Most recent entries from all

bdu:2025-01219

2026-10-05T19:47:48.084099+00:00

bdu:2025-01219

DRUPAL-CONTRIB-2024-039

2026-10-05T19:47:48.084138+00:00

Affected: Packagist:https://packages.drupal.org/8: drupal/seckit

This module provides Drupal with various security-hardening options, for example by emitting various configurable HTTP response headers.

The module doesn't sufficiently validate input in Content Security Policy (CSP) violation reports. This can cause errors when a logging module (e.g. dblog or syslog) attempts to parse the resulting log message which contains invalid data.

This vulnerability is mitigated by the fact that to be affected a site must have seckit's CSP reporting functionality enabled. Recent versions of Drupal 10 and 11 core are not vulnerable due to [improved parsing of log messages](https://www.drupal.org/project/drupal/issues/2481349).

EUVD-2026-210467

2026-10-05T19:47:48.084179+00:00

EUVD-2026-210467

fkie_cve-2024-13275

2026-10-05T19:47:48.084192+00:00

Access of Resource Using Incompatible Type ('Type Confusion') vulnerability in Drupal Security Kit allows HTTP DoS.This issue affects Security Kit: from 0.0.0 before 2.0.3.

GHSA-jjvf-4cxj-rqv4

2026-10-05T19:47:48.084214+00:00

Access of Resource Using Incompatible Type ('Type Confusion') vulnerability in Drupal Security Kit allows HTTP DoS.This issue affects Security Kit: from 0.0.0 before 2.0.3.

WID-SEC-W-2024-2126 — Drupal: Mehrere Schwachstellen ermöglichen Offenlegung von Informationen und Denial of Service

2026-10-05T19:47:48.084228+00:00

Ein entfernter, authentisierter oder anonymer Angreifer kann mehrere Schwachstellen in Drupal ausnutzen, um Informationen offenzulegen und um einen Denial-of-Service-Zustand zu erzeugen.