Skip to content
OpenAdvisories

Ecosystem

Packagist

7,190 known vulnerabilities.

Most affected packages

moodle/moodle 437 magento/community-edition 360 typo3/cms 188 magento/project-community-edition 161 wwbn/avideo 160 drupal/core 150 pimcore/pimcore 135 typo3/cms-core 128 dolibarr/dolibarr 127 craftcms/cms 127 concrete5/concrete5 121 thorsten/phpmyfaq 112 phpmyadmin/phpmyadmin 107 microweber/microweber 106 librenms/librenms 106 symfony/symfony 102 getgrav/grav 99 silverstripe/framework 93 snipe/snipe-it 81 drupal/drupal 81 mantisbt/mantisbt 74 shopware/platform 70 shopware/core 65 froxlor/froxlor 60 mautic/core 57 baserproject/basercms 56 getkirby/cms 51 admidio/admidio 50 phpmyfaq/phpmyfaq 47 statamic/cms 44 nilsteampassnet/teampass 42 intelliants/subrion 42 showdoc/showdoc 42 contao/core-bundle 40 ci4-cms-erp/ci4ms 36 phpoffice/phpspreadsheet 35 shopware/shopware 34 zendframework/zendframework1 34 kimai/kimai 33 prestashop/prestashop 31
All Critical High Medium Low Exploited only Public exploit

7,180 results · Feed

  • Medium 5.3
    CVE-2026-107266

    Views Share - Moderately critical - Access bypass - SA-CONTRIB-2026-205

    Missing Authorization vulnerability in Drupal Views Share allows Forceful Browsing. This issue affects Views Share versions: from 0.0.0 to 2.0.1.

    Drupal Views Share drupal/views_share Packagist
  • Medium 6.5
    CVE-2026-96389

    Xray Audit - Moderately critical - Access bypass - SA-CONTRIB-2026-206

    Missing Authorization vulnerability in Drupal Xray Audit allows Forceful Browsing. This issue affects Xray Audit versions: from 0.0.0 to 1.6.3, from 2.0.0 to 2.0.4, from 3.0.0 to 3.1.1.

    Drupal Xray Audit drupal/xray_audit Packagist
  • Medium 4.3
    CVE-2026-107268 Public exploit

    Two Factor Authentication - TFA / Passwordless Login - Moderately critical - Information disclosure - SA-CONTRIB-2026-207

    Insertion of Sensitive Information Into Sent Data vulnerability in Drupal Two Factor Authentication - TFA / Passwordless Login allows Forceful Browsing. This issue affects Two Factor Authentication - TFA / Passwordless Login versions: from 0.0.0 to 5.4.1, fro…

    Drupal Two Factor Authentication - TFA / Passwordless Login drupal/miniorange_2fa Packagist
  • Medium 5.3
    CVE-2026-107267

    DKAN - Moderately critical - Access bypass - SA-CONTRIB-2026-208

    Missing Authorization vulnerability in Drupal DKAN allows Forceful Browsing. This issue affects DKAN versions: from 0.0.0 to 4.0.4, from 4.1.0 to 4.1.5.

    Drupal DKAN drupal/dkan Packagist
  • Low 3.8
    CVE-2026-107306

    Menu Link Attributes - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-209

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Menu Link Attributes allows Stored XSS. This issue affects Menu Link Attributes versions: from 0.0.0 to 1.8.0.

    Drupal Menu Link Attributes drupal/menu_link_attributes Packagist
  • Medium 4.3
    CVE-2026-107307

    SmartLinker AI - Moderately critical - Information disclosure - SA-CONTRIB-2026-210

    Incorrect Authorization vulnerability in Drupal SmartLinker AI allows Forceful Browsing. This issue affects SmartLinker AI versions: from 0.0.0 to 1.0.3.

    Drupal SmartLinker AI drupal/smartlinker_ai Packagist
  • Low 3.1
    CVE-2026-107308

    Country - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-211

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Country allows Cross-Site Scripting (XSS). This issue affects Country versions: from 0.0.0 to 2.1.3, from 2.2.0 to 2.2.1.

