Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-003 Read post

Drupal core - Moderately critical - Gadget Chain - SA-CORE-2026-002 Read post

Drupal core - Critical - Cross-site scripting - SA-CORE-2026-001 Read post

Orejime - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-032 Read post

SAML SSO - Service Provider - Critical - Authentication bypass - SA-CONTRIB-2026-031 Read post

Automated Logout - Moderately critical - Cross-site request forgery - SA-CONTRIB-2026-030 Read post

Unpublished Node Permissions - Critical - Access bypass - SA-CONTRIB-2026-029 Read post

AI (Artificial Intelligence) - Moderately critical - Information Disclosure - SA-CONTRIB-2026-028 Read post

Home Drupal is an open source platform for building amazing digital experiences. It's made by a dedicated community. Anyone can use it, and it will always be free.

There is a delay in delivering emails announcing today's advisories due to the drupal.org data center migration. See drupal.community/@drupalinfra... for more details.

OpenID Connect / OAuth client - Less critical - Access bypass - SA-CONTRIB-2026-027 Read post

OpenID Connect / OAuth client - Moderately critical - Access bypass - SA-CONTRIB-2026-026 Read post

OpenID Connect / OAuth client - Moderately critical - Server-side request forgery, Information disclosure - SA-CONTRIB-2026-025 Read post

Google Analytics GA4 - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-024 Read post

Calculation Fields - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-023 Read post

AJAX Dashboard - Critical - Access bypass - SA-CONTRIB-2026-022 Read post

File Access Fix (deprecated) - Moderately critical - Access bypass - SA-CONTRIB-2026-021 Read post

File Access Fix (deprecated) - Moderately critical - Access bypass - SA-CONTRIB-2026-020 Read post

Responsive Favicons - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-019 Read post

SAML SSO - Service Provider - Critical - Cross-site scripting - SA-CONTRIB-2026-018 Read post

Drupal Canvas - Moderately critical - Server-side request forgery, Information disclosure - SA-CONTRIB-2026-017 Read post

Islandora - Moderately critical - Arbitrary file upload, Cross-site scripting - SA-CONTRIB-2026-016 Read post

CAPTCHA - Moderately critical - Access bypass - SA-CONTRIB-2026-015 Read post

Anti-Spam by CleanTalk - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-014 Read post

Tagify - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-013 Read post

Theme Negotiation by Rules - Moderately critical - Cross-site request forgery - SA-CONTRIB-2026-012 Read post

Material Icons - Moderately critical - Access bypass - SA-CONTRIB-2026-011 Read post

UI Icons - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-010 Read post

Quick Edit - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-009 Read post

Login Disable - Less critical - Access bypass - SA-CONTRIB-2026-008 Read post

Central Authentication System (CAS) Server - Less critical - XML Element Injection - SA-CONTRIB-2026-007 Read post