avisos de seguridad: Magento, Drupal y Linux, en un sitio
Actualizado: 12/11/2026 11:00 UTC
Several vulnerabilities were discovered in SPIP, a website engine for publishing, which could result in unauthenticated remote code execution. https://security-tracker.debian.org/tracker/DSA-6619-1
Fuente: Debian Security
Project: Data field Project machine name: datafield Date: 2026-November-11 Security risk: Moderately critical 12 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Uncommon Vulnerability: Cross-site scripting Affected versions: <2.0.15 || >=3.0.0 <3.0.1 CVE IDs: CVE-2026-126760 Description: This module provides a field type for storing structured data with multiple sub-fields, along with severa
Fuente: Drupal.org · CVE-2026-126760
Project: File Resumable Upload Project machine name: file_resup Date: 2026-November-11 Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:All Vulnerability: Improper authorization Affected versions: <2.0.6 CVE IDs: CVE-2026-126747 Description: This module adds large file, multiple file, and resumable uploads to the File and Image field widgets. The module d
Fuente: Drupal.org · CVE-2026-126747
Project: S3 File System CORS Upload Project machine name: s3fs_cors Date: 2026-November-11 Security risk: Moderately critical 11 ∕ 25 AC:Basic/A:User/CI:None/II:Some/E:Theoretical/TD:All Vulnerability: Improper authorization Affected versions: <1.4.0 CVE IDs: CVE-2026-126746 Description: The S3 File System CORS Upload module lets users upload files straight from the browser to Amazon S3 (or an S3-
Fuente: Drupal.org · CVE-2026-126746
Project: Real Name Project machine name: realname Date: 2026-November-11 Security risk: Moderately critical 10 ∕ 25 AC:Basic/A:User/CI:Some/II:None/E:Theoretical/TD:Default Vulnerability: Twig injection Affected versions: <2.0.1 CVE IDs: CVE-2026-126745 Description: This module enables you to display users by a configurable "real name" pattern built from tokens, instead of by their username. The m
Fuente: Drupal.org · CVE-2026-126745
Project: Layout Builder iFrame Modal Project machine name: layout_builder_iframe_modal Date: 2026-November-11 Security risk: Moderately critical 13 ∕ 25 AC:Complex/A:User/CI:Some/II:Some/E:Theoretical/TD:All Vulnerability: Cross-site scripting Affected versions: <1.3.9 CVE IDs: CVE-2026-126744 Description: This module renders Layout Builder forms inside an iframe in a modal dialog, using the admin
Fuente: Drupal.org · CVE-2026-126744
Project: COOKiES Consent Management Project machine name: cookies Date: 2026-November-11 Security risk: Moderately critical 12 ∕ 25 AC:Complex/A:Admin/CI:Some/II:Some/E:Theoretical/TD:All Vulnerability: Cross-site scripting Affected versions: <1.2.17 Description: This module enables you to manage user consent for external services, such as embedded videos. The COOKiES Video submodule blocks extern
Fuente: Drupal.org
Project: Commerce sermepa Project machine name: commerce_sermepa Date: 2026-November-11 Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:All Vulnerability: Improper authorization Affected versions: <2.5.0 CVE IDs: CVE-2026-126742 Description: The Commerce sermpea module provides Commerce support for Spanish banks that use Sermepa/Redsys systems. The modul
Fuente: Drupal.org · CVE-2026-126742
Project: Smart Trim Project machine name: smart_trim Date: 2026-November-11 Security risk: Moderately critical 12 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Uncommon Vulnerability: Cross-site scripting Affected versions: <2.2.2 || >=2.3.0 <2.3.2 CVE IDs: CVE-2026-126741 Description: This module implements a field formatter for text fields that improves the Summary or Trimmed formatter b
Fuente: Drupal.org · CVE-2026-126741
Project: Download Count Project machine name: download_count Date: 2026-November-11 Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default Vulnerability: Access bypass Affected versions: <2.2.5 || >=3.0.0 <3.0.2 CVE IDs: CVE-2026-126740 Description: This module tracks file downloads for private files and provides reports about them. The module provides
Fuente: Drupal.org · CVE-2026-126740
Project: Page Manager Project machine name: page_manager Date: 2026-November-11 Security risk: Moderately critical 11 ∕ 25 AC:Complex/A:None/CI:None/II:Some/E:Theoretical/TD:Default Vulnerability: Cross-site request forgery Affected versions: <4.1.0 CVE IDs: CVE-2026-126739 Description: This module enables you to create custom pages and to override existing paths, such as node or user pages, with
Fuente: Drupal.org · CVE-2026-126739
Project: Mollie for Drupal Project machine name: mollie Date: 2026-November-11 Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:All Vulnerability: Information disclosure Affected versions: <2.3.2 CVE IDs: CVE-2026-126738 Description: This module enables you to accept online payments on your website using Mollie. In some cases the Mollie secret token can b
Fuente: Drupal.org · CVE-2026-126738
Project: Mollie for Drupal Project machine name: mollie Date: 2026-November-11 Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:All Vulnerability: Incorrect authorization Affected versions: <2.3.2 CVE IDs: CVE-2026-126737 Description: This module enables you to accept online payments on your website using Mollie. This module doesn't sufficiently validate
Fuente: Drupal.org · CVE-2026-126737
Project: Entity Print Project machine name: entity_print Date: 2026-November-11 Security risk: Moderately critical 12 ∕ 25 AC:Complex/A:User/CI:Some/II:Some/E:Theoretical/TD:Default Vulnerability: Insertion of Sensitive Information Into Sent Data Affected versions: <2.20.0 CVE IDs: CVE-2026-126736 Description: This module enables you to print and export Drupal entities to PDF and other formats, us
Fuente: Drupal.org · CVE-2026-126736
Project: Campaign Monitor Project machine name: campaignmonitor Date: 2026-November-11 Security risk: Moderately critical 12 ∕ 25 AC:Complex/A:None/CI:None/II:Some/E:Theoretical/TD:All Vulnerability: Cross-site request forgery Affected versions: <3.0.3 CVE IDs: CVE-2026-126735 Description: This module integrates the Campaign Monitor API into Drupal so that users can subscribe and unsubscribe for y
Fuente: Drupal.org · CVE-2026-126735
Project: Paragraphs entity embed Project machine name: paragraphs_entity_embed Date: 2026-November-11 Security risk: Moderately critical 14 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All Vulnerability: Cross-site scripting Affected versions: <4.0.1 CVE IDs: CVE-2026-126734 Description: This module enables you to provide a way to embed parapraphs in any rich-text field using the WYSIWYG
Fuente: Drupal.org · CVE-2026-126734
Project: Commerce License Project machine name: commerce_license Date: 2026-November-11 Security risk: Less critical 9 ∕ 25 AC:Basic/A:User/CI:None/II:Some/E:Theoretical/TD:Uncommon Vulnerability: Access bypass Affected versions: <3.1.2 CVE IDs: CVE-2026-126733 Description: This module enables you to sell licenses (such as roles or files) using Drupal Commerce. The module doesn't sufficiently vali
Fuente: Drupal.org · CVE-2026-126733
Project: Commerce License Project machine name: commerce_license Date: 2026-November-11 Security risk: Moderately critical 13 ∕ 25 AC:Complex/A:None/CI:Some/II:Some/E:Theoretical/TD:Uncommon Vulnerability: Access bypass Affected versions: <3.1.2 CVE IDs: CVE-2026-126732 Description: This module enables you to sell licenses that grant access to resources (such as roles) through Drupal Commerce. The
Fuente: Drupal.org · CVE-2026-126732
Project: Authenticator Login Plus (2FA) Project machine name: auth_login_plus Date: 2026-November-11 Security risk: Moderately critical 13 ∕ 25 AC:Complex/A:User/CI:Some/II:Some/E:Theoretical/TD:All Vulnerability: Authentication bypass Affected versions: <1.0.3 CVE IDs: CVE-2026-126731 Description: This module enables you to require a second authentication factor (a time-based one-time password fr
Fuente: Drupal.org · CVE-2026-126731
Project: Authenticator Login Plus (2FA) Project machine name: auth_login_plus Date: 2026-November-11 Security risk: Moderately critical 12 ∕ 25 AC:Complex/A:None/CI:None/II:Some/E:Theoretical/TD:All Vulnerability: Authentication bypass Affected versions: <1.0.3 CVE IDs: CVE-2026-126730 Description: This module enables you to require a second authentication factor (a time-based one-time password fr
Fuente: Drupal.org · CVE-2026-126730
Project: Authenticator Login Plus (2FA) Project machine name: auth_login_plus Date: 2026-November-11 Security risk: Moderately critical 13 ∕ 25 AC:Complex/A:None/CI:Some/II:Some/E:Theoretical/TD:Uncommon Vulnerability: Authentication bypass Affected versions: <1.0.3 CVE IDs: CVE-2026-126729 Description: This module enables you to require a second authentication factor (a time-based one-time passwo
Fuente: Drupal.org · CVE-2026-126729
Project: Texts: key-based strings and translations Project machine name: texts Date: 2026-November-11 Security risk: Moderately critical 11 ∕ 25 AC:Basic/A:User/CI:None/II:Some/E:Theoretical/TD:All Vulnerability: Cross-site request forgery Affected versions: >=1.0.13 <1.0.17 CVE IDs: CVE-2026-126728 Description: The Texts module provides key-based strings and translations for Drupal and tools for
Fuente: Drupal.org · CVE-2026-126728
Project: Texts: key-based strings and translations Project machine name: texts Date: 2026-November-11 Security risk: Moderately critical 14 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All Vulnerability: Cross-site scripting Affected versions: <1.0.17 CVE IDs: CVE-2026-126727 Description: The Texts module provides key-based strings and translations for Drupal, including Twig filters for d
Fuente: Drupal.org · CVE-2026-126727
Project: Paragraphs Edit Project machine name: paragraphs_edit Date: 2026-November-11 Security risk: Moderately critical 14 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All Vulnerability: Improper authorization Affected versions: <3.0.2 CVE IDs: CVE-2026-126726 Description: Paragraphs Edit adds contextual edit, clone, and delete links, along with the required routes, to individual Paragra
Fuente: Drupal.org · CVE-2026-126726
Project: GraphQL Core Schema Project machine name: graphql_core_schema Date: 2026-November-11 Security risk: Critical 15 ∕ 25 AC:Basic/A:User/CI:Some/II:All/E:Theoretical/TD:Default Vulnerability: Improper authorization Affected versions: <1.0.29 CVE IDs: CVE-2026-126725 Description: This module provides a configurable GraphQL schema generator for Drupal entities and fields, along with optional sc
Fuente: Drupal.org · CVE-2026-126725
Multiple vulnerabilities were discovered in OpenEXR, a library for handling high dynamic range images. Processing malformed image files could cause denial of service or out-of-bounds memory reads and writes. This update moves to OpenEXR 3.2 series while retaining compatibility with the existing Debian trixie library ABI. https://security-tracker.debian.org/tracker/DSA-6618-1
Fuente: Debian Security
Multiple vulnerabilities have been found in the Symfony PHP framework which could lead to a bypass of access restrictions, information disclosure, XML external entity injection or denial of service. https://security-tracker.debian.org/tracker/DSA-6617-1
Fuente: Debian Security
Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks. https://security-tracker.debian.org/tracker/DSA-6616-1
Fuente: Debian Security
The update for vim in DSA 6600-1 did not correctly built binary packages for the s390x architecture due to test failures during during build. This update corrects that problem. https://security-tracker.debian.org/tracker/DSA-6600-2
Fuente: Debian Security
A buffer overflow was discovered in the handling of dBASE database files in LibreOffice, which could potentially result in the execution of arbitrary code. https://security-tracker.debian.org/tracker/DSA-6615-1
Fuente: Debian Security
Several vulnerabilities have been discovered in the interpreter for the Ruby language, which may result in IMAP command injection, denial of service, information disclosure or the execution of arbitrary code. https://security-tracker.debian.org/tracker/DSA-6614-1
Fuente: Debian Security
Several vulnerabilities were discovered in the zlib compression library, which could result in denial of service or potentially the execution of arbitrary code if specially crafted input is processed. https://security-tracker.debian.org/tracker/DSA-6613-1
Fuente: Debian Security
Multiple vulnerabilities have been found in the Symfony PHP framework which could lead to denial of service or email header injection. https://security-tracker.debian.org/tracker/DSA-6612-1
Fuente: Debian Security
Multiple security vulnerabilities were discovered in imagemagick, a software suite used for editing and manipulating digital images, which could lead to denial of service, bypass of policy restrictions, information disclosure or potentially arbitrary code execution if malformed images are processed. https://security-tracker.debian.org/tracker/DSA-6611-1
Fuente: Debian Security
Multiple vulnerabilities have been discovered in the Xen hypervisor, which could result in guest-to-host privilege escalation or information disclosure. https://security-tracker.debian.org/tracker/DSA-6610-1
Fuente: Debian Security
It was discovered that incorrect validation of hostname ACLs in the authorisation service of Trapperkeeper, a service framework used by Puppet servers, could allow a Puppet client to download the catalogue of a different host. https://security-tracker.debian.org/tracker/DSA-6609-1
Fuente: Debian Security
It was discovered that missing validation of event data in the agent of the Puppet configuration management system could result in code execution on the Puppet server. https://security-tracker.debian.org/tracker/DSA-6608-1
Fuente: Debian Security
Max Justicz discovered a vulnerability in the APT package manager. APT can merge two different package downloads after an HTTP redirect gives them the same URI. Improper file handling when resuming an HTTP download allows a man-in-the-middle attacker to replace a package after verification, resulting in the execution of arbitrary code as root. https://security-tracker.debian.org/tracker/DSA-6607-1
Fuente: Debian Security
Project: htmLawed Project machine name: htmlawed Date: 2026-November-04 Security risk: Moderately critical 14 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All Vulnerability: Cross-site scripting Affected versions: >=4.1.0 <4.1.11 CVE IDs: CVE-2026-122079 Description: The htmLawed module enables use of the htmLawed PHP library as a filter in a Text Format for restriction/filtering of HTML
Fuente: Drupal.org · CVE-2026-122079
Project: htmLawed Project machine name: htmlawed Date: 2026-November-04 Security risk: Moderately critical 11 ∕ 25 AC:Complex/A:User/CI:Some/II:Some/E:Theoretical/TD:Uncommon Vulnerability: Cross-site scripting Affected versions: >=3.0.0 <3.9.0 || >=4.0.0 <4.1.8 CVE IDs: CVE-2026-122080 Description: The htmLawed module enables use of the htmLawed PHP library as a filter in a Text Format for restri
Fuente: Drupal.org · CVE-2026-122080
Project: Islandora Project machine name: islandora Date: 2026-November-04 Security risk: Moderately critical 10 ∕ 25 AC:Basic/A:User/CI:None/II:Some/E:Theoretical/TD:Default Vulnerability: Access bypass leading to arbitrary file overwrite Affected versions: <2.19.1 CVE IDs: CVE-2026-122081 Description: Islandora does not sufficiently check file update access when processing media source and deriva
Fuente: Drupal.org · CVE-2026-122081
Project: Mime Mail Project machine name: mimemail Date: 2026-November-04 Security risk: Moderately critical 10 ∕ 25 AC:Complex/A:None/CI:Some/II:None/E:Theoretical/TD:Uncommon Vulnerability: Information disclosure Affected versions: <2.0.4 CVE IDs: CVE-2026-122082 Description: The Mime Mail module gives Drupal sites the ability to send HTML email messages. Under rare site configuration conditions,
Fuente: Drupal.org · CVE-2026-122082
Project: AdobeAnalytics Project machine name: adobe_analytics Date: 2026-November-04 Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default Vulnerability: Cross-site scripting Affected versions: <1.1.0 CVE IDs: CVE-2026-122083 Description: This module integrates the Site Catalyst or AdobeAnalytics software into a Drupal site. The module does not suffici
Fuente: Drupal.org · CVE-2026-122083
Project: WordsOnline Connector Project machine name: wordsonline_connector Date: 2026-November-04 Security risk: Moderately critical 12 ∕ 25 AC:Basic/A:Admin/CI:All/II:None/E:Theoretical/TD:All Vulnerability: SQL injection Affected versions: >=2.0.0 <2.0.6 CVE IDs: CVE-2026-122084 Description: The WordsOnline Connector module integrates Drupal with the WordsOnline translation service through the T
Fuente: Drupal.org · CVE-2026-122084
Project: Extended HTML Filter Project machine name: extended_html_filter Date: 2026-November-04 Security risk: Moderately critical 14 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All Vulnerability: Cross-site scripting Affected versions: <1.0.4 CVE IDs: CVE-2026-122078 Description: The Extended HTML Filter module allows using style attributes in CKEditor. The module XSS filter does not su
Fuente: Drupal.org · CVE-2026-122078
Project: Allowed Languages Project machine name: allowed_languages Date: 2026-November-04 Security risk: Less critical 7 ∕ 25 AC:Complex/A:User/CI:None/II:None/E:Theoretical/TD:All Vulnerability: Access bypass Affected versions: <2.0.3 CVE IDs: CVE-2026-122077 Description: The Allowed Languages module makes it possible to set restrictions on which content a user can edit based on language. The mod
Fuente: Drupal.org · CVE-2026-122077
Project: Password Separate Form Project machine name: change_pwd_page Date: 2026-November-04 Security risk: Moderately critical 10 ∕ 25 AC:Complex/A:User/CI:None/II:Some/E:Theoretical/TD:All Vulnerability: Access bypass Affected versions: <2.0.3 CVE IDs: CVE-2026-122076 Description: This module provides a separate page with a form for users to change their own password, which asks for the current
Fuente: Drupal.org · CVE-2026-122076
Project: Scheduler Project machine name: scheduler Date: 2026-November-04 Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default Vulnerability: Access bypass Affected versions: <1.7.0 || >=2.2.0 <2.2.3 || 2.0.* || 2.1.* || >= 2.3.0 <2.3.1 CVE IDs: CVE-2026-122075 Description: This module enables you to schedule content to be published or unpublished at
Fuente: Drupal.org · CVE-2026-122075
Project: Reset Password Email/SMS OTP Project machine name: reset_password_email_otp Date: 2026-November-04 Security risk: Critical 15 ∕ 25 AC:Complex/A:None/CI:Some/II:Some/E:Theoretical/TD:All Vulnerability: Access bypass Affected versions: <1.0.5 CVE IDs: CVE-2026-122074 Description: This module enables you to reset passwords via one time passcode to email or SMS rather than reset password link
Fuente: Drupal.org · CVE-2026-122074
Project: Name Field Project machine name: name Date: 2026-November-04 Security risk: Moderately critical 12 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Uncommon Vulnerability: Cross-site scripting Affected versions: <1.6.0 CVE IDs: CVE-2026-122073 Description: The Name Field module provides a field for storing a personal name as separate components. The module does not sufficiently sanit
Fuente: Drupal.org · CVE-2026-122073
Project: Forum Access Project machine name: forum_access Date: 2026-November-04 Security risk: Moderately critical 10 ∕ 25 AC:Basic/A:User/CI:None/II:Some/E:Theoretical/TD:Default Vulnerability: Access bypass Affected versions: <2.0.3 CVE IDs: CVE-2026-122072 Description: This module allows forums to be set private and to be given moderators. The module doesn't sufficiently check access for creati
Fuente: Drupal.org · CVE-2026-122072
Project: Commerce Escrow Project machine name: commerce_escrow Date: 2026-November-04 Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:All Vulnerability: Access bypass Affected versions: <1.1.0 CVE IDs: CVE-2026-122071 Description: This module enables you to accept payments through Escrow.com with Drupal Commerce. The module doesn't sufficiently verify in
Fuente: Drupal.org · CVE-2026-122071
Project: Commerce Product Alternative Project machine name: commerce_product_alternative Date: 2026-November-04 Security risk: Critical 16 ∕ 25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:All Vulnerability: Access bypass Affected versions: <1.0.1 CVE IDs: CVE-2026-122070 Description: This module lets customers replace an item in their cart with one of the alternative product variations listed
Fuente: Drupal.org · CVE-2026-122070
Project: AlternativeCommerce PayPal Checkout Project machine name: basket_paypal Date: 2026-November-04 Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:All Vulnerability: Access bypass Affected versions: <1.1.1 CVE IDs: CVE-2026-122069 Description: The AlternativeCommerce PayPal Checkout module provides an AlternativeCommerce method to embed payment serv
Fuente: Drupal.org · CVE-2026-122069
Project: Highlight Js syntax highlighter Project machine name: highlight_js Date: 2026-November-04 Security risk: Critical 16 ∕ 25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:All Vulnerability: Cross-site scripting Affected versions: <1.3.1 CVE IDs: CVE-2026-122068 Description: This module enables you to add syntax-highlighted code snippets to content using CKEditor 5. The module doesn't suff
Fuente: Drupal.org · CVE-2026-122068
Project: REST & JSON API Authentication for Drupal Project machine name: rest_api_authentication Date: 2026-November-04 Security risk: Critical 17 ∕ 25 AC:Basic/A:None/CI:Some/II:All/E:Theoretical/TD:Default Vulnerability: Access bypass Affected versions: <3.2.1 CVE IDs: CVE-2026-122067 Description: The REST & JSON API Authentication module provides API authentication for Drupal sites. The module
