diff --git a/advisories/ai_provider_amazeeio/DRUPAL-CONTRIB-2026-134.json b/advisories/ai_provider_amazeeio/DRUPAL-CONTRIB-2026-134.json new file mode 100644 index 00000000..42539b28 --- /dev/null +++ b/advisories/ai_provider_amazeeio/DRUPAL-CONTRIB-2026-134.json @@ -0,0 +1,66 @@ +{ + "schema_version": "1.7.0", + "id": "DRUPAL-CONTRIB-2026-134", + "modified": "2026-09-09T17:14:57.000Z", + "published": "2026-09-09T17:14:00.000Z", + "aliases": [ + "CVE-2026-87936" + ], + "details": "This module integrates amazee.ai's AI services into Drupal, including a Postgres/pgvector vector database backend for use with Search API AI Search.\n\nThe module doesn't sufficiently sanitize filter values before using them to build SQL queries in its Postgres/pgvector backend, allowing SQL injection.\n\nThis vulnerability is mitigated by the fact that a site must be using the module's Postgres/pgvector vector database backend for a Search API AI Search index, and must expose one of that index's non-string fields as a filter (for example, through a View) that is reachable by the attacker.", + "affected": [ + { + "package": { + "ecosystem": "Packagist:https://packages.drupal.org/8", + "name": "drupal/ai_provider_amazeeio" + }, + "severity": [], + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.3.7" + } + ], + "database_specific": { + "constraint": "<1.3.7" + } + }, + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.4.0" + }, + { + "fixed": "1.4.3" + } + ], + "database_specific": { + "constraint": ">=1.4.0 <1.4.3" + } + } + ], + "database_specific": { + "affected_versions": "<1.3.7 || >=1.4.0 <1.4.3" + } + } + ], + "references": [ + { + "type": "WEB", + "url": "https://www.drupal.org/sa-contrib-2026-134" + } + ], + "credits": [ + { + "name": "Matan Kotick (matank001)", + "contact": [ + "https://www.drupal.org/u/matank001" + ] + } + ] +} diff --git a/advisories/cas_server/DRUPAL-CONTRIB-2026-135.json b/advisories/cas_server/DRUPAL-CONTRIB-2026-135.json new file mode 100644 index 00000000..e95df9f2 --- /dev/null +++ b/advisories/cas_server/DRUPAL-CONTRIB-2026-135.json @@ -0,0 +1,66 @@ +{ + "schema_version": "1.7.0", + "id": "DRUPAL-CONTRIB-2026-135", + "modified": "2026-09-09T17:15:40.000Z", + "published": "2026-09-09T17:15:40.000Z", + "aliases": [ + "CVE-2026-87937" + ], + "details": "This module enables you to turn a Drupal install into the Central Authentication System (CAS) Server. It makes your database the primary location for other systems to use for authentication in a SSO environment.\n\nThe module doesn't sufficiently check the service URL used to redirect the user during logout, leading to an open redirect.\n\nThis vulnerability is mitigated by the fact that an attacker must convince a user to click a specially crafted link. The vulnerability cannot be exploited without user interaction and does not allow an attacker to directly compromise the CAS server or bypass authentication.", + "affected": [ + { + "package": { + "ecosystem": "Packagist:https://packages.drupal.org/8", + "name": "drupal/cas_server" + }, + "severity": [], + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.0.4" + } + ], + "database_specific": { + "constraint": "<2.0.4" + } + }, + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.1.0" + }, + { + "fixed": "2.1.3" + } + ], + "database_specific": { + "constraint": ">=2.1.0 <2.1.3" + } + } + ], + "database_specific": { + "affected_versions": "<2.0.4 || >=2.1.0 <2.1.3" + } + } + ], + "references": [ + { + "type": "WEB", + "url": "https://www.drupal.org/sa-contrib-2026-135" + } + ], + "credits": [ + { + "name": "Kalle Kipin\u00e4 (kekkis)", + "contact": [ + "https://www.drupal.org/u/kekkis" + ] + } + ] +} diff --git a/advisories/csp_log/DRUPAL-CONTRIB-2026-136.json b/advisories/csp_log/DRUPAL-CONTRIB-2026-136.json new file mode 100644 index 00000000..51055d0a --- /dev/null +++ b/advisories/csp_log/DRUPAL-CONTRIB-2026-136.json @@ -0,0 +1,52 @@ +{ + "schema_version": "1.7.0", + "id": "DRUPAL-CONTRIB-2026-136", + "modified": "2026-09-09T17:16:33.000Z", + "published": "2026-09-09T17:16:33.000Z", + "aliases": [ + "CVE-2026-87938" + ], + "details": "The CSP Log module enhances any module that adds the CSP header to a site, by providing a reporting endpoint, custom storage, and aggregated reports that can be used to trace issues or adapt the CSP headers.\n\nThe module did not sufficiently sanitize user-supplied values used in database queries, resulting in an SQL injection vulnerability.\n\nThis vulnerability is mitigated by the fact that an attacker needs access to an account with the *Access CSP reports* permission to exploit the SQL Injection.", + "affected": [ + { + "package": { + "ecosystem": "Packagist:https://packages.drupal.org/8", + "name": "drupal/csp_log" + }, + "severity": [], + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.0.2" + } + ], + "database_specific": { + "constraint": "<1.0.2" + } + } + ], + "database_specific": { + "affected_versions": "<1.0.2" + } + } + ], + "references": [ + { + "type": "WEB", + "url": "https://www.drupal.org/sa-contrib-2026-136" + } + ], + "credits": [ + { + "name": "eduardo morales alberti", + "contact": [ + "https://www.drupal.org/u/eduardo-morales-alberti" + ] + } + ] +} diff --git a/advisories/feed_block/DRUPAL-CONTRIB-2026-137.json b/advisories/feed_block/DRUPAL-CONTRIB-2026-137.json new file mode 100644 index 00000000..6e34071b --- /dev/null +++ b/advisories/feed_block/DRUPAL-CONTRIB-2026-137.json @@ -0,0 +1,66 @@ +{ + "schema_version": "1.7.0", + "id": "DRUPAL-CONTRIB-2026-137", + "modified": "2026-09-09T17:16:58.000Z", + "published": "2026-09-09T17:16:58.000Z", + "aliases": [ + "CVE-2026-87939" + ], + "details": "The Feed Block module provides a block content type that displays items pulled from a remote RSS/Atom feed.\n\nThe module does not sufficiently validate or sanitize the RSS feed it generates, resulting in a stored cross-site scripting (XSS) vulnerability.", + "affected": [ + { + "package": { + "ecosystem": "Packagist:https://packages.drupal.org/8", + "name": "drupal/feed_block" + }, + "severity": [], + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.0.2" + } + ], + "database_specific": { + "constraint": "<2.0.2" + } + }, + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.0.0" + }, + { + "fixed": "3.0.2" + } + ], + "database_specific": { + "constraint": ">=3.0.0 <3.0.2" + } + } + ], + "database_specific": { + "affected_versions": "<2.0.2 || >=3.0.0 <3.0.2" + } + } + ], + "references": [ + { + "type": "WEB", + "url": "https://www.drupal.org/sa-contrib-2026-137" + } + ], + "credits": [ + { + "name": "Marcus Johansson (marcus_johansson)", + "contact": [ + "https://www.drupal.org/u/marcus_johansson" + ] + } + ] +} diff --git a/advisories/key_auth/DRUPAL-CONTRIB-2026-138.json b/advisories/key_auth/DRUPAL-CONTRIB-2026-138.json new file mode 100644 index 00000000..c5113455 --- /dev/null +++ b/advisories/key_auth/DRUPAL-CONTRIB-2026-138.json @@ -0,0 +1,52 @@ +{ + "schema_version": "1.7.0", + "id": "DRUPAL-CONTRIB-2026-138", + "modified": "2026-09-09T17:17:50.000Z", + "published": "2026-09-09T17:17:50.000Z", + "aliases": [ + "CVE-2026-87940" + ], + "details": "This module enables you to add key-based authentication on a per-user \nbasis.