Search: 1.2.4.4

The Fasttoggle module for Drupal allows users with the "Use Fasttoggle" permission to quickly toggle publication status, promotion, and stickiness of nodes and comments. However, it insufficiently verifies access permissions for the entities being toggled, enabling such users to change the status of nodes or comments they are not authorized to update. This could allow unauthorized publishing of unpublished drafts. The vulnerability affects versions prior to 4.1.1 and is fixed in version 4.1.1.

Highcharts JS is a JavaScript charting library based on SVG. From 10.3.2 until 11.4.9, 12.6.2, and 13.1.1, Highcharts accepts an SVG anchor xlink:href attribute without applying the allowed-scheme check used for href and src. An attacker who controls a chart text option can preserve a javascript URL in serialized chart output. When exported or server-rendered SVG is parsed again and a user activates the link, script runs in the origin of that document. This issue is fixed in 11.4.9, 12.6.2 and 13.1.1.

A vulnerability in the Drupal Single Content Sync module allows remote code execution via deserialization of untrusted data in a maliciously crafted import file. Exploitation requires the attacker to have the "import single content" permission. The issue is fixed in version 1.4.19.

The Single Content Sync module for Drupal allows exporting and importing content, referenced entities, and files between Drupal sites. A vulnerability exists due to insufficient validation of file sources and destinations during content imports, which can enable an attacker with the import permission to write arbitrary files, disclose sensitive files accessible to the web server, or cause the server to make requests to internal or external resources. This may lead to remote code execution depending on server configuration and permissions. The import single content permission is required for exploitation and is restricted starting with version 1.4.18. The issue is fixed in version 1.4.19.

HTTP::Body versions prior to 1.24_01 for Perl have a vulnerability where unbounded buffering of chunked HTTP request bodies can lead to memory exhaustion. This occurs because the parser holds each chunk in memory until the entire body is received, and malformed chunk size lines cause the parser to wait indefinitely, causing the buffer to grow without limit. Remote attackers can exploit this to exhaust memory in applications using HTTP::Body.

HTTP::Body versions before 1.24_01 for Perl contain an inefficient regular expression in the multipart upload filename parsing logic. This flaw allows a remote attacker to cause CPU exhaustion by sending a specially crafted filename with many dots ending in a backslash, triggering excessive regex backtracking. Each file part in a multipart request is processed separately, amplifying the impact. The issue is fixed in version 1.24_01.

CVE-2026-116134 is a vulnerability in HTTP::Body for Perl versions before 1.23_01 that allows a remote attacker to cause memory exhaustion. The issue arises because the multipart parser does not limit the size or number of lines in a multipart part header block, leading to excessive memory allocation.

HTTP::Body versions before 1.23_01 for Perl contain an inefficient algorithmic complexity vulnerability in the multipart body parser. The parser rescans the entire buffered body repeatedly when a multipart boundary is missing or malformed, leading to quadratic CPU time consumption. This allows a remote attacker to exhaust CPU resources by sending specially crafted HTTP requests with missing or malformed multipart boundaries.

HTTP::Body versions before 1.23_01 for Perl have an incomplete cleanup vulnerability where temporary files from incomplete multipart uploads remain on disk. This occurs because temporary files are only tracked and deleted if the upload part completes, leaving orphaned files when uploads end prematurely. An attacker can exploit this by sending repeated incomplete multipart requests, causing disk space exhaustion in the temporary directory.

The AI module for Drupal includes a submodule called AI Automator that automatically fills out fields using AI based on other fields. A vulnerability exists because the module does not sufficiently check access permissions to text formats, allowing users to author field data in text formats they should not have access to. This could lead to unauthorized content creation or manipulation. Fixed versions 1.4.11 and 1.5.2 address this issue.

The Drupal AI module has a cross-site scripting (XSS) vulnerability due to insufficient sanitization of certain HTMX attributes. This flaw affects versions prior to 1.4.11 and versions from 1.5.0 up to but not including 1.5.2. Fixed versions 1.4.11 and 1.5.2 address this issue.

The Drupal AI integration module has a vulnerability where audio files from speech-to-text requests are stored in a shared temporary directory without deletion. An attacker with read access to this directory could access audio submitted by other users. However, this requires the attacker to have read permissions on the temporary directory, which is typically restricted. The issue is fixed in versions 1.4.11 and 1.5.2.

The Drupal AI module's AI Search submodule has a vulnerability where cached search results may expose titles and fields of unpublished or access-restricted content to unauthorized users under certain configurations. This occurs because the Search API caches results without considering access restrictions, potentially leaking sensitive content. The vulnerability only affects setups using the AI Search submodule with Search API result caching enabled and requires that a user with access to restricted content has previously run the same search within the cache lifetime. Retrieval-augmented generation tools and custom Search API queries are not affected. Fixed versions 1.4.11 and 1.5.2 address this issue.

The Drupal AI module contains a vulnerability where insufficient validation of Markdown links under certain conditions can lead to cross-site scripting (XSS). This flaw allows attackers to inject malicious scripts via Markdown links. Fixed versions 1.4.11 and 1.5.2 address this issue.

The Drupal AI module has a vulnerability where it does not sufficiently validate links under certain conditions, which could allow sensitive information to be exfiltrated to external sites. Exploitation requires the attacker to use untrusted sources that interact with the AI module in a way that produces rendered HTML. Fixed versions 1.4.11 and 1.5.2 address this issue.

The Drupal AI module includes an AI Chatbot submodule that under certain configurations does not properly filter user input before rendering, leading to a potential cross-site scripting (XSS) vulnerability. Exploitation requires attacker access to administer blocks, limiting the attack surface. Fixed versions 1.4.11 and 1.5.2 address this issue.

The Drupal AI module contains a cross-site scripting (XSS) vulnerability due to insufficient restrictions on HTML rendering. Exploitation requires the attacker to have access to a text format that permits HTML rendering. Fixed versions 1.4.11 and 1.5.2 address this issue.

CVE-2026-82962 is a memory-safety vulnerability in the Zephyr project affecting Ethernet packet handling. It occurs when the ethernet_fill_header() function prepends an Ethernet header in place without verifying sufficient headroom in the packet buffer, leading to out-of-bounds memory writes. This flaw can be triggered by forwarding packets from other network layers or interfaces, causing memory corruption that may result in crashes or packet corruption. The vulnerability affects Zephyr versions from 4.1.0 through 4.4.2. The CVSS score is 6.5, indicating medium severity.

The Drupal Commerce Stripe module allows payment processing via multiple Stripe APIs. A vulnerability exists where the module does not sufficiently verify the cryptographic signature of webhook events if the webhook signing secret is not properly configured. This issue is mitigated if a webhook signing secret is set or if the payment gateway plugin does not use webhooks. Fixed versions 1.4.0 and 2.2.3 address this vulnerability.

A vulnerability in Jenkins versions 2.587 and earlier, including LTS 2.580.1 and earlier, allows attackers to bypass the root element check during deserialization of certain configuration objects. This occurs because Jenkins does not consistently enforce restrictions on deserializing objects marked as storing their configuration in independent top-level files when they appear as nested values. This flaw could enable injection of nested objects.