Fuente: Drupal.org · CVE-2026-122067
Project: Workflow Notifications Project machine name: workflow_notifications Date: 2026-November-04 Security risk: Critical 16 ∕ 25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:All Vulnerability: Access bypass Affected versions: <3.0.3 CVE IDs: CVE-2026-122066 Description: This module enables you to send messages ("Notifications") to users upon a certain Workflow state change. The module doesn
Fuente: Drupal.org · CVE-2026-122066
Project: Simple OAuth (OAuth2) & OpenID Connect Project machine name: simple_oauth Date: 2026-November-04 Security risk: Critical 15 ∕ 25 AC:Complex/A:Admin/CI:All/II:All/E:Theoretical/TD:Default Vulnerability: Access bypass Affected versions: <5.2.6 || >=6.0.0 <6.0.10 || >=6.1.0 <6.1.4 CVE IDs: CVE-2026-122058 Description: This module introduces an OAuth 2.0 authorization server, which can be con
Fuente: Drupal.org · CVE-2026-122058
Project: S3 File System CORS Upload Project machine name: s3fs_cors Date: 2026-November-04 Security risk: Critical 16 ∕ 25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:All Vulnerability: Access bypass Affected versions: <1.3.0 CVE IDs: CVE-2026-122057 Description: This module enables you to upload files from the browser directly to Amazon S3 and register them as Drupal files, bypassing normal
Fuente: Drupal.org · CVE-2026-122057
Project: Content Synchronizer Project machine name: content_synchronizer Date: 2026-November-04 Security risk: Moderately critical 14 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All Vulnerability: Cross-site scripting Affected versions: <4.1.1 CVE IDs: CVE-2026-118566 Description: The Content Synchronizer module allows content to be exported and imported between Drupal sites via uploaded
Fuente: Drupal.org · CVE-2026-118566
Project: Content Synchronizer Project machine name: content_synchronizer Date: 2026-November-04 Security risk: Critical 17 ∕ 25 AC:Basic/A:Admin/CI:All/II:All/E:Theoretical/TD:All Vulnerability: Remote code execution Affected versions: <4.1.1 CVE IDs: CVE-2026-118547 Description: The Content Synchronizer module allows content to be exported and imported between Drupal sites via uploaded archive fi
Fuente: Drupal.org · CVE-2026-118547
Several security issues were found in Squid, a caching proxy for the web. These issues could allow request smuggling, buffer overflows or FTP command injection under certain conditions. https://security-tracker.debian.org/tracker/DSA-6606-1
Fuente: Debian Security
Date: 2026-November-02 Description: Background Drupal has supported each minor release of Drupal (example: 11.3, 11.4) for 12 months each since the release of Drupal 8.6 in 2018. Like all open source projects , Drupal is enduring a "tsunami" of security reports due to the prevalence of AI tools, and this has created more work than the Drupal Security Team, especially with its current levels of fun
Fuente: Drupal.org
Security issues were discovered in Chromium which could result in the execution of arbitrary code, denial of service, or information disclosure. https://security-tracker.debian.org/tracker/DSA-6605-1
Fuente: Debian Security
Multiple security issues were discovered in Incus, a system container and virtual machine manager, which could result in a bypass of security/authorisation restrictions, denial of service. privilege escalation or information disclosure. https://security-tracker.debian.org/tracker/DSA-6604-1
Fuente: Debian Security
A vulnerabilitiy was discovered in git-annex, a tool to manage large files with git, without storing the file contents in git, which could result in data exfiltration. For additional details please refer to the upstream advisory at https://git-annex.branchable.com/security/cross_repository_data_exfiltration_via_special_remote/ https://security-tracker.debian.org/tracker/DSA-6603-1
Fuente: Debian Security
Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks. https://security-tracker.debian.org/tracker/DSA-6602-1
Fuente: Debian Security
A buffer overflow was found in the "Eye of GNOME" graphics viewer program, which could possibly result in the execution of arbitrary code when opening a malformed PNG file. https://security-tracker.debian.org/tracker/DSA-6601-1
Fuente: Debian Security
Multiple vulnerabilities were found and fixed in Vim, an enhanced version of the standard UNIX editor Vi (Vi IMproved). A remote attacker could trigger arbitrary code execution, command injection, or a crash (potential memory-corruption) via crafted files, archives, help/tag files, modelines, spell files, or crafted input to the NetBeans interface. CVE-2025-53905 - Path traversal in the tar plugin
Fuente: Debian Security · CVE-2025-53905
It was discovered that several eMudhra intermediate CA certificates have been compromised. Updated nss packages are provided to remove the "eMudhra emSign Root CA - G3", "eMudhra emSign Root CA - C1" and "emSign ECC Root CA - C3" certificates. https://security-tracker.debian.org/tracker/DSA-6599-1
Fuente: Debian Security
Multiple security issues were discovered in Thunderbird, which could result in the execution of arbitrary code or information disclosure https://security-tracker.debian.org/tracker/DSA-6598-1
Fuente: Debian Security
Several vulnerabilities were discovered in DPDK, a set of libraries for fast packet processing. Depending on enabled functionality, crafted packets or malicious guest requests could cause denial of service or memory corruption. https://security-tracker.debian.org/tracker/DSA-6597-1
Fuente: Debian Security
Several vulnerabilities were discovered in wordpress, a web blogging tool, which could result in denial of service, cross-site scripting, SQL injection, information disclosure, privilege escalation or remote code execution. https://security-tracker.debian.org/tracker/DSA-6596-1
Fuente: Debian Security
Multiple security vulnerabilities were discovered in Tor, a connection- based low-latency anonymous communication system, would could result in denial of service. https://security-tracker.debian.org/tracker/DSA-6595-1
Fuente: Debian Security
Multiple security issues were discovered in GitPython, a Python library to interact with Git repositories, which could result in information disclosure, directory traversal, execution of arbitrary code or denial of service. https://security-tracker.debian.org/tracker/DSA-6594-1
Fuente: Debian Security
Multiple security vulnerabilities were discovered in imagemagick, a software suite used for editing and manipulating digital images, which could lead to denial of service, information disclosure or potentially arbitrary code execution if malformed images are processed. https://security-tracker.debian.org/tracker/DSA-6593-1
Fuente: Debian Security
Security issues were discovered in Chromium which could result in the execution of arbitrary code, denial of service, or information disclosure. https://security-tracker.debian.org/tracker/DSA-6592-1
Fuente: Debian Security
Several vulnerabilities have been discovered in the OpenJDK Java runtime, which may result in denial of service, sandbox breakout, incomplete certificate checks or information disclosure. https://security-tracker.debian.org/tracker/DSA-6591-1
Fuente: Debian Security
Multiple security issues have been found in the Mozilla Firefox web browser, which could potentially result in the execution of arbitrary code, sandbox escape, bypass of the same-origin policy, privilege escalation, information disclosure or spoofing. https://security-tracker.debian.org/tracker/DSA-6590-1
Fuente: Debian Security
Project: Media Alias Display Project machine name: media_alias_display Date: 2026-October-28 Security risk: Moderately critical 11 ∕ 25 AC:Complex/A:None/CI:Some/II:None/E:Proof/TD:Uncommon Vulnerability: Information disclosure Affected versions: <2.1.3 || >=3.0.0 <3.0.3 CVE IDs: CVE-2026-118571 Description: This module allows for direct viewing of a file with the URL alias. This is a followup adv
Fuente: Drupal.org · CVE-2026-118571
Project: Content Sync (content-sync.io) Project machine name: cms_content_sync Date: 2026-October-28 Security risk: Moderately critical 12 ∕ 25 AC:Complex/A:Admin/CI:Some/II:Some/E:Theoretical/TD:All Vulnerability: Information disclosure Affected versions: <3.2.2 CVE IDs: CVE-2026-118568 Description: This module enables you to share and reuse content across websites. The module did not sufficientl
Fuente: Drupal.org · CVE-2026-118568
Project: OAuth2 Token Manager Project machine name: oauth2_token_manager Date: 2026-October-28 Security risk: Critical 15 ∕ 25 AC:Complex/A:None/CI:Some/II:Some/E:Theoretical/TD:All Vulnerability: Access bypass Affected versions: <1.2.0 CVE IDs: CVE-2026-118573 Description: This module lets you manage system-wide OAuth2 access and refresh tokens for Box, Quip, and Slack integrations through Drush
Fuente: Drupal.org · CVE-2026-118573
Project: Field Permissions Project machine name: field_permissions Date: 2026-October-28 Security risk: Moderately critical 13 ∕ 25 AC:None/A:None/CI:Some/II:None/E:Theoretical/TD:Uncommon Vulnerability: Access bypass Affected versions: <1.6.0 CVE IDs: CVE-2026-118584 Description: The Field Permissions module enables you to set field-level permissions for viewing and editing fields, including a "P
Fuente: Drupal.org · CVE-2026-118584
Project: Field Permissions Project machine name: field_permissions Date: 2026-October-28 Security risk: Moderately critical 11 ∕ 25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:Uncommon Vulnerability: Access bypass Affected versions: <1.6.0 CVE IDs: CVE-2026-118583 Description: This module enables you to set field-level permissions to create, update or view individual fields. The module does
Fuente: Drupal.org · CVE-2026-118583
Project: OpenID Connect Client Project machine name: oidc Date: 2026-October-28 Security risk: Moderately critical 14 ∕ 25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:Uncommon Vulnerability: Improper authentication Affected versions: <2.3.1 CVE IDs: CVE-2026-118554 Description: The module enables authentication via the OpenID Connect (oAuth2) protocol. When a new user logs in via OpenID Conne
Fuente: Drupal.org · CVE-2026-118554
Project: Stage File Proxy Project machine name: stage_file_proxy Date: 2026-October-28 Security risk: Critical 16 ∕ 25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:All Vulnerability: Cross-site scripting Affected versions: <3.1.7 || >=4.0.0 <4.0.1 CVE IDs: CVE-2026-118576 Description: Stage File Proxy is a general solution for getting production files on a development server on demand. It is n
Fuente: Drupal.org · CVE-2026-118576
Project: Signature pad widget Project machine name: sign_widget Date: 2026-October-28 Security risk: Critical 16 ∕ 25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:All Vulnerability: Cross-site scripting Affected versions: <1.15.0 CVE IDs: CVE-2026-118575 Description: This module enables users to create and save signatures as SVG images. The module did not sufficiently sanitize user-supplied co
Fuente: Drupal.org · CVE-2026-118575
Project: OAuth Login - OAuth OIDC SSO Project machine name: oauth_login_oauth2 Date: 2026-October-28 Security risk: Critical 15 ∕ 25 AC:Complex/A:None/CI:Some/II:Some/E:Theoretical/TD:All Vulnerability: Authentication bypass Affected versions: <3.1.1 CVE IDs: CVE-2026-118572 Description: This module enables you to log in to your Drupal site using any OAuth 2.0 or OpenID Connect compliant identity
Fuente: Drupal.org · CVE-2026-118572
Project: Bulk Update User Roles Project machine name: bulk_update_user_roles Date: 2026-October-28 Security risk: Moderately critical 12 ∕ 25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:Default Vulnerability: Incorrect authorization Affected versions: <1.0.5 CVE IDs: CVE-2026-118567 Description: This module provides a bulk form for assigning or removing roles on multiple user accounts at onc
Fuente: Drupal.org · CVE-2026-118567
Project: S3 File System Project machine name: s3fs Date: 2026-October-28 Security risk: Moderately critical 14 ∕ 25 AC:Complex/A:None/CI:Some/II:Some/E:Theoretical/TD:Default Vulnerability: Access bypass Affected versions: <3.12.0 CVE IDs: CVE-2026-118574 Description: S3 File System (s3fs) provides an additional file system to your Drupal site that stores files in Amazon's Simple Storage Service (
Fuente: Drupal.org · CVE-2026-118574
Project: Fasttoggle Project machine name: fasttoggle Date: 2026-October-28 Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:All Vulnerability: Cross-Site Request Forgery Affected versions: <4.1.1 CVE IDs: CVE-2026-118570 Description: This module enables you to quickly toggle the publication status, promotion and stickiness of nodes, and the publication st
Fuente: Drupal.org · CVE-2026-118570
Project: Fasttoggle Project machine name: fasttoggle Date: 2026-October-28 Security risk: Moderately critical 13 ∕ 25 AC:None/A:User/CI:None/II:Some/E:Theoretical/TD:All Vulnerability: Access bypass Affected versions: <4.1.1 CVE IDs: CVE-2026-118569 Description: This module enables you to quickly toggle the publication status, promotion and stickiness of nodes, and the publication status of commen
Fuente: Drupal.org · CVE-2026-118569
Project: CAPTCHA Project machine name: captcha Date: 2026-October-28 Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:None/CI:None/II:None/E:Exploit/TD:All Vulnerability: Session Replay (CAPTCHA bypass) Affected versions: <1.18.0 || >=2.0.0 <2.0.11 CVE IDs: CVE-2026-118582 Description: The CAPTCHA module places a configurable challenge on forms to block automated submissions. To skip the chal
Fuente: Drupal.org · CVE-2026-118582
Project: GroupEx PRO ( Daxko ) integration Project machine name: groupexpro Date: 2026-November-04 Security risk: Critical 17 ∕ 25 AC:Basic/A:Admin/CI:All/II:All/E:Theoretical/TD:All Vulnerability: PHP object injection Affected versions: <2.2.1 CVE IDs: CVE-2026-118565 Description: Integration with GroupEx PRO system, decoupled from Open Y. The module does not sufficiently validate user inputs in
Fuente: Drupal.org · CVE-2026-118565
Project: PayUmoney for Drupal Commerce Project machine name: commerce_payumoney Date: 2026-October-28 Security risk: Critical 16 ∕ 25 AC:Complex/A:Admin/CI:All/II:All/E:Theoretical/TD:All Vulnerability: Unsupported Affected versions: * CVE IDs: CVE-2026-118564 Description: The Drupal Security Team is marking this project unsupported. There is a known security issue with the project that has not be
Fuente: Drupal.org · CVE-2026-118564
Project: CacheFlush Project machine name: cacheflush Date: 2026-October-28 Security risk: Critical 16 ∕ 25 AC:Complex/A:Admin/CI:All/II:All/E:Theoretical/TD:All Vulnerability: Unsupported Affected versions: * CVE IDs: CVE-2026-118563 Description: The Drupal Security Team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer.
Fuente: Drupal.org · CVE-2026-118563
Project: Single Content Sync Project machine name: single_content_sync Date: 2026-October-28 Security risk: Critical 17 ∕ 25 AC:Basic/A:Admin/CI:All/II:All/E:Theoretical/TD:All Vulnerability: Remote code execution Affected versions: <1.4.19 CVE IDs: CVE-2026-118562 Description: Single Content Sync enables exporting and importing content, referenced entities, and files between Drupal sites. A malic
Fuente: Drupal.org · CVE-2026-118562
Project: Single Content Sync Project machine name: single_content_sync Date: 2026-October-28 Security risk: Critical 17 ∕ 25 AC:Basic/A:Admin/CI:All/II:All/E:Theoretical/TD:All Vulnerability: External control of file name or path Affected versions: <1.4.19 CVE IDs: CVE-2026-118561 Description: Single Content Sync enables exporting and importing content, referenced entities, and files between Drupa
Fuente: Drupal.org · CVE-2026-118561
Project: AI (Artificial Intelligence) Project machine name: ai Date: 2026-October-28 Security risk: Moderately critical 11 ∕ 25 AC:Complex/A:User/CI:Some/II:Some/E:Theoretical/TD:Uncommon Vulnerability: Cross-site scripting Affected versions: <1.4.11 || >=1.5.0 <1.5.2 CVE IDs: CVE-2026-118553 Description: The AI module includes a submodule, AI Automator. This submodule allows you to automatically
Fuente: Drupal.org · CVE-2026-118553
Project: AI (Artificial Intelligence) Project machine name: ai Date: 2026-October-28 Security risk: Moderately critical 14 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All Vulnerability: Cross-site scripting Affected versions: <1.4.11 || >=1.5.0 <1.5.2 CVE IDs: CVE-2026-118552 Description: This module provides a framework for integrating AI providers and features into Drupal. The module d
Fuente: Drupal.org · CVE-2026-118552
Project: AI (Artificial Intelligence) Project machine name: ai Date: 2026-October-28 Security risk: Less critical 8 ∕ 25 AC:Complex/A:User/CI:Some/II:None/E:Theoretical/TD:Uncommon Vulnerability: Information Disclosure Affected versions: <1.4.11 || >=1.5.0 <1.5.2 CVE IDs: CVE-2026-118551 Description: This module provides a framework for integrating AI providers and features into Drupal. Audio for
Fuente: Drupal.org · CVE-2026-118551
Project: AI (Artificial Intelligence) Project machine name: ai Date: 2026-October-28 Security risk: Moderately critical 10 ∕ 25 AC:Complex/A:None/CI:Some/II:None/E:Theoretical/TD:Uncommon Vulnerability: Access bypass Affected versions: <1.4.11 || >=1.5.0 <1.5.2 CVE IDs: CVE-2026-118550 Description: This module provides a framework for integrating Drupal with AI providers. Its AI Search submodule p
Fuente: Drupal.org · CVE-2026-118550
Project: AI (Artificial Intelligence) Project machine name: ai Date: 2026-October-28 Security risk: Critical 15 ∕ 25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:Default Vulnerability: Cross-site scripting Affected versions: <1.4.11 || >=1.5.0 <1.5.2 CVE IDs: CVE-2026-118549 Description: This AI module enables you to interact with AI providers. It has a service that helps any consumer of the m
Fuente: Drupal.org · CVE-2026-118549
Project: AI (Artificial Intelligence) Project machine name: ai Date: 2026-October-28 Security risk: Moderately critical 11 ∕ 25 AC:Complex/A:None/CI:Some/II:None/E:Theoretical/TD:Default Vulnerability: Information disclosure Affected versions: <1.4.11 || >=1.5.0 <1.5.2 CVE IDs: CVE-2026-118548 Description: This module enables you to use AI on the website. It also enables you to interact with AI pr
Fuente: Drupal.org · CVE-2026-118548
Project: AI (Artificial Intelligence) Project machine name: ai Date: 2026-October-28 Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default Vulnerability: Cross-site scripting Affected versions: <1.4.11 || >=1.5.0 <1.5.2 CVE IDs: CVE-2026-118546 Description: This module enables you to use AI on the website. It includes an AI Chatbot submodule allows you
Fuente: Drupal.org · CVE-2026-118546
Project: AI (Artificial Intelligence) Project machine name: ai Date: 2026-October-28 Security risk: Moderately critical 14 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All Vulnerability: Cross-site scripting Affected versions: <1.4.11 || >=1.5.0 <1.5.2 CVE IDs: CVE-2026-118545 Description: This module enables you to use AI on the website. The module does not sufficiently restrict HTML ren
Fuente: Drupal.org · CVE-2026-118545
Project: Commerce Stripe Project machine name: commerce_stripe Date: 2026-October-28 Security risk: Moderately critical 11 ∕ 25 AC:Complex/A:Admin/CI:Some/II:Some/E:Theoretical/TD:Default Vulnerability: Cross site scripting Affected versions: >=2.0.0 <2.2.3 CVE IDs: CVE-2026-118560 Description: This module enables you to use the Stripe Connect API to quickly configure your Drupal Commerce store to
Fuente: Drupal.org · CVE-2026-118560
Project: Commerce Stripe Project machine name: commerce_stripe Date: 2026-October-28 Security risk: Moderately critical 12 ∕ 25 AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:Default Vulnerability: Improper verification of cryptographic signature Affected versions: <1.4 || >=2.0.0 <2.2.3 CVE IDs: CVE-2026-118559 Description: This module enables you to take payments via multiple Stripe APIs. The
Fuente: Drupal.org · CVE-2026-118559
Project: Commerce Stripe Project machine name: commerce_stripe Date: 2026-October-28 Security risk: Critical 15 ∕ 25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:Default Vulnerability: Cross-site request forgery Affected versions: >=2.0.0 <2.2.3 CVE IDs: CVE-2026-118558 Description: This module enables you to use the Stripe Connect API to quickly configure your Drupal Commerce store to take pa
Fuente: Drupal.org · CVE-2026-118558
Project: Commerce Shipping Project machine name: commerce_shipping Date: 2026-October-28 Security risk: Less critical 8 ∕ 25 AC:Basic/A:Admin/CI:Some/II:None/E:Theoretical/TD:Uncommon Vulnerability: Access bypass Affected versions: <2.16.0 || >=3.0.0 <3.0.6 CVE IDs: CVE-2026-118557 Description: This module enables you to sell tangible products via Drupal Commerce that are organized into shipments
Fuente: Drupal.org · CVE-2026-118557
Project: Commerce Shipping Project machine name: commerce_shipping Date: 2026-October-28 Security risk: Moderately critical 11 ∕ 25 AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:Uncommon Vulnerability: Access bypass Affected versions: <2.16.0 || >=3.0.0 <3.0.6 CVE IDs: CVE-2026-118556 Description: This module enables you to sell tangible products via Drupal Commerce that are organized into ship
Fuente: Drupal.org · CVE-2026-118556
Project: Commerce License Project machine name: commerce_license Date: 2026-October-28 Security risk: Moderately critical 12 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Uncommon Vulnerability: Access bypass Affected versions: <3.1.1 CVE IDs: CVE-2026-118555 Description: This module enables you to sell licenses granting access to resources, such as user roles, files, or protected content.