    Drupal Country drupal/country Packagist
  • Low 3.7
    CVE-2026-107309

    Easy Breadcrumb - Moderately critical - Information disclosure - SA-CONTRIB-2026-212

    Missing Authorization vulnerability in Drupal Easy Breadcrumb allows Forceful Browsing. This issue affects Easy Breadcrumb versions: from 0.0.0 to 2.0.11.

    Drupal Easy Breadcrumb drupal/easy_breadcrumb Packagist
  • Medium 4.3
    CVE-2026-107310

    Freelinking - Moderately critical - Information Disclosure - SA-CONTRIB-2026-213

    Server-Side Request Forgery (SSRF) vulnerability in Drupal Freelinking allows Server Side Request Forgery. This issue affects Freelinking versions: from 0.0.0 to 4.0.3.

    Drupal Freelinking drupal/freelinking Packagist
  • Low 3.7
    CVE-2026-107311

    Permissions by Term - Moderately critical - Information disclosure - SA-CONTRIB-2026-214

    Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal Permissions by Term allows Forceful Browsing. This issue affects Permissions by Term versions: from 0.0.0 to 3.1.41.

    Drupal Permissions by Term drupal/permissions_by_term Packagist
  • Medium 4.3
    CVE-2026-107312

    Examples for Developers - Less critical - Allocation of resources without limits or throttling - SA-CONTRIB-2026-215

    Allocation of Resources Without Limits or Throttling vulnerability in Drupal Examples for Developers allows Excessive Allocation. This issue affects Examples for Developers versions: from 0.0.0 to 4.0.7.

    Drupal Examples for Developers drupal/examples Packagist
  • High 7.3
    CVE-2026-107255

    Restrict route by IP - Critical - Access bypass - SA-CONTRIB-2026-216

    Incorrect Authorization vulnerability in Drupal Restrict route by IP allows Forceful Browsing. This issue affects Restrict route by IP versions: from 0.0.0 to 1.3.1, from 2.0.0 to 2.0.1.

    Drupal Restrict route by IP drupal/restrict_route_by_ip Packagist
  • Medium 5.3
    CVE-2026-107262

    Advanced Filesystem - Moderately critical - Cross-Site Request Forgery - SA-CONTRIB-2026-217

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal Advanced Filesystem allows Cross Site Request Forgery. This issue affects Advanced Filesystem versions: from 0.0.0 to 1.0.28.

    Drupal Advanced Filesystem drupal/advanced_filesystem Packagist
  • High 8.1
    CVE-2026-108097 Public exploit

    Drupal core - Critical - Remote code execution - SA-CORE-2026-014

    Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Drupal Drupal core allows Reflection Injection. This issue affects Drupal core versions: from 8.9.0 to 10.6.19, from 11.0.0 to 11.3.19, from 11.4.0 to 11.4.10,…

    Drupal Drupal core drupal/core Web / CMS Packagist
  • Medium 6.5
    CVE-2026-110738

    Gin Admin Theme - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-219

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Gin Admin Theme allows Cross-Site Scripting (XSS). This issue affects Gin Admin Theme versions: from 0.0.0 to 4.1.4, from 5.0.0 to 5.0.16.

    Drupal Gin Admin Theme drupal/gin Packagist
  • Medium 6.5
    CVE-2026-108515

    Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-015

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Drupal core versions: from 8.9.0 to 10.6.19, from 11.0.0 to 11.3.19, from 11.4.0 to …

    Drupal Drupal core drupal/core Web / CMS Packagist
  • Medium 6.5
    CVE-2026-108514

    Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-016

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Drupal core versions: from 10.3.0 to 10.6.19, from 11.0.0 to 11.3.19, from 11.4.0 to…

    Drupal Drupal core drupal/core Web / CMS Packagist
  • High 8.1
    CVE-2026-108099

    Entity List - Critical - Remote code execution - SA-CONTRIB-2026-218

    Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Drupal Entity List allows Reflection Injection. This issue affects Entity List versions: from 0.0.0 to 3.0.10.