\n\nThe module doesn't cache per user, potentially allowing an attacker to view another user's authentication keys, if the attacker has the same permissions.\n\nThis vulnerability is mitigated by the fact that the site must have the `dynamic_page_cache` module enabled.", + "affected": [ + { + "package": { + "ecosystem": "Packagist:https://packages.drupal.org/8", + "name": "drupal/key_auth" + }, + "severity": [], + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.2.4" + } + ], + "database_specific": { + "constraint": "<2.2.4" + } + } + ], + "database_specific": { + "affected_versions": "<2.2.4" + } + } + ], + "references": [ + { + "type": "WEB", + "url": "https://www.drupal.org/sa-contrib-2026-138" + } + ], + "credits": [ + { + "name": "Utkarsh Choudhary (sisyphus_ut)", + "contact": [ + "https://www.drupal.org/u/sisyphus_ut" + ] + } + ] +} diff --git a/advisories/miniorange_saml/DRUPAL-CONTRIB-2026-141.json b/advisories/miniorange_saml/DRUPAL-CONTRIB-2026-141.json new file mode 100644 index 00000000..592634a0 --- /dev/null +++ b/advisories/miniorange_saml/DRUPAL-CONTRIB-2026-141.json @@ -0,0 +1,52 @@ +{ + "schema_version": "1.7.0", + "id": "DRUPAL-CONTRIB-2026-141", + "modified": "2026-09-09T17:19:43.000Z", + "published": "2026-09-09T17:19:43.000Z", + "aliases": [ + "CVE-2026-87943" + ], + "details": "This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider.\n\nThe miniorange\\_saml module does not correctly restrict access to certain functionality intended for administrative use. This could allow unauthorized users to access functionality or modify configuration values that should only be available to privileged users.", + "affected": [ + { + "package": { + "ecosystem": "Packagist:https://packages.drupal.org/8", + "name": "drupal/miniorange_saml" + }, + "severity": [], + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "3.2.0" + } + ], + "database_specific": { + "constraint": "<3.2.0" + } + } + ], + "database_specific": { + "affected_versions": "<3.2.0" + } + } + ], + "references": [ + { + "type": "WEB", + "url": "https://www.drupal.org/sa-contrib-2026-141" + } + ], + "credits": [ + { + "name": "Brian Willows (hsjbrianwillows)", + "contact": [ + "https://www.drupal.org/u/hsjbrianwillows" + ] + } + ] +} diff --git a/advisories/miniorange_saml/DRUPAL-CONTRIB-2026-142.json b/advisories/miniorange_saml/DRUPAL-CONTRIB-2026-142.json new file mode 100644 index 00000000..1e26f2fe --- /dev/null +++ b/advisories/miniorange_saml/DRUPAL-CONTRIB-2026-142.json @@ -0,0 +1,52 @@ +{ + "schema_version": "1.7.0", + "id": "DRUPAL-CONTRIB-2026-142", + "modified": "2026-09-09T17:20:12.000Z", + "published": "2026-09-09T17:20:12.000Z", + "aliases": [ + "CVE-2026-87944" + ], + "details": "This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider.\n\nThe module does not properly validate TLS certificates when making outbound HTTPS requests.\n\nAn attacker in a position to intercept network traffic could impersonate a trusted remote service and influence communications performed by the module.\n\nThis vulnerability is mitigated by the fact that an attacker must be able to \nintercept or redirect network traffic originating from the site.", + "affected": [ + { + "package": { + "ecosystem": "Packagist:https://packages.drupal.org/8", + "name": "drupal/miniorange_saml" + }, + "severity": [], + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "3.2.0" + } + ], + "database_specific": { + "constraint": "<3.2.0" + } + } + ], + "database_specific": { + "affected_versions": "<3.2.0" + } + } + ], + "references": [ + { + "type": "WEB", + "url": "https://www.drupal.org/sa-contrib-2026-142" + } + ], + "credits": [ + { + "name": "Jonni Kalpio (thatguy)", + "contact": [ + "https://www.drupal.org/u/thatguy" + ] + } + ] +} diff --git a/advisories/miniorange_saml/DRUPAL-CONTRIB-2026-143.json b/advisories/miniorange_saml/DRUPAL-CONTRIB-2026-143.json new file mode 100644 index 00000000..29ab17a8 --- /dev/null +++ b/advisories/miniorange_saml/DRUPAL-CONTRIB-2026-143.json @@ -0,0 +1,52 @@ +{ + "schema_version": "1.7.0", + "id": "DRUPAL-CONTRIB-2026-143", + "modified": "2026-09-09T17:20:35.000Z", + "published": "2026-09-09T17:20:35.000Z", + "aliases": [ + "CVE-2026-87945" + ], + "details": "This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider.\n\nThe miniorange\\_saml module does not sufficiently validate certain user-supplied URLs before performing redirects.\n\nAn attacker could cause users to be redirected to an external website after authentication. This could be used in phishing attacks or to increase the credibility of malicious links.", + "affected": [ + { + "package": { + "ecosystem": "Packagist:https://packages.drupal.org/8", + "name": "drupal/miniorange_saml" + }, + "severity": [], + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "3.2.0" + } + ], + "database_specific": { + "constraint": "<3.2.0" + } + } + ], + "database_specific": { + "affected_versions": "<3.2.0" + } + } + ], + "references": [ + { + "type": "WEB", + "url": "https://www.drupal.org/sa-contrib-2026-143" + } + ], + "credits": [ + { + "name": "Sudhanshu Dhage (sudhanshu0542)", + "contact": [ + "https://www.drupal.org/u/sudhanshu0542" + ] + } + ] +} diff --git a/advisories/miniorange_saml/DRUPAL-CONTRIB-2026-144.json b/advisories/miniorange_saml/DRUPAL-CONTRIB-2026-144.json new file mode 100644 index 00000000..01b01192 --- /dev/null +++ b/advisories/miniorange_saml/DRUPAL-CONTRIB-2026-144.json @@ -0,0 +1,52 @@ +{ + "schema_version": "1.7.0", + "id": "DRUPAL-CONTRIB-2026-144", + "modified": "2026-09-09T17:21:01.000Z", + "published": "2026-09-09T17:21:01.000Z", + "aliases": [ + "CVE-2026-87946" + ], + "details": "This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider.\n\nThe module uses cryptographic constructions that do not align with current security best practices.\n\nThe module performs certain signature comparisons using non constant-time comparison logic and generates SAML request identifiers using predictable values derived from non-cryptographic random number generation.\n\nWhile no practical authentication bypass has been demonstrated as a result of these weaknesses alone, they may reduce the overall security margin of SAML authentication workflows.", + "affected": [ + { + "package": { + "ecosystem": "Packagist:https://packages.drupal.org/8", + "name": "drupal/miniorange_saml" + }, + "severity": [], + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "3.2.0" + } + ], + "database_specific": { + "constraint": "<3.2.0" + } + } + ], + "database_specific": { + "affected_versions": "<3.2.0" + } + } + ], + "references": [ + { + "type": "WEB", + "url": "https://www.drupal.org/sa-contrib-2026-144" + } + ], + "credits": [ + { + "name": "Sudhanshu Dhage (sudhanshu0542)", + "contact": [ + "https://www.drupal.org/u/sudhanshu0542" + ] + } + ] +} diff --git a/advisories/miniorange_saml/DRUPAL-CONTRIB-2026-145.json b/advisories/miniorange_saml/DRUPAL-CONTRIB-2026-145.json new file mode 100644 index 00000000..83a8580e --- /dev/null +++ b/advisories/miniorange_saml/DRUPAL-CONTRIB-2026-145.json @@ -0,0 +1,52 @@ +{ + "schema_version": "1.7.0", + "id": "DRUPAL-CONTRIB-2026-145", + "modified": "2026-09-09T17:21:27.000Z", + "published": "2026-09-09T17:21:27.000Z", + "aliases": [ + "CVE-2026-87947" + ], + "details": "This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider.