Skip to content
OpenAdvisories

Ecosystem

Packagist

7,188 known vulnerabilities.

Most affected packages

moodle/moodle 437 magento/community-edition 360 typo3/cms 188 magento/project-community-edition 161 wwbn/avideo 160 drupal/core 150 pimcore/pimcore 135 typo3/cms-core 128 dolibarr/dolibarr 127 craftcms/cms 127 concrete5/concrete5 121 thorsten/phpmyfaq 112 phpmyadmin/phpmyadmin 107 microweber/microweber 106 librenms/librenms 106 symfony/symfony 102 getgrav/grav 99 silverstripe/framework 93 snipe/snipe-it 81 drupal/drupal 81 mantisbt/mantisbt 74 shopware/platform 70 shopware/core 65 froxlor/froxlor 60 mautic/core 57 baserproject/basercms 56 getkirby/cms 51 admidio/admidio 50 phpmyfaq/phpmyfaq 47 statamic/cms 44 nilsteampassnet/teampass 42 intelliants/subrion 42 showdoc/showdoc 42 contao/core-bundle 40 ci4-cms-erp/ci4ms 36 phpoffice/phpspreadsheet 35 shopware/shopware 34 zendframework/zendframework1 34 kimai/kimai 33 prestashop/prestashop 31
All Critical High Medium Low Exploited only Public exploit

3,764 results · Clear filters · Feed

  • Medium 6.5
    CVE-2026-114536

    USWDS Paragraph Components - Moderately critical - Cross site scripting - SA-CONTRIB-2026-234

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal USWDS Paragraph Components allows Stored XSS. This issue affects USWDS Paragraph Components versions: from 0.0.0 to 3.1.3.

    Drupal USWDS Paragraph Components drupal/uswds_paragraph_components Packagist
  • Medium 5.3
    CVE-2026-114537

    View Unpublished - Moderately critical - Access bypass - SA-CONTRIB-2026-235

    Incorrect Authorization vulnerability in Drupal View Unpublished allows Forceful Browsing. This issue affects View Unpublished versions: from 0.0.0 to 1.5.0.

    Drupal View Unpublished drupal/view_unpublished Packagist
  • Medium 6.3
    CVE-2026-114540

    Domain - Moderately critical - Access bypass - SA-CONTRIB-2026-238

    Incorrect Authorization vulnerability in Drupal Domain allows Forceful Browsing. This issue affects Domain versions: from 3.0.0 to 3.0.2.

    Drupal Domain drupal/domain Packagist
  • Medium 4.8
    CVE-2026-114541

    Frontend Editing - Moderately critical - Cross-Site Request Forgery (CSRF) - SA-CONTRIB-2026-240

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal Frontend Editing allows Cross Site Request Forgery. This issue affects Frontend Editing versions: from 0.0.0 to 1.9.3.

    Drupal Frontend Editing drupal/frontend_editing Packagist
  • Medium 5.4
    CVE-2026-114553

    Frontend Editing - Less critical - Access bypass - SA-CONTRIB-2026-241

    Incorrect Authorization vulnerability in Drupal Frontend Editing allows Forceful Browsing. This issue affects Frontend Editing versions: from 0.0.0 to 1.9.3.

    Drupal Frontend Editing drupal/frontend_editing Packagist
  • Medium 5.4
    CVE-2026-114542

    Simple OAuth (OAuth2) & OpenID Connect - Moderately critical - Access bypass - SA-CONTRIB-2026-242

    Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Simple OAuth (OAuth2) & OpenID Connect allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Simple OAuth (OAuth2) & OpenID Connect version…

    Drupal Simple OAuth (OAuth2) & OpenID Connect drupal/simple_oauth Packagist
  • Medium 5.4
    CVE-2026-114544

    Media Bulk Upload - Moderately critical - Access bypass - SA-CONTRIB-2026-243

    Incorrect Authorization vulnerability in Drupal Media Bulk Upload allows Forceful Browsing. This issue affects Media Bulk Upload versions: from 0.0.0 to 3.0.6.