    Drupal Entity List drupal/entity_list Packagist
  • Critical 9.8
    CVE-2026-114523

    Ffmpeg Image Toolkit - Highly critical - Remote Code Execution - SA-CONTRIB-2026-220

    Improper Neutralization of Special Elements used in an OS Command ("OS Command Injection") vulnerability in Drupal Ffmpeg Image Toolkit allows OS Command Injection. This issue affects Ffmpeg Image Toolkit versions: from 0.0.0 to 1.0.3.

    Drupal Ffmpeg Image Toolkit drupal/ffmpeg_image_toolkit Packagist
  • High 7.1
    CVE-2026-114527

    UI Icons - Critical - Cross site scripting - SA-CONTRIB-2026-221

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal UI Icons allows Cross-Site Scripting (XSS). This issue affects UI Icons versions: from 0.0.0 to 1.1.3, from 2.0.0 to 2.0.2.

    Drupal UI Icons drupal/ui_icons Packagist
  • High 7.1
    CVE-2026-114528

    Zero Point - Critical - Cross-site scripting - SA-CONTRIB-2026-222

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Zero Point allows Stored XSS. This issue affects Zero Point versions: from 0.0.0 to 1.30.0, from 2.0.0 to 2.0.1.

    Drupal Zero Point drupal/zeropoint Packagist
  • High 7.1
    CVE-2026-114526

    Black Hole - Critical - Cross-site scripting - SA-CONTRIB-2026-223

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Black Hole allows Stored XSS. This issue affects Black Hole versions: from 0.0.0 to 1.26.0, from 2.0.0 to 2.0.1.

    Drupal Black Hole drupal/black_hole Packagist
  • High 7.1
    CVE-2026-114525

    ABC - Critical - Cross-site scripting - SA-CONTRIB-2026-224

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal ABC allows Stored XSS. This issue affects ABC versions: from 0.0.0 to 1.25.0, from 2.0.0 to 2.0.1.

    Drupal ABC drupal/abc Packagist
  • High 7.2
    CVE-2026-114524

    Custom Formatters - Critical - Remote code execution - SA-CONTRIB-2026-225

    Privilege Defined With Unsafe Actions vulnerability in Drupal Custom Formatters allows Privilege Escalation. This issue affects Custom Formatters versions: from 0.0.0 to 4.2.1.

    Drupal Custom Formatters drupal/custom_formatters Packagist
  • Medium 6.5
    CVE-2026-114529

    CSV Field - Moderately critical - Cross site Scripting - SA-CONTRIB-2026-226

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal CSV Field allows Stored XSS. This issue affects CSV Field versions: from 0.0.0 to 2.0.10, from 3.0.0 to 3.0.7.

    Drupal CSV Field drupal/csv_field Packagist
  • Medium 5.3
    CVE-2026-114530

    Dopup - Critical - Information disclosure - SA-CONTRIB-2026-227

    Incorrect Authorization vulnerability in Drupal Dopup allows Forceful Browsing. This issue affects Dopup versions: from 0.0.0 to 1.0.7.

    Drupal Dopup drupal/dopup Packagist
  • Medium 6.5
    CVE-2026-114531

    Swiper formatter - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-228

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Swiper formatter allows Stored XSS. This issue affects Swiper formatter versions: from 0.0.0 to 2.1.2, from 3.0.1 to 3.1.0.

    Drupal Swiper formatter drupal/swiper_formatter Packagist
  • Medium 6.5
    CVE-2026-107260

    Sector Distribution - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-229

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Sector Distribution allows Stored XSS. This issue affects Sector Distribution versions: from 0.0.0 to 10.3.3, from 10.4.0 to 10.4.2.

    Drupal Sector Distribution drupal/sector Packagist
  • Medium 6.5
    CVE-2026-114532

    UI Icons - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-230

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal UI Icons allows Cross-Site Scripting (XSS). This issue affects UI Icons versions: from 0.0.0 to 1.1.3, from 2.0.0 to 2.0.2.

