Jess (xjm)

Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-011

Drupal core - Moderately critical - Information disclosure - SA-CORE-2026-010

Config Pages - Moderately critical - Access bypass - SA-CONTRIB-2025-093

Drupal core - Critical - PHP object injection - SA-CORE-2026-005

Drupal core - Moderately critical - Gadget chain - SA-CORE-2026-006

Drupal core - Less critical - Cache poisoning and open redirect - SA-CORE-2026-007

Drupal core - Moderately critical - Server-side request forgery - SA-CORE-2026-008

Drupal core - Moderately critical - Improper validation - SA-CORE-2026-009

Formatter Field - Critical - PHP object injection - SA-CONTRIB-2026-048

Flag attendance field - Critical - PHP object injection - SA-CONTRIB-2026-049