Most recent entries from all

DRUPAL-CONTRIB-2026-271

Affected: Packagist:https://packages.drupal.org/8: drupal/ai

This module provides a framework for integrating AI providers and features into Drupal.

Audio for every speech-to-text request is written to the same file in the temporary directory and does not delete it afterwards. As a result, an attacker who can read the site's temporary directory could get the audio that another user sent for transcription.

This vulnerability is mitigated by the fact that the attacker needs read access to the temporary directory, either through the server (for example a shared hosting account) or through a module or custom code that exposes temporary files to other users. Drupal core's `system.temporary` route only serves temporary files to the user who owns them.

fkie_cve-2026-118551

Insecure Storage of Sensitive Information vulnerability in Drupal AI (Artificial Intelligence) allows Retrieve Embedded Sensitive Data. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2.

GHSA-c2vh-345q-88w5

WID-SEC-W-2026-4230 — Drupal Erweiterungen: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in Drupal ausnutzen, um erweiterte Berechtigungen zu erlangen und Benutzerkonten zu übernehmen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen, Daten zu manipulieren, Cross-Site-Scripting-Angriffe durchzuführen und nicht näher spezifizierte Auswirkungen zu verursachen.