    Drupal UI Icons drupal/ui_icons Packagist
  • Medium 5.3
    CVE-2026-114533

    Ágora Transparency Theme - Moderately critical - Information disclosure - SA-CONTRIB-2026-231

    Missing Authorization vulnerability in Drupal Ágora Transparency Theme allows Forceful Browsing. This issue affects Ágora Transparency Theme versions: from 0.0.0 to 1.2.3.

    Drupal Ágora Transparency Theme drupal/agora_theme Packagist
  • Medium 5.9
    CVE-2026-114534

    Block Attributes - Moderately critical - Cross site Scripting - SA-CONTRIB-2026-232

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Block Attributes allows Stored XSS. This issue affects Block Attributes versions: from 0.0.0 to 2.1.0.

    Drupal Block Attributes drupal/block_attributes Packagist
  • Medium 5.3
    CVE-2026-114535

    Swiper formatter - Moderately critical - Information disclosure - SA-CONTRIB-2026-233

    Missing Authorization vulnerability in Drupal Swiper formatter allows Forceful Browsing. This issue affects Swiper formatter versions: from 0.0.0 to 2.1.2, from 3.0.1 to 3.1.0.

    Drupal Swiper formatter drupal/swiper_formatter Packagist
  • Medium 6.5
    CVE-2026-114536

    USWDS Paragraph Components - Moderately critical - Cross site scripting - SA-CONTRIB-2026-234

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal USWDS Paragraph Components allows Stored XSS. This issue affects USWDS Paragraph Components versions: from 0.0.0 to 3.1.3.

    Drupal USWDS Paragraph Components drupal/uswds_paragraph_components Packagist
  • Medium 5.3
    CVE-2026-114537

    View Unpublished - Moderately critical - Access bypass - SA-CONTRIB-2026-235

    Incorrect Authorization vulnerability in Drupal View Unpublished allows Forceful Browsing. This issue affects View Unpublished versions: from 0.0.0 to 1.5.0.

    Drupal View Unpublished drupal/view_unpublished Packagist
  • High 7.1
    CVE-2026-114538

    Bootstrap - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-236

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Bootstrap allows Cross-Site Scripting (XSS). This issue affects Bootstrap versions: from 0.0.0 to 3.45.0.

    Drupal Bootstrap drupal/bootstrap debootstrap Azure Linux Packagist
  • Medium 6.3
    CVE-2026-114540

    Domain - Moderately critical - Access bypass - SA-CONTRIB-2026-238

    Incorrect Authorization vulnerability in Drupal Domain allows Forceful Browsing. This issue affects Domain versions: from 3.0.0 to 3.0.2.

    Drupal Domain drupal/domain Packagist
  • Medium 6.3
    CVE-2026-114543

    Simple User Management - Moderately critical - Access bypass - SA-CONTRIB-2026-239

    Incorrect Authorization vulnerability in Drupal Simple User Management allows Forceful Browsing. This issue affects Simple User Management versions: from 0.0.0 to 1.11.0.

    Drupal Simple User Management drupal/simple_user_management Packagist
  • Medium 4.8
    CVE-2026-114541

    Frontend Editing - Moderately critical - Cross-Site Request Forgery (CSRF) - SA-CONTRIB-2026-240

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal Frontend Editing allows Cross Site Request Forgery. This issue affects Frontend Editing versions: from 0.0.0 to 1.9.3.

    Drupal Frontend Editing drupal/frontend_editing Packagist
  • Medium 5.4
    CVE-2026-114553

    Frontend Editing - Less critical - Access bypass - SA-CONTRIB-2026-241

    Incorrect Authorization vulnerability in Drupal Frontend Editing allows Forceful Browsing. This issue affects Frontend Editing versions: from 0.0.0 to 1.9.3.

    Drupal Frontend Editing drupal/frontend_editing Packagist
  • Medium 5.4
    CVE-2026-114542

    Simple OAuth (OAuth2) & OpenID Connect - Moderately critical - Access bypass - SA-CONTRIB-2026-242

    Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Simple OAuth (OAuth2) & OpenID Connect allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Simple OAuth (OAuth2) & OpenID Connect version…

    Drupal Simple OAuth (OAuth2) & OpenID Connect drupal/simple_oauth Packagist