    Drupal Media Bulk Upload drupal/media_bulk_upload Packagist
  • Medium 5.4
    CVE-2026-114545

    Fullcalendar View - Moderately critical - Access bypass - SA-CONTRIB-2026-244

    Incorrect Authorization vulnerability in Drupal Fullcalendar View allows Forceful Browsing. This issue affects Fullcalendar View versions: from 0.0.0 to 5.2.6.

    Drupal Fullcalendar View drupal/fullcalendar_view Packagist
  • Medium 5.3
    CVE-2026-107256

    Shield - Moderately critical - Access bypass - SA-CONTRIB-2026-248

    Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Shield allows Brute Force. This issue affects Shield versions: from 0.0.0 to 1.9.0.

    Drupal Shield drupal/shield Packagist
  • Medium 5.4
    CVE-2026-114572

    Domain Login Restrict - Moderately critical - Access bypass - SA-CONTRIB-2026-249

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Domain Login Restrict allows Authentication Bypass. This issue affects Domain Login Restrict versions: from 0.0.0 to 1.5.0.

    Drupal Domain Login Restrict drupal/domain_login_restrict Packagist
  • Medium 4.3
    CVE-2026-114554

    AI File to Text - Moderately critical - Access bypass - SA-CONTRIB-2026-251

    Incorrect Authorization vulnerability in Drupal AI File to Text allows Forceful Browsing. This issue affects AI File to Text versions: from 0.0.0 to 1.0.1.

    Drupal AI File to Text drupal/ai_file_to_text Packagist
  • Medium 6.5
    CVE-2026-114571

    Rabbit Hole - Moderately critical - Access Bypass - SA-CONTRIB-2026-252

    Incorrect Authorization vulnerability in Drupal Rabbit Hole allows Forceful Browsing. This issue affects Rabbit Hole versions: from 0.0.0 to 1.3.0.

    Drupal Rabbit Hole drupal/rabbit_hole Packagist
  • Medium 6.5
    CVE-2026-118539 Scanner template

    Commerce Core - Highly critical - Access bypass - SA-CONTRIB-2026-254

    Missing Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41, from 3.0.0 to 3.3.13.

    Drupal Commerce Core drupal/commerce Packagist
  • Medium 5.3
    CVE-2026-118540

    Commerce Core - Moderately critical - Information disclosure - SA-CONTRIB-2026-255

    Incorrect Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41, from 3.0.0 to 3.2.0.

    Drupal Commerce Core drupal/commerce Packagist
  • Medium 4.3
    CVE-2026-118541

    Commerce Core - Less critical - Access bypass - SA-CONTRIB-2026-256

    Incorrect Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13.

    Drupal Commerce Core drupal/commerce Packagist
  • Medium 5.3
    CVE-2026-118543

    Commerce Core - Moderately critical - Cross-site request forgery - SA-CONTRIB-2026-258

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal Commerce Core allows Cross Site Request Forgery. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13.

    Drupal Commerce Core drupal/commerce Packagist
  • Medium 6.3
    CVE-2026-118555

    Commerce License - Moderately critical - Access bypass - SA-CONTRIB-2026-260

    Incorrect Authorization vulnerability in Drupal Commerce License allows Forceful Browsing. This issue affects Commerce License versions: from 0.0.0 to 3.1.1.

    Drupal Commerce License drupal/commerce_license Packagist
  • Medium 6.5
    CVE-2026-118556

    Commerce Shipping - Moderately critical - Access bypass - SA-CONTRIB-2026-261

    Incorrect Authorization vulnerability in Drupal Commerce Shipping allows Forceful Browsing. This issue affects Commerce Shipping versions: from 0.0.0 to 2.16.0, from 3.0.0 to 3.0.6.

