Drupal Erweiterungen: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 23

• Unscored —
  CVE-2026-118547

  The Content Synchronizer module allows content to be exported and imported between Drupal sites via uploaded archive fi…

  drupal/content_synchronizer Packagist
  Nov 4, 2026
• Unscored —
  CVE-2026-118566

  The Content Synchronizer module allows content to be exported and imported between Drupal sites via uploaded archive fi…

  drupal/content_synchronizer Packagist
  Nov 4, 2026
• Unscored —
  CVE-2026-122057

  This module enables you to upload files from the browser directly to Amazon S3 and register them as Drupal files, bypas…

  drupal/s3fs_cors Packagist
  Nov 4, 2026
• Unscored —
  CVE-2026-122058

  This module introduces an OAuth 2.0 authorization server, which can be configured to protect your Drupal instance with …

  drupal/simple_oauth Packagist
  Nov 4, 2026
• Unscored —
  CVE-2026-122066

  This module enables you to send messages ("Notifications") to users upon a certain Workflow state change. The module do…

  drupal/workflow_notifications Packagist
  Nov 4, 2026
• Unscored —
  CVE-2026-122067

  The REST & JSON API Authentication module provides API authentication for Drupal sites. The module does not properly re…

  drupal/rest_api_authentication Packagist
  Nov 4, 2026
• Unscored —
  CVE-2026-122068

  This module enables you to add syntax-highlighted code snippets to content using CKEditor 5. The module doesn't suffici…

  drupal/highlight_js Packagist
  Nov 4, 2026
• Unscored —
  CVE-2026-122069

  The AlternativeCommerce PayPal Checkout module provides an AlternativeCommerce method to embed payment services from Pa…

  drupal/basket_paypal Packagist
  Nov 4, 2026
• Unscored —
  CVE-2026-122070

  This module lets customers replace an item in their cart with one of the alternative product variations listed for it. …

  drupal/commerce_product_alternative Packagist
  Nov 4, 2026
• Unscored —
  CVE-2026-122071

  This module enables you to accept payments through Escrow.com with Drupal Commerce. The module doesn't sufficiently ver…

  drupal/commerce_escrow Packagist
  Nov 4, 2026
• Unscored —
  CVE-2026-122072

  This module allows forums to be set private and to be given moderators. The module doesn't sufficiently check access fo…

  drupal/forum_access Packagist
  Nov 4, 2026
• Unscored —
  CVE-2026-122073

  The Name Field module provides a field for storing a personal name as separate components. The module does not sufficie…

  drupal/name Packagist
  Nov 4, 2026
• Unscored —
  CVE-2026-122074

  This module enables you to reset passwords via one time passcode to email or SMS rather than reset password links. The …

  drupal/reset_password_email_otp Packagist
  Nov 4, 2026
• Unscored —
  CVE-2026-122075

  This module enables you to schedule content to be published or unpublished at a certain time in the future. The module …

  drupal/scheduler Packagist
  Nov 4, 2026
• Unscored —
  CVE-2026-122076

  This module provides a separate page with a form for users to change their own password, which asks for the current pas…

  drupal/change_pwd_page Packagist
  Nov 4, 2026
• Unscored —
  CVE-2026-122077

  The Allowed Languages module makes it possible to set restrictions on which content a user can edit based on language. …

  drupal/allowed_languages Packagist
  Nov 4, 2026
• Unscored —
  CVE-2026-122078

  The Extended HTML Filter module allows using style attributes in CKEditor. The module XSS filter does not sufficiently …

  drupal/extended_html_filter Packagist
  Nov 4, 2026
• Unscored —
  CVE-2026-122079

