Critical · 503 sites report using it · SA-CONTRIB-2026-316 · on drupal.org
This module provides a configurable data feed generator for pieces of content and fields.
The module does not properly check access rights when changing a password through the data feed. Someone with an ordinary account who can view another user could change their password and take over their account. They could access hidden data and change any information on the site including code.
- Who could do thisOnly someone with a login on your site.
- Does it apply to youA site is affected if the user login extension is turned on for the data feed server.
- Has it been used in attacksNo sign of it.
- How urgentDrupal rates this critical. Cyber Essentials expects a fix within 14 days. Do it this week.
Tell your developerUpdate GraphQL Core Schema to 1.0.29.
For developers: what the fix changed
The fix updates the PasswordChange data producer in `src/Plugin/GraphQL/DataProducer/User/PasswordChange.php` to verify that the current user has `update` access to the user entity before checking field-level access for the password field.
Also in this release The release also fixes a bug with language switch links on POST requests, refactors view resolvers, and adds missing schema annotations.
1.0.28 to 1.0.29 5 commits, 15 files including 9 tests.
src/GraphQL/Resolver/FieldResolver.php +96 −0src/Plugin/GraphQL/DataProducer/EnabledView.php +57 −0src/Plugin/GraphQL/DataProducer/LanguageSwitchLinks.php +15 −1src/Plugin/GraphQL/DataProducer/User/PasswordChange.php +6 −2 fixsrc/Plugin/GraphQL/SchemaExtension/LanguageExtension.php +2 −1src/Plugin/GraphQL/SchemaExtension/ViewsExtension.php +40 −191
Full diff, 1.0.28 to 1.0.29
The comparison is against the release immediately before the fix. If your site is on an older release, more will have changed.
Moderately critical · 65,684 sites report using it · SA-CONTRIB-2026-332 · on drupal.org
This module provides an improved way to shorten text fields and show summaries on a website.
The module does not properly clean unsafe code when text passes through its custom template filter. Someone with an ordinary account could run harmful code in the browser of other visitors. They could read hidden data and change information on the site.
- Who could do thisOnly someone with a login on your site.
- Does it apply to youA site is affected if an attacker has an access right to post content that passes through a template using one of the filters provided by this module.
- Has it been used in attacksNo sign of it.
- How urgentDrupal rates this moderately critical. Include it in your next routine update, within the month.
Tell your developerUpdate Smart Trim to 2.3.2 or 2.2.2, whichever branch you are on.
For developers: what the fix changed
The fix adds a smartTrimFilterOrEscape method in src/SmartTrimTwigExtension.php to escape untrusted input using Html::escape when HTML stripping is disabled, and updates smartTrimChars and smartTrimWords to use this new method.
2.3.1 to 2.3.2 1 commit, 1 file.
src/SmartTrimTwigExtension.php +38 −10 fix
Full diff, 2.3.1 to 2.3.2 · Full diff, 2.2.0 to 2.2.2
The comparison is against the release immediately before the fix. If your site is on an older release, more will have changed.
Moderately critical · 33,372 sites report using it · SA-CONTRIB-2026-327 · on drupal.org
This module lets you print and export pieces of content to PDF and other document formats.
The module sends private session data to external servers when generating a PDF that includes external resources. Someone with an ordinary account could use this to steal session data and impersonate other users who print that content. They could access hidden session data and modify information on the site by acting as someone else.
- Who could do thisOnly someone with a login on your site.
- Does it apply to youA site is affected if an attacker can create or edit content using a text format that allows images or styles from arbitrary sites.
- Has it been used in attacksNo sign of it.
- How urgentDrupal rates this moderately critical. Include it in your next routine update, within the month.
Tell your developerUpdate Entity Print to 8.x-2.20.
For developers: what the fix changed
The fix modifies `DomPdf::setupHttpContext` and adds `scopeHttpContextHeaders` and `isOwnHost` in `src/Plugin/EntityPrint/PrintEngine/DomPdf.php` to ensure that sensitive headers like session cookies and HTTP authentication are only sent to the site's own host, and disables following redirects.