    Drupal Commerce Shipping drupal/commerce_shipping Packagist
  • Medium 5.3
    CVE-2026-118559

    Commerce Stripe - Moderately critical - Improper verification of cryptographic signature - SA-CONTRIB-2026-264

    Improper Verification of Cryptographic Signature vulnerability in Drupal Commerce Stripe allows Signature Spoof. This issue affects Commerce Stripe versions: from 0.0.0 to 1.4, from 2.0.0 to 2.2.3.

    Drupal Commerce Stripe drupal/commerce_stripe Packagist
  • Medium 5.1
    CVE-2026-118560

    Commerce Stripe - Moderately critical - Cross site scripting - SA-CONTRIB-2026-265

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Commerce Stripe allows Cross-Site Scripting (XSS). This issue affects Commerce Stripe versions: from 2.0.0 to 2.2.3.

    Drupal Commerce Stripe drupal/commerce_stripe Packagist
  • Medium 6.5
    CVE-2026-118545

    AI (Artificial Intelligence) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-266

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Cross-Site Scripting (XSS). This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1…

    Drupal AI (Artificial Intelligence) drupal/ai Packagist
  • Medium 6.5
    CVE-2026-118546

    AI (Artificial Intelligence) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-267

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Cross-Site Scripting (XSS). This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1…

    Drupal AI (Artificial Intelligence) drupal/ai Packagist
  • Medium 5.9
    CVE-2026-118550

    AI (Artificial Intelligence) - Moderately critical - Access bypass - SA-CONTRIB-2026-270

    Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal AI (Artificial Intelligence) allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4…

    Drupal AI (Artificial Intelligence) drupal/ai Packagist
  • Medium 6.5
    CVE-2026-118552

    AI (Artificial Intelligence) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-272

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Cross-Site Scripting (XSS). This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1…

    Drupal AI (Artificial Intelligence) drupal/ai Packagist
  • Medium 5.5
    CVE-2026-118553

    AI (Artificial Intelligence) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-273

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Stored XSS. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2.

    Drupal AI (Artificial Intelligence) drupal/ai Packagist
  • Medium 6.6
    CVE-2026-118563

    CacheFlush - Critical - Unsupported - SA-CONTRIB-2026-276

    Vulnerability in Drupal CacheFlush. This issue affects CacheFlush versions: *.*.

    Drupal CacheFlush drupal/cacheflush Packagist
  • Medium 6.6
    CVE-2026-118564

    PayUmoney for Drupal Commerce - Critical - Unsupported - SA-CONTRIB-2026-277

    Vulnerability in Drupal PayUmoney for Drupal Commerce. This issue affects PayUmoney for Drupal Commerce versions: *.*.

    Drupal PayUmoney for Drupal Commerce drupal/commerce_payumoney Web / CMS Packagist
  • Medium 5.4
    CVE-2026-118569 Public exploit

    Fasttoggle - Moderately critical - Access bypass - SA-CONTRIB-2026-282

    Incorrect Authorization vulnerability in Drupal Fasttoggle allows Forceful Browsing. This issue affects Fasttoggle versions: from 0.0.0 to 4.1.1.

    Drupal Fasttoggle drupal/fasttoggle Packagist
  • Medium 6.5
    CVE-2026-118570 Public exploit

    Fasttoggle - Moderately critical - Cross-Site Request Forgery - SA-CONTRIB-2026-283

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal Fasttoggle allows Cross Site Request Forgery. This issue affects Fasttoggle versions: from 0.0.0 to 4.1.1.

    Drupal Fasttoggle drupal/fasttoggle Packagist
  • Medium 5.6
    CVE-2026-118574

    S3 File System - Moderately critical - Access bypass - SA-CONTRIB-2026-279

    Incorrect Permission Assignment for Critical Resource vulnerability in Drupal S3 File System allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects S3 File System versions: from 0.0.0 to 3.12.0.