Fuente: Drupal.org · CVE-2026-118555
Project: Commerce Core Project machine name: commerce Date: 2026-October-28 Security risk: Moderately critical 11 ∕ 25 AC:Complex/A:None/CI:Some/II:None/E:Proof/TD:Uncommon Vulnerability: Information disclosure Affected versions: <2.41.0 || >=3.0.0 <3.3.13 CVE IDs: CVE-2026-118544 Description: This module enables you to sell goods and services to customers through a shopping cart and checkout form
Fuente: Drupal.org · CVE-2026-118544
Project: Commerce Core Project machine name: commerce Date: 2026-October-28 Security risk: Moderately critical 12 ∕ 25 AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:Default Vulnerability: Cross-site request forgery Affected versions: <2.41.0 || >=3.0.0 <3.3.13 CVE IDs: CVE-2026-118543 Description: This module enables you to sell goods and services to customers through a shopping cart and checko
Fuente: Drupal.org · CVE-2026-118543
Project: Commerce Core Project machine name: commerce Date: 2026-October-28 Security risk: Moderately critical 10 ∕ 25 AC:Basic/A:Admin/CI:None/II:Some/E:Theoretical/TD:All Vulnerability: Access bypass Affected versions: <2.41.0 || >=3.0.0 <3.3.13 CVE IDs: CVE-2026-118542 Description: This module enables you to sell goods and services to customers through a shopping cart and checkout form. Sites c
Fuente: Drupal.org · CVE-2026-118542
Project: Commerce Core Project machine name: commerce Date: 2026-October-28 Security risk: Less critical 9 ∕ 25 AC:Basic/A:User/CI:None/II:Some/E:Theoretical/TD:Uncommon Vulnerability: Access bypass Affected versions: <2.41.0 || >=3.0.0 <3.3.13 CVE IDs: CVE-2026-118541 Description: This module enables you to sell goods and services to customers through a shopping cart and checkout form. It include
Fuente: Drupal.org · CVE-2026-118541
Project: Commerce Core Project machine name: commerce Date: 2026-October-28 Security risk: Moderately critical 12 ∕ 25 AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:Default Vulnerability: Information disclosure Affected versions: <2.41 || >=3.0.0 <3.2.0 CVE IDs: CVE-2026-118540 Description: This module enables you to sell goods and services to customers through a shopping cart and checkout form
Fuente: Drupal.org · CVE-2026-118540
Project: Commerce Core Project machine name: commerce Date: 2026-October-28 Security risk: Highly critical 21 ∕ 25 AC:None/A:None/CI:Some/II:Some/E:Exploit/TD:All Vulnerability: Access bypass Affected versions: <2.41 || >=3.0.0 <3.3.13 CVE IDs: CVE-2026-118539 Description: This module enables you to sell goods and services to customers through an included shopping cart and checkout form or through
Fuente: Drupal.org · CVE-2026-118539
The update for thunderbird in DSA-6585-1 introduced a regression in the supported for PGP-encrypted emails. Updated packages are now available to correct this issue. https://security-tracker.debian.org/tracker/DSA-6585-2
Fuente: Debian Security
Multiple security vulnerabilities have been discovered in the MongoDB driver for PHP, which could result in denial of service. https://security-tracker.debian.org/tracker/DSA-6589-1
Fuente: Debian Security
Several vulnerabilities have been discovered in the OpenJDK Java runtime, which may result in denial of service, sandbox bypass, incomplete certificate checks or information disclosure. https://security-tracker.debian.org/tracker/DSA-6588-1
Fuente: Debian Security
It was discovered that incorrect parsing of packets with compression pointers in the PowerDNS DNS server could result in denial of service. https://security-tracker.debian.org/tracker/DSA-6587-1
Fuente: Debian Security
Several vulnerabilities were discovered in Valkey, an in-memory key-value database. These issues could cause denial of service and, in some cases, potentially allow arbitrary code execution. https://security-tracker.debian.org/tracker/DSA-6586-1
Fuente: Debian Security
Multiple security issues were discovered in Thunderbird, which could result in the execution of arbitrary code or information disclosure Debian follows the Thunderbird upstream releases. Support for the 140.x series has ended, so starting with this update we're now following the 153.x series. https://security-tracker.debian.org/tracker/DSA-6585-1
Fuente: Debian Security
Several vulnerabilities were discovered in Varnish Cache, an HTTP accelerator, which could result in cache poisoning, authentication bypass or denial of service. CVE-2026-34475 Tom Kinnaird discovered a deficiency in the parsing of HTTP/1.1 absolute-form request targets. If the request URL is passed unchecked to a backend which accepts absolute-form URIs, a remote attacker could potentially poison
Fuente: Debian Security · CVE-2026-34475
Adobe reemplazó el parche aislado de octubre 2026 para Adobe Commerce 2.4.8-p5 (Community Edition) con una versión actualizada que añade salvaguardas de defensa en profundidad. Quien ya aplicó el archivo original debería descargar de nuevo el revisado, porque el Commerce Version Tool puede mostrar UNKNOWN. No pude verificar la fecha de publicación, que podría ser cercana al 19-10-2026, es decir en el límite del plazo de 14 días.
Fuente: Adobe Commerce KB
Fuente: Adobe PSIRT
Fuente: Adobe PSIRT
Fuente: Adobe PSIRT
Fuente: Adobe PSIRT
Fuente: Adobe PSIRT
Fuente: Adobe PSIRT
Fuente: Adobe PSIRT
Update October 27th: Convertr has removed the skimmer and upgraded Plausible to a patched version. Convertr says it is notifying affected merchants, payment providers and the relevant authorities. ...
Fuente: Sansec
Sansec found deepveindrilling.com in the CMS blocks of 83 online stores, nearly all on Magento. The domain was registered on October 6, 2026, and the first stores loaded it the next evening. It is ...
Fuente: Sansec
Multiple security issues were discovered in libheif, a library for reading and writing HEIF and AVIF images. Processing specially crafted images could result in denial of service through excessive resource consumption or crashes, or disclosure of process memory. A use-after-free and double-free affecting timestamp handling during image encoding, including transcoding of crafted images, is also add
Fuente: Debian Security
Several vulnerabilities were discovered in Erlang/OTP, a programming language and runtime environment. These issues could result in denial of service, HTTP request smuggling, or bypass of authentication and access restrictions, including TLS server impersonation. The affected components include the HTTP client and server, SSH, TLS, ASN.1 decoding, the network driver, and URI, LDAP and SNMP parsing
Fuente: Debian Security
Multiple vulnerabilities were discovered in roundcube, a skinnable AJAX based webmail solution for IMAP servers, which could result in IMAP command injection, cross-site scripting, SSRF bypass, email header injection, css property injection, remote content blocking bypass, information disclosure or privilege escalation. https://security-tracker.debian.org/tracker/DSA-6579-1
Fuente: Debian Security
Multiple security vulnerabilities were discovered in Unbound, a validating, recursive, caching DNS resolver. CVE-2026-35501 (DNSSEC) Bypass of a configured island trust anchor underneath an insecure parent from an attacker-controlled NSEC record. CVE-2026-50106 (DNSSEC) Possible insecure NXDOMAIN for non-existing records under a configured island trust anchor underneath an insecure parent. CVE-202
Fuente: Debian Security · CVE-2026-35501
A vulnerability was discovered in Brotli, a generic-purpose lossless compression suite, which could result in denial of service, or potentially the execution of arbitrary code. https://security-tracker.debian.org/tracker/DSA-6582-1
Fuente: Debian Security
The webkit2gtk update released as DSA-6534-1 introduced a regression that prevents Evolution from displaying images embedded in HTML emails. https://security-tracker.debian.org/tracker/DSA-6534-3
Fuente: Debian Security
Security issues were discovered in Chromium which could result in the execution of arbitrary code, denial of service, or information disclosure. https://security-tracker.debian.org/tracker/DSA-6577-1
Fuente: Debian Security
Two vulnerabilities were discovered in aide, an advanced intrusion detection system, which could allow a local user to bypass the detection of malicious files. https://security-tracker.debian.org/tracker/DSA-6578-1
Fuente: Debian Security
Project: Monster Menus Project machine name: monster_menus Date: 2026-October-21 Security risk: Critical 16 ∕ 25 AC:Basic/A:User/CI:All/II:All/E:Theoretical/TD:Uncommon Vulnerability: PHP object injection Affected versions: <9.5.6 CVE IDs: CVE-2026-114573 Description: This module enables you to create one or more multisites with highly granular page permissions. The included RSS Page submodule all
Fuente: Drupal.org · CVE-2026-114573
Project: Rabbit Hole Project machine name: rabbit_hole Date: 2026-October-21 Security risk: Moderately critical 11 ∕ 25 AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:Uncommon Vulnerability: Access Bypass Affected versions: <1.3.0 CVE IDs: CVE-2026-114571 Description: Rabbit Hole lets site builders control what happens when an entity's page is viewed: show it, return an access denied or not foun
Fuente: Drupal.org · CVE-2026-114571
Project: AI File to Text Project machine name: ai_file_to_text Date: 2026-October-21 Security risk: Moderately critical 11 ∕ 25 AC:Basic/A:User/CI:Some/II:None/E:Theoretical/TD:All Vulnerability: Access bypass Affected versions: <1.0.1 CVE IDs: CVE-2026-114554 Description: The AI File to Text module extracts text from uploaded documents, including Word, PDF, OpenDocument, CSV, Markdown and plain t
Fuente: Drupal.org · CVE-2026-114554
Project: Data field Project machine name: datafield Date: 2026-October-21 Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:All Vulnerability: Cross site scripting Affected versions: <2.0.14 CVE IDs: CVE-2026-114555 Description: Data Field allows you to create custom fields with multiple values under the default table form. The file_uri formatter does not
Fuente: Drupal.org · CVE-2026-114555
Project: Domain Login Restrict Project machine name: domain_login_restrict Date: 2026-October-21 Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default Vulnerability: Access bypass Affected versions: <1.5.0 CVE IDs: CVE-2026-114572 Description: This module enables you to restrict user logins on a multi-domain site built with the Domain module, so that u
Fuente: Drupal.org · CVE-2026-114572
Project: Shield Project machine name: shield Date: 2026-October-21 Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:All Vulnerability: Access bypass Affected versions: <1.9.0 CVE IDs: CVE-2026-107256 Description: The Shield module enables you to protect a site behind an HTTP basic authentication prompt, so that an unfinished or non-public site cannot be v
Fuente: Drupal.org · CVE-2026-107256
Project: ImageAPI Optimize WebP Project machine name: imageapi_optimize_webp Date: 2026-October-21 Security risk: Moderately critical 10 ∕ 25 AC:Complex/A:None/CI:Some/II:None/E:Theoretical/TD:Uncommon Vulnerability: Information disclosure Affected versions: <2.1.2 CVE IDs: CVE-2026-114548 Description: This module enables you to generate and serve WebP derivatives of image style images, overriding
Fuente: Drupal.org · CVE-2026-114548
Project: TinyPNG Project machine name: tinypng Date: 2026-October-21 Security risk: Moderately critical 10 ∕ 25 AC:Complex/A:None/CI:Some/II:None/E:Theoretical/TD:Uncommon Vulnerability: Information disclosure Affected versions: <2.0.2 CVE IDs: CVE-2026-114547 Description: TinyPNG uses smart lossy compression techniques to reduce the file size of your PNG files. The module doesn't sufficiently che
Fuente: Drupal.org · CVE-2026-114547
Project: Media Alias Display Project machine name: media_alias_display Date: 2026-October-21 Security risk: Moderately critical 10 ∕ 25 AC:Complex/A:None/CI:Some/II:None/E:Theoretical/TD:Uncommon Vulnerability: Information disclosure Affected versions: <2.1.2 || >=3.0.0 <3.0.2 CVE IDs: CVE-2026-114546 Description: This module allows for direct viewing of a file with the URL alias. In some cases, f
Fuente: Drupal.org · CVE-2026-114546
Project: Fullcalendar View Project machine name: fullcalendar_view Date: 2026-October-21 Security risk: Moderately critical 11 ∕ 25 AC:Basic/A:User/CI:None/II:Some/E:Theoretical/TD:All Vulnerability: Access bypass Affected versions: <5.2.6 CVE IDs: CVE-2026-114545 Description: This module provides a View plugin that integrates a calendar view format powered by FullCalendar JavaScript library. This
Fuente: Drupal.org · CVE-2026-114545
Project: Media Bulk Upload Project machine name: media_bulk_upload Date: 2026-October-21 Security risk: Moderately critical 11 ∕ 25 AC:Basic/A:User/CI:None/II:Some/E:Theoretical/TD:All Vulnerability: Access bypass Affected versions: <3.0.6 CVE IDs: CVE-2026-114544 Description: This module enables users to upload files and create media items in bulk. The module doesn't sufficiently check user permi
Fuente: Drupal.org · CVE-2026-114544
Project: Simple OAuth (OAuth2) & OpenID Connect Project machine name: simple_oauth Date: 2026-October-21 Security risk: Moderately critical 12 ∕ 25 AC:Complex/A:User/CI:Some/II:Some/E:Theoretical/TD:Default Vulnerability: Access bypass Affected versions: >=6.1.0 <6.1.3 CVE IDs: CVE-2026-114542 Description: This module introduces an OAuth 2.0 authorization server, which can be configured to protect
Fuente: Drupal.org · CVE-2026-114542
Project: Frontend Editing Project machine name: frontend_editing Date: 2026-October-21 Security risk: Less critical 9 ∕ 25 AC:Basic/A:User/CI:None/II:Some/E:Theoretical/TD:Uncommon Vulnerability: Access bypass Affected versions: <1.9.3 CVE IDs: CVE-2026-114553 Description: This module enables editors to edit content, including paragraphs, directly on the rendered page. The module doesn't sufficien
Fuente: Drupal.org · CVE-2026-114553
Project: Frontend Editing Project machine name: frontend_editing Date: 2026-October-21 Security risk: Moderately critical 12 ∕ 25 AC:Complex/A:None/CI:None/II:Some/E:Theoretical/TD:All Vulnerability: Cross-Site Request Forgery (CSRF) Affected versions: <1.9.3 CVE IDs: CVE-2026-114541 Description: This module enables editors to edit content, including paragraphs, directly on the rendered page. The
Fuente: Drupal.org · CVE-2026-114541
Project: Simple User Management Project machine name: simple_user_management Date: 2026-October-21 Security risk: Moderately critical 14 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All Vulnerability: Access bypass Affected versions: <1.11.0 CVE IDs: CVE-2026-114543 Description: This module lets non-administrators approve, deactivate and delete users, limited by the roles they can delegat
Fuente: Drupal.org · CVE-2026-114543
Project: Domain Project machine name: domain Date: 2026-October-21 Security risk: Moderately critical 12 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Uncommon Vulnerability: Access bypass Affected versions: >=3.0.0 <3.0.2 CVE IDs: CVE-2026-114540 Description: This module enables you to share users, content and configuration across a group of domains from a single Drupal installation. Its
Fuente: Drupal.org · CVE-2026-114540
Project: DocCheck Basic Project machine name: doccheck_basic Date: 2026-October-21 Security risk: Moderately critical 12 ∕ 25 AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:Default Vulnerability: Access bypass CVE IDs: CVE-2026-114539 Description: This module allows healthcare professionals to log in to a shared account on the Drupal website using their DocCheck credentials. The module doesn't s
Fuente: Drupal.org · CVE-2026-114539
Project: Bootstrap Project machine name: bootstrap Date: 2026-October-21 Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default Vulnerability: Cross-site scripting Affected versions: <3.45.0 CVE IDs: CVE-2026-114538 Description: Provides the Bootstrap front-end framework as a Drupal theme. Bootstrap theme did not sufficiently filter certain attributes,
Fuente: Drupal.org · CVE-2026-114538
Project: View Unpublished Project machine name: view_unpublished Date: 2026-October-21 Security risk: Moderately critical 13 ∕ 25 AC:None/A:None/CI:Some/II:None/E:Theoretical/TD:Uncommon Vulnerability: Access bypass Affected versions: <1.5.0 CVE IDs: CVE-2026-114537 Description: This module allows granting access to unpublished nodes per content type. For nodes with at least one unpublished transl
Fuente: Drupal.org · CVE-2026-114537
Project: USWDS Paragraph Components Project machine name: uswds_paragraph_components Date: 2026-October-21 Security risk: Moderately critical 14 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All Vulnerability: Cross site scripting Affected versions: <3.1.3 CVE IDs: CVE-2026-114536 Description: This module provides a suite of Paragraphs bundles that works within the USWDS framework. The mod
Fuente: Drupal.org · CVE-2026-114536
Project: Swiper formatter Project machine name: swiper_formatter Date: 2026-October-21 Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:All Vulnerability: Information disclosure Affected versions: <2.1.2 || >=3.0.1 <3.1.0 CVE IDs: CVE-2026-114535 Description: Swiper is mobile first, layout and gestures wise, it provides great amount of options for designi
Fuente: Drupal.org · CVE-2026-114535
Project: Block Attributes Project machine name: block_attributes Date: 2026-October-21 Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:All Vulnerability: Cross site Scripting Affected versions: <2.1.0 CVE IDs: CVE-2026-114534 Description: This module allows you to define custom attributes for a block. You can specify an attribute name to be added to the
Fuente: Drupal.org · CVE-2026-114534
Project: Ágora Transparency Theme Project machine name: agora_theme Date: 2026-October-21 Security risk: Moderately critical 13 ∕ 25 AC:None/A:None/CI:Some/II:None/E:Theoretical/TD:Uncommon Vulnerability: Information disclosure Affected versions: <1.2.3 CVE IDs: CVE-2026-114533 Description: This theme provides a front-end design for transparency and open-government sites, including a table preview
Fuente: Drupal.org · CVE-2026-114533
Project: UI Icons Project machine name: ui_icons Date: 2026-October-21 Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default Vulnerability: Cross-site scripting Affected versions: <1.1.3 || >=2.0.0 <2.0.2 CVE IDs: CVE-2026-114532 Description: This module provides a user interface to select and configure icons, including a CKEditor 5 button and widget t
Fuente: Drupal.org · CVE-2026-114532
Project: Sector Distribution Project machine name: sector Date: 2026-October-21 Security risk: Moderately critical 14 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All Vulnerability: Cross-site scripting Affected versions: <10.3.3 || >=10.4.0 <10.4.2 CVE IDs: CVE-2026-107260 Description: Sector is a distribution targeted towards Drupal site builders and site owners who are looking for a fu
Fuente: Drupal.org · CVE-2026-107260
Project: Swiper formatter Project machine name: swiper_formatter Date: 2026-October-21 Security risk: Moderately critical 14 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All Vulnerability: Cross-site scripting Affected versions: <2.1.2 || >=3.0.1 <3.1.0 CVE IDs: CVE-2026-114531 Description: The module provides integration with third party JS library SwiperJs. User-entered text is used as
Fuente: Drupal.org · CVE-2026-114531
Project: Dopup Project machine name: dopup Date: 2026-October-21 Security risk: Critical 15 ∕ 25 AC:None/A:None/CI:Some/II:None/E:Theoretical/TD:All Vulnerability: Information disclosure Affected versions: <1.0.7 CVE IDs: CVE-2026-114530 Description: The Dopup module provides functionality for selecting and working with Webforms. The module does not perform sufficient entity access checking in som
Fuente: Drupal.org · CVE-2026-114530
Project: CSV Field Project machine name: csv_field Date: 2026-October-21 Security risk: Moderately critical 14 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All Vulnerability: Cross site Scripting Affected versions: <2.0.10 || >=3.0.0 <3.0.7 CVE IDs: CVE-2026-114529 Description: This module enables you to upload CSV files to a field and display them as an interactive, sortable and searchab
Fuente: Drupal.org · CVE-2026-114529
Project: Custom Formatters Project machine name: custom_formatters Date: 2026-October-21 Security risk: Critical 17 ∕ 25 AC:Basic/A:Admin/CI:All/II:All/E:Theoretical/TD:All Vulnerability: Remote code execution Affected versions: <4.2.1 CVE IDs: CVE-2026-114524 Description: The Custom Formatters module allows users to easily create custom Field Formatters through an admin UI without writing a custo
Fuente: Drupal.org · CVE-2026-114524
Project: ABC Project machine name: abc Date: 2026-October-21 Security risk: Critical 16 ∕ 25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:All Vulnerability: Cross-site scripting Affected versions: <1.25.0 || >=2.0.0 <2.0.1 CVE IDs: CVE-2026-114525 Description: The ABC theme provides configurable layouts and visual styling for Drupal websites, including support for Font Awesome icons in navigat
Fuente: Drupal.org · CVE-2026-114525
Project: Black Hole Project machine name: black_hole Date: 2026-October-21 Security risk: Critical 16 ∕ 25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:All Vulnerability: Cross-site scripting Affected versions: <1.26.0 || >=2.0.0 <2.0.1 CVE IDs: CVE-2026-114526 Description: The Black Hole theme provides configurable layouts and visual styling for Drupal websites, including support for Font Awe
Fuente: Drupal.org · CVE-2026-114526
Project: Zero Point Project machine name: zeropoint Date: 2026-October-21 Security risk: Critical 16 ∕ 25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:All Vulnerability: Cross-site scripting Affected versions: <1.30.0 || >=2.0.0 <2.0.1 CVE IDs: CVE-2026-114528 Description: The ZeroPoint theme provides configurable layouts and visual styling for Drupal websites, including support for Font Aweso
Fuente: Drupal.org · CVE-2026-114528
Project: UI Icons Project machine name: ui_icons Date: 2026-October-21 Security risk: Critical 16 ∕ 25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:All Vulnerability: Cross site scripting Affected versions: <1.1.3 || >=2.0.0 <2.0.2 CVE IDs: CVE-2026-114527 Description: This module provides a user interface to select and configure icons, including a form element, a text format filter and severa
Fuente: Drupal.org · CVE-2026-114527
Project: Ffmpeg Image Toolkit Project machine name: ffmpeg_image_toolkit Date: 2026-October-21 Security risk: Highly critical 20 ∕ 25 AC:Basic/A:None/CI:All/II:All/E:Theoretical/TD:All Vulnerability: Remote Code Execution Affected versions: <1.0.3 CVE IDs: CVE-2026-114523 Description: This module enables you to use ffmpeg for image conversion The module doesn't sufficiently sanitize file names pas
Fuente: Drupal.org · CVE-2026-114523
Date: 2026-October-21 Description: PHP has announced a critical PHP security release for Wednesday, October 21, 2026, at 14:00 UTC. Reserve time to update PHP as soon as the release is available. If you manage PHP yourself, you’ll need to apply the update. If your host manages it, follow their communications for timing and any required action. Updating to a PHP release containing the patch to thes
Fuente: Drupal.org
CVE-2026-109618 and CVE-2026-109619 are both rated CVSS v4.0 9.2. The flaws are in the PHP engine, so Magento, Shopware and WooCommerce stores are affected even when their own code is clean. Calif...
