https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T07:16:52.999076+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/drupal-contrib-2026-076 DRUPAL-CONTRIB-2026-076 2026-10-04T07:16:53.004038+00:00

Affected: Packagist:https://packages.drupal.org/8: drupal/ai_seo

The AI SEO/GEO Analyzer module generates SEO/GEO analysis reports by sending content of an entity (including its comments) to an LLM, then converts the model's Markdown response to HTML and stores it for display to privileged users.

The generated HTML was rendered without passing through Drupal's filtering pipeline, so it relied on the LLM output being safe. Under certain circumstances a crafted prompt injection — planted in content that is included in the analysis — can cause the LLM to emit markup that results in stored Cross-site Scripting when the report is later viewed.

This vulnerability is mitigated by the fact that an attacker must be able to inject text into the content that is sent to the LLM, and that prompt injection is non-deterministic and not guaranteed to succeed on a given attempt.

 https://cve.radiocsirt.org/vuln/euvd-2026-336150 EUVD-2026-336150 2026-10-04T07:16:53.004135+00:00 EUVD-2026-336150 https://cve.radiocsirt.org/vuln/fkie_cve-2026-15085 fkie_cve-2026-15085 2026-10-04T07:16:53.004167+00:00

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI SEO/GEO Analyzer allows Stored XSS. This issue affects AI SEO/GEO Analyzer versions: from 0.0.0 to 1.1.3.

 https://cve.radiocsirt.org/vuln/ghsa-xg2f-c7h9-qw99 GHSA-xg2f-c7h9-qw99 2026-10-04T07:16:53.004223+00:00

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI SEO/GEO Analyzer allows Stored XSS. This issue affects AI SEO/GEO Analyzer versions: from 0.0.0 to 1.1.3.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2251 WID-SEC-W-2026-2251 — Drupal Module: Mehrere Schwachstellen 2026-10-04T07:16:53.004252+00:00

Ein Angreifer kann mehrere Schwachstellen in Drupal ausnutzen, umSQL-Injection-Angriffe durchzuführen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen und Cross-Site-Scripting-Angriffe durchzuführen.