8.x-2.19 to 8.x-2.20 1 commit, 2 files including 1 test.
src/Plugin/EntityPrint/PrintEngine/DomPdf.php +85 −7 fix
Full diff, 8.x-2.19 to 8.x-2.20
The comparison is against the release immediately before the fix. If your site is on an older release, more will have changed.
Moderately critical · 31,118 sites report using it · SA-CONTRIB-2026-330 · on drupal.org
This module lets you create custom pages and replace existing pages with different versions based on specific conditions.
The module does not properly protect its administration pages from forged requests. Anyone without logging in could trick an administrator into turning a page on or off without their knowledge. They could change this setting but could not view any hidden information.
- Who could do thisAnyone visiting the site. No login needed.
- Does it apply to youA site is affected if the user interface part of the module is turned on and the targeted user has the access right to administer pages.
- Has it been used in attacksNo sign of it.
- How urgentDrupal rates this moderately critical. Include it in your next routine update, within the month.
Tell your developerUpdate Page Manager to 8.x-4.1.
For developers: what the fix changed
Adds `_csrf_token: 'TRUE'` to the `entity.page.enable` and `entity.page.disable` routes in `page_manager_ui.routing.yml` to protect them against cross-site request forgery.
Also in this release Added Drupal 12 compatibility, converted procedural hooks to object-oriented hooks using attributes, and fixed an issue with outdated tempstore page statuses.
8.x-4.0 to 8.x-4.1 5 commits, 72 files including 42 tests.
page_manager.info.yml +1 −1page_manager.module +8 −16page_manager.services.yml +7 −19page_manager_ui/page_manager_ui.info.yml +1 −1page_manager_ui/page_manager_ui.module +13 −123page_manager_ui/page_manager_ui.post_update.php +7 −0page_manager_ui/page_manager_ui.routing.yml +2 −0 fixpage_manager_ui/page_manager_ui.services.yml +5 −0page_manager_ui/src/Controller/PageManagerController.php +7 −1page_manager_ui/src/Entity/PageListBuilder.php +2 −11page_manager_ui/src/Form/PageGeneralForm.php +3 −9page_manager_ui/src/Hook/PageManagerUiHooks.php +179 −0
Full diff, 8.x-4.0 to 8.x-4.1
The comparison is against the release immediately before the fix. If your site is on an older release, more will have changed.
Moderately critical · 15,544 sites report using it · SA-CONTRIB-2026-336 · on drupal.org
This module lets a site display users by a custom name built from their profile data instead of their username.
The module does not properly clean the data users enter into their profiles. Someone with an ordinary account could add harmful template code to their profile which runs when their name is shown. They could uncover hidden data but could not change anything else on the site.
- Who could do thisOnly someone with a login on your site.
- Does it apply to youA site is affected if it is set up to use a name pattern that includes user supplied data and the attacker can edit that data on their own account.
- Has it been used in attacksNo sign of it.
- How urgentDrupal rates this moderately critical. Include it in your next routine update, within the month.
Tell your developerUpdate Real Name to 2.0.1.
For developers: what the fix changed
The fix introduces a PatternRenderer service in src/PatternRenderer.php that compiles the real name pattern into a Twig template and passes user token values as context variables, preventing user input from being evaluated as Twig code. This replaces the direct token replacement and Twig rendering in the realname_update function of realname.module.
Also in this release The release also fixes a PHP deprecation warning for an implicitly nullable parameter and adds automated tests.
2.0.0 to 2.0.1 3 commits, 12 files including 6 tests.
realname.api.php +3 −0realname.install +7 −0 fixrealname.module +9 −13 fixrealname.services.yml +8 −0 fixsrc/PatternRenderer.php +192 −0 fixsrc/Plugin/Action/RealnameUpdateRealname.php +1 −1
Full diff, 2.0.0 to 2.0.1
The comparison is against the release immediately before the fix. If your site is on an older release, more will have changed.
Moderately critical · 15,403 sites report using it · SA-CONTRIB-2026-317 · on drupal.org
This module adds links and pages to edit, copy, and delete individual complex content blocks.