Fuente: Sansec · CVE-2026-109618
It was discovered that incorrect memory state tracking in PHP, a widely-used open source general purpose scripting language, could result in the execution of arbitrary code. https://security-tracker.debian.org/tracker/DSA-6574-1
Fuente: Debian Security
This update blocks compromised intermediate certificates issued by the eMudhra CA. Most users will have these certs already blocked by the OneCRL feature provided by Firefox. This update blocks the certificates also for installations which have RemoteSettings disabled or which are unable to connect to the revocation backend service due to network constraints. https://security-tracker.debian.org/tr
Fuente: Debian Security
Several vulnerabilities were discovered in BIND, a DNS server implementation, which could result in denial of service or remote code execution. https://security-tracker.debian.org/tracker/DSA-6576-1
Fuente: Debian Security
Several vulnerabilities were discovered in nginx, a high performance web and reverse proxy server. Depending on the configuration, these could result in memory corruption, denial of service, injection of requests to backend servers, or bypass of client certificate authentication. CVE-2026-15176 Mapping a rewritten request URI to a filesystem path in a location using the alias directive could cause
Fuente: Debian Security · CVE-2026-15176
It was discovered that several eMudhra intermediate CA certificates have been compromised. Updated ca-certificate packages are provided to remove the "emSign ECC Root CA - G3" and "Comodo AAA Services root" certificates. https://security-tracker.debian.org/tracker/DSA-6572-1
Fuente: Debian Security
Two vulnerabilities were discovered in HAProxy, a fast and reliable load balancing reverse proxy, which could result in denial of service. https://security-tracker.debian.org/tracker/DSA-6570-1
Fuente: Debian Security
The update for cifs-utils announced in DSA 6567-1 introduced a regression when using the sec=krb5 and cruid mount options. Updated packages are now available to correct this issue. https://security-tracker.debian.org/tracker/DSA-6567-2
Fuente: Debian Security
Multiple vulnerabilities have been discovered in the Xen hypervisor, which could result in privilege escalation, information disclosure or denial of service. https://security-tracker.debian.org/tracker/DSA-6571-1
Fuente: Debian Security
Several vulnerabilities have been discovered in Expat, an XML parsing C library, which could result in denial of service or potentially the execution of arbitrary code, if a malformed XML file is processed. https://security-tracker.debian.org/tracker/DSA-6566-1
Fuente: Debian Security
A vulnerability was discovered in SPIP, a website engine for publishing, which could result in unauthenticated remote code execution. https://security-tracker.debian.org/tracker/DSA-6565-1
Fuente: Debian Security
Two vulnerabilities were discovered in cifs-utils, the Common Internet File System utilities, which could result in privilege escalation. https://security-tracker.debian.org/tracker/DSA-6567-1
Fuente: Debian Security
Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks. https://security-tracker.debian.org/tracker/DSA-6568-1
Fuente: Debian Security
Multiple vulnerabilities have been discovered in the Apache HTTP server, which may result in denial of service, information disclosure, authentication bypass or HTTP request smuggling. https://security-tracker.debian.org/tracker/DSA-6569-1
Fuente: Debian Security
No exploitation observed yet. Sansec has not seen BlockStrap attacks on live stores. But we managed to reproduce four different attack routes within 24 hours, and expect threat actors to do the sam...
Fuente: Sansec · CVE-2026-103849
Security issues were discovered in Chromium which could result in the execution of arbitrary code, denial of service, or information disclosure. https://security-tracker.debian.org/tracker/DSA-6562-1
Fuente: Debian Security
It was discovered that missing input sanitising in the APNG parser in the reference code implementation of the JPEG XL format could result in denial of service or information disclosure if malformed images are processed. https://security-tracker.debian.org/tracker/DSA-6564-1
Fuente: Debian Security
It was discovered that incorrect parsing of Content-Type headers in the Mutt mail user agent could result in denial of service or potentially the execution of arbitrary code. https://security-tracker.debian.org/tracker/DSA-6563-1
Fuente: Debian Security
Project: Entity List Project machine name: entity_list Date: 2026-October-14 Security risk: Critical 19 ∕ 25 AC:Basic/A:None/CI:All/II:All/E:Theoretical/TD:Default Vulnerability: Remote code execution Affected versions: <3.0.10 CVE IDs: CVE-2026-108099 Description: The Entity List module provides a way to create lists of entities without Views. The module has a remote code execution vulnerability.
Fuente: Drupal.org · CVE-2026-108099
Project: Drupal core Project machine name: drupal Date: 2026-October-14 Security risk: Moderately critical 12 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Uncommon Vulnerability: Cross-site scripting Affected versions: >= 10.3.0 < 10.6.19 || >= 11.0.0 < 11.3.19 || >= 11.4.0 < 11.4.10 || >= 12.0.0-alpha1 < 12.0.0-beta2 CVE IDs: CVE-2026-108514 Description: The Navigation module doesn't suf
Fuente: Drupal.org · CVE-2026-108514
Project: Drupal core Project machine name: drupal Date: 2026-October-14 Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Proof/TD:Uncommon Vulnerability: Cross-site scripting Affected versions: >= 8.9.0 < 10.6.19 || >= 11.0.0 < 11.3.19 || >= 11.4.0 < 11.4.10 || >= 12.0.0-alpha1 < 12.0.0-beta2 CVE IDs: CVE-2026-108515 Description: The Drupal core Link module provides a f
Fuente: Drupal.org · CVE-2026-108515
Project: Gin Admin Theme Project machine name: gin Date: 2026-October-14 Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default Vulnerability: Cross-site scripting Affected versions: <4.1.4 || >=5.0.0 <5.0.16 CVE IDs: CVE-2026-110738 Description: Gin is an administration theme that provides a modern, clean, and customizable backend UI for editors and si
Fuente: Drupal.org · CVE-2026-110738
Project: Drupal core Project machine name: drupal Date: 2026-October-14 Security risk: Critical 19 ∕ 25 AC:Basic/A:None/CI:All/II:All/E:Theoretical/TD:Default Vulnerability: Remote code execution Affected versions: >= 8.9.0 < 10.6.19 || >= 11.0.0 < 11.3.19 || >= 11.4.0 < 11.4.10 || >= 12.0.0-alpha1 < 12.0.0-beta2 CVE IDs: CVE-2026-108097 Description: A remote code execution vulnerability exists wi
Fuente: Drupal.org · CVE-2026-108097
It was discovered that the cURL URL transfer library, is prone to a use-after-free vulnerability when handling a HTTP/2 RST_STREAM received by a server during an upload, which could result in remote code execution. https://security-tracker.debian.org/tracker/DSA-6558-1
Fuente: Debian Security
Multiple security vulnerabilities were discovered in the SOGo groupware server, which could result in cross-site scripting, shell injection, password reset poisoning or SQL injection. https://security-tracker.debian.org/tracker/DSA-6561-1
Fuente: Debian Security
Multiple security issues have been found in the Mozilla Firefox web browser, which could potentially result in the execution of arbitrary code, sandbox escape, information disclosure, mitigation bypass or privilege escalation. https://security-tracker.debian.org/tracker/DSA-6560-1
Fuente: Debian Security
It was discovered that missing validation of tar sources in the Buildstream software integration tool could allow to write files on the build host. https://security-tracker.debian.org/tracker/DSA-6559-1
Fuente: Debian Security
Parches de seguridad aislados de octubre de 2026 para Adobe Commerce, publicados el 13 de octubre y que cubren las versiones 2.4.x hasta 2.4.9. El hotfix de CVE-2026-75650 (APSB26-146, explotado activamente) no está incluido y debe aplicarse por separado.
Fuente: Adobe Commerce KB
Date: 2026-October-12 Security risk: Critical 19 ∕ 25 AC:Complex/A:None/CI:All/II:All/E:Theoretical/TD:All Description: There will be a Drupal core security release for all supported branches on October 14, 2026 between 16:00 and 21:00 UTC . (To see this in your local timezone, refer to the Drupal Core Calendar .) Based on our analysis this vulnerability rates at 19/25 on our risk calculator. The
Fuente: Drupal.org
Security issues were discovered in Chromium which could result in the execution of arbitrary code, denial of service, or information disclosure. https://security-tracker.debian.org/tracker/DSA-6553-1
Fuente: Debian Security
Several vulnerabilities were discovered in NTFS-3G, a read-write NTFS driver for FUSE, which could result in denial of service, information leak or potentially local root privilege escalation. https://security-tracker.debian.org/tracker/DSA-6557-1
Fuente: Debian Security
Multiple security vulnerabilities were discovered in the Nagios monitoring system, which could result in cross-site request forgery, cross-site scripting or the execution of arbitrary commands. https://security-tracker.debian.org/tracker/DSA-6556-1
Fuente: Debian Security
It was discovered that librsvg, a library to render Scalable Vector Graphics, incorrectly parsed files with nested XML includes, which could result in denial of service or potentially the execution of arbitrary code. https://security-tracker.debian.org/tracker/DSA-6555-1
Fuente: Debian Security
A vulnerability was discovered in the handling of delegated authentication in Keystone, the OpenStack identity service, which may result in information disclosure of privilege escalation. https://security-tracker.debian.org/tracker/DSA-6554-1
Fuente: Debian Security
Several vulnerabilities have been discovered in vips, a fast image processing library. These vulnerabilities could result in denial of service, memory safety issues, or other security impact when processing specially crafted image files or data. https://security-tracker.debian.org/tracker/DSA-6552-1
Fuente: Debian Security
Multiple security issues were discovered in Ghostscript, the GPL PostScript/PDF interpreter, which could result in denial of service and potentially the execution of arbitrary code if malformed document files are processed. https://security-tracker.debian.org/tracker/DSA-6550-1
Fuente: Debian Security
Multiple security vulnerabilities were discovered in Tor, a connection- based low-latency anonymous communication system. https://security-tracker.debian.org/tracker/DSA-6551-1
Fuente: Debian Security
Project: Advanced Filesystem Project machine name: advanced_filesystem Date: 2026-October-07 Security risk: Moderately critical 12 ∕ 25 AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:Default Vulnerability: Cross-Site Request Forgery Affected versions: <1.0.28 CVE IDs: CVE-2026-107262 Description: Advanced File System turns Drupal's file storage into a manageable, observable and maintainable subs
Fuente: Drupal.org · CVE-2026-107262
Project: Restrict route by IP Project machine name: restrict_route_by_ip Date: 2026-October-07 Security risk: Critical 17 ∕ 25 AC:None/A:None/CI:Some/II:Some/E:Theoretical/TD:Default Vulnerability: Access bypass Affected versions: <1.3.1 || >=2.0.0 <2.0.1 CVE IDs: CVE-2026-107255 Description: This module enables you to restrict access to routes by IP address. The module doesn't reliably restrict a
Fuente: Drupal.org · CVE-2026-107255
Project: Examples for Developers Project machine name: examples Date: 2026-October-07 Security risk: Less critical 8 ∕ 25 AC:Basic/A:User/CI:None/II:None/E:Theoretical/TD:All Vulnerability: Allocation of resources without limits or throttling Affected versions: <4.0.7 CVE IDs: CVE-2026-107312 Description: The Examples for Developers project aims to provide high-quality, well-documented API example
Fuente: Drupal.org · CVE-2026-107312
Project: Permissions by Term Project machine name: permissions_by_term Date: 2026-October-07 Security risk: Moderately critical 10 ∕ 25 AC:Complex/A:None/CI:Some/II:None/E:Theoretical/TD:Uncommon Vulnerability: Information disclosure Affected versions: <3.1.41 CVE IDs: CVE-2026-107311 Description: This module enables you to restrict view access to single nodes via taxonomy terms. The module doesn'
Fuente: Drupal.org · CVE-2026-107311
Project: Freelinking Project machine name: freelinking Date: 2026-October-07 Security risk: Moderately critical 10 ∕ 25 AC:Basic/A:User/CI:Some/II:None/E:Theoretical/TD:Default Vulnerability: Information Disclosure Affected versions: <4.0.3 CVE IDs: CVE-2026-107310 Description: This module enables you to configure a WIKI-like input filter that allows users to create links to site and external cont
Fuente: Drupal.org · CVE-2026-107310
Project: Easy Breadcrumb Project machine name: easy_breadcrumb Date: 2026-October-07 Security risk: Moderately critical 10 ∕ 25 AC:Complex/A:None/CI:Some/II:None/E:Theoretical/TD:Uncommon Vulnerability: Information disclosure Affected versions: <2.0.11 CVE IDs: CVE-2026-107309 Description: This module enables you to show a breadcrumb trail for taxonomy term hierarchies. The module doesn't sufficie
Fuente: Drupal.org · CVE-2026-107309
Project: Country Project machine name: country Date: 2026-October-07 Security risk: Moderately critical 10 ∕ 25 AC:Complex/A:Admin/CI:Some/II:Some/E:Theoretical/TD:Uncommon Vulnerability: Cross-site scripting Affected versions: <2.1.3 || >=2.2.0 <2.2.1 CVE IDs: CVE-2026-107308 Description: The module Country provides a dedicated field type for Drupal core's official country list. The module does n
Fuente: Drupal.org · CVE-2026-107308
Project: SmartLinker AI Project machine name: smartlinker_ai Date: 2026-October-07 Security risk: Moderately critical 11 ∕ 25 AC:Basic/A:User/CI:Some/II:None/E:Theoretical/TD:All Vulnerability: Information disclosure Affected versions: <1.0.3 CVE IDs: CVE-2026-107307 Description: This module adds a "Generate internal links" action to the AI CKEditor toolbar, letting editors select text and have th
Fuente: Drupal.org · CVE-2026-107307
Project: Menu Link Attributes Project machine name: menu_link_attributes Date: 2026-October-07 Security risk: Moderately critical 11 ∕ 25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:Uncommon Vulnerability: Cross-site scripting Affected versions: <1.8.0 CVE IDs: CVE-2026-107306 Description: This module enables you to add HTML attributes to menu links and their container elements ( <li> ). The
Fuente: Drupal.org · CVE-2026-107306
Project: DKAN Project machine name: dkan Date: 2026-October-07 Security risk: Moderately critical 11 ∕ 25 AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:Uncommon Vulnerability: Access bypass Affected versions: <4.0.4 || >=4.1.0 <4.1.5 CVE IDs: CVE-2026-107267 Description: The DKAN module enables organizations and individuals to build open data portals in Drupal. The DKAN datastore imports tabula
Fuente: Drupal.org · CVE-2026-107267
Project: Two Factor Authentication - TFA / Passwordless Login Project machine name: miniorange_2fa Date: 2026-October-07 Security risk: Moderately critical 12 ∕ 25 AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:Default Vulnerability: Information disclosure Affected versions: <5.4.1 || >=5.5.0 <5.5.2 CVE IDs: CVE-2026-107268 Description: This module enables you to add an extra layer of verificati
Fuente: Drupal.org · CVE-2026-107268
Project: Xray Audit Project machine name: xray_audit Date: 2026-October-07 Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:All Vulnerability: Access bypass Affected versions: <1.6.3 || >=2.0.0 <2.0.4 || >=3.0.0 <3.1.1 CVE IDs: CVE-2026-96389 Description: This module enables you to audit a Drupal site by generating reports about its content, entities, dis
Fuente: Drupal.org · CVE-2026-96389
Project: Views Share Project machine name: views_share Date: 2026-October-07 Security risk: Moderately critical 10 ∕ 25 AC:Basic/A:None/CI:None/II:None/E:Theoretical/TD:All Vulnerability: Access bypass Affected versions: <2.0.1 CVE IDs: CVE-2026-107266 Description: This module enables you to "share" a view display within another website via an iframe. The module doesn't sufficiently block access t
Fuente: Drupal.org · CVE-2026-107266
Project: Leaflet Project machine name: leaflet Date: 2026-October-07 Security risk: Moderately critical 14 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All Vulnerability: Cross site scripting Affected versions: <10.4.13 CVE IDs: CVE-2026-107265 Description: The Leaflet module provides integration with the Leaflet JS mapping library. Under certain circumstances, when the Leaflet field form
Fuente: Drupal.org · CVE-2026-107265
Project: Inline Formatter Field Project machine name: inline_formatter_field Date: 2026-October-07 Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default Vulnerability: Server-side template injection Affected versions: <4.2.0 CVE IDs: CVE-2026-107264 Description: The Inline Formatter Field module allows site builders to template and style entities with
Fuente: Drupal.org · CVE-2026-107264
Project: Gutenberg Project machine name: gutenberg Date: 2026-October-07 Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default Vulnerability: Access bypass Affected versions: <2.15.0 || >=3.0.0 <3.0.7 CVE IDs: CVE-2026-107263 Description: This module provides a new UI experience for node editing using the Gutenberg Editor library. The module does not s
Fuente: Drupal.org · CVE-2026-107263
Project: Authenticator Login Plus (2FA) Project machine name: auth_login_plus Date: 2026-October-07 Security risk: Moderately critical 13 ∕ 25 AC:Complex/A:User/CI:Some/II:Some/E:Theoretical/TD:All Vulnerability: Improper authentication Affected versions: <1.0.1 CVE IDs: CVE-2026-107261 Description: This module provides TOTP-based two-factor authentication (2FA) for Drupal, with an optional settin
Fuente: Drupal.org · CVE-2026-107261
Project: Linked Field Project machine name: linked_field Date: 2026-October-07 Security risk: Moderately critical 14 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All Vulnerability: Server-side template injection Affected versions: <1.8.0 CVE IDs: CVE-2026-107259 Description: This module enables you to link the output of a field to a URL or to the value of another field. The module doesn't
Fuente: Drupal.org · CVE-2026-107259
Project: Inline Entity Form Dialog Project machine name: inline_entity_form_dialog Date: 2026-October-07 Security risk: Moderately critical 14 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All Vulnerability: Access bypass Affected versions: <1.0.6 CVE IDs: CVE-2026-107258 Description: This module renders entity add/edit forms inside an AJAX dialog for use with entity reference fields. This
Fuente: Drupal.org · CVE-2026-107258
Project: Actstream Project machine name: actstream Date: 2026-October-07 Security risk: Critical 16 ∕ 25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:All Vulnerability: Access bypass Affected versions: <2.0.1 || >=2.1.0 <2.1.1 CVE IDs: CVE-2026-107257 Description: Actstream (short for Activity Stream) aggregates a user's activity from external services (RSS feeds, etc.) into per-user activity
Fuente: Drupal.org · CVE-2026-107257
Project: Authenticator Login Plus (2FA) Project machine name: auth_login_plus Date: 2026-October-07 Security risk: Critical 15 ∕ 25 AC:Complex/A:None/CI:Some/II:Some/E:Theoretical/TD:All Vulnerability: Improper authentication Affected versions: <1.0.1 CVE IDs: CVE-2026-107254 Description: This module provides TOTP-based two-factor authentication (2FA) for Drupal. The module doesn't enforce the sec
Fuente: Drupal.org · CVE-2026-107254
Project: Orphans Media Project machine name: orphans_media Date: 2026-October-07 Security risk: Critical 16 ∕ 25 AC:Complex/A:Admin/CI:All/II:All/E:Theoretical/TD:All Vulnerability: Unsupported Affected versions: * CVE IDs: CVE-2026-107253 Description: The Drupal Security Team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maint
Fuente: Drupal.org · CVE-2026-107253
Project: MathJax: LaTeX for Drupal Project machine name: mathjax Date: 2026-October-07 Security risk: Critical 15 ∕ 25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:Default Vulnerability: Cross site scripting Affected versions: <4.1.2 CVE IDs: CVE-2026-107252 Description: This module integrates the MathJax library into your Drupal site. MathJax is the modern JavaScript-based LaTeX rendering sol
Fuente: Drupal.org · CVE-2026-107252
Project: Entity Reference Manager (Merge entities) Project machine name: entity_reference_manager Date: 2026-October-07 Security risk: Critical 16 ∕ 25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:All Vulnerability: Access bypass Affected versions: <1.0.3 CVE IDs: CVE-2026-107251 Description: Entity Reference Manager is an advanced administrative module for Drupal that allows site administrato
Fuente: Drupal.org · CVE-2026-107251
Project: ECA Helper Project machine name: eca_helper Date: 2026-October-07 Security risk: Critical 16 ∕ 25 AC:Complex/A:Admin/CI:All/II:All/E:Theoretical/TD:All Vulnerability: Unsupported Affected versions: * CVE IDs: CVE-2026-107250 Description: The Drupal Security Team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer.