\n\nThe module does not properly restrict which signature algorithm may be used to validate a SAML assertion, allowing the algorithm to be influenced by the incoming response rather than being tied to the type of key configured for the Identity Provider (IdP).\n\nThe vulnerability is mitigated by the fact that an attacker must be able to submit a crafted SAML response to the affected site.", + "affected": [ + { + "package": { + "ecosystem": "Packagist:https://packages.drupal.org/8", + "name": "drupal/miniorange_saml" + }, + "severity": [], + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "3.2.0" + } + ], + "database_specific": { + "constraint": "<3.2.0" + } + } + ], + "database_specific": { + "affected_versions": "<3.2.0" + } + } + ], + "references": [ + { + "type": "WEB", + "url": "https://www.drupal.org/sa-contrib-2026-145" + } + ], + "credits": [ + { + "name": "Timo De Clercq (timodc)", + "contact": [ + "https://www.drupal.org/u/timodc" + ] + } + ] +} diff --git a/advisories/miniorange_saml/DRUPAL-CONTRIB-2026-146.json b/advisories/miniorange_saml/DRUPAL-CONTRIB-2026-146.json new file mode 100644 index 00000000..0aa58994 --- /dev/null +++ b/advisories/miniorange_saml/DRUPAL-CONTRIB-2026-146.json @@ -0,0 +1,52 @@ +{ + "schema_version": "1.7.0", + "id": "DRUPAL-CONTRIB-2026-146", + "modified": "2026-09-09T17:21:49.000Z", + "published": "2026-09-09T17:21:49.000Z", + "aliases": [ + "CVE-2026-87948" + ], + "details": "This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider.\n\nThe module does not sufficiently sanitize user-supplied data before displaying it in generated HTML leading to a cross-site scripting vulnerability (XSS).", + "affected": [ + { + "package": { + "ecosystem": "Packagist:https://packages.drupal.org/8", + "name": "drupal/miniorange_saml" + }, + "severity": [], + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "3.2.0" + } + ], + "database_specific": { + "constraint": "<3.2.0" + } + } + ], + "database_specific": { + "affected_versions": "<3.2.0" + } + } + ], + "references": [ + { + "type": "WEB", + "url": "https://www.drupal.org/sa-contrib-2026-146" + } + ], + "credits": [ + { + "name": "Sudhanshu Dhage (sudhanshu0542)", + "contact": [ + "https://www.drupal.org/u/sudhanshu0542" + ] + } + ] +} diff --git a/advisories/miniorange_saml/DRUPAL-CONTRIB-2026-147.json b/advisories/miniorange_saml/DRUPAL-CONTRIB-2026-147.json new file mode 100644 index 00000000..fdbec8ce --- /dev/null +++ b/advisories/miniorange_saml/DRUPAL-CONTRIB-2026-147.json @@ -0,0 +1,52 @@ +{ + "schema_version": "1.7.0", + "id": "DRUPAL-CONTRIB-2026-147", + "modified": "2026-09-09T17:22:13.000Z", + "published": "2026-09-09T17:22:13.000Z", + "aliases": [ + "CVE-2026-87949" + ], + "details": "This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider.\n\nThe module does not sufficiently sanitize certain values derived from SAML assertions before displaying them to users. A malicious identity provider or an attacker able to supply crafted SAML attributes, leading to a cross-site scripting (XSS) vulnerability.", + "affected": [ + { + "package": { + "ecosystem": "Packagist:https://packages.drupal.org/8", + "name": "drupal/miniorange_saml" + }, + "severity": [], + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "3.2.0" + } + ], + "database_specific": { + "constraint": "<3.2.0" + } + } + ], + "database_specific": { + "affected_versions": "<3.2.0" + } + } + ], + "references": [ + { + "type": "WEB", + "url": "https://www.drupal.org/sa-contrib-2026-147" + } + ], + "credits": [ + { + "name": "Brian Willows (hsjbrianwillows)", + "contact": [ + "https://www.drupal.org/u/hsjbrianwillows" + ] + } + ] +} diff --git a/advisories/miniorange_saml/DRUPAL-CONTRIB-2026-148.json b/advisories/miniorange_saml/DRUPAL-CONTRIB-2026-148.json new file mode 100644 index 00000000..a9cc67f9 --- /dev/null +++ b/advisories/miniorange_saml/DRUPAL-CONTRIB-2026-148.json @@ -0,0 +1,52 @@ +{ + "schema_version": "1.7.0", + "id": "DRUPAL-CONTRIB-2026-148", + "modified": "2026-09-09T17:22:34.000Z", + "published": "2026-09-09T17:22:34.000Z", + "aliases": [ + "CVE-2026-87950" + ], + "details": "This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider.\n\nThe module contains embedded credentials used by the functionality provided by the module.\n\nUnder certain circumstances, these credentials could allow information about associated services to be disclosed.", + "affected": [ + { + "package": { + "ecosystem": "Packagist:https://packages.drupal.org/8", + "name": "drupal/miniorange_saml" + }, + "severity": [], + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "3.2.0" + } + ], + "database_specific": { + "constraint": "<3.2.0" + } + } + ], + "database_specific": { + "affected_versions": "<3.2.0" + } + } + ], + "references": [ + { + "type": "WEB", + "url": "https://www.drupal.org/sa-contrib-2026-148" + } + ], + "credits": [ + { + "name": "Sudhanshu Dhage (sudhanshu0542)", + "contact": [ + "https://www.drupal.org/u/sudhanshu0542" + ] + } + ] +} diff --git a/advisories/miniorange_saml/DRUPAL-CONTRIB-2026-149.json b/advisories/miniorange_saml/DRUPAL-CONTRIB-2026-149.json new file mode 100644 index 00000000..4000afa7 --- /dev/null +++ b/advisories/miniorange_saml/DRUPAL-CONTRIB-2026-149.json @@ -0,0 +1,52 @@ +{ + "schema_version": "1.7.0", + "id": "DRUPAL-CONTRIB-2026-149", + "modified": "2026-09-09T17:22:55.000Z", + "published": "2026-09-09T17:22:55.000Z", + "aliases": [ + "CVE-2026-87951" + ], + "details": "This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider.\n\nThe module stores sensitive authentication information in a manner that could allow disclosure to users with access to configuration or related system data.\n\nThis vulnerability is mitigated by the fact that an attacker must first obtain access to configuration or underlying storage mechanisms.", + "affected": [ + { + "package": { + "ecosystem": "Packagist:https://packages.drupal.org/8", + "name": "drupal/miniorange_saml" + }, + "severity": [], + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "3.2.0" + } + ], + "database_specific": { + "constraint": "<3.2.0" + } + } + ], + "database_specific": { + "affected_versions": "<3.2.0" + } + } + ], + "references": [ + { + "type": "WEB", + "url": "https://www.drupal.org/sa-contrib-2026-149" + } + ], + "credits": [ + { + "name": "Sudhanshu Dhage (sudhanshu0542)", + "contact": [ + "https://www.drupal.org/u/sudhanshu0542" + ] + } + ] +} diff --git a/advisories/miniorange_saml/DRUPAL-CONTRIB-2026-150.json b/advisories/miniorange_saml/DRUPAL-CONTRIB-2026-150.json new file mode 100644 index 00000000..6b626b27 --- /dev/null +++ b/advisories/miniorange_saml/DRUPAL-CONTRIB-2026-150.json @@ -0,0 +1,52 @@ +{ + "schema_version": "1.7.0", + "id": "DRUPAL-CONTRIB-2026-150", + "modified": "2026-09-09T17:23:14.000Z", + "published": "2026-09-09T17:23:14.000Z", + "aliases": [ + "CVE-2026-87952" + ], + "details": "This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider.\n\nThe module does not sufficiently prevent reuse of previously accepted SAML assertions. Under certain circumstances, a valid assertion may be replayed within its validity period, potentially allowing repeated authentication attempts using the same assertion.