The module does not properly check access rights on the edit and delete pages for a content block. Someone with an ordinary account could edit or delete blocks they should not have access to. They could read hidden data and change information on the site.
- Who could do thisOnly someone with a login on your site.
- Does it apply to youA site is affected if an attacker has an account on the site and knows or guesses the ID of the content block.
- Has it been used in attacksNo sign of it.
- How urgentDrupal rates this moderately critical. Include it in your next routine update, within the month.
Tell your developerUpdate Paragraphs Edit to 3.0.2.
For developers: what the fix changed
The fix adds a custom access check to the edit, clone, and delete routes to verify that the paragraph belongs to the root parent specified in the path. This is implemented in src/Access/ParagraphLineageAccessCheck.php and applied via paragraphs_edit.routing.yml and paragraphs_edit.services.yml.
Also in this release The release also fixes a TypeError in the lineage inspector, improves revision handling, adds cancel links to forms, and refactors form preparation logic.
3.0.1 to 3.0.2 9 commits, 11 files.
.gitlab-ci.yml +0 −1paragraphs_edit.module +32 −0paragraphs_edit.routing.yml +3 −0 fixparagraphs_edit.services.yml +5 −0 fixsrc/Access/ParagraphLineageAccessCheck.php +57 −0 fixsrc/Form/ParagraphCloneForm.php +7 −3src/Form/ParagraphDeleteForm.php +7 −0src/Form/ParagraphEditForm.php +26 −33src/ParagraphFormHelperTrait.php +24 −0src/ParagraphLineageInspector.php +1 −1src/ParagraphLineageRevisioner.php +2 −1
Full diff, 3.0.1 to 3.0.2
The comparison is against the release immediately before the fix. If your site is on an older release, more will have changed.
Moderately critical · 11,479 sites report using it · SA-CONTRIB-2026-334 · on drupal.org
This module manages visitor consent for external services and blocks external videos until the visitor accepts the consent banner.
The module misses a check when converting a specific video attribute back into a source link. An administrator could add harmful code that runs in the browser of other visitors. They could view hidden data and alter information on the site.
- Who could do thisOnly someone with an administrator login.
- Does it apply to youA site is affected if an attacker has the access right to display a specific HTML element with a specific class to all users.
- Has it been used in attacksNo sign of it.
- How urgentDrupal rates this moderately critical. Include it in your next routine update, within the month.
Tell your developerUpdate COOKiES Consent Management to 1.2.17.
For developers: what the fix changed
The fix introduces a Drupal.cookies.isSafeUrl function in js/cookies.lib.js to ensure URLs use safe protocols. It also updates several JavaScript files, such as modules/cookies_video/js/cookies_media.js, to read raw attribute values and validate them using this new function before assigning them to an iframe.
1.2.16 to 1.2.17 1 commit, 4 files.
js/cookies.lib.js +33 −0 fixmodules/cookies_filter/js/cookies_filter.js +17 −12 fixmodules/cookies_video/js/cookies_media.js +17 −15 fixmodules/cookies_video/js/cookies_video_embed_field.js +8 −12 fix
Full diff, 1.2.16 to 1.2.17
The comparison is against the release immediately before the fix. If your site is on an older release, more will have changed.
Moderately critical · 9,404 sites report using it · SA-CONTRIB-2026-335 · on drupal.org
This module shows page layout editing forms inside a popup window using the administration design.
The command used to open the popup window does not properly clean the options it receives. Someone with an ordinary account could run harmful code in the browser of other visitors. They could access hidden data and modify information on the site.
- Who could do thisOnly someone with a login on your site.
- Does it apply to youA site is affected if an attacker can control the response from the server or add specific code to a page.
- Has it been used in attacksNo sign of it.
- How urgentDrupal rates this moderately critical. Include it in your next routine update, within the month.
Tell your developerUpdate Layout Builder iFrame Modal to 1.3.9.