    Drupal S3 File System drupal/s3fs Packagist
  • Medium 4.7
    CVE-2026-118567

    Bulk Update User Roles - Moderately critical - Incorrect authorization - SA-CONTRIB-2026-280

    Incorrect Authorization vulnerability in Drupal Bulk Update User Roles allows Forceful Browsing. This issue affects Bulk Update User Roles versions: from 0.0.0 to 1.0.5.

    Drupal Bulk Update User Roles drupal/bulk_update_user_roles Packagist
  • Medium 4.8
    CVE-2026-118572

    OAuth Login - OAuth OIDC SSO - Critical - Authentication bypass - SA-CONTRIB-2026-284

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal OAuth Login - OAuth OIDC SSO allows Authentication Bypass. This issue affects OAuth Login - OAuth OIDC SSO versions: from 0.0.0 to 3.1.1.

    Drupal OAuth Login - OAuth OIDC SSO drupal/oauth_login_oauth2 Packagist
  • Medium 6.1
    CVE-2026-118575

    Signature pad widget - Critical - Cross-site scripting - SA-CONTRIB-2026-285

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Signature pad widget allows Stored XSS. This issue affects Signature pad widget versions: from 0.0.0 to 1.15.0.

    Drupal Signature pad widget drupal/sign_widget Packagist
  • Medium 6.5
    CVE-2026-118576

    Stage File Proxy - Critical - Cross-site scripting - SA-CONTRIB-2026-286

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Stage File Proxy allows Cross-Site Scripting (XSS). This issue affects Stage File Proxy versions: from 0.0.0 to 3.1.7, from 4.0.0 to 4.0.1.

    Drupal Stage File Proxy drupal/stage_file_proxy Packagist
  • Medium 5.4
    CVE-2026-118554

    OpenID Connect Client - Moderately critical - Improper authentication - SA-CONTRIB-2026-287

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal OpenID Connect Client allows Authentication Bypass. This issue affects OpenID Connect Client versions: from 0.0.0 to 2.3.1.

    Drupal OpenID Connect Client drupal/oidc Packagist
  • Medium 5.3
    CVE-2026-118583

    Field Permissions - Moderately critical - Access bypass - SA-CONTRIB-2026-288

    Incorrect Authorization vulnerability in Drupal Field Permissions allows Forceful Browsing. This issue affects Field Permissions versions: from 0.0.0 to 1.6.0.

    Drupal Field Permissions drupal/field_permissions Packagist
  • Medium 5.3
    CVE-2026-118584

    Field Permissions - Moderately critical - Access bypass - SA-CONTRIB-2026-289

    Incorrect Authorization vulnerability in Drupal Field Permissions allows Forceful Browsing. This issue affects Field Permissions versions: from 0.0.0 to 1.6.0.

    Drupal Field Permissions drupal/field_permissions Packagist
  • Medium 4.8
    CVE-2026-118573

    OAuth2 Token Manager - Critical - Access bypass - SA-CONTRIB-2026-290

    Missing Authorization vulnerability in Drupal OAuth2 Token Manager allows Forceful Browsing. This issue affects OAuth2 Token Manager versions: from 0.0.0 to 1.2.0.

    Drupal OAuth2 Token Manager drupal/oauth2_token_manager Packagist
  • Medium 5.9
    CVE-2026-118571

    Media Alias Display - Moderately critical - Information disclosure - SA-CONTRIB-2026-292

    Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Media Alias Display allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Media Alias Display versions: from 0.0.0 to 2.1.3, from 3.0.0 to …

    Drupal Media Alias Display drupal/media_alias_display Packagist
  • Medium 5.4
    CVE-2026-119193

    PHPUnit vulnerable to code execution by other local users via shared temporary directory in PHPT code coverage handling

    PHPUnit is a testing framework for PHP. From 13.4.0 until 13.4.4, the TestCase::coverageFilesDirectory() logic in src/Runner/Phpt/TestCase.php creates temporary files for PHPT code coverage in a predictable phpunit-phpt directory under sys_get_temp_dir() and …

    sebastianbergmann phpunit phpunit/phpunit phpunit Debian Packagist