\n\nThis vulnerability is mitigated by the fact that an attacker must first obtain a valid SAML assertion and can only reuse it during the assertion's validity period.", + "affected": [ + { + "package": { + "ecosystem": "Packagist:https://packages.drupal.org/8", + "name": "drupal/miniorange_saml" + }, + "severity": [], + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "3.2.0" + } + ], + "database_specific": { + "constraint": "<3.2.0" + } + } + ], + "database_specific": { + "affected_versions": "<3.2.0" + } + } + ], + "references": [ + { + "type": "WEB", + "url": "https://www.drupal.org/sa-contrib-2026-150" + } + ], + "credits": [ + { + "name": "Brian Willows (hsjbrianwillows)", + "contact": [ + "https://www.drupal.org/u/hsjbrianwillows" + ] + } + ] +} diff --git a/advisories/miniorange_saml/DRUPAL-CONTRIB-2026-151.json b/advisories/miniorange_saml/DRUPAL-CONTRIB-2026-151.json new file mode 100644 index 00000000..28ba1984 --- /dev/null +++ b/advisories/miniorange_saml/DRUPAL-CONTRIB-2026-151.json @@ -0,0 +1,52 @@ +{ + "schema_version": "1.7.0", + "id": "DRUPAL-CONTRIB-2026-151", + "modified": "2026-09-09T17:23:34.000Z", + "published": "2026-09-09T17:23:34.000Z", + "aliases": [ + "CVE-2026-87953" + ], + "details": "This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider.\n\nThe module does not sufficiently validate URLs obtained from identity provider metadata. An attacker with the ability to configure identity provider metadata could cause the application to make requests to unintended destinations, potentially allowing access to internal network resources.\n\nThis vulnerability is mitigated by the fact that an attacker must have permission to configure identity provider metadata.", + "affected": [ + { + "package": { + "ecosystem": "Packagist:https://packages.drupal.org/8", + "name": "drupal/miniorange_saml" + }, + "severity": [], + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "3.2.0" + } + ], + "database_specific": { + "constraint": "<3.2.0" + } + } + ], + "database_specific": { + "affected_versions": "<3.2.0" + } + } + ], + "references": [ + { + "type": "WEB", + "url": "https://www.drupal.org/sa-contrib-2026-151" + } + ], + "credits": [ + { + "name": "Brian Willows (hsjbrianwillows)", + "contact": [ + "https://www.drupal.org/u/hsjbrianwillows" + ] + } + ] +} diff --git a/advisories/safedelete/DRUPAL-CONTRIB-2026-140.json b/advisories/safedelete/DRUPAL-CONTRIB-2026-140.json new file mode 100644 index 00000000..71f37c8b --- /dev/null +++ b/advisories/safedelete/DRUPAL-CONTRIB-2026-140.json @@ -0,0 +1,52 @@ +{ + "schema_version": "1.7.0", + "id": "DRUPAL-CONTRIB-2026-140", + "modified": "2026-09-09T17:19:26.000Z", + "published": "2026-09-09T17:19:26.000Z", + "aliases": [ + "CVE-2026-87942" + ], + "details": "This module enables you to manage content deletion and provides reports for identifying orphaned content.\n\nThe module doesn't sufficiently sanitize node titles when displaying the orphaned nodes report. This leads to a persistent cross-site scripting vulnerability (XSS).