Fuente: Drupal.org · CVE-2026-107250
Project: Block AJAX Project machine name: block_ajax Date: 2026-October-07 Security risk: Highly critical 20 ∕ 25 AC:Basic/A:None/CI:All/II:All/E:Theoretical/TD:All Vulnerability: PHP object injection Affected versions: <3.0.2 CVE IDs: CVE-2026-107249 Description: The Block AJAX module enables you to load blocks asynchronously via Ajax. The module doesn't sufficiently validate user-supplied data w
Fuente: Drupal.org · CVE-2026-107249
It was discovered that an invalid memory write in the LZMA1 decoders of xz-utils, the XZ-format compression utilities, could result in denial of service or potentially the execution of arbitrary code. https://security-tracker.debian.org/tracker/DSA-6549-1
Fuente: Debian Security
Multiple vulnerabilities were discovered in roundcube, a skinnable AJAX based webmail solution for IMAP servers, which could result in cross-site scripting, SRF bypass, email header injection, css property injection, remote content blocking bypass, information disclosure or privilege escalation. https://security-tracker.debian.org/tracker/DSA-6545-1
Fuente: Debian Security
Two vulnerabilities were discovered in node-shell-quote, a Node.js module to quote and parse shell commands, which could result in denial of service or shell command injection. https://security-tracker.debian.org/tracker/DSA-6548-1
Fuente: Debian Security
It was discovered that ruby-jwt, a JSON Web Token implementation in Ruby, insufficiently validated the HMAC of some tokens. https://security-tracker.debian.org/tracker/DSA-6547-1
Fuente: Debian Security
Multiple security issues were discovered in the Rails web framework which could result in cross-site scripting, denial of service, path traversal or the execution of arbitrary code. https://security-tracker.debian.org/tracker/DSA-6546-1
Fuente: Debian Security
Multiple security vulnerabilities were discocered in the web UI of the SABnzbd+ binary news reader/grabber, which could result in the execution of arbitrary code or authorisation bypass. https://security-tracker.debian.org/tracker/DSA-6544-1
Fuente: Debian Security
Multiple security vulnerabilities were discovered in LibreOffice, which could result in denial of service, information disclosure or the execution of arbitrary code if malformed document files are opened. https://security-tracker.debian.org/tracker/DSA-6543-1
Fuente: Debian Security
It was discovered that incorrect error handling in ruby-rack-session may result in authentication bypass or privilege escalation in some setups. https://security-tracker.debian.org/tracker/DSA-6542-1
Fuente: Debian Security
Multiple vulnerabilities have been discocvered in Wireshark, a network protocol analyzer which could result in denial of service or the execution of arbitrary code. https://security-tracker.debian.org/tracker/DSA-6541-1
Fuente: Debian Security
Multiple vulnerabilities were discovered in Redis, a persistent key-value database, which could result in denial of service or the execution of arbitrary code. This update also includes fixes for several related issues that have not been assigned CVE identifiers: ACL key permission checks for SORT, GEORADIUS, GEORADIUSBYMEMBER, XREAD and XREADGROUP could be bypassed; an out-of-bounds read during A
Fuente: Debian Security
It was discovered that incomplete validation of MS-PPPE packets in radsecproxy, a Radius protocol proxy, could result in denial of service or potentially the execution of arbitrary code. https://security-tracker.debian.org/tracker/DSA-6540-1
Fuente: Debian Security
Multiple security vulnerabilities have been discovered in the MongoDB driver for PHP, which could result in information disclosure, PHP objection injection or denial of service. https://security-tracker.debian.org/tracker/DSA-6539-1
Fuente: Debian Security
The webkit2gtk update released as DSA-6534-1 introduced two regressions that cause programs such as evolution or the Eclipse IDE to crash on startup in some cases. https://security-tracker.debian.org/tracker/DSA-6534-2
Fuente: Debian Security
A use-after-free was discovered in libpng, a library implementing an interface for reading and writing PNG (Portable Network Graphics), which could result in denial of service. https://security-tracker.debian.org/tracker/DSA-6537-1
Fuente: Debian Security
Multiple security issues were discovered in Thunderbird, which could result in the execution of arbitrary code. https://security-tracker.debian.org/tracker/DSA-6536-1
Fuente: Debian Security
Security issues were discovered in Chromium which could result in the execution of arbitrary code, denial of service, or information disclosure. https://security-tracker.debian.org/tracker/DSA-6535-1
Fuente: Debian Security
Several vulnerabilities have been discovered in the WebKitGTK web engine, that may lead to heap corruption, local privilege escalation, remote code execution, out-of-bounds memory access, cross-origin data leak and sandbox escape, among other problems. See the WebKitGTK security advisory for details on each vulnerability: https://webkitgtk.org/security/WSA-2026-0006.html https://security-tracker.d
Fuente: Debian Security
Multiple vulnerabilities have been discovered in OpenSSL, a Secure Sockets Layer toolkit, which could result in denial of service, information disclosure or potentially recovery of private keys. Additional details can be found in the upstream advisories: https://openssl-library.org/news/secadv/20260929.txt https://security-tracker.debian.org/tracker/DSA-6531-1
Fuente: Debian Security
Multiple security issues have been found in the Mozilla Firefox web browser, which could potentially result in the execution of arbitrary code, sandbox escape, information disclosure or privilege escalation. Debian follows the extended support releases (ESR) of Firefox. Starting with this update we're now following the 153.x releases. Between 140.x and 153.x, Firefox has seen a number of feature u
Fuente: Debian Security
Multiple security vulnerabilities were discovered in Tor, a connection- based low-latency anonymous communication system, would could result in denial of service. https://security-tracker.debian.org/tracker/DSA-6532-1
Fuente: Debian Security
Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks. https://security-tracker.debian.org/tracker/DSA-6528-1
Fuente: Debian Security
Michael Allen discovered an out-of-bounds write vulnerability in PCRE2, a library of functions to support Perl compatible regular expressions, which could result in denial of service or potentially the execution of arbitrary code. https://security-tracker.debian.org/tracker/DSA-6530-1
Fuente: Debian Security
It was discovered that missing input validation in the hpack path header parser of libwebsockets could result in denial of service or potentially the execution of arbitrary code. https://security-tracker.debian.org/tracker/DSA-6529-1
Fuente: Debian Security
Multiple security issues were discovered in libheif, an ISO/IEC 23008-12 HEIF and AVIF image file format decoder and encoder, which may result in denial of service, the disclosure of sensitive memory contents or, potentially, the execution of arbitrary code if a malformed image file is processed. Besides the CVEs listed above, this update also fixes a number of issues tracked upstream as GHSA-x8r2
Fuente: Debian Security
Multiple vulnerabilities have been discovered in the Dovecot IMAP server which could result in denial of service, SMTP smuggling, information disclosure, code injection via malformed Sieve scripts or bypass of ACL restrictions. https://security-tracker.debian.org/tracker/DSA-6526-1
Fuente: Debian Security
Several vulnerabilities were discovered in wordpress, a web blogging tool, which could result in cross-site scripting, privilege escalation or remote code execution. https://security-tracker.debian.org/tracker/DSA-6525-1
Fuente: Debian Security
Multiple security vulnerabilities were discovered in Flatpak, an application deployment framework for desktop apps, which could result in denial service via malicious applications or information disclosure. https://security-tracker.debian.org/tracker/DSA-6524-1
Fuente: Debian Security
Several vulnerabilities were discovered in rsync, a fast, versatile, remote (and local) file-copying tool, which could result in local privilege escalation, bypass of intended access restrictions, information disclosure, denial of service or the execution of arbitrary code. Details can be found at https://download.samba.org/pub/rsync/NEWS#3.5.0 https://security-tracker.debian.org/tracker/DSA-6527-
Fuente: Debian Security
Multiple security vulnerabilities were discovered in Oj, a fast JSON parser and serializer for Ruby, which could result in denial of service or memory disclosure. https://security-tracker.debian.org/tracker/DSA-6521-1
Fuente: Debian Security
Multiple security vulnerabilities were discovered in the Lemonldap::NG web SSO system, which could result in a bypass of access controls, authorisation bypass in setups using PKCE or information disclosure. https://security-tracker.debian.org/tracker/DSA-6520-1
Fuente: Debian Security
Several vulnerabilities were discovered in the Exim mail transport agent, which could result in SMTP smuggling, information disclosure, denial of service or the execution of arbitrary code. https://security-tracker.debian.org/tracker/DSA-6522-1
Fuente: Debian Security
Multiple vulnerabilities were discovered in Node.js, which could result in denial of service, permission model bypass, incorrect certificate validation or information disclosure. https://security-tracker.debian.org/tracker/DSA-6517-1
Fuente: Debian Security
A vulnerability was discovered in the Swift tempurl middleware, which could result in information disclosure. https://security-tracker.debian.org/tracker/DSA-6519-1
Fuente: Debian Security
Multiple security issues were discovered in Incus, a system container and virtual machine manager, which could result in a bypass of security/authorisation restrictions, guest to host privilege escalation or information disclosure. https://security-tracker.debian.org/tracker/DSA-6518-1
Fuente: Debian Security
The update for jq released as DSA-6416-1 introduced a regression in the loading of modules. The fix for CVE-2026-44777 registered each library before its own dependencies, so a module reached only through another module (a transitive import or include) was discarded as unreferenced and jq aborted with an assertion failure at compile time. https://security-tracker.debian.org/tracker/DSA-6416-2
Fuente: Debian Security · CVE-2026-44777
Multiple security issues were found in PHP, a widely-used open source general purpose scripting language which could result in denial of service, information disclosure, incorrect validation of TLS certificates or bypass of access control restrictions, https://security-tracker.debian.org/tracker/DSA-6514-1
Fuente: Debian Security
Security issues were discovered in Chromium which could result in the execution of arbitrary code, denial of service, or information disclosure. https://security-tracker.debian.org/tracker/DSA-6513-1
Fuente: Debian Security
Multiple security issues were discovered in Ghostscript, the GPL PostScript/PDF interpreter, which could result in denial of service and potentially the execution of arbitrary code if malformed document files are processed. https://security-tracker.debian.org/tracker/DSA-6516-1
Fuente: Debian Security
Multiple vulnerabilities were discovered in the VLC media player, which could result in the execution of arbitrary code or denial of service if a malformed media file is opened. https://security-tracker.debian.org/tracker/DSA-6515-1
Fuente: Debian Security
Multiple security vulnerabilities were discovered in LibreOffice, which could result in denial of service, information disclosure or potentially the execution of arbitrary code if malformed document files are opened. https://security-tracker.debian.org/tracker/DSA-6512-1
Fuente: Debian Security
Project: Diba carousel slider Project machine name: diba_carousel Date: 2026-September-23 Security risk: Moderately critical 12 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Uncommon Vulnerability: Cross Site Scripting (XSS) Affected versions: <3.0.2 CVE IDs: CVE-2026-96382 Description: The Diba Carousel Slider adds a Bootstrap carousel slider block that can be used directly without creati
Fuente: Drupal.org · CVE-2026-96382
Project: Smart Content Project machine name: smart_content Date: 2026-September-23 Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:All Vulnerability: Access bypass Affected versions: <3.2.1 CVE IDs: CVE-2026-96386 Description: This module enables you to personalize content for anonymous and authenticated users by showing different blocks to visitors base
Fuente: Drupal.org · CVE-2026-96386
Project: CSS Usage Analyzer Project machine name: css_usage_analyzer Date: 2026-September-23 Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:All Vulnerability: Improper access control Affected versions: >=1.0.0 <1.0.2 CVE IDs: CVE-2026-96380 Description: This module lets a frontend scanner post CSS-usage measurements to the site so admin reports can show
Fuente: Drupal.org · CVE-2026-96380
Project: Combined image style Project machine name: combined_image_style Date: 2026-September-23 Security risk: Moderately critical 10 ∕ 25 AC:Basic/A:None/CI:None/II:None/E:Theoretical/TD:All Vulnerability: Improper access control Affected versions: <1.0.7 CVE IDs: CVE-2026-96377 Description: This module enables you to combine multiple image styles into a single image derivative. The module does
Fuente: Drupal.org · CVE-2026-96377
Project: AI CKEditor Project machine name: ai_ckeditor Date: 2026-September-23 Security risk: Moderately critical 10 ∕ 25 AC:Basic/A:User/CI:Some/II:None/E:Theoretical/TD:Default Vulnerability: Code execution via Twig templates Affected versions: <1.4.3 CVE IDs: CVE-2026-96392 Description: This module enables you to use AI to fill in or replace text in CKEditor. The module doesn't sufficiently mit
Fuente: Drupal.org · CVE-2026-96392
Project: Webform REST Project machine name: webform_rest Date: 2026-September-23 Security risk: Less critical 9 ∕ 25 AC:Basic/A:User/CI:Some/II:None/E:Theoretical/TD:Uncommon Vulnerability: Access bypass Affected versions: <4.2.1 CVE IDs: CVE-2026-96391 Description: This module enables you to retrieve and submit webforms via REST. The module doesn't sufficiently check permission to webform and web
Fuente: Drupal.org · CVE-2026-96391
Project: Editoria11y Accessibility Checker Project machine name: editoria11y Date: 2026-September-23 Security risk: Moderately critical 11 ∕ 25 AC:Basic/A:User/CI:None/II:Some/E:Theoretical/TD:All Vulnerability: Access bypass Affected versions: <2.2.23 || >=3.0.0 <3.0.9 CVE IDs: CVE-2026-96390 Description: This module runs a client-side accessibility checker that automatically reports results to d
Fuente: Drupal.org · CVE-2026-96390
Project: Tawk.to - Live chat application Project machine name: tawk_to Date: 2026-September-23 Security risk: Critical 16 ∕ 25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:All Vulnerability: Cross Site Request Forgery Affected versions: <3.0.4 CVE IDs: CVE-2026-96388 Description: This module provides integration of the tawk.to live chat for Drupal sites. The module does not sufficiently valida
Fuente: Drupal.org · CVE-2026-96388
Project: Stop administrator login Project machine name: stop_admin Date: 2026-September-23 Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:All Vulnerability: Access bypass Affected versions: >=1.0 <1.6 CVE IDs: CVE-2026-96387 Description: This module enables sites to block access for the administrative user account (user 1) or users with the administrat
Fuente: Drupal.org · CVE-2026-96387
Project: REST & JSON API Authentication for Drupal Project machine name: rest_api_authentication Date: 2026-September-23 Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:All Vulnerability: Access bypass Affected versions: <3.2.0 CVE IDs: CVE-2026-96385 Description: This module enables you to add an extra authentication layer to the API. The module does no
Fuente: Drupal.org · CVE-2026-96385
Project: CookieCuttr Project machine name: cookiecuttr Date: 2026-September-23 Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:All Vulnerability: Cross-site scripting Affected versions: >=2.0.0 <2.0.3 CVE IDs: CVE-2026-96379 Description: This module enables you to provide information and options about cookie usage. The module does not sufficiently filte
Fuente: Drupal.org · CVE-2026-96379
Project: Mermaid Diagram Field Project machine name: mermaid_diagram_field Date: 2026-September-23 Security risk: Moderately critical 13 ∕ 25 AC:None/A:User/CI:Some/II:None/E:Theoretical/TD:All Vulnerability: Access bypass Affected versions: >=1.0.4 <1.0.9 CVE IDs: CVE-2026-96384 Description: This module enables you to add mermaid diagram that displays either inline on an entity or optionally in a
Fuente: Drupal.org · CVE-2026-96384
Project: Commerce Decoupled Checkout Project machine name: commerce_decoupled_checkout Date: 2026-September-23 Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:All Vulnerability: Access bypass Affected versions: >=1.0.0 <1.8.0 CVE IDs: CVE-2026-96378 Description: This module enables REST endpoints for a decoupled Commerce experience which allow for remote
Fuente: Drupal.org · CVE-2026-96378
Project: Project Browser Project machine name: project_browser Date: 2026-September-23 Security risk: Critical 15 ∕ 25 AC:Complex/A:None/CI:Some/II:Some/E:Theoretical/TD:All Vulnerability: Cross-site request forgery Affected versions: <2.0.3 || >=2.1.0 <2.1.5 CVE IDs: CVE-2026-96374 Description: The Project Browser module enables you to apply recipes and enable modules from the web user interface.
