSuggestion/src/AddressSuggestionIcon-view.js +1 −1js/ckeditor5_plugins/addressSuggestion/src/InsertAddressCommand.js +18 −2 fixsrc/Controller/AddressSuggestion.php +13 −5 fixsrc/Element/AddressSuggestion.php +5 −5src/Hook/AddressSuggestionHooks.php +74 −74src/Plugin/AddressProvider/BingMaps.php +2 −2src/Plugin/AddressProvider/CAPost.php +2 −2src/Plugin/AddressProvider/DistanceMatrix.php +2 −2src/Plugin/AddressProvider/FranceAddress.php +2 −2src/Plugin/AddressProvider/GoogleMaps.php +2 −2
Full diff, 1.0.24 to 1.0.25
The comparison is against the release immediately before the fix. If your site is on an older release, more will have changed.
Moderately critical · 102 sites report using it · SA-CONTRIB-2026-106 · on drupal.org
This module connects the website online shop to a specific payment processing service.
Anyone without logging in could manipulate the timing of messages sent back from the payment provider. This would allow them to trick the website into recording a successful payment when no money was actually taken. They could not read any private data.
- Who could do thisAnyone visiting the site. No login needed.
- Does it apply to youA site is affected if it uses the off site redirect payment method.
- Has it been used in attacksNo sign of it.
- How urgentDrupal rates this moderately critical. Include it in your next routine update, within the month.
Tell your developerUpdate Commerce CyberSource to 8.x-1.10.
For developers: what the fix changed
The fix updates the signature validation in the validateResponse function of src/Plugin/Commerce/PaymentGateway/CyberSourceSahc.php to use hash_equals. This ensures the comparison executes in constant time to prevent timing attacks.
Also in this release The release also added JWT signature verification for transient tokens in the Flex payment gateway.
8.x-1.9 to 8.x-1.10 1 commit, 2 files.
src/Plugin/Commerce/PaymentGateway/CyberSourceSahc.php +26 −6 fixsrc/Plugin/Commerce/PaymentGateway/Flex.php +36 −4
Full diff, 8.x-1.9 to 8.x-1.10
The comparison is against the release immediately before the fix. If your site is on an older release, more will have changed.
Moderately critical · 41 sites report using it · SA-CONTRIB-2026-105 · on drupal.org
This module allows administrators to protect specific pages with a test to prove the visitor is human.
Anyone without logging in could create a fake digital token to trick the website into thinking they had already passed the human verification test. This would allow automated bots to read protected pages. They could not change any information.
- Who could do thisAnyone visiting the site. No login needed.
- Does it apply to youAny site using this module.
- Has it been used in attacksNo sign of it.
- How urgentDrupal rates this moderately critical. Include it in your next routine update, within the month.
Tell your developerUpdate CAPTCHA Protected Page to 1.0.2.
For developers: what the fix changed
The fix replaces the static 'verified' cookie value with a token signed using HMAC containing the protected path and expiration time, generated in `CaptchaForm::createCookie()` and validated in `CaptchaRedirectSubscriber::onKernelRequest()`.
Also in this release Added Drupal 11 compatibility.
1.0.1 to 1.0.2 2 commits, 4 files.
captcha_protected_page.info.yml +1 −1captcha_protected_page.services.yml +2 −2 fixsrc/EventSubscriber/CaptchaRedirectSubscriber.php +89 −6 fixsrc/Form/CaptchaForm.php +59 −6 fix
Full diff, 1.0.1 to 1.0.2
The comparison is against the release immediately before the fix. If your site is on an older release, more will have changed.
Moderately critical · 12 sites report using it · SA-CONTRIB-2026-116 · on drupal.org
This module allows a website to be split into multiple smaller sites with highly detailed access rights for different pages.
An ordinary account on the site could add malicious code to a page name. This code would run when someone else views the built in tree browser. The attacker could use this to read private data or change content on the site.
- Who could do thisOnly someone with a login on your site.
