https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T19:10:49.083169+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/drupal-contrib-2026-017 DRUPAL-CONTRIB-2026-017 2026-10-03T19:10:49.142974+00:00

Affected: Packagist:https://packages.drupal.org/8: drupal/canvas

This module enables you to easily theme and build an entire website using only their browser, without the need to write code beyond basic JSX and CSS. Content creators are able to compose content on any part of the page without relying on developers.

The project has a hidden sub-module, **Drupal Canvas AI**, which is disabled by default. It is typically enabled as a dependