Most recent entries from all

DRUPAL-CONTRIB-2026-153

2026-10-23T00:01:03.589384+00:00

Affected: Packagist:https://packages.drupal.org/8: drupal/ultimate_table_field

The Ultimate Table Field module enables you to store table data in a field and edit each table cell through a dialog, using cell field plugins such as text, link, and file.

The module doesn't sufficiently protect the route that opens the cell editor dialog. The route is accessible to anonymous users, who can open the dialog for any cell type. The dialog allows uploading files to the server location.

This vulnerability is partially mitigated by the fact that only files with the `pdf`, `doc` and `docx` extensions are accepted.

fkie_cve-2026-87955

2026-10-23T00:01:03.589469+00:00

Missing Authorization vulnerability in Drupal Ultimate Table Field allows Forceful Browsing. This issue affects Ultimate Table Field versions: from 0.0.0 to 1.1.1, from 2.0.0 to 2.0.1.

GHSA-7r58-7q87-mv6m

2026-10-23T00:01:03.589509+00:00

Missing Authorization vulnerability in Drupal Ultimate Table Field allows Forceful Browsing. This issue affects Ultimate Table Field versions: from 0.0.0 to 1.1.1, from 2.0.0 to 2.0.1.

WID-SEC-W-2026-3284 — Drupal Erweiterungen: Mehrere Schwachstellen

2026-10-23T00:01:03.589525+00:00

Ein Angreifer kann mehrere Schwachstellen in Drupal ausnutzen, um Datenbankinhalte zu manipulieren oder auszulesen, Zugriffsbeschränkungen und Authentifizierungsmechanismen zu umgehen, vertrauliche Informationen offenzulegen, Cross Site Scripting Angriffe auszuführen, Benutzer auf manipulierte Webseiten umzuleiten, SAML-Authentifizierungen zu beeinflussen oder wiederzuverwenden, interne Ressourcen über SSRF anzusprechen sowie unberechtigt Dateien auf den Server hochzuladen.