Fuente: Drupal.org · CVE-2026-96374
Project: Cloud Project machine name: cloud Date: 2026-September-23 Security risk: Critical 15 ∕ 25 AC:Basic/A:Admin/CI:All/II:All/E:Theoretical/TD:Uncommon Vulnerability: Remote code execution Affected versions: <7.0.1 CVE IDs: CVE-2026-96376 Description: The Cloud module enables users to manage cloud resources through Drupal. The module does not sufficiently sanitize user-controlled Git branch an
Fuente: Drupal.org · CVE-2026-96376
Project: Cloud Project machine name: cloud Date: 2026-September-23 Security risk: Critical 15 ∕ 25 AC:Complex/A:None/CI:Some/II:Some/E:Theoretical/TD:All Vulnerability: Remote code execution Affected versions: <7.0.1 CVE IDs: CVE-2026-96375 Description: The Cloud module enables users to manage cloud infrastructure through Drupal. The Kubernetes and VMware integrations do not properly validate TLS
Fuente: Drupal.org · CVE-2026-96375
Project: Webform Project machine name: webform Date: 2026-September-23 Security risk: Critical 18 ∕ 25 AC:Basic/A:None/CI:All/II:All/E:Theoretical/TD:Uncommon Vulnerability: Remote Code Execution Affected versions: <6.2.12 || >=6.3.0 <6.3.1 CVE IDs: CVE-2026-96355 Description: The Webform module allows site builders to create forms, collect submissions, and render submitted values in configurable
Fuente: Drupal.org · CVE-2026-96355
Project: Webform Project machine name: webform Date: 2026-September-23 Security risk: Moderately critical 11 ∕ 25 AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:Uncommon Vulnerability: Access bypass Affected versions: <6.2.12 || >=6.3.0 <6.3.1 CVE IDs: CVE-2026-96356 Description: The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submi
Fuente: Drupal.org · CVE-2026-96356
Project: Webform Project machine name: webform Date: 2026-September-23 Security risk: Less critical 9 ∕ 25 AC:Basic/A:User/CI:Some/II:None/E:Theoretical/TD:Uncommon Vulnerability: Access bypass Affected versions: <6.2.12 || >=6.3.0 <6.3.1 CVE IDs: CVE-2026-96398 Description: The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission d
Fuente: Drupal.org · CVE-2026-96398
Project: Webform Project machine name: webform Date: 2026-September-23 Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default Vulnerability: Cross-site scripting Affected versions: <6.2.12 || >=6.3.0 <6.3.1 CVE IDs: CVE-2026-96357 Description: The Webform module allows site builders to create forms, collect submissions, and configure access to forms and
Fuente: Drupal.org · CVE-2026-96357
Project: Webform Project machine name: webform Date: 2026-September-23 Security risk: Moderately critical 14 ∕ 25 AC:Basic/A:None/CI:None/II:Some/E:Exploit/TD:Uncommon Vulnerability: Access bypass Affected versions: <6.2.12 || >=6.3.0 <6.3.1 CVE IDs: CVE-2026-96364 Description: The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submissio
Fuente: Drupal.org · CVE-2026-96364
Project: Webform Project machine name: webform Date: 2026-September-23 Security risk: Less critical 8 ∕ 25 AC:Basic/A:None/CI:None/II:None/E:Theoretical/TD:Uncommon Vulnerability: Denial of service Affected versions: <6.2.12 || >=6.3.0 <6.3.1 CVE IDs: CVE-2026-96365 Description: The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submissi
Fuente: Drupal.org · CVE-2026-96365
Project: Webform Project machine name: webform Date: 2026-September-23 Security risk: Moderately critical 12 ∕ 25 AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:Default Vulnerability: Access bypass Affected versions: <6.2.12 || >=6.3.0 <6.3.1 CVE IDs: CVE-2026-96366 Description: The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submis
Fuente: Drupal.org · CVE-2026-96366
Project: Webform Project machine name: webform Date: 2026-September-23 Security risk: Moderately critical 11 ∕ 25 AC:Complex/A:Admin/CI:Some/II:Some/E:Theoretical/TD:Default Vulnerability: Access bypass Affected versions: <6.2.12 || >=6.3.0 <6.3.1 CVE IDs: CVE-2026-96373 Description: The Webform module allows site builders to create forms, collect submissions, and configure access to forms and sub
Fuente: Drupal.org · CVE-2026-96373
Project: Webform Project machine name: webform Date: 2026-September-23 Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default Vulnerability: Access bypass Affected versions: <6.2.12 || >=6.3.0 <6.3.1 CVE IDs: CVE-2026-96372 Description: The Webform module enables site builders to create forms and collect submissions. The module does not sufficiently res
Fuente: Drupal.org · CVE-2026-96372
Project: Webform Project machine name: webform Date: 2026-September-23 Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default Vulnerability: Cross-site scripting Affected versions: <6.2.12 || >=6.3.0 <6.3.1 CVE IDs: CVE-2026-96371 Description: The Webform module allows site builders to create forms, collect submissions, and configure access to forms and
Fuente: Drupal.org · CVE-2026-96371
Project: Webform Project machine name: webform Date: 2026-September-23 Security risk: Less critical 8 ∕ 25 AC:Complex/A:User/CI:Some/II:None/E:Theoretical/TD:Uncommon Vulnerability: Access bypass Affected versions: <6.2.12 || >=6.3.0 <6.3.1 CVE IDs: CVE-2026-96369 Description: The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission
Fuente: Drupal.org · CVE-2026-96369
Project: Webform Project machine name: webform Date: 2026-September-23 Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default Vulnerability: Access bypass, Server-side request forgery Affected versions: <6.2.12 || >=6.3.0 <6.3.1 CVE IDs: CVE-2026-96370 Description: The Webform module allows site builders to create forms, collect submissions, and configu
Fuente: Drupal.org · CVE-2026-96370
Project: Webform Project machine name: webform Date: 2026-September-23 Security risk: Moderately critical 12 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Uncommon Vulnerability: Cross-site scripting Affected versions: <6.2.12 || >=6.3.0 <6.3.1 CVE IDs: CVE-2026-96368 Description: The Webform module allows site builders to create forms, collect submissions, and configure access to forms an
Fuente: Drupal.org · CVE-2026-96368
Project: Webform Project machine name: webform Date: 2026-September-23 Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Proof/TD:Uncommon Vulnerability: Cross-site scripting Affected versions: <6.2.12 || >=6.3.0 <6.3.1 CVE IDs: CVE-2026-96367 Description: The Webform module allows site builders to create forms, collect submissions, and configure access to forms and subm
Fuente: Drupal.org · CVE-2026-96367
Project: Webform Project machine name: webform Date: 2026-September-23 Security risk: Moderately critical 10 ∕ 25 AC:Complex/A:Admin/CI:Some/II:Some/E:Theoretical/TD:Uncommon Vulnerability: Cross-site scripting Affected versions: <6.2.12 || >=6.3.0 <6.3.1 CVE IDs: CVE-2026-96363 Description: The Webform module allows site builders to create forms, collect submissions, and configure access to forms
Fuente: Drupal.org · CVE-2026-96363
Project: Webform Project machine name: webform Date: 2026-September-23 Security risk: Moderately critical 13 ∕ 25 AC:Complex/A:None/CI:Some/II:Some/E:Theoretical/TD:Uncommon Vulnerability: Cross-site scripting Affected versions: <6.2.12 || >=6.3.0 <6.3.1 CVE IDs: CVE-2026-96362 Description: The Webform module allows site builders to create forms, collect submissions, and configure access to forms
Fuente: Drupal.org · CVE-2026-96362
Project: Webform Project machine name: webform Date: 2026-September-23 Security risk: Moderately critical 12 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Uncommon Vulnerability: Cross-site scripting Affected versions: <6.2.12 || >=6.3.0 <6.3.1 CVE IDs: CVE-2026-96359 Description: The Webform module allows site builders to create forms, collect submissions, and configure access to forms an
Fuente: Drupal.org · CVE-2026-96359
Project: Webform Project machine name: webform Date: 2026-September-23 Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default Vulnerability: Cross-site scripting Affected versions: <6.2.12 || >=6.3.0 <6.3.1 CVE IDs: CVE-2026-96358 Description: The Webform module allows site builders to create forms, collect submissions, and configure access to forms and
Fuente: Drupal.org · CVE-2026-96358
Project: Webform Project machine name: webform Date: 2026-September-23 Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default Vulnerability: Cross-site scripting Affected versions: <6.2.12 || >=6.3.0 <6.3.1 CVE IDs: CVE-2026-96358 Description: The Webform module allows site builders to create forms, collect submissions, and configure access to forms and
Fuente: Drupal.org · CVE-2026-96358
Project: Webform Project machine name: webform Date: 2026-September-23 Security risk: Moderately critical 12 ∕ 25 AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:Default Vulnerability: Access bypass Affected versions: <6.2.12 || >=6.3.0 <6.3.1 CVE IDs: CVE-2026-96366 Description: The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submis
Fuente: Drupal.org · CVE-2026-96366
Project: Webform Project machine name: webform Date: 2026-September-23 Security risk: Less critical 8 ∕ 25 AC:Basic/A:None/CI:None/II:None/E:Theoretical/TD:Uncommon Vulnerability: Denial of service Affected versions: <6.2.12 || >=6.3.0 <6.3.1 CVE IDs: CVE-2026-96365 Description: The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submissi
Fuente: Drupal.org · CVE-2026-96365
Project: Webform Project machine name: webform Date: 2026-September-23 Security risk: Moderately critical 12 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Uncommon Vulnerability: Cross-site scripting Affected versions: <6.2.12 || >=6.3.0 <6.3.1 CVE IDs: CVE-2026-96361 Description: The Webform module allows site builders to create forms, collect submissions, and configure access to forms an
Fuente: Drupal.org · CVE-2026-96361
Project: Webform Project machine name: webform Date: 2026-September-23 Security risk: Moderately critical 12 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Uncommon Vulnerability: Cross-site scripting Affected versions: <6.2.12 || >=6.3.0 <6.3.1 CVE IDs: CVE-2026-96361 Description: The Webform module allows site builders to create forms, collect submissions, and configure access to forms an
Fuente: Drupal.org · CVE-2026-96361
Project: Webform Project machine name: webform Date: 2026-September-23 Security risk: Moderately critical 11 ∕ 25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:Uncommon Vulnerability: Cross-site scripting Affected versions: <6.2.12 || >=6.3.0 <6.3.1 CVE IDs: CVE-2026-96360 Description: The Webform module allows site builders to create forms, collect submissions, and configure access to forms a
Fuente: Drupal.org · CVE-2026-96360
Project: Webform Project machine name: webform Date: 2026-September-23 Security risk: Moderately critical 11 ∕ 25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:Uncommon Vulnerability: Cross-site scripting Affected versions: <6.2.12 || >=6.3.0 <6.3.1 CVE IDs: CVE-2026-96360 Description: The Webform module allows site builders to create forms, collect submissions, and configure access to forms a
Fuente: Drupal.org · CVE-2026-96360
Project: Webform Project machine name: webform Date: 2026-September-23 Security risk: Moderately critical 14 ∕ 25 AC:Basic/A:None/CI:None/II:Some/E:Exploit/TD:Uncommon Vulnerability: Access bypass Affected versions: <6.2.12 || >=6.3.0 <6.3.1 CVE IDs: CVE-2026-96364 Description: The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submissio
Fuente: Drupal.org · CVE-2026-96364
Project: Webform Project machine name: webform Date: 2026-September-23 Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default Vulnerability: Cross-site scripting Affected versions: <6.2.12 || >=6.3.0 <6.3.1 CVE IDs: CVE-2026-96357 Description: The Webform module allows site builders to create forms, collect submissions, and configure access to forms and
Fuente: Drupal.org · CVE-2026-96357
Project: Webform Project machine name: webform Date: 2026-September-23 Security risk: Moderately critical 11 ∕ 25 AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:Uncommon Vulnerability: Access bypass Affected versions: <6.2.12 || >=6.3.0 <6.3.1 CVE IDs: CVE-2026-96356 Description: The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submi
Fuente: Drupal.org · CVE-2026-96356
It was discovered that an incorrect implementation of message filtering in xdg-dbus-proxy allows an attacker to bypass the intended message filtering on the D-Bus session bus by setting a reply serial number on non-reply messages. A malicious or compromised Flatpak app could achieve arbitrary code execution outside its sandbox. If other app frameworks rely on xdg-dbus-proxy in the same way that Fl
Fuente: Debian Security
Two security vulnerabilities were discovered in the ZNC IRC bouncer, which could result in denial of service. https://security-tracker.debian.org/tracker/DSA-6511-1
Fuente: Debian Security
Date: 2026-September-21 Description: Updated 2026-09-22, 12:00 UTC, to document that the advisories in the release might be possible for more common configurations, and that other projects may have advisories. Updated 2026-09-21, 19:00 UTC, to document that this is not covered by Drupal Steward. There will be a security release for a widely used contributed module on September 23, 2026 between 17:
Fuente: Drupal.org
Several vulnerabilities were discovered in GIMP, the GNU Image Manipulation Program, which could result in denial of service or potentially the execution of arbitrary code if malformed PSD, light effects filter, ICO, PIX or PCX files are opened. https://security-tracker.debian.org/tracker/DSA-6509-1
Fuente: Debian Security
Multiple security vulnerabilities were discovered in Unbound, a validating, recursive, caching DNS resolver, which could result in denial of service, cache poisoning, DNS cookie bypass or potentially the execution of arbitrary code. https://security-tracker.debian.org/tracker/DSA-6507-1
Fuente: Debian Security
Security issues were discovered in Chromium which could result in the execution of arbitrary code, denial of service, or information disclosure. https://security-tracker.debian.org/tracker/DSA-6508-1
Fuente: Debian Security
Several vulnerabilities were discovered in BIND, a DNS server implementation, which may result in denial of service or cache poisoning. https://security-tracker.debian.org/tracker/DSA-6505-1
Fuente: Debian Security
It was discovered that incorrect state cookie parsing in mod_auth_openidc, an OpenID Certified authentication and authorisation module for the Apache HTTP server that implements the OpenID Connect Relying Party functionality, could result in denial of service. https://security-tracker.debian.org/tracker/DSA-6504-1
Fuente: Debian Security
Security issues were discovered in Chromium which could result in the execution of arbitrary code, denial of service, or information disclosure. https://security-tracker.debian.org/tracker/DSA-6506-1
Fuente: Debian Security
Project: Drupal core Project machine name: drupal Date: 2026-September-16 Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default Vulnerability: Third-party libraries Affected versions: >=10.5.0 <10.6.17 || >=11.0.0 <11.3.17 || >=11.4.0 <11.4.7 Description: The Drupal project uses the CKEditor library for WYSIWYG editing. CKEditor has released a security
Fuente: Drupal.org
Brevo (aka Sendinblue) lists eBay, Louis Vuitton, Michelin and Amnesty International as its clients. It disclosed (copy) a security incident on 10 September, claiming that 6 customer accounts were ...
Fuente: Sansec
The update for nginx released as DSA 6496-1 caused a regression in the nginx-dev package: the backported fix for CVE-2026-42533 declared two private header files, which are not shipped in nginx-dev, as dependencies of the module build, so third-party nginx modules could no longer be built against nginx-dev. Updated nginx packages are now available to correct this issue. https://security-tracker.de
Fuente: Debian Security · CVE-2026-42533
Multiple security issues were discovered in Thunderbird, which could result in the execution of arbitrary code. https://security-tracker.debian.org/tracker/DSA-6503-1
Fuente: Debian Security
A buffer overflow was found in the ODML parser of MKVToolNix, a set of command-line tools (and GUI) to work with Matroska files, which could potentially result in the execution of arbitrary code when processing malformed .mkv files. https://security-tracker.debian.org/tracker/DSA-6502-1
Fuente: Debian Security
Multiple security issues have been found in the Mozilla Firefox web browser, which could potentially result in the execution of arbitrary code, information disclosure or privilege escalation. https://security-tracker.debian.org/tracker/DSA-6501-1
Fuente: Debian Security
Multiple security vulnerabilities were discovered in Tor, a connection- based low-latency anonymous communication system, would could result in denial of service. https://security-tracker.debian.org/tracker/DSA-6500-1
Fuente: Debian Security
Two vulnerabilities were discovered in cjose, a C library implementing the JOSE standard, which could result in denial of service, execution of arbitrary code or plain text recovery in specific setups. https://security-tracker.debian.org/tracker/DSA-6499-1
Fuente: Debian Security
Andres Berbescu discovered two vulnerabilities in the L2TP connection plugin for Network Manager which allowed a local user with permissions to create/activate personal VPN connections to escalate their privileges to root. https://security-tracker.debian.org/tracker/DSA-6498-1
Fuente: Debian Security
Several vulnerabilities were discovered in the Xorg X server, which may result in privilege escalation if the X server is running privileged. https://security-tracker.debian.org/tracker/DSA-6497-1
Fuente: Debian Security
Multiple vulnerabilities were discovered in nginx, a high-performance web and reverse proxy server, which may result in denial of service, memory disclosure or potentially the execution of arbitrary code. CVE-2026-42533 A heap buffer overflow was discovered in the nginx script engine. It can be triggered when a map directive performs regular expression matching and a string expression references c
Fuente: Debian Security · CVE-2026-42533
Several vulnerabilities were discovered in SPIP, a website engine for publishing, which could result in unauthenticated remote code execution. https://security-tracker.debian.org/tracker/DSA-6495-1
Fuente: Debian Security
Multiple security vulnerabilities were discovered in the Kamailio SIP server, which could result in denial of service. https://security-tracker.debian.org/tracker/DSA-6494-1
Fuente: Debian Security
Several vulnerabilities were discovered in libevent, an asynchronous event notification library. The HTTP implementation (evhttp) handled Transfer-Encoding and Content-Length headers, chunked-encoding line terminators, header line folding and chunked trailers too permissively, which could allow HTTP request smuggling, header injection or access control bypass when a libevent-based server or client
Fuente: Debian Security
Multiple security issues were found in Rack, an interface for developing web applications in Ruby, which could result in denial of service, information disclosure, spoofing or bypass of access restrictions. https://security-tracker.debian.org/tracker/DSA-6492-1
Fuente: Debian Security
Project: Ultimate Table Field Project machine name: ultimate_table_field Date: 2026-September-09 Security risk: Critical 15 ∕ 25 AC:None/A:None/CI:None/II:Some/E:Theoretical/TD:All Vulnerability: Access bypass Affected versions: <1.1.1 || >=2.0.0 <2.0.1 CVE IDs: CVE-2026-87955 Description: The Ultimate Table Field module enables you to store table data in a field and edit each table cell through a
Fuente: Drupal.org · CVE-2026-87955
Project: Taxonomy Term Glossary Project machine name: term_glossary Date: 2026-September-09 Security risk: Critical 15 ∕ 25 AC:None/A:None/CI:Some/II:None/E:Theoretical/TD:All Vulnerability: Access bypass Affected versions: <4.6.0 CVE IDs: CVE-2026-87954 Description: This module adds automatic highlighting of taxonomy terms in content. The module doesn't sufficiently check access on taxonomy terms
Fuente: Drupal.org · CVE-2026-87954
Project: SAML SSO - Service Provider Project machine name: miniorange_saml Date: 2026-September-09 Security risk: Moderately critical 11 ∕ 25 AC:Complex/A:Admin/CI:Some/II:Some/E:Theoretical/TD:Default Vulnerability: Server Side Request Forgery Affected versions: <3.2.0 CVE IDs: CVE-2026-87953 Description: This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that
Fuente: Drupal.org · CVE-2026-87953
Project: SAML SSO - Service Provider Project machine name: miniorange_saml Date: 2026-September-09 Security risk: Moderately critical 10 ∕ 25 AC:Complex/A:User/CI:None/II:Some/E:Theoretical/TD:All Vulnerability: Insufficient replay protection Affected versions: <3.2.0 CVE IDs: CVE-2026-87952 Description: This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that us
Fuente: Drupal.org · CVE-2026-87952
Project: SAML SSO - Service Provider Project machine name: miniorange_saml Date: 2026-September-09 Security risk: Moderately critical 12 ∕ 25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:Default Vulnerability: Information disclosure Affected versions: <3.2.0 CVE IDs: CVE-2026-87951 Description: This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users c
Fuente: Drupal.org · CVE-2026-87951
Project: SAML SSO - Service Provider Project machine name: miniorange_saml Date: 2026-September-09 Security risk: Moderately critical 13 ∕ 25 AC:None/A:None/CI:Some/II:None/E:Theoretical/TD:Uncommon Vulnerability: Embedded credentials Affected versions: <3.2.0 CVE IDs: CVE-2026-87950 Description: This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can
Fuente: Drupal.org · CVE-2026-87950
Project: SAML SSO - Service Provider Project machine name: miniorange_saml Date: 2026-September-09 Security risk: Moderately critical 12 ∕ 25 AC:Complex/A:Admin/CI:Some/II:Some/E:Theoretical/TD:All Vulnerability: Cross-site scripting Affected versions: <3.2.0 CVE IDs: CVE-2026-87949 Description: This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can a
Fuente: Drupal.org · CVE-2026-87949
Project: SAML SSO - Service Provider Project machine name: miniorange_saml Date: 2026-September-09 Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:All Vulnerability: Cross-site scripting Affected versions: <3.2.0 CVE IDs: CVE-2026-87948 Description: This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can aut
Fuente: Drupal.org · CVE-2026-87948
Project: SAML SSO - Service Provider Project machine name: miniorange_saml Date: 2026-September-09 Security risk: Moderately critical 14 ∕ 25 AC:Complex/A:None/CI:Some/II:Some/E:Theoretical/TD:Default Vulnerability: Authentication bypass Affected versions: <3.2.0 CVE IDs: CVE-2026-87947 Description: This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users c
Fuente: Drupal.org · CVE-2026-87947
Project: SAML SSO - Service Provider Project machine name: miniorange_saml Date: 2026-September-09 Security risk: Critical 15 ∕ 25 AC:Complex/A:None/CI:Some/II:Some/E:Theoretical/TD:All Vulnerability: Weak cryptographic practices Affected versions: <3.2.0 CVE IDs: CVE-2026-87946 Description: This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authe
Fuente: Drupal.org · CVE-2026-87946
Project: SAML SSO - Service Provider Project machine name: miniorange_saml Date: 2026-September-09 Security risk: Critical 16 ∕ 25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:All Vulnerability: Open redirect Affected versions: <3.2.0 CVE IDs: CVE-2026-87945 Description: This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through a
Fuente: Drupal.org · CVE-2026-87945
Project: SAML SSO - Service Provider Project machine name: miniorange_saml Date: 2026-September-09 Security risk: Critical 15 ∕ 25 AC:Complex/A:None/CI:Some/II:Some/E:Theoretical/TD:All Vulnerability: Improper certificate validation Affected versions: <3.2.0 CVE IDs: CVE-2026-87944 Description: This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can au
Fuente: Drupal.org · CVE-2026-87944
Project: SAML SSO - Service Provider Project machine name: miniorange_saml Date: 2026-September-09 Security risk: Critical 18 ∕ 25 AC:None/A:None/CI:Some/II:Some/E:Theoretical/TD:All Vulnerability: Improper access control Affected versions: <3.2.0 CVE IDs: CVE-2026-87943 Description: This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate
Fuente: Drupal.org · CVE-2026-87943
Project: SafeDelete Project machine name: safedelete Date: 2026-September-09 Security risk: Moderately critical 12 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Uncommon Vulnerability: Cross-site scripting Affected versions: <1.0.88 CVE IDs: CVE-2026-87942 Description: This module enables you to manage content deletion and provides reports for identifying orphaned content. The module doesn
Fuente: Drupal.org · CVE-2026-87942
Project: Patreon Project machine name: patreon Date: 2026-September-09 Security risk: Critical 16 ∕ 25 AC:Complex/A:Admin/CI:All/II:All/E:Theoretical/TD:All Vulnerability: Unsupported CVE IDs: CVE-2026-87941 Description: The Drupal Security Team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to main
Fuente: Drupal.org · CVE-2026-87941
Project: Key auth Project machine name: key_auth Date: 2026-September-09 Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default Vulnerability: Access bypass Affected versions: <2.2.4 CVE IDs: CVE-2026-87940 Description: This module enables you to add key-based authentication on a per-user basis. The module doesn't cache per user, potentially allowing an
Fuente: Drupal.org · CVE-2026-87940
Project: Feed Block Project machine name: feed_block Date: 2026-September-09 Security risk: Moderately critical 13 ∕ 25 AC:Complex/A:User/CI:Some/II:Some/E:Theoretical/TD:All Vulnerability: Cross-site scripting Affected versions: <2.0.2 || >=3.0.0 <3.0.2 CVE IDs: CVE-2026-87939 Description: The Feed Block module provides a block content type that displays items pulled from a remote RSS/Atom feed.
