https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T16:01:29.611118+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/drupal-contrib-2025-100 DRUPAL-CONTRIB-2025-100 2026-10-03T16:01:29.613757+00:00

Affected: Packagist:https://packages.drupal.org/8: drupal/facets

This module enables you to to easily create and manage faceted search interfaces.

The module doesn’t sufficiently filter certain user-provided text leading to a cross site scripting (XSS) vulnerability.

This vulnerability is mitigated by the fact that an attacker must have a role with the permission “administer facets”.

**CVSS risk score ([experimental](https://www.drupal.org/project/securitydrupalorg/issues/3442181)) 4.8 / Medium**

[CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:L/SI:N/SA:N](https://www.first.org/cvss/calculator/4-0#CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:L/SI:N/SA:N)

 https://cve.radiocsirt.org/vuln/euvd-2026-255174 EUVD-2026-255174 2026-10-03T16:01:29.613826+00:00 EUVD-2026-255174 https://cve.radiocsirt.org/vuln/fkie_cve-2025-9550 fkie_cve-2025-9550 2026-10-03T16:01:29.613842+00:00

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Facets allows Cross-Site Scripting (XSS).This issue affects Facets: from 0.0.0 before 2.0.10, from 3.0.0 before 3.0.1.

 https://cve.radiocsirt.org/vuln/ghsa-5x6h-48h5-777v GHSA-5x6h-48h5-777v 2026-10-03T16:01:29.613865+00:00

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Facets allows Cross-Site Scripting (XSS).This issue affects Facets: from 0.0.0 before 2.0.10, from 3.0.0 before 3.0.1.