For developers: what the fix changed
The fix updates the `render` method in `src/Ajax/OpenIframeCommand.php` to reuse the parent `OpenDialogCommand::render` logic, ensuring dialog options are properly sanitized.
Also in this release Added origin checks to postMessage listeners and updated tests for Drupal 12 compatibility.
1.3.8 to 1.3.9 5 commits, 5 files including 2 tests.
js/iframe.js +4 −0js/redirect.js +1 −1src/Ajax/OpenIframeCommand.php +5 −8 fix
Full diff, 1.3.8 to 1.3.9
The comparison is against the release immediately before the fix. If your site is on an older release, more will have changed.
Moderately critical · 3,318 sites report using it · 2 security fixes
This module lets a website sell access to resources like roles through an online shop.
2 security fixes in one update. Commerce License fixed 2 separate security bugs at once: 2 access bypass. One update covers all of them. The most serious, SA-CONTRIB-2026-323, is explained here and the full list is at the end of the card.
The module does not properly check the license linked to an order item. Anyone without logging in could take over a license belonging to another user. They could access hidden data and alter information on the site.
- Who could do thisAnyone visiting the site. No login needed.
- Does it apply to youA site is affected if a data feed is set up to allow writes to order items.
- Has it been used in attacksNo sign of it.
- How urgentDrupal rates this moderately critical. Include it in your next routine update, within the month.
Tell your developerUpdate Commerce License to 3.1.2.
For developers: what the fix changed
This release carries 2 security fixes. The summary below is for SA-CONTRIB-2026-323, the most serious of them.
The fix restricts access to the `license` field on order items and subscriptions in `commerce_license.module` and validates that the referenced license belongs to the order customer in `OrderSubscriber::getOrderItemLicense()`.
Also in this release The release also fixes an issue with fractional quantities in `LicenseOrderProcessorMultiples.php`, updates the `commerce` dependency version, and modifies access checks in `LicenseStorage.php`.
3.1.1 to 3.1.2 1 commit, 8 files including 2 tests.
commerce_license.module +35 −0 fixcomposer.json +1 −1src/Entity/License.php +1 −0src/EventSubscriber/OrderSubscriber.php +36 −4 fixsrc/LicenseOrderProcessorMultiples.php +7 −2src/LicenseStorage.php +1 −1
Full diff, 3.1.1 to 3.1.2
The comparison is against the release immediately before the fix. If your site is on an older release, more will have changed.
All 2 security bugs this update fixes, worst first. Each link is the drupal.org notice for that one.
Moderately critical · 1,745 sites report using it · SA-CONTRIB-2026-325 · on drupal.org
This module provides a way to place complex content blocks inside rich text fields using the text editor.
The module does not properly filter malicious text in the search feature. Someone with an ordinary account could run harmful code in the browser of other visitors. They could uncover hidden data and change information on the site.
- Who could do thisOnly someone with a login on your site.
- Does it apply to youA site is affected if an attacker has the access right to edit the label of the content block.
- Has it been used in attacksNo sign of it.
- How urgentDrupal rates this moderately critical. Include it in your next routine update, within the month.
Tell your developerUpdate Paragraphs entity embed to 4.0.1.
For developers: what the fix changed
The fix escapes the paragraph label in the autocomplete search results within the `handleAutocomplete` method of `ParagraphsEntityEmbedController`.
Also in this release The release also adds options to disable the search filter, negate the paragraph type selection, and fixes validation errors not showing in the embed dialog.
4.0.0 to 4.0.1 4 commits, 7 files including 1 test.
config/schema/paragraphs_entity_embed.schema.yml +6 −0paragraphs_entity_embed.install +64 −0src/Controller/ParagraphsEntityEmbedController.php +8 −16 fixsrc/Form/ParagraphEmbedDialog.php +71 −2src/Plugin/EmbedType/Paragraph.php +20 −2src/Plugin/Field/FieldWidget/EmbedParagraphsWidget.php +22 −2
Full diff, 4.0.0 to 4.0.1
The comparison is against the release immediately before the fix. If your site is on an older release, more will have changed.
