Dell Terraform Provider for PowerFlex versions 1.5.0 through 1.8.0 contains an improper certificate validation vulnerability in its SSH client component. The provider uses ssh.InsecureIgnoreHostKey() as the default SSH host key callback, which can allow an unauthenticated remote attacker to exploit this flaw. Successful exploitation could lead to information exposure and unauthorized access. The vulnerability is tracked as CVE-2026-91880 and has a high severity rating with a CVSS score of 8.9. A fix is available in version 1.9.0 or later.
Red Hat JBoss Enterprise Application Platform 7.4.26 includes multiple security fixes addressing vulnerabilities such as unauthorized queue creation, password leaks, session hijacking, unsafe deserialization leading to remote code execution, and incomplete fixes for prior issues. These vulnerabilities affect components including artemis-server, jgroups, jackson-databind, openjdk-orb, and Apache CXF. The update replaces version 7.4.25 and is rated as having an important security impact by Red Hat.
The Commerce sermpea module for Drupal provides support for Spanish banks using Sermepa/Redsys payment systems. A vulnerability exists where the module does not verify that a Redsys payment response corresponds to the order being processed. This flaw can result in incorrect order payment status updates.
The Drupal smart_trim module contains a vulnerability where unsafe HTML is not sufficiently escaped when processed through its Twig filter, potentially allowing content injection. This issue requires an attacker to have a role capable of posting content that is rendered using the module's Twig filters. Sites using only the field formatter without the Twig filter are not vulnerable. Fixed versions 2.2.2 and 2.3.2 address this issue.
The Drupal download_count module has a vulnerability where permissions related to viewing download counts are not properly enforced. A user with the 'View download counts' permission can export and delete download logs, despite these actions not being intended for that permission level. Exploitation requires the attacker to have an account with this specific permission.
Dell Terraform Provider for ObjectScale and PowerStore contains a vulnerability where sensitive information is inserted into log files. This affects ObjectScale versions prior to 1.1.1 and PowerStore versions 1.2.1 through 1.3.0. A low privileged remote attacker could exploit this to gain unauthorized access and cause information exposure. The vulnerability is identified as CWE-532 and has a high severity CVSS score of 8.8. Fixed versions are 1.1.1 or later for ObjectScale and 1.3.1 or later for PowerStore.
The Page Manager module for Drupal allows creation and overriding of custom pages. The Page Manager UI submodule has a cross-site request forgery (CSRF) vulnerability that could allow an attacker to trick an authorized user into enabling or disabling pages without their consent. This requires the submodule to be enabled and the user to have the 'administer pages' permission. The issue is fixed in version 4.1.0.
The Drupal Mollie module allows websites to accept online payments via Mollie. A vulnerability exists where the Mollie secret token can be exposed under certain conditions. This exposure risk is mitigated if the 'mollie_webform' submodule is enabled. The issue affects versions prior to 2.3.2 and has been fixed in version 2.3.2.
The Drupal Mollie module before version 2.3.2 insufficiently validates incoming webhook calls, which can lead to incorrect application of payments on websites using this module.
The Drupal Entity Print module before version 2.20.0 has a vulnerability where it sends private user data, including session cookies and Dompdf HTTP authentication credentials, to third-party servers when generating PDFs containing third-party resources. This can allow those third-party sites to impersonate users. Exploitation requires the attacker to create or edit content using a text format that permits embedding images or stylesheets from arbitrary sites, such as "Full HTML."
CVE-2026-68862 is an OS Command Injection vulnerability in the Dell Terraform Provider for Dell PowerFlex, specifically in the SDC host provisioning component. A high privileged remote attacker with access to the PowerFlex management plane could exploit this flaw to execute arbitrary OS commands on provisioned SDC hosts, potentially leading to full compromise of those hosts. The vulnerability is rated with a CVSS score of 6.6 (medium severity). A fix is available in version 1.9.0 or later.
The Drupal Campaign Monitor module before version 3.0.3 is vulnerable to cross-site request forgery (CSRF) on its administrative routes. This flaw allows an attacker to craft a malicious link targeting users with the 'administer campaignmonitor' permission, potentially causing unauthorized actions related to Campaign Monitor list management. Exploitation requires the attacker to embed a link with the exact Campaign Monitor list ID and trick an authorized admin user into clicking it.
The Drupal module 'paragraphs_entity_embed' before version 4.0.1 contains a cross-site scripting (XSS) vulnerability due to insufficient filtering of malicious text in the autocomplete search filter. Exploitation requires the attacker to have permission to edit paragraph entity labels. A fix is available in version 4.0.1.
A code injection vulnerability (CWE-94) exists in the aeon-toolkit aeon library prior to version 1.5.0. The issue arises from a GitHub Actions workflow using pull_request_target for pre-commit checks on forked pull requests, allowing malicious fork code to execute with elevated privileges. This could expose tokens and enable unauthorized repository write access. The vulnerability is fixed in version 1.5.0.
The Drupal Commerce License module allows selling licenses such as roles or files. A vulnerability exists due to insufficient validation of license order items, which could enable a customer to obtain a license without paying the full price. This issue requires that the site exposes order items to modification outside the standard cart form for exploitation. The vulnerability is fixed in version 3.1.2.
The Drupal Commerce License module allows selling licenses granting access to resources like roles. A vulnerability exists due to insufficient validation of the license referenced by an order item, enabling an attacker to take over another user's license. This issue requires JSON:API or REST to be configured to allow writes to order items, which is not the default configuration. The vulnerability is fixed in version 3.1.2.
CVE-2026-91890 is an improper certificate validation vulnerability in Dell Ansible Storage for Unity versions prior to 1.2.13. It affects the UnityRESTConnector component and allows an unauthenticated remote attacker to potentially cause information exposure and unauthorized access. The vulnerability has a high severity with a CVSS score of 8.7. A fix is available in version 1.2.13 or later.
The Auth login plus module for Drupal allows enforcing a second authentication factor using time-based one-time passwords. A vulnerability exists where an attacker, under certain conditions, can bypass the password check or access the two-factor setup page of another user's account. This may enable account takeover of 2FA-enabled accounts without knowing the victim's password or second factor. Exploitation requires the attacker to have their own account, control the victim's email or know their password, and succeed in a timing-dependent race. The issue is fixed in version 1.0.3.