\n\nThis vulnerability is mitigated by the fact that an attacker must have permission to create content of a content type configured for the orphaned nodes report.", + "affected": [ + { + "package": { + "ecosystem": "Packagist:https://packages.drupal.org/8", + "name": "drupal/safedelete" + }, + "severity": [], + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.0.88" + } + ], + "database_specific": { + "constraint": "<1.0.88" + } + } + ], + "database_specific": { + "affected_versions": "<1.0.88" + } + } + ], + "references": [ + { + "type": "WEB", + "url": "https://www.drupal.org/sa-contrib-2026-140" + } + ], + "credits": [ + { + "name": "Lee Rowlands (larowlan)", + "contact": [ + "https://www.drupal.org/u/larowlan" + ] + } + ] +} diff --git a/advisories/term_glossary/DRUPAL-CONTRIB-2026-152.json b/advisories/term_glossary/DRUPAL-CONTRIB-2026-152.json new file mode 100644 index 00000000..3e6b22a1 --- /dev/null +++ b/advisories/term_glossary/DRUPAL-CONTRIB-2026-152.json @@ -0,0 +1,64 @@ +{ + "schema_version": "1.7.0", + "id": "DRUPAL-CONTRIB-2026-152", + "modified": "2026-09-09T17:24:26.000Z", + "published": "2026-09-09T17:24:26.000Z", + "aliases": [ + "CVE-2026-87954" + ], + "details": "This module adds automatic highlighting of taxonomy terms in content.\n\nThe module doesn't sufficiently check access on taxonomy terms. As a result, anonymous users can view any of the site's taxonomy terms at the module's JSON endpoint, including taxonomy terms that are unpublished or otherwise restricted.", + "affected": [ + { + "package": { + "ecosystem": "Packagist:https://packages.drupal.org/8", + "name": "drupal/term_glossary" + }, + "severity": [], + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "4.6.0" + } + ], + "database_specific": { + "constraint": "<4.6.0" + } + } + ], + "database_specific": { + "affected_versions": "<4.6.0" + } + } + ], + "references": [ + { + "type": "WEB", + "url": "https://www.drupal.org/sa-contrib-2026-152" + } + ], + "credits": [ + { + "name": "Hemant Gupta (guptahemant)", + "contact": [ + "https://www.drupal.org/u/guptahemant" + ] + }, + { + "name": "Marcus Johansson (marcus_johansson)", + "contact": [ + "https://www.drupal.org/u/marcus_johansson" + ] + }, + { + "name": "Serhii Checheniev (serhii-che)", + "contact": [ + "https://www.drupal.org/u/serhii-che" + ] + } + ] +} diff --git a/advisories/ultimate_table_field/DRUPAL-CONTRIB-2026-153.json b/advisories/ultimate_table_field/DRUPAL-CONTRIB-2026-153.json new file mode 100644 index 00000000..63f2db6a --- /dev/null +++ b/advisories/ultimate_table_field/DRUPAL-CONTRIB-2026-153.json @@ -0,0 +1,66 @@ +{ + "schema_version": "1.7.0", + "id": "DRUPAL-CONTRIB-2026-153", + "modified": "2026-09-09T17:24:59.000Z", + "published": "2026-09-09T17:24:59.000Z", + "aliases": [ + "CVE-2026-87955" + ], + "details": "The Ultimate Table Field module enables you to store table data in a field and edit each table cell through a dialog, using cell field plugins such as text, link, and file.\n\nThe module doesn't sufficiently protect the route that opens the cell editor dialog. The route is accessible to anonymous users, who can open the dialog for any cell type. The dialog allows uploading files to the server location.\n\nThis vulnerability is partially mitigated by the fact that only files with the `pdf`, `doc` and `docx` extensions are accepted.", + "affected": [ + { + "package": { + "ecosystem": "Packagist:https://packages.drupal.org/8", + "name": "drupal/ultimate_table_field" + }, + "severity": [], + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.1.1" + } + ], + "database_specific": { + "constraint": "<1.1.1" + } + }, + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.0.0" + }, + { + "fixed": "2.0.1" + } + ], + "database_specific": { + "constraint": ">=2.0.0 <2.0.1" + } + } + ], + "database_specific": { + "affected_versions": "<1.1.1 || >=2.0.0 <2.0.1" + } + } + ], + "references": [ + { + "type": "WEB", + "url": "https://www.drupal.org/sa-contrib-2026-153" + } + ], + "credits": [ + { + "name": "Marcus Johansson (marcus_johansson)", + "contact": [ + "https://www.drupal.org/u/marcus_johansson" + ] + } + ] +}