Moderately critical · 1,707 sites report using it · SA-CONTRIB-2026-338 · on drupal.org
This module adds the ability to upload large files in chunks or multiple files at once to image and file upload forms.
The module does not properly check who is allowed to use the upload forms. Anyone without logging in could start uploading files to forms they should not have access to and store partial files on the server. They could add data to the server but could not view any hidden information.
- Who could do thisAnyone visiting the site. No login needed.
- Does it apply to youAny site using this module.
- Has it been used in attacksNo sign of it.
- How urgentDrupal rates this moderately critical. Include it in your next routine update, within the month.
Tell your developerUpdate File Resumable Upload to 2.0.6.
For developers: what the fix changed
The fix adds access checks to the `onBuildForm` methods in `src/EventSubscriber/BuildForm.php` and `modules/file_resup_media_library/src/EventSubscriber/BuildForm.php` to verify that the current user has permission to create or update the entity, or access the media library, before allowing the upload.
Also in this release The release also added a composer.json file, improved upload request handling, and updated field settings to be read as booleans.
2.0.5 to 2.0.6 2 commits, 11 files.
composer.json +30 −0file_resup.module +1 −1 fixfile_resup.services.yml +1 −1 fixjs/file-resup.js +4 −0 fixmodules/file_resup_media_library/file_resup_media_library.services.yml +1 −1 fixmodules/file_resup_media_library/src/EventSubscriber/BuildForm.php +50 −22 fixmodules/file_resup_media_library/src/Form/MediaLibraryAddFormUploadAlter.php +2 −2 fixsrc/Controller/UploadController.php +29 −14 fixsrc/EventSubscriber/BuildForm.php +67 −42 fixsrc/Form/FileFormAlterBase.php +10 −5 fixsrc/Form/FileWidgetFormAlter.php +2 −2 fix
Full diff, 2.0.5 to 2.0.6
The comparison is against the release immediately before the fix. If your site is on an older release, more will have changed.
Moderately critical · 1,153 sites report using it · SA-CONTRIB-2026-337 · on drupal.org
This module lets users upload files straight from their browser to an external storage service using a file upload form.
The module gives the browser too much power when uploading files. Someone with an ordinary account could replace existing files in the storage service that they normally would not be allowed to change. They could overwrite files but could not read any hidden information.
- Who could do thisOnly someone with a login on your site.
- Does it apply to youA site is affected if an attacker has access to a form that uses this specific file upload feature.
- Has it been used in attacksNo sign of it.
- How urgentDrupal rates this moderately critical. Include it in your next routine update, within the month.
Tell your developerUpdate S3 File System CORS Upload to 8.x-1.4.
For developers: what the fix changed
The fix moves the S3 upload policy generation from the form element into a new `UploadPolicy` service and changes the policy condition from a `starts-with` prefix to an exact `key` match. This ensures the browser can only upload to the specific file key issued, preventing users from overwriting other files in the bucket.
Also in this release Added kernel tests, fixed server-side validation, and added support for Drupal 12.
8.x-1.3 to 8.x-1.4 4 commits, 24 files including 8 tests.
.cspell-project-words.txt +3 −1.gitlab-ci.yml +1 −1s3fs_cors.info.yml +1 −1s3fs_cors.install +7 −0s3fs_cors.js +2 −2 fixs3fs_cors.module +0 −30s3fs_cors.services.yml +3 −0src/Controller/AjaxController.php +60 −22 fixsrc/Element/S3fsCorsFile.php +21 −106 fixsrc/Form/S3fsCorsAdminForm.php +1 −1src/Plugin/Field/FieldWidget/S3fsCorsFileWidget.php +1 −1src/Plugin/Field/FieldWidget/S3fsCorsImageWidget.php +1 −1
Full diff, 8.x-1.3 to 8.x-1.4
The comparison is against the release immediately before the fix. If your site is on an older release, more will have changed.
Moderately critical · 766 sites report using it · SA-CONTRIB-2026-331 · on drupal.org
This module tracks downloads of private files and provides reports about them.