Fuente: Drupal.org · CVE-2026-87939
Project: CSP log Project machine name: csp_log Date: 2026-September-09 Security risk: Critical 15 ∕ 25 AC:Basic/A:Admin/CI:All/II:Some/E:Theoretical/TD:All Vulnerability: SQL Injection Affected versions: <1.0.2 CVE IDs: CVE-2026-87938 Description: The CSP Log module enhances any module that adds the CSP header to a site, by providing a reporting endpoint, custom storage, and aggregated reports tha
Fuente: Drupal.org · CVE-2026-87938
Project: Central Authentication System (CAS) Server Project machine name: cas_server Date: 2026-September-09 Security risk: Moderately critical 10 ∕ 25 AC:Basic/A:None/CI:None/II:None/E:Theoretical/TD:All Vulnerability: Open redirect Affected versions: <2.0.4 || >=2.1.0 <2.1.3 CVE IDs: CVE-2026-87937 Description: This module enables you to turn a Drupal install into the Central Authentication Syst
Fuente: Drupal.org · CVE-2026-87937
Project: amazee.ai Private AI Provider Project machine name: ai_provider_amazeeio Date: 2026-September-09 Security risk: Critical 17 ∕ 25 AC:Complex/A:None/CI:All/II:Some/E:Proof/TD:Default Vulnerability: SQL injection Affected versions: <1.3.7 || >=1.4.0 <1.4.3 CVE IDs: CVE-2026-87936 Description: Update 2026-09-11: Increased risk score to reflect publicly documented methods for developing exploi
Fuente: Drupal.org · CVE-2026-87936
Several vulnerabilities were discovered in the Slurm Workload Manager, a cluster resource management and job scheduling system, which may result in privilege escalation, SQL injection in the accounting database, deletion of files outside the container spool directory, bypass of credential verification for shared objects transferred with sbcast, or denial of service. https://security-tracker.debian
Fuente: Debian Security
Fuente: Adobe PSIRT
Qi Wang and Jianjun Chen discovered that FORT validator, a RPKI validation service, performed incomplete validation of RRDP notifications, which could result in denial of service via cache poisoning. For additional details please refer to the upstream advisory at https://github.com/NICMx/FORT-validator/security/advisories/GHSA-qfm3-577x-rh54 https://security-tracker.debian.org/tracker/DSA-6490-1
Fuente: Debian Security
An buffer overflow was discovered in the OPUS audio decoder of the GStreamer media framework, which may result in denial of service or potentially the execution of arbitrary code if a malformed audio file is processed. https://security-tracker.debian.org/tracker/DSA-6489-1
Fuente: Debian Security
Fuente: Adobe PSIRT
It was discovered that missing input sanitising in the JBIG2 decoder library could result in denial of service. https://security-tracker.debian.org/tracker/DSA-6488-1
Fuente: Debian Security
Multiple vulnerabilities were found in strongSwan, an IKE/IPsec suite. CVE-2026-78123 An undefined memory access vulnerability in the openssl plugin when handling PKCS#7 containers, that can result in a crash. CVE-2026-78124 A memory leak in the openssl plugin during the enumeration of certificates in PKCS#7 containers. CVE-2026-78126 A NULL-pointer dereference vulnerability in the eap-aka plugin
Fuente: Debian Security · CVE-2026-78123
Two security issues were discovered in libde265, an implementation of the H.265 video codec which may result in denial of service or potentially the execution of arbitrary code if a malformed media file is processed. https://security-tracker.debian.org/tracker/DSA-6486-1
Fuente: Debian Security
Two security vulnerabilities were discovered in the server of the Tryton application platform, which could lead to arbitrary command execution via malformed email/report templates. https://security-tracker.debian.org/tracker/DSA-6485-1
Fuente: Debian Security
Developing investigation. Sansec is publishing early because stores are being compromised right now. The threat actors are quickly iterating so we update this article with new indicators as we lear...
Fuente: Sansec · CVE-2026-75650
Security issues were discovered in Chromium which could result in the execution of arbitrary code, denial of service, or information disclosure. https://security-tracker.debian.org/tracker/DSA-6484-1
Fuente: Debian Security
Multiple security issues were discovered in Thunderbird, which could result in the execution of arbitrary code or information disclosure. https://security-tracker.debian.org/tracker/DSA-6483-1
Fuente: Debian Security
Security issues were discovered in Chromium which could result in the execution of arbitrary code, denial of service, or information disclosure. https://security-tracker.debian.org/tracker/DSA-6482-1
Fuente: Debian Security
Project: Webform Submissions Delete Project machine name: webform_submissions_delete Date: 2026-September-02 Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:All Vulnerability: Access bypass Affected versions: <1.2.0 CVE IDs: CVE-2026-84921 Description: This module enables you to delete Webform submissions in bulk using a specified date range. The module
Fuente: Drupal.org · CVE-2026-84921
Project: Unpublished Node Permissions Project machine name: unpublished_node_permissions Date: 2026-September-02 Security risk: Critical 15 ∕ 25 AC:None/A:None/CI:Some/II:None/E:Theoretical/TD:All Vulnerability: Access bypass Affected versions: <1.8.0 CVE IDs: CVE-2026-84920 Description: This module creates permissions per node content type to control access to unpublished content. The module has
Fuente: Drupal.org · CVE-2026-84920
Project: PhotoSwipe - Responsive JavaScript Modal Image Gallery Project machine name: photoswipe Date: 2026-September-02 Security risk: Moderately critical 14 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All Vulnerability: Cross-site scripting Affected versions: <5.0.9 CVE IDs: CVE-2026-84919 Description: This module enables you to add dynamic caption support to PhotoSwipe image galleries
Fuente: Drupal.org · CVE-2026-84919
Project: Monobank payment API Project machine name: monobank Date: 2026-September-02 Security risk: Moderately critical 12 ∕ 25 AC:Complex/A:None/CI:None/II:Some/E:Theoretical/TD:All Vulnerability: Access bypass Affected versions: <1.0.3 CVE IDs: CVE-2026-84918 Description: The Monobank payment API module provides integration with Monobank acquiring payments. The module did not verify the Monobank
Fuente: Drupal.org · CVE-2026-84918
Project: Media Library Importer Project machine name: media_library_importer Date: 2026-September-02 Security risk: Moderately critical 11 ∕ 25 AC:Basic/A:User/CI:Some/II:None/E:Theoretical/TD:All Vulnerability: Access bypass Affected versions: <2.1.6 CVE IDs: CVE-2026-81163 Description: A module to import media files into media library. The import folder is a plain textfield with no validation. P
Fuente: Drupal.org · CVE-2026-81163
Project: Mailer Plus Log Project machine name: symfony_mailer_log Date: 2026-September-02 Security risk: Moderately critical 12 ∕ 25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:Default Vulnerability: Access bypass Affected versions: <1.2.7 CVE IDs: CVE-2026-16648 Description: This module enables you to log the emails sent by Mailer Plus as content entities, so they can be reviewed at Reports
Fuente: Drupal.org · CVE-2026-16648
Project: Jsonapi Role Access Project machine name: jsonapi_role_access Date: 2026-September-02 Security risk: Critical 16 ∕ 25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:All Vulnerability: Access bypass Affected versions: <2.0.2 CVE IDs: CVE-2026-84917 Description: This module enables you to restrict access to JSON:API routes based on specific user roles. The module doesn't sufficiently enfo
Fuente: Drupal.org · CVE-2026-84917
Project: Islandora Project machine name: islandora Date: 2026-September-02 Security risk: Moderately critical 12 ∕ 25 AC:Complex/A:None/CI:Some/II:None/E:Theoretical/TD:All Vulnerability: Access bypass Affected versions: <2.19.0 CVE IDs: CVE-2026-84916 Description: This islandora_advanced_search sub module enables AJAX updates for advanced search, facet, and search result blocks. The module doesn'
Fuente: Drupal.org · CVE-2026-84916
Project: Email Verification / SMS Verification / OTP Verification Project machine name: otp_verification Date: 2026-September-02 Security risk: Critical 16 ∕ 25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:All Vulnerability: Cross Site Scripting Affected versions: <2.4.0 CVE IDs: CVE-2026-84924 Description: This module enables you to add an extra layer of verification for user registration. Th
Fuente: Drupal.org · CVE-2026-84924
Project: Email Verification / SMS Verification / OTP Verification Project machine name: otp_verification Date: 2026-September-02 Security risk: Critical 16 ∕ 25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:All Vulnerability: Access Bypass Affected versions: <2.4.0 CVE IDs: CVE-2026-84923 Description: This module enables you to add extra layer of verification for user registration. The module d
Fuente: Drupal.org · CVE-2026-84923
Project: Component blocks Project machine name: component_blocks Date: 2026-September-02 Security risk: Moderately critical 14 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All Vulnerability: Cross site scripting Affected versions: <1.2.7 CVE IDs: CVE-2026-84915 Description: This module enables you use UI Patterns with blocks, for use in Layout Builder. The module doesn't sufficiently vali
Fuente: Drupal.org · CVE-2026-84915
Project: Calculate Working Days Project machine name: calculate_working_days Date: 2026-September-02 Security risk: Critical 15 ∕ 25 AC:None/A:None/CI:None/II:Some/E:Theoretical/TD:All Vulnerability: Access bypass Affected versions: <2.0.3 CVE IDs: CVE-2026-84914 Description: Calculate Working Days allows you to calculate working days between 2 dates. This module doesn't sufficiently restrict acce
Fuente: Drupal.org · CVE-2026-84914
Project: AI translate Project machine name: ai_translate Date: 2026-September-02 Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default Vulnerability: Access Bypass Affected versions: <1.3.2 || >=1.4.0 <1.4.1 CVE IDs: CVE-2026-84913 Description: This module enables you to automatically translate entities. The module doesn't sufficiently check access on
Fuente: Drupal.org · CVE-2026-84913
Project: AI (Artificial Intelligence) Project machine name: ai Date: 2026-September-02 Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default Vulnerability: Access Bypass Affected versions: <1.3.13 || >=1.4.0 <1.4.8 CVE IDs: CVE-2026-84912 Description: This submodule AI Translate enables you to automatically translate entities. The module doesn't suffic
Fuente: Drupal.org · CVE-2026-84912
Project: AI (Artificial Intelligence) Project machine name: ai Date: 2026-September-02 Security risk: Moderately critical 10 ∕ 25 AC:Complex/A:Admin/CI:Some/II:Some/E:Theoretical/TD:Uncommon Vulnerability: Cross site scripting Affected versions: <1.3.13 || >=1.4.0 <1.4.8 CVE IDs: CVE-2026-84911 Description: This AI Chatbot module enables you to have a Chatbot using assistants to help you with your
Fuente: Drupal.org · CVE-2026-84911
Project: Advanced Search Project machine name: advanced_search Date: 2026-September-02 Security risk: Moderately critical 12 ∕ 25 AC:Complex/A:None/CI:Some/II:None/E:Theoretical/TD:All Vulnerability: Access bypass Affected versions: <2.4.5 CVE IDs: CVE-2026-84910 Description: This module enables AJAX updates for advanced search, facet, and search result blocks. The module doesn’t sufficiently chec
Fuente: Drupal.org · CVE-2026-84910
Multiple security issues have been found in the Mozilla Firefox web browser, which could potentially result in the execution of arbitrary code, sandbox escape or privilege escalation. https://security-tracker.debian.org/tracker/DSA-6481-1
Fuente: Debian Security
Multiple vulnerabilities were discovered in Keystone, the OpenStack identity service, which may result in authorisation bypass or information disclosure. https://security-tracker.debian.org/tracker/DSA-6480-1
Fuente: Debian Security
Multiple vulnerabilities were discovered in roundcube, a skinnable AJAX based webmail solution for IMAP servers, which could result in cross-site scripting, SSRF bypass, information disclosure, privilege escalation, denial of service or remote code execution. https://security-tracker.debian.org/tracker/DSA-6479-1
Fuente: Debian Security
Several vulnerabilities were discovered in starlette, a lightweight ASGI framework/toolkit, which could result in bypass of authorization checks or denial of service. https://security-tracker.debian.org/tracker/DSA-6478-1
Fuente: Debian Security
Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks. https://security-tracker.debian.org/tracker/DSA-6477-1
Fuente: Debian Security
Security issues were discovered in Chromium which could result in the execution of arbitrary code, denial of service, or information disclosure. https://security-tracker.debian.org/tracker/DSA-6476-1
Fuente: Debian Security
Guillem Lefait discovered a path traversal attack in suricata-update, a tool for updating Suricata rules, which allowed malformed rules to overwrite files on the system. https://security-tracker.debian.org/tracker/DSA-6475-1
Fuente: Debian Security
Two security vulnerabilities were discovered in Cockpit, a web console for Linux servers, which could result in the execution of arbitrary code or denial of service. https://security-tracker.debian.org/tracker/DSA-6474-1
Fuente: Debian Security
Several vulnerabilities were discovered in libdbi-perl, a Perl framework that provides a common interface to access various backend databases in a uniform manner, which could result in denial of service, path traversal, bypass of file-backed filters or the execution of arbitrary code. https://security-tracker.debian.org/tracker/DSA-6473-1
Fuente: Debian Security
A symlink traversal vulnerability was discovered in bubblewrap, a low-level unprivileged sandboxing tool used by Flatpak and other projects, which could result in sandbox escape by malicious/compromised Flatpak apps. https://security-tracker.debian.org/tracker/DSA-6472-1
Fuente: Debian Security
Multiple vulnerabilities have been discocvered in Wireshark, a network protocol analyzer which could result in denial of service or the execution of arbitrary code. https://security-tracker.debian.org/tracker/DSA-6471-1
Fuente: Debian Security
Several vulnerabilities were discovered in GIMP, the GNU Image Manipulation Program, which could result in denial of service or potentially the execution of arbitrary code if malformed PSP, TIFF, DDS, PSD, SGI, FLI, FITS or ICNS files are opened. https://security-tracker.debian.org/tracker/DSA-6470-1
Fuente: Debian Security
Multiple vulnerabilities were discovered in xrdp, a Remote Desktop Protocol (RDP) server, which may result in denial of service, information disclosure, privilege escalation or the execution of arbitrary code. Several of these issues are exploitable by an unauthenticated remote attacker. This update also changes two defaults, as part of the fixes: * Alternate shells supplied by the client are now
Fuente: Debian Security
Project: Slick Carousel Project machine name: slick Date: 2026-August-26 Security risk: Moderately critical 12 ∕ 25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:Default Vulnerability: Cross Site Scripting Affected versions: <2.1.0 CVE IDs: CVE-2026-81160 Description: Slick UI, a sub-module of Slick, enables you to add Slick option sets that may contain HTML for carousel buttons. Previous rele
Fuente: Drupal.org · CVE-2026-81160
Project: Monster Menus Project machine name: monster_menus Date: 2026-August-26 Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default Vulnerability: Cross-site Scripting Affected versions: <9.5.3 CVE IDs: CVE-2026-81201 Description: This module enables you to create one or more multisites with highly granular page permissions. The module doesn't suffic
Fuente: Drupal.org · CVE-2026-81201
Project: LDAP / Active Directory Integration Project machine name: ldap_auth Date: 2026-August-26 Security risk: Moderately critical 14 ∕ 25 AC:Basic/A:None/CI:Some/II:None/E:Proof/TD:All Vulnerability: Information Disclosure Affected versions: <2.2.1 CVE IDs: CVE-2026-81205 Description: This module enables users to authenticate using LDAP or Active Directory credentials. The module does not suffi
Fuente: Drupal.org · CVE-2026-81205
Project: Entity PDF Project machine name: entity_pdf Date: 2026-August-26 Security risk: Moderately critical 13 ∕ 25 AC:None/A:User/CI:Some/II:None/E:Theoretical/TD:All Vulnerability: Access bypass Affected versions: <2.1.5 CVE IDs: CVE-2026-81164 Description: The Entity PDF module can create a PDF from any entity based on any View mode. This module does not check entity view access when fetching
Fuente: Drupal.org · CVE-2026-81164
Project: Entity API Project machine name: entity Date: 2026-August-26 Security risk: Moderately critical 12 ∕ 25 AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:Default Vulnerability: Information disclosure Affected versions: <1.8.0 CVE IDs: CVE-2026-81158 Description: The Entity API module extends the Drupal core entity API to provide a unified way to deal with entities and their properties. The
Fuente: Drupal.org · CVE-2026-81158
Project: DXPR Builder: The Best Editing (AI) Experience for Drupal Project machine name: dxpr_builder Date: 2026-August-26 Security risk: Moderately critical 14 ∕ 25 AC:None/A:None/CI:Some/II:None/E:Theoretical/TD:Default Vulnerability: Information Disclosure Affected versions: <2.8.1 CVE IDs: CVE-2026-81162 Description: The DXPR Builder module provides a visual / AI page builder for Drupal. The m
Fuente: Drupal.org · CVE-2026-81162
Project: Disable Login Page Project machine name: disable_login Date: 2026-August-26 Security risk: Moderately critical 13 ∕ 25 AC:None/A:None/CI:None/II:None/E:Proof/TD:All Vulnerability: Access bypass Affected versions: <1.1.4 CVE IDs: CVE-2026-16647 Description: This module enables you to disable access to the /user/login form unless a secret key is provided. The module does not invalidate the
Fuente: Drupal.org · CVE-2026-16647
Project: Disable Login Page Project machine name: disable_login Date: 2026-August-26 Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:All Vulnerability: Access bypass Affected versions: <1.1.4 CVE IDs: CVE-2026-18260 Description: This module enables you to disable access to the /user/login form unless a secret key is provided. The module does not sufficie
Fuente: Drupal.org · CVE-2026-18260
Project: Digital Signage Framework Project machine name: digital_signage_framework Date: 2026-August-26 Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:All Vulnerability: Access bypass Affected versions: <2.6.1 CVE IDs: CVE-2026-81166 Description: The Digital Signage Framework module provides a route that signage devices can call to refresh dynamic block
Fuente: Drupal.org · CVE-2026-81166
Project: Data field Project machine name: datafield Date: 2026-August-26 Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:All Vulnerability: Information disclosure Affected versions: <2.0.13 CVE IDs: CVE-2026-81269 Description: This module enables you to store structured data in configurable fields and expose Data Field values through JSON endpoints. The
Fuente: Drupal.org · CVE-2026-81269
Project: Content Moderation Notifications Project machine name: content_moderation_notifications Date: 2026-August-26 Security risk: Moderately critical 12 ∕ 25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:Default Vulnerability: Access bypass Affected versions: <3.9.0 CVE IDs: CVE-2026-81161 Description: The module provides a permission that allows users to configure email templates containin
Fuente: Drupal.org · CVE-2026-81161
Project: Commerce CyberSource Project machine name: commerce_cybersource Date: 2026-August-26 Security risk: Moderately critical 11 ∕ 25 AC:Complex/A:None/CI:None/II:Some/E:Theoretical/TD:Default Vulnerability: Insufficient input validation Affected versions: <1.10.0 CVE IDs: CVE-2026-81159 Description: This module integrates Drupal Commerce with the CyberSource payment gateway. The module does no
Fuente: Drupal.org · CVE-2026-81159
Project: CAPTCHA Protected Page Project machine name: captcha_protected_page Date: 2026-August-26 Security risk: Moderately critical 12 ∕ 25 AC:Complex/A:None/CI:Some/II:None/E:Theoretical/TD:All Vulnerability: Cookie Forgery Affected versions: <1.0.2 CVE IDs: CVE-2026-81168 Description: This module enables site administrators to require CAPTCHA confirmation on specific pages. The module does not
Fuente: Drupal.org · CVE-2026-81168
Project: Blazy Project machine name: blazy Date: 2026-August-26 Security risk: Less critical 9 ∕ 25 AC:Basic/A:User/CI:Some/II:None/E:Theoretical/TD:Uncommon Vulnerability: Access bypass Affected versions: <3.0.18 CVE IDs: CVE-2026-81165 Description: This module enables users to display a field of a target entity through a Blazy Filter plugin shortcode. The module does not consistently check entit
Fuente: Drupal.org · CVE-2026-81165
Two security issues were discovered in GNU Emacs, which could result in the execution of arbitrary code when opening a malformed file and denial of service when processing malformed PBM/PPM/PGM images. https://security-tracker.debian.org/tracker/DSA-6468-1
Fuente: Debian Security
Sansec discovered this vulnerability in Shopware 6.7.12.2, the latest stable release at the time of testing, and disclosed it privately to Shopware two days later. Shopware fixed it in 6.7.13.1 and...