- Does it apply to youA site is affected if an attacker has the ability to create pages where the title supports HTML code.
- Has it been used in attacksNo sign of it.
- How urgentDrupal rates this moderately critical. Include it in your next routine update, within the month.
Tell your developerUpdate Monster Menus to 9.5.3.
For developers: what the fix changed
The fix introduces a new `_mm_content_escape_name` function in `mm_content.inc` that sanitises page names using `strip_tags` and `Xss::filter`, and applies it to the return values of `mm_content_expand_name` and `mm_content_get_name`.
Also in this release Added a functional JavaScript test to ensure JavaScript in page names is not evaluated.
9.5.2 to 9.5.3 1 commit, 2 files including 1 test.
mm_content.inc +12 −7 fix
Full diff, 9.5.2 to 9.5.3
The comparison is against the release immediately before the fix. If your site is on an older release, more will have changed.
Moderately critical · 7 sites report using it · SA-CONTRIB-2026-109 · on drupal.org
This module provides a way for digital display screens to automatically update their content from the website.
Anyone without logging in could pretend to be a display screen and ask the website for specific blocks of content. This would allow them to read information they were not meant to see. They could not change any of the content.
- Who could do thisAnyone visiting the site. No login needed.
- Does it apply to youAny site using this module.
- Has it been used in attacksNo sign of it.
- How urgentDrupal rates this moderately critical. Include it in your next routine update, within the month.
Tell your developerUpdate Digital Signage Framework to 2.6.1.
For developers: what the fix changed
The fix replaces the generic 'access content' permission on the block API route with a custom access check in `BlockApi::access()` that verifies the requester is a known device or has preview permission. It also updates `BlockApi::request()` to verify that the requested block is a valid signage block using the new `isSignageBlock()` method, returning a 404 if it is not.
Also in this release The release introduces a `Regions` class to centralise region names and adds comprehensive tests for the block API route.
2.6.0 to 2.6.1 1 commit, 8 files including 3 tests.
digital_signage_framework.routing.yml +1 −1 fixsrc/Controller/BlockApi.php +223 −6 fixsrc/EventSubscriber/Blocks.php +3 −2src/Hook/DigitalSignageFrameworkHooks.php +3 −2src/Regions.php +32 −0
Full diff, 2.6.0 to 2.6.1
The comparison is against the release immediately before the fix. If your site is on an older release, more will have changed.
Less critical · 79,986 sites report using it · SA-CONTRIB-2026-104 · on drupal.org
This module speeds up the website by only loading images and media when they scroll into view.
An ordinary account on the site could use a special text code to display a specific part of a piece of content they are not allowed to view. This would let them read private information from that specific part. They could not change any information.
- Who could do thisOnly someone with a login on your site.
- Does it apply to youA site is affected if a user has access to a text format that uses this module.
- Has it been used in attacksNo sign of it.
- How urgentDrupal rates this less critical. Fix it with the next routine update.
Tell your developerUpdate Blazy to 3.0.18.
For developers: what the fix changed
The provided diff does not appear to contain the fix for the access bypass vulnerability, as there are no changes related to entity view access checks or filter plugin shortcode rendering logic.
The fix is not clearly separable from the other changes in this release, so treat the summary above as a pointer rather than a finding.
Also in this release The release refactored hooks for Drupal 12 compatibility, updated documentation, modified JavaScript for media handling, and adjusted service definitions.
3.0.17 to 3.0.18 61 commits, 225 files including 25 tests.
.eslintignore +11 −0.eslintrc.json +2 −1.gitattributes +6 −0.gitignore +4 −0.gitlab-ci.yml +5 −0CHANGELOG.txt +51 −0blazy.api.php +38 −4blazy.install +1 −1blazy.libraries.yml +7 −4blazy.module +20 −109blazy.services.yml +74 −35config/install/blazy.settings.yml +2 −0
Full diff, 3.0.17 to 3.0.18
The comparison is against the release immediately before the fix. If your site is on an older release, more will have changed.