  The htmLawed module enables use of the [htmLawed](https://bioinformatics.org/phplabware/internal_utilities/htmLawed/ind…

  drupal/htmlawed Packagist
  Nov 4, 2026
• Unscored —
  CVE-2026-122080

  The htmLawed module enables use of the [htmLawed](https://bioinformatics.org/phplabware/internal_utilities/htmLawed/ind…

  drupal/htmlawed Packagist
  Nov 4, 2026
• Unscored —
  CVE-2026-122081

  Islandora does not sufficiently check file update access when processing media source and derivative uploads. A user wi…

  drupal/islandora Packagist
  Nov 4, 2026
• Unscored —
  CVE-2026-122082

  The Mime Mail module gives Drupal sites the ability to send HTML email messages. Under rare site configuration conditio…

  drupal/mimemail Packagist
  Nov 4, 2026
• Unscored —
  CVE-2026-122083

  This module integrates the Site Catalyst or AdobeAnalytics software into a Drupal site. The module does not sufficientl…

  drupal/adobe_analytics Packagist
  Nov 4, 2026
• Unscored —
  CVE-2026-122084

  The WordsOnline Connector module integrates Drupal with the WordsOnline translation service through the TMGMT module. T…

  drupal/wordsonline_connector Packagist
  Nov 4, 2026

Revision history

1. 2026-11-04 #1

   Initiale Fassung

References

• Drupal Security Advisory sa-contrib-2026-293 vom 2026-11-04
  https://www.drupal.org/sa-contrib-2026-293
• Drupal Security Advisory sa-contrib-2026-294 vom 2026-11-04
  https://www.drupal.org/sa-contrib-2026-294
• Drupal Security Advisory sa-contrib-2026-295 vom 2026-11-04
  https://www.drupal.org/sa-contrib-2026-295
• Drupal Security Advisory sa-contrib-2026-296 vom 2026-11-04
  https://www.drupal.org/sa-contrib-2026-296
• Drupal Security Advisory sa-contrib-2026-297 vom 2026-11-04
  https://www.drupal.org/sa-contrib-2026-297
• Drupal Security Advisory sa-contrib-2026-298 vom 2026-11-04
  https://www.drupal.org/sa-contrib-2026-298
• Drupal Security Advisory sa-contrib-2026-299 vom 2026-11-04
  https://www.drupal.org/sa-contrib-2026-299
• Drupal Security Advisory sa-contrib-2026-300 vom 2026-11-04
  https://www.drupal.org/sa-contrib-2026-300
• Drupal Security Advisory sa-contrib-2026-301 vom 2026-11-04
  https://www.drupal.org/sa-contrib-2026-301
• Drupal Security Advisory sa-contrib-2026-302 vom 2026-11-04
  https://www.drupal.org/sa-contrib-2026-302
• Drupal Security Advisory sa-contrib-2026-303 vom 2026-11-04
  https://www.drupal.org/sa-contrib-2026-303
• Drupal Security Advisory sa-contrib-2026-304 vom 2026-11-04
  https://www.drupal.org/sa-contrib-2026-304
• Drupal Security Advisory sa-contrib-2026-305 vom 2026-11-04
  https://www.drupal.org/sa-contrib-2026-305
• Drupal Security Advisory sa-contrib-2026-306 vom 2026-11-04
  https://www.drupal.org/sa-contrib-2026-306
• Drupal Security Advisory sa-contrib-2026-307 vom 2026-11-04
  https://www.drupal.org/sa-contrib-2026-307
• Drupal Security Advisory sa-contrib-2026-308 vom 2026-11-04
  https://www.drupal.org/sa-contrib-2026-308
• Drupal Security Advisory sa-contrib-2026-309 vom 2026-11-04
  https://www.drupal.org/sa-contrib-2026-309
• Drupal Security Advisory sa-contrib-2026-310 vom 2026-11-04
  https://www.drupal.org/sa-contrib-2026-310
• Drupal Security Advisory sa-contrib-2026-311 vom 2026-11-04
  https://www.drupal.org/sa-contrib-2026-311
• Drupal Security Advisory sa-contrib-2026-312 vom 2026-11-04
  https://www.drupal.org/sa-contrib-2026-312
• Drupal Security Advisory sa-contrib-2026-313 vom 2026-11-04
  https://www.drupal.org/sa-contrib-2026-313
• Drupal Security Advisory sa-contrib-2026-314 vom 2026-11-04
  https://www.drupal.org/sa-contrib-2026-314
• Drupal Security Advisory sa-contrib-2026-315 vom 2026-11-04
  https://www.drupal.org/sa-contrib-2026-315