Fuente: Sansec
Adobe has released isolated security patches for APSB26-92 for Adobe Commerce and Magento Open Source.The update fixes seven vulnerabilities. Five are rated Critical, including CVE-2026-71362, an ...
Fuente: Sansec · CVE-2026-71362
Fuente: Adobe PSIRT
Fuente: Adobe PSIRT
Update November 1, 2026: This advisory now lists 6 more extensions (Customer Attributes, Common Rules, Two-Factor Authentication, Gift Wrap, Live Chat and Store Pickup).Update October 19, 2026: Th...
Fuente: Sansec
JTL responded fast and has released fixes for every supported branch: versions 5.5.4, 5.6.2 and 5.7.2, plus a back-patch covering 5.0.0 through 5.7.0. Every store owner running JTL Shop 5.2.0 or la...
Fuente: Sansec
Sansec discovered an active supply-chain attack hitting over 1.2 million sites that use the popular OptinMonster, TrustPulse and PushEngage Wordpress plugins, all operated by Wordpress giant Awesom...
Fuente: Sansec
Amasty Order Attributes contains an unauthenticated arbitrary file upload vulnerability. An attacker can upload a file of any type and name to the store's media directory with no login, no session ...
Fuente: Sansec
The skimmer never loads from a domain the attacker controls. The loader, the payload, and the stolen cards all flow through two domains every store already trusts: Google Tag Manager and Stripe.Bo...
Fuente: Sansec
A skimming operation tracked as GorgonAgora is running over 4,800 fake storefronts that impersonate real brands and steal payment data from anyone who checks out. An independent researcher has been...
Fuente: Sansec
Sansec is proud to add Sylius to our list of supported platforms. Sansec eComscan now integrates with Sylius 1 and Sylius 2 and will run deep searches to hunt for malware & vulnerabilities.Whi...
Fuente: Sansec
Sansec discovered an unauthenticated PHP object injection vulnerability in Mirasvit Cache Warmer, a full-page cache extension for Magento and Adobe Commerce. Any storefront request carrying a craft...
Fuente: Sansec
Sansec is tracking active attacks against Funnel Builder by FunnelKit, a checkout and upsell plugin used on 40,000+ WooCommerce stores. All versions before 3.15.0.3 let unauthenticated attackers in...
Fuente: Sansec
Update May 13th: GitHub has temporarily rolled back the new token format rollout. According to the Composer maintainers, that leaves a few days to update Composer in CI before the rollout resumes n...
Fuente: Sansec
Fuente: Adobe PSIRT
The affected stores span 27 countries, with France, Italy, Poland, and the Czech Republic accounting for the majority. Among them: a multi-billion dollar fashion retailer, two French university boo...
Fuente: Sansec
The vendor is currently running a ClickFix clipboard hijacker on its own homepage. The vendor sells network exposure management and attack-path analysis to Fortune 500 enterprises, the US Departmen...
Fuente: Sansec
In the early hours of April 7th, nearly 100 Magento stores got mass-infected with a "double-tap" skimmer: a credit card stealer hidden inside an invisible SVG element. Sansec found stolen...
Fuente: Sansec
Sansec is tracking a mass exploitation wave of the PolyShell vulnerability that hit hundreds of online stores within a single hour today. The attacks are ongoing: new victims appear every minute.N...
Fuente: Sansec
What sets this attack apart is the skimmer itself. Instead of the usual HTTP requests or image beacons, this malware uses WebRTC DataChannels to load its payload and exfiltrate stolen payment data....
Fuente: Sansec
Sansec discovered and named the PolyShell vulnerability (CVE-2026-48356): a critical flaw in Magento's REST API that lets unauthenticated attackers upload executable files to any store. The attack ...
Fuente: Sansec · CVE-2026-48356
Fuente: Adobe PSIRT
The affected company, with about €100 billion in annual revenue and over 10,000 stores across 25 countries, runs some of its ecommerce operations on the PrestaShop platform. As of publication, the ...
Fuente: Sansec
YARA is the industry standard for pattern matching in malware detection. Maintained by VirusTotal, it powers threat detection at nearly every security vendor. At Sansec, we rely on YARA for eComsca...
Fuente: Sansec
Rob Aimes alerted us to malicious GitHub repositories targeting Magento developers. The repos pose as legitimate tools but deliver Windows malware: a RAT and keylogger bundled as a LuaJIT package. ...
Fuente: Sansec
Open source ecosystems have a long tail security problem. Python, Ruby, Javascript, PHP: these ecosystems have millions of packages. The top 100 packages get scrutinized. The next 5,000, not so muc...
Fuente: Sansec
Yesterday, Sansec discovered an active keylogger at an external site of one of America's largest banks. The malware was harvesting private information from over 200,000 potential victims. We detect...
Fuente: Sansec
Update Jan 15th: the malware appears to have been removed. It was live for about 18 hoursSansec detected a keylogger on the employee store of one of America's largest banks. The site serves over 2...
Fuente: Sansec
Sansec researchers discovered that ConnectPOS, a popular Point of Sale solution, had been exposing a GitHub Personal Access Token (PAT) in their public installation instructions for over four years...
Fuente: Sansec
NameMgt_VarnishVulnerable1.0.10 and earlierFixed in1.1.0Sansec researchers discovered a critical vulnerability in the popular Varnish module for Magento. This module, develope...
Fuente: Sansec
Six weeks after Adobe's emergency patch for SessionReaper (CVE-2025-54236), the vulnerability has entered active exploitation. Sansec Shield detected and blocked the first real-world attacks today,...
Fuente: Sansec · CVE-2025-54236
Fuente: Adobe PSIRT
Fuente: Adobe PSIRT
October 22nd: mass SessionReaper attacks have startedIn August 2025, a critical (CVSS 9.1) flaw was discovered in all versions of Adobe Commerce and Magento. The bug, named "SessionReaper&q...
Fuente: Sansec · CVE-2025-54236
Fuente: Adobe PSIRT
Adobe has just released several security fixes for its Commerce (Magento) platform and one of them is critical (CVE-2025-47110). Adobe urges merchants to patch within 72 hours (highest priority).S...
Fuente: Sansec · CVE-2025-47110
Fuente: Adobe PSIRT
Hundreds of stores, including a $40 billion multinational, are running backdoored versions of popular ecommerce software. We found that the backdoor is actively used since at least April 20th. Sans...
Fuente: Sansec
Fuente: Adobe PSIRT
The Sansec Shield WAF detected mass scans for "defunct.dat" and "qfile" files this week. As it turns out, these files contain connection keys that can be used to launch a GSocke...
Fuente: Sansec
The new PCI-DSS regulations that will come into effect after March 31st, 2025, require merchants to monitor scripts on their payment pages to prevent digital skimming attacks*. The use of Conte...
Fuente: Sansec
It's insanity that we still don't have clarity(Clean_Anteater992)They have to be kidding me (sawer82)It's clusterf after clusterf (andrew_barratt)The Payment Card Industry Security Stan...
Fuente: Sansec
APSB25-08 released on Feb 11th, 2025Critical Adobe Commerce/Magento security patches have just been released (CVSS 9.4/10)New versions: 2.4.4-p12, 2.4.5-p11, 2.4.6-p9, 2.4.7-p4, additionally 2.4....
Fuente: Sansec
Fuente: Adobe PSIRT
Merchants spend millions of dollars on client-side security solutions to prevent digital skimming attacks. Companies are rushing to implement these tools, often driven by PCI requirements. But here...
Fuente: Sansec
Google TranslateAttackers are using Google Translate’s page functionality to execute malicious JavaScript files, as demonstrated below:<script src="https://translate.google.co.in/translat...
Fuente: Sansec
Fuente: Adobe PSIRT
Sansec research shows that seven different groups have been hacking into 4275 online stores since the publication of CVE-2024-34102 (also known as CosmicSting) on June 11th. Despite ongoing warning...
Fuente: Sansec · CVE-2024-34102
ImplicationsCosmicSting targets a critical bug in the Adobe Commerce and Magento platforms. Bad actors use it to read any of your files, such as passwords and other secrets. The typical attack str...
Fuente: Sansec
CosmicSting (CVE-2024-34102) allows arbitrary file reading on unpatched systems. When combined with CNEXT (CVE-2024-2961), threat actors can escalate to remote code execution, taking over the entir...
Fuente: Sansec · CVE-2024-34102
API AbuseAs CosmicSting enables attackers to read any file, attackers can steal Magento's secret encryption key. This encryption key can generate JSON Web Tokens with full administrative API acces...
Fuente: Sansec
Update June 28th: We are flagging more domains that have been used by the same actor to spread malware since at least June 2023: bootcdn.net, bootcss.com, staticfile.net, staticfile.org, unionad...
Fuente: Sansec
Update June 27th: Adobe has now provided an official, isolated fix that can be applied to installations without requiring upgrade.Update June 27th: our partner Hypernode as actually observed the ...
Fuente: Sansec
The following XML code was found in the layout_update database table and is responsible for periodic reinfections of your system.Attackers combine the Magento layout parser with the beberlei/asse...
Fuente: Sansec
In January we announced our partnership with Europol and today, we are proud to be recognized by Google as experts in eCommerce security.Sansec and Google have agreed on a data exchange and we tru...
Fuente: Sansec
In a strategic alliance, Europol, the European Union Agency for Cybersecurity (ENISA), law enforcement from 17 nations, and key private sector entities such as Sansec, have aligned to counteract th...
Fuente: Sansec
In recent weeks, Sansec observed a spike in hacked Magento 2 stores. Our investigations led to a (likely) single attacker, who used a combination of clever techniques to bypass WAFs and competing t...
Fuente: Sansec
Cybercriminals in eCommerce are diversifying their targets, now aiming at entire customer databases instead of just stealing credit cards. A recent incident revealed this trend: a hacked Magento ad...
Fuente: Sansec
Attackers are devising ingenious methods to prolong their skimming activities, aiming for sustained persistence.The usual tactics, techniques, and procedures (TTP) include the creation of disposab...
Fuente: Sansec
Fuente: Adobe PSIRT
The domain gtag-analytics.com has recently emerged as a threat, employing various cunning techniques to evade detection and targeting unsuspecting users, but what makes it especially deceptive is i...
Fuente: Sansec
Fuente: Adobe PSIRT
It is a common practice to make ad-hoc backups during store platform maintenance. The problem, however, is that these backups often end up in a public folder. Perhaps the administrator intended to ...
Fuente: Sansec
BackgroundAdobe’s fix to CVE-2022-24086 was to remove “smart” mail templates. Many vendors were caught off guard and had to revert to the original functionality. In doing so, they unknowingly expo...
Fuente: Sansec · CVE-2022-24086
Magento 2 template hacks have been raging since a month or two, and Sansec is closely tracking any new attack payloads. So far, we observed about 20 different payloads which all added a basic PHP b...
Fuente: Sansec
After a quiet summer, the number of attacks targeting the mail template vulnerability in Magento 2 and Adobe Commerce is rising fast. Merchants and developers should be on the lookout for TrojanOrd...
Fuente: Sansec
Related: many stores are occassionally contacted by "security researchers" who claim to have found a vulnerability and want a "bounty" to disclose it. In 99% of these cases, the...
Fuente: Sansec
Currently, Sansec eComscan is the only malware scanner that detects the injected remote access trojan (see Virustotal).223sam.jpg attackAll of the observed attacks have been interactive, possibly...
Fuente: Sansec
Update 2022-09-13 FishPig has confirmed the incident and published a status page. It recommends customers to upgrade and/or reinstall all FishPig modules.Sansec discovered malware in the Fishpig ...
Fuente: Sansec
Fuente: Adobe PSIRT
Fuente: Adobe PSIRT
Update Feb 21st, 2022: Sansec has observed the first actual attacks in the wild. Patch now! Unfortunately, this validates our previous prediction that abuse would start within days. Attacks are com...
Fuente: Sansec · CVE-2022-24086
Fuente: Adobe PSIRT
More than 350 ecommerce stores infected with malware in a single day.Today our global crawler discovered 374 ecommerce stores infected with the same strain of malware. 370 of these stores load the ...
Fuente: Sansec
Updated Dec 20th. This article describes how Magento is affected by the critical log4j vulnerability, and what you can (and should) do to prevent a hack.A critical vulnerability in the popular Log...
Fuente: Sansec
Last week we exposed the CronRAT eCommerce malware, which is controlled by a Chinese server. Out of curiosity, we wrote a "custom" RAT client and waited for commands from the far east. Ev...
Fuente: Sansec
At this time of year we typically see a surge in eCommerce attacks and new malware. Last week we analyzed a clever malware attacking online stores, and today we expose another, much more sophistica...
Fuente: Sansec
A merchant recently reached out to us, after hiring two forensic companies but still having malware on his store. As we appreciate a challenge, our team got started and quickly discovered an intric...
Fuente: Sansec
The Google business application platform Apps Script is used to funnel stolen personal data, Sansec learned. Attackers use the reputation of the trusted Google domain script.google.com to evade mal...
Fuente: Sansec
Once the data is intercepted and exfiltrated, the attackers display an error message and the customer is redirected to the real payment page. Customers probably just enter their details again and i...
Fuente: Sansec
Sansec discovered a clever remote access trojan (RAT) that has been hiding in the alleys of hacked eCommerce servers. Despite the advanced setup, perpetrators mistakenly left a list of victim store...
Fuente: Sansec
The affected stores were all running the older Magento 2.2, which is unsupported since December 2019.In addition to the injected flaw, attackers used a hybrid skimming architecture, with front and...
Fuente: Sansec
Researchers at Sansec have uncovered a novel technique to inject payment skimmers onto checkout pages. This new malware has two parts: a concealed payload and a decoder, of which the latter reads t...
Fuente: Sansec
Update Sept 18: Cardbleed has infected 2806 Magento1 stores so far (3% of total install base)Over the weekend, almost two thousand Magento 1 stores across the world have been hacked in the larges...
Fuente: Sansec
Previously, North Korean hacking activity was mostly restricted to banks and South Korean crypto markets^cryptohack, covert cyber operations that earned hackers $2 billion, according to a 2019 Unit...
Fuente: Sansec
A newly discovered skimming campaign runs entirely on Google servers, Sansec research shows. The novel malware sends stolen credit cards directly to Google Analytics, evading security controls like...
Fuente: Sansec
While an international retail chain closed its physical stores, attackers hacked its online presence, Sansec research shows. Following common Magecart malpractice, payment skimmers were injected an...
Fuente: Sansec
Over a 100 thousands Magento 1 stores will be running after Adobe terminates support in June (end-of-life). Many merchants need more time to transition to Magento 2 or another platform. No need to ...
Fuente: Sansec
Magento 1 will no longer receive official updates & security fixes per July 1st, 2020 (the end-of-life, or EOL date). Merchants are urged to upgrade to Magento 2, but for many stores this deadl...
Fuente: Sansec
Sansec, a global leader in eCommerce security, reveals that hackers successfully infiltrated an online printing platform for more than two and a half years. Our research shows that crooks ran keylo...
Fuente: Sansec
Utrecht, February 20; Sansec is proud to announce that it hasformed a long-term strategic partnership with maxcluster to bring itsindustry-leading anti-malware technology to the German e-commerce...
Fuente: Sansec
The Indonesian police announced on Friday that they have arrested three alleged Magecart hackers on December 20th. The suspects are from Jakarta and Yogyakarta and are 23, 26 and 35 years old. Afte...
Fuente: Sansec
Payment skimmers are hiding their malpractice by impersonating our Sansec anti-skimming service. They have registered malicious domains sansec.us and sanguinelab.net, even using a fake address in A...
Fuente: Sansec
Digital skimming groups (aka Magecart) hit another low, as they successfully targeted the American Cancer Society last night. Our skimmer detectors found a piece of malicious code embedded on the C...
Fuente: Sansec
The store of a US Magento extension vendor was found compromised. Attackers had write access to the server selling extensions. We are awaiting a statement on the integrity of downloaded software.O...
Fuente: Sansec
The FBI warns small and medium-sized businesses and government agencies against the threat of e-skimming. E-skimming occurs when cyber criminals inject malicious code onto a website.Read the origi...
Fuente: Sansec
Cementing itself as a global force in the protection against eCommerce fraud, Sansec has been invited to speak at the fifth edition of Europol’s Training Course on Payment Card Fraud Forensic Inves...
Fuente: Sansec
The PCI Security Standards Council and the Retail & Hospitality ISAC alert merchants to the threat of digital skimming. In its report, it quotes Sansec research, which has found that about 20% ...
Fuente: Sansec
The number of hacked Magento 2 stores spiked in the last four weeks, after a critical security flaw was discovered in March and criminals stole admin passwords within 16 hours. Merchants are advise...
Fuente: Sansec
After the NBA Hawks got skimmed last week, this time Puma's Australian customers are cannon fodder for Magecart thieves. Anyone who ordered a pair of sneakers online, had their name, address and cr...
Fuente: Sansec
Sansec discovered a polymorphic skimmer that works with 57 different payment gateways. It has global reach, affecting payment systems from Germany to Brazil. It is by far the most advanced skimmer ...
Fuente: Sansec
MageCart attacks on online stores surged last year, culminating in the hack of British Airways and Ticketmaster. This year the trend continues with another high-profile target. The Atlanta Hawks sh...
Fuente: Sansec
In October last year Sansec discovered several Magento extension 0days. As it turns out, this was only the tip of the iceberg: today, insecure 3rd party extensions are used to hack into thousands o...
Fuente: Sansec
This week Sansec discovered that large ecommerce and government sites got hacked via the Adminer database tool. As it turns out, the root cause is a protocol flaw in MySQL. Curiously, it is describ...
Fuente: Sansec
Update 2019-01-20: the root cause is a protocol flaw in MySQL.Adminer is a popular PHP tool to administer MySQL and PostgreSQL databases. However, it can be lured to disclose arbitrary files. Atta...
Fuente: Sansec
Skimmers found to subtly sabotage each others fraud operations.Competition is grim in the online skimming business (aka "MageCart"). The aggressive MagentoCore skimmer was previously obs...
Fuente: Sansec
1 in 5 compromised merchants get reinfected, average skimming operation lasts 13 daysMageCart, the notorious actors behind massive online card skimming, has been busy. And so have we: our crawlers...
Fuente: Sansec
Update Nov 23rd: Webgility has released a patch and a public statement, urging all customers to upgrade to version 345.Update Nov 30th: Webgility has discovered another security issue and urges al...
Fuente: Sansec
Online credit card theft has been all over the news: criminals inject hidden card stealers on legitimate checkout pages. But how are they are able to inject anything in the first place? As it turns...
Fuente: Sansec
The store of German political party CSU (www.csu-shop.de) contains an identity skimmer that was planted on or before Oct 5th, right before the Bavarian election on Oct 14th. Personal identifyable i...
Fuente: Sansec
Back in 2016, Magecart skimmers would evade detection by sleeping if any developer tools were found running. Then, their malware would 404 without correct Referer or User-Agent header. And now, Mag...
Fuente: Sansec
While Filipinos are recovering from typhoon Mangkhut, another misfortune awaits them online. We found their broadcasting giant ABS-CBN − a $740 million conglomerate & top-500 global Internet de...
Fuente: Sansec
Would you - a webdeveloper - get alarmed if you found the following code on your website? Probably not, as Google Analytics is embedded in pretty much every website these days:<script type=&quo...
Fuente: Sansec
A single group is responsible for planting skimmers on 7339 individual stores in the last 6 months. The MagentoCore skimmer is now the most successful to date.Update 2018-09-07: Because Google Chr...
Fuente: Sansec
Magento merchants have recently received messages like this:Hey, I strongly recommend you to make a redesign! Please contact me if you need a good designer! -- knockers@yahoo.comUpon closer exa...
Fuente: Sansec
Does your laptop get hot when visiting your favorite shop? You computer is likely mining cryptocurrencies to the benefit of a cyberthief.Cryptojacking - running crypto mining software in the brow...
Fuente: Sansec
If you code against Akamai hosted sites, you could be rejected because your HTTP library sends request headers in the wrong order. In fact, most libraries use undefined order, as the IETF specifica...
Fuente: Sansec
Update May 21st: a similar phishing mail circulates about a fake patch SUPEE-1798.Update Apr 22nd: added reference to Neutrino Bot and POS systemsThis week a mail was sent out to announce the ne...
Fuente: Sansec
Part of a series where Magento security professionals share their case notes, so that we can ultimately distill a set of best practices, tools and workflow.Part of the job of running the MageRepor...
Fuente: Sansec
This post shows how sophisticated Magento hacking operations have become nowadays.While investigating a bruteforced Magento store, we noticed that the hacker logged in using a curious referrer sit...
Fuente: Sansec
Regular Javascript-based malware is normally injected in the static header or footer HTML definitions in the database. Cleaning these records used to be sufficient to get rid of the malware. But no...
Fuente: Sansec
Visbot is one of the oldest Magecart payment skimmers: it steals customer data and credit cards. The first case was documented as early as March 2015. But being publicly discussed did not stop it f...
Fuente: Sansec
Criminals have secretly rewired 3,500 online stores to continuously harvest credit card numbers. The fraud can be traced back as far as May 12th 2015, so if you have bought something at one of thes...
Fuente: Sansec