The module creates access rights that it never actually checks. Someone with an ordinary account could export the download log and delete all download records. They could view hidden download data and remove these records.
- Who could do thisOnly someone with a login on your site.
- Does it apply to youA site is affected if the attacker has an account with the access right to view download counts.
- Has it been used in attacksNo sign of it.
- How urgentDrupal rates this moderately critical. Include it in your next routine update, within the month.
Tell your developerUpdate Download Count to 3.0.2 or 2.2.5, whichever branch you are on.
For developers: what the fix changed
Updates download_count.routing.yml to require the reset download counts and export download counts permissions for the reset and export routes respectively.
Also in this release Updated a library reference from classy to claro for Drupal 10 compatibility and added a test.
3.0.1 to 3.0.2 2 commits, 3 files including 1 test.
download_count.routing.yml +2 −2 fixsrc/Plugin/Field/FieldFormatter/FieldDownloadCount.php +1 −1
Full diff, 3.0.1 to 3.0.2 · Full diff, 2.2.4 to 2.2.5
The comparison is against the release immediately before the fix. If your site is on an older release, more will have changed.
Moderately critical · 719 sites report using it · SA-CONTRIB-2026-326 · on drupal.org
This module connects a website to an email marketing service so visitors can join or leave mailing lists.
The module does not properly protect its administration pages from forged requests. Anyone without logging in could trick an administrator into clicking a malicious link. They could alter list settings but could not read any hidden information.
- Who could do thisAnyone visiting the site. No login needed.
- Does it apply to youA site is affected if an attacker embeds a link with the exact ID of a mailing list and tricks a user with the access right to administer the module into clicking it.
- Has it been used in attacksNo sign of it.
- How urgentDrupal rates this moderately critical. Include it in your next routine update, within the month.
Tell your developerUpdate Campaign Monitor to 3.0.3.
For developers: what the fix changed
Added `_csrf_token: 'TRUE'` to the list enable, disable, and refresh routes in `campaignmonitor.routing.yml` and updated link generation in `CampaignMonitorListsController.php` to use routes so tokens are automatically appended.
Also in this release Updated the delete form description and redirect URL, and added a cache clear on list deletion.
3.0.2 to 3.0.3 4 commits, 3 files.
campaignmonitor.routing.yml +3 −0 fixsrc/Controller/CampaignMonitorListsController.php +49 −68 fixsrc/Form/CampaignMonitorListDeleteForm.php +5 −3
Full diff, 3.0.2 to 3.0.3
The comparison is against the release immediately before the fix. If your site is on an older release, more will have changed.
Moderately critical · 442 sites report using it · SA-CONTRIB-2026-333 · on drupal.org
This module provides online shop support for Spanish banks that use specific payment systems.
The module does not check if a payment response actually belongs to the order it is being processed for. Anyone without logging in could cause an order to show the wrong payment status. They could change this data but could not uncover any hidden information.
- Who could do thisAnyone visiting the site. No login needed.
- Does it apply to youAny site using this module.
- Has it been used in attacksNo sign of it.
- How urgentDrupal rates this moderately critical. Include it in your next routine update, within the month.
Tell your developerUpdate Commerce sermepa to 8.x-2.5.
For developers: what the fix changed
The fix validates the Redsys response signature before processing merchant parameters and ensures the received order ID matches the order being paid in `Sermepa::processRequest()`. It also adds `isPaidAmountValid()` to verify the paid amount and currency, and updates `SermepaForm::buildConfigurationForm()` to include the amount and order total in the signed merchant data.
8.x-2.4 to 8.x-2.5 1 commit, 2 files.
src/Plugin/Commerce/PaymentGateway/Sermepa.php +101 −10 fixsrc/PluginForm/OffsiteRedirect/SermepaForm.php +5 −1 fix
Full diff, 8.x-2.4 to 8.x-2.5
The comparison is against the release immediately before the fix. If your site is on an older release, more will have changed.
Moderately critical · 429 sites report using it · 2 security fixes
This module provides tools for managing text strings and translations on a website.
