PHP: уязвимости стека · Страница 21

Drupal core - Moderately critical - Information disclosure - SA-CORE-2026-010

Missing Authorization vulnerability in Drupal Drupal core allows Forceful Browsing. This issue affects Drupal core versions: from 0.0.0 to 10.6.13, from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, from 0.0.0 to 11.0.*, from 0.0.0 to 11.1.*, from 0.0.0 to 11.2.*.

• Обновитесь до 10.6.13
• Обновитесь до 11.1.0
• Обновитесь до 11.2.0
• Обновитесь до 11.3.0
• Обновитесь до 11.3.14
• Обновитесь до 11.4.4

Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-011

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Drupal core versions: from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, from 0.0.0 to 11.2.*.

• Обновитесь до 11.3.0
• Обновитесь до 11.3.14
• Обновитесь до 11.4.4

Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-012

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Stored XSS. This issue affects Drupal core versions: from 0.0.0 to 10.6.13, from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, from 0.0.0 to 11.0.*, from 0.0.0 to 11.1.*, from 0.0.0 to 11.2.*.

• Обновитесь до 10.6.13
• Обновитесь до 11.1.0
• Обновитесь до 11.2.0
• Обновитесь до 11.3.0
• Обновитесь до 11.3.14
• Обновитесь до 11.4.4

Media Folders - Moderately critical - Cross site scripting - SA-CONTRIB-2026-080

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Media Folders allows Stored XSS. This issue affects Media Folders versions: from 0.0.0 to 1.0.8.

• Обновитесь до 1.0.8

Internationalization Single Sign-On - Critical - Access bypass - SA-CONTRIB-2026-081

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Internationalization Single Sign-On allows Authentication Bypass. This issue affects Internationalization Single Sign-On versions: from 0.0.0 to 1.8.0.

• Обновитесь до 1.8.0

Search API Autocomplete - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-082

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Search API Autocomplete allows Reflected XSS. This issue affects Search API Autocomplete versions: from 0.0.0 to 1.12.0.

• Обновитесь до 1.12.0

Commerce Elavon - Critical - Unsupported - SA-CONTRIB-2026-084

Vulnerability in Drupal Commerce Elavon. This issue affects Commerce Elavon versions: *.*.

Email Login OTP - Critical - Unsupported - SA-CONTRIB-2026-085

Vulnerability in Drupal Email Login OTP. This issue affects Email Login OTP versions: *.*.

Lunr exposed filters - Critical - Unsupported - SA-CONTRIB-2026-086

Vulnerability in Drupal Lunr exposed filters. This issue affects Lunr exposed filters versions: *.*.

Webform REST - Moderately critical - Access bypass - SA-CONTRIB-2026-087

Incorrect Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. This issue affects Webform REST versions: from 0.0.0 to 4.1.0.

• Обновитесь до 4.1.0

PhotoSwipe - Responsive JavaScript Modal Image Gallery - Moderately critical - Access bypass - SA-CONTRIB-2026-088

Missing Authorization vulnerability in Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery allows Forceful Browsing. This issue affects PhotoSwipe - Responsive JavaScript Modal Image Gallery versions: from 0.0.0 to 3.2.0.

• Обновитесь до 3.2.0

Development Environment - Critical - Unsupported - SA-CONTRIB-2026-089

Vulnerability in Drupal Development Environment. This issue affects Development Environment versions: *.*.

Token Content Access - Moderately critical - Access bypass - SA-CONTRIB-2026-090

Observable Timing Discrepancy vulnerability in Drupal Token Content Access allows Brute Force. This issue affects Token Content Access versions: from 0.0.0 to 3.1.2.

• Обновитесь до 3.1.2

Disable Login Page - Moderately critical - Access bypass - SA-CONTRIB-2026-110

Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Disable Login Page allows Brute Force. This issue affects Disable Login Page versions: from 0.0.0 to 1.1.4.

• Обновитесь до 1.1.4

Edit in-place field - Moderately critical - Access bypass - SA-CONTRIB-2026-093

Incorrect Authorization vulnerability in Drupal Edit in-place field allows Forceful Browsing. This issue affects Edit in-place field versions: from 0.0.0 to 2.1.1.

• Обновитесь до 2.1.1

MCP PHP SDK: Unbounded SSE buffer in HttpTransport enables client-side denial of service

The MCP PHP SDK (Composer package mcp/sdk) is the official Model Context Protocol SDK for PHP. In versions 0.5.0 through 0.7.0, the HTTP client transport reads a Server-Sent Events response stream incrementally and appends each chunk to an in-memory buffer with no upper bound. The buffer is only flushed when an SSE event delimiter, a double newline, is found, so a remote MCP server that streams response bytes without ever sending the delimiter causes the buffer to grow without limit. A malicious, compromised, or man-in-the-middle-controlled server that the client connects to over the HTTP transport can exploit this to exhaust the client proce

• Обновитесь до 0.7.1

Winter CMS before 1.2.13 Twig Sandbox Escape via SecurityPolicy

Winter CMS versions before 1.2.13 contain an incomplete fix for a Twig sandbox escape vulnerability in System\\Twig\\SecurityPolicy that allows authenticated backend users with template-editing permissions to bypass sandbox restrictions. Attackers can exploit method forwarding through Eloquent models and query builders using methods like saveQuietly(), deleteQuietly(), increment(), decrement(), and newQuery() to read and modify arbitrary database records, execute arbitrary SQL, and achieve remote code execution by injecting PHP into template code sections.

• Обновитесь до 1.2.13

Winter CMS before 1.2.13 Local File Inclusion via JavaScript

Winter CMS before 1.2.13 contains a local file inclusion vulnerability in the JavascriptImporter filter that allows authenticated users with cms.manage_assets permission to disclose arbitrary server-readable files by placing =include or =require directives in theme JavaScript assets. Attackers can reference files like .env outside the theme directory, and the combined output served through the combine route becomes readable by unauthenticated visitors, exposing application keys and database credentials.

• Обновитесь до 1.2.13

Grav before 2.0.16 Information Disclosure via Twig Sandbox

Grav before 2.0.16 contains an incomplete default denylist in the Twig sandbox configuration that fails to block access to system configuration secrets. Attackers with page-edit permission can use config.get() or config.toArray() in Twig templates to retrieve sensitive values like system.cache.redis.password when config_access is enabled.

• Обновитесь до 2.0.16

Grav before 2.0.16 Information Disclosure via offsetGet

Grav before 2.0.16 allows sandboxed Twig templates to access sensitive User fields through allow-listed offsetGet() and offsetexists() methods that lack field filtering. Attackers with page-edit permissions can call offsetGet() on User objects to extract hashed passwords and 2FA secrets, enabling offline password cracking and authentication bypass.

• Обновитесь до 2.0.16