PatchFirst · Свежие уязвимости
За последние 30 дней в PHP опубликовано уязвимостей: 194; в каталоге KEV: 0.
Свежие сообщения об уязвимостях из анонсов разработчиков и новостей безопасности. Предупреждения не меняют рейтинг защищённости.
По данным OpenNet, в PHP найдена уязвимость — удалённое выполнение кода (CVE-2026-115560). Точные затронутые версии не указаны. Версия с исправлением в сообщении не указана.
Что сделать сейчас: Проверьте, вышло ли обновление PHP с исправлением, и установите его.
CVE-2026-115560
Уязвимостей: 7182
This module enables you to generate and serve WebP derivatives of image style images, overriding Drupal core's image style download controller to serve them. The module serves WebP image derivative responses with the HTTP header `Cache-Control: public` for all file schemes other than the private file system, including the temporary file system and access-controlled custom schemes. This can lead to some users getting cached versions of files with information they should not be able to access. For example, files may be cached by Varnish or a CDN. This vulnerability is mitigated by the fact that it only affects sites that serve image derivativ
TinyPNG uses smart lossy compression techniques to reduce the file size of your PNG files. The module doesn't sufficiently check access to image style derivatives when those files are served via a file stream other than `private://`. This vulnerability is mitigated by the fact that Drupal must be configured to use a contributed (non-core) file scheme to serve private derived images.
This module allows for direct viewing of a file with the URL alias. In some cases, files may be served with the HTTP header `Cache-Control: public` when they should be uncacheable. This can lead to some users getting cached versions of files with information they should not be able to access. This vulnerability is mitigated by the following: * Drupal must be configured to handle non-public files using a custom or contributed module providing an additional file scheme. * An attacker must know to request a file that has previously been requested by a more-privileged user, and that file must still be cached.
This module provides a View plugin that integrates a calendar view format powered by FullCalendar JavaScript library. This module has an access bypass vulnerability which allows to update entity fields without checking field-level access. The vulnerability is mitigated by the fact that an attacker must have access to update the entity itself.
This module enables users to upload files and create media items in bulk. The module doesn't sufficiently check user permission to create specific media types if the bulk upload form is configured for that media type. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "bulk upload form".
This module introduces an OAuth 2.0 authorization server, which can be configured to protect your Drupal instance with access tokens, or allow clients to request new access tokens and refresh them. Since version 6.1.0, the module could cache a token's permissions in a way that let them be reused for another user's token with the same scopes. A user could gain permissions they do not have, including administrative access. This vulnerability is mitigated by the fact that an attacker needs an OAuth2 token, and cannot trigger the issue themselves: a more privileged user's token with the same scopes must be used first. User 1 is not affected unl
This module enables editors to edit content, including paragraphs, directly on the rendered page. The module doesn't sufficiently check field access permissions when editing, deleting or adding paragraph items to entity reference revisions fields. This vulnerability is mitigated by the fact that an attacker must have a role with the permissions "access frontend editing", "add paragraphs"/"edit paragraphs"/"delete paragraphs" and also have access to update the parent entity the field belongs to.
This module enables editors to edit content, including paragraphs, directly on the rendered page. The module doesn't sufficiently protect the routes used to delete and reorder paragraphs against Cross-Site Request Forgery (CSRF). An attacker could trick an editor into visiting a crafted link, which deletes or reorders paragraphs on a node using the editor's permissions. This vulnerability is mitigated by the fact that the victim must be logged in with permission to edit the content and to delete or move paragraphs.
This module lets non-administrators approve, deactivate and delete users, limited by the roles they can delegate through Role Delegation. The module doesn't sufficiently check role delegation when approving users, and offers an Activate link for blocked administrators. It also doesn't protect user 1 from being deactivated or deleted. This vulnerability is mitigated by the fact that an attacker must have a role with one of the module's additional action permissions.
This module enables you to share users, content and configuration across a group of domains from a single Drupal installation. Its Domain Access submodule controls which domains a user may edit content on, and has an optional setting to grant user access per content type. The module doesn't sufficiently check which domains a user is assigned to when the per-content-type grant setting is enabled. This vulnerability is mitigated by the fact that the per-content-type grants setting must be enabled (it is off by default), and an attacker must have a role with the permission "Edit any content on assigned domains" or "Delete any content on assign
Provides the Bootstrap front-end framework as a Drupal theme. Bootstrap theme did not sufficiently filter certain attributes, which could lead to a cross-site scripting vulnerability. This vulnerability is mitigated by only affecting the optional tooltip and popover features. A short-term mitigation is to disable tooltips and popovers on `admin/appearance/settings/bootstrap` or `admin/appearance/settings/my_bootstrap_subtheme`.
This module allows granting access to unpublished nodes per content type. For nodes with at least one unpublished translation, the module grants every user with the "access content" permission view access to the published translations of that node. This overrides the restrictions of other node access modules, such as Content Access or Domain Access, that might have been in place for these translations. This vulnerability is mitigated by the fact that the site must be multilingual, a node must have both unpublished and published translations, and another node access module must restrict view access to the published translations.
This module provides a suite of Paragraphs bundles that works within the USWDS framework. The module's twig templates do not sufficiently sanitize values passed to its markup. This vulnerability is mitigated by the fact that an attacker must have a role to edit content that uses the paragraph bundles provided by the module.
Swiper is mobile first, layout and gestures wise, it provides great amount of options for designing your own widget and related events. This module provides a route for displaying published content entities in a dialog. The route does not sufficiently verify the current user's access to the specific entity. This vulnerability is mitigated by the fact that only rendered output is returned, and field-level access controls are still enforced.
This module allows you to define custom attributes for a block. You can specify an attribute name to be added to the block in a predefined format. The module does not sufficiently sanitize attributes against cross site scripting. This issue is mitigated by the fact that the attacker must have the `administer blocks` permission.
This theme provides a front-end design for transparency and open-government sites, including a table preview of CSV files attached to content. The theme doesn't sufficiently check file access when it renders that preview. It reads the file directly, so a visitor who may view the content, but whose download of the file is refused, can still read the file's contents on the page. A preview rendered for one visitor can also be cached and shown to another. This vulnerability is mitigated by the fact that the site must store the CSV files outside the public file system, and must restrict their download beyond access to the content itself with an
This module provides a user interface to select and configure icons, including a CKEditor 5 button and widget that embed an icon in formatted text. Under uncommon situations, the CKEditor 5 widget displays admin-controlled text with appropriate filtering leading to a Cross-site scripting (XSS) vulnerability. This vulnerability is mitigated by the fact that an attacker must have access to edit content with a text format that allows the UI Icons CKEditor 5 button.
Sector is a distribution targeted towards Drupal site builders and site owners who are looking for a fully configured Drupal project out of the box. A module specific to this distribution doesn't sufficiently sanitize media names, potentially leading to an XSS exploit. This vulnerability is mitigated by the fact that an attacker must have a role with the ability to create or edit a media entity.
The module provides integration with third party JS library SwiperJs. User-entered text is used as part of the slide without appropriate filtering leading to a cross-site scripting (XSS) vulnerability. This vulnerability is mitigated by the fact that an attacker would need a role with permission to edit the caption.
The Dopup module provides functionality for selecting and working with Webforms. The module does not perform sufficient entity access checking in some cases and may expose the title of private Webforms.
Сопоставьте установленный стек и версии со свежими базами уязвимостей.