2 security fixes in one update. Texts: key-based strings and translations fixed 2 separate security bugs at once: 1 cross site request forgery, 1 cross site scripting. One update covers all of them. The most serious, SA-CONTRIB-2026-319, is explained here and the full list is at the end of the card.
The module does not properly protect the action to restore a duplicate translation. Someone with an ordinary account could trick a user into overwriting an existing translation and deleting the duplicate. They could change translation data but could not view any hidden information.
- Who could do thisOnly someone with a login on your site.
- Does it apply to youA site is affected if an attacker creates a suitable duplicate translation and tricks a user with access to the translation overview into opening a crafted request.
- Has it been used in attacksNo sign of it.
- How urgentDrupal rates this moderately critical. Include it in your next routine update, within the month.
Tell your developerUpdate Texts: key-based strings and translations to 1.0.17.
For developers: what the fix changed
This release carries 2 security fixes. The summary below is for SA-CONTRIB-2026-319, the most serious of them.
Adds CSRF protection to the `entity.texts.restore_duplicate` route in `texts.routing.yml` and enforces `update` and `delete` access checks in `TextsController::restoreDuplicate()`.
Also in this release Replaces deprecated GraphQL callbacks with data producers, fixes deprecations, refines text validation, and requires Drupal 10.3.
1.0.16 to 1.0.17 3 commits, 26 files including 5 tests.
.gitlab-ci.yml +65 −0Readme.MD +3 −2composer.json +1 −1modules/texts_graphql/src/Plugin/GraphQL/DataProducer/TextsDataProducerBase.php +48 −0modules/texts_graphql/src/Plugin/GraphQL/DataProducer/TextsGetText.php +96 −0modules/texts_graphql/src/Plugin/GraphQL/DataProducer/TextsGetTextMultiple.php +95 −0modules/texts_graphql/src/Plugin/GraphQL/DataProducer/TextsGetTextPlural.php +106 −0modules/texts_graphql/src/Plugin/GraphQL/SchemaExtension/TextsExtension.php +23 −158modules/texts_graphql/texts_graphql.info.yml +1 −1phpstan.neon +1 −1src/Controller/TextsController.php +7 −0 fixsrc/Entity/Texts.php +55 −42
Full diff, 1.0.16 to 1.0.17
The comparison is against the release immediately before the fix. If your site is on an older release, more will have changed.
All 2 security bugs this update fixes, worst first. Each link is the drupal.org notice for that one.
Moderately critical · 291 sites report using it · SA-CONTRIB-2026-339 · on drupal.org
This module provides a way to store structured data with multiple parts and includes a search feature.
The search feature does not properly clean up stored data before showing it as a suggestion. Someone with an ordinary account could add harmful code that runs when other people view the suggestions. They could uncover hidden information and alter data on the site.
- Who could do thisOnly someone with a login on your site.
- Does it apply to youA site is affected if the attacker has the access right to edit a piece of content with this data field and the search feature is turned on for that field.
- Has it been used in attacksNo sign of it.
- How urgentDrupal rates this moderately critical. Include it in your next routine update, within the month.
Tell your developerUpdate Data field to 3.0.1 or 2.0.15, whichever branch you are on.
For developers: what the fix changed
The fix escapes the value and label returned by the autocomplete endpoint using Html::escape and Html::decodeEntities in JsonController.
3.0.0 to 3.0.1 1 commit, 1 file.
src/Controller/JsonController.php +3 −2 fix
Full diff, 3.0.0 to 3.0.1 · Full diff, 2.0.14 to 2.0.15
The comparison is against the release immediately before the fix. If your site is on an older release, more will have changed.
Moderately critical · 267 sites report using it · 2 security fixes
This module lets a website accept online payments using a specific payment provider.
2 security fixes in one update. Mollie for Drupal fixed 2 separate security bugs at once: 1 information disclosure, 1 incorrect authorization. One update covers all of them. The most serious, SA-CONTRIB-2026-329, is explained here and the full list is at the end of the card.
The module can sometimes reveal the secret security token used to connect to the payment provider. Anyone without logging in could see this hidden token. They could not alter any information on the site.
