https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T02:22:27.424133+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/drupal-contrib-2026-063 DRUPAL-CONTRIB-2026-063 2026-10-04T02:22:27.427398+00:00

Affected: Packagist:https://packages.drupal.org/8: drupal/salesforce

The Salesforce Suite of modules integrates Drupal with Salesforce.

The Salesforce module does not properly validate the OAuth handshake during interactive authentication, allowing an attacker to hijack the authorization token and bind the site to an attacker's Salesforce account.

This vulnerability is mitigated by the fact that `salesforce_oauth` submodule must be enabled, and a `salesforce_oauth` authorization profile active and in use. The submodule `salesforce_oauth` is deprecated, and `salesforce_jwt` has been the recommended authentication plugin for several years. Sites with `salesforce_oauth` uninstalled, or sites relying exclusively on `salesforce_jwt` (JWT or JWT Gov Cloud) for authentication are not impacted.

Submodule salesforce\_oauth has been removed in branch 6.0.x, so >= 6.0.x versions are not affected by this vulnerability.

 https://cve.radiocsirt.org/vuln/euvd-2026-336094 EUVD-2026-336094 2026-10-04T02:22:27.427449+00:00 EUVD-2026-336094 https://cve.radiocsirt.org/vuln/fkie_cve-2026-13243 fkie_cve-2026-13243 2026-10-04T02:22:27.427466+00:00

Cross-Site Request Forgery (CSRF) vulnerability in Drupal Salesforce Suite allows Cross Site Request Forgery. This issue affects Salesforce Suite versions: from 0.0.0 to 5.1.3.

 https://cve.radiocsirt.org/vuln/ghsa-585m-5jj4-5474 GHSA-585m-5jj4-5474 2026-10-04T02:22:27.427488+00:00

Cross-Site Request Forgery (CSRF) vulnerability in Drupal Salesforce Suite allows Cross Site Request Forgery. This issue affects Salesforce Suite versions: from 0.0.0 to 5.1.3.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2080 WID-SEC-W-2026-2080 — Drupal: Mehrere Schwachstellen 2026-10-04T02:22:27.427502+00:00

Ein Angreifer kann mehrere Schwachstellen in Drupal ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um einen Cross-Site Scripting Angriff durchzuführen, um Informationen offenzulegen, um einen SQL-Injection Angriff durchzuführen, und um Daten zu manipulieren.