- Who could do thisAnyone visiting the site. No login needed.
- Does it apply to youA site is affected if the webform part of the module is turned on.
- Has it been used in attacksNo sign of it.
- How urgentDrupal rates this moderately critical. Include it in your next routine update, within the month.
Tell your developerUpdate Mollie for Drupal to 2.3.2.
For developers: what the fix changed
This release carries 2 security fixes. The summary below is for SA-CONTRIB-2026-329, the most serious of them.
The fix adds a cryptographic signature to the redirect URL in `PaymentStorage.php` and verifies it in `RedirectController::paymentRedirect` to prevent unauthorized access. It also enforces context validation for transactions in `WebhookController.php` and `Mollie.php`.
Also in this release The release also fixes a plugin instantiation issue in the Mollie commerce payment gateway and adds automated tests.
2.3.1 to 2.3.2 4 commits, 8 files including 3 tests.
modules/mollie_commerce/src/Plugin/Commerce/PaymentGateway/Mollie.php +11 −1 fixsrc/Controller/RedirectController.php +14 −1 fixsrc/Controller/WebhookController.php +22 −13 fixsrc/Entity/PaymentStorage.php +3 −1 fixsrc/RedirectSignature.php +54 −0 fix
Full diff, 2.3.1 to 2.3.2
The comparison is against the release immediately before the fix. If your site is on an older release, more will have changed.
All 2 security bugs this update fixes, worst first. Each link is the drupal.org notice for that one.
Moderately critical · 6 sites report using it · 3 security fixes
This module requires a second security check using a code from an app when users log in.
3 security fixes in one update. Authenticator Login Plus (2FA) fixed 3 separate security bugs at once: 3 authentication bypass. One update covers all of them. The most serious, SA-CONTRIB-2026-322, is explained here and the full list is at the end of the card.
The module can sometimes be tricked into accepting a login without a valid password or second code. Someone with an ordinary account could take over another account that has this security check turned on. They could view hidden data and modify information on the site.
- Who could do thisOnly someone with a login on your site.
- Does it apply to youA site is affected if the attacker has their own account, controls the email address or knows the password of the victim, and wins a timing dependent race.
- Has it been used in attacksNo sign of it.
- How urgentDrupal rates this moderately critical. Include it in your next routine update, within the month.
Tell your developerUpdate Authenticator Login Plus (2FA) to 1.0.3.
For developers: what the fix changed
This release carries 3 security fixes. The summary below is for SA-CONTRIB-2026-322, the most serious of them.
The fix resolves a race condition by storing the pending login state as a single record via the new PendingLogin class and in src/Service/LoginChallengeManager.php, rather than across multiple keys. It also reworks the handling of logins that bypass the standard form by introducing UnverifiedLoginSubscriber and OneTimeLoginController to ensure the password check and second factor authentication cannot be bypassed.
Also in this release The release also stores code length and validity period per enrollment, fixes a doubled base path in the continue link, lists each user once on the admin overview, and updates dependencies.
1.0.2 to 1.0.3 7 commits, 36 files including 15 tests.
README.md +38 −1auth_login_plus.install +102 −0auth_login_plus.routing.yml +3 −3 fixauth_login_plus.services.yml +17 −0 fixcomposer.json +1 −1src/Access/OwnSettingsAccessCheck.php +6 −3 fixsrc/Controller/AdminOverviewController.php +2 −0src/Controller/OneTimeLoginController.php +64 −0 fixsrc/Controller/ResetRequestController.php +11 −4 fixsrc/EventSubscriber/LoginEnforcementSubscriber.php +116 −6 fixsrc/EventSubscriber/UnverifiedLoginSubscriber.php +143 −0 fixsrc/Exception/UnverifiedLoginException.php +24 −0 fix
Full diff, 1.0.2 to 1.0.3
The comparison is against the release immediately before the fix. If your site is on an older release, more will have changed.
All 3 security bugs this update fixes, worst first. Each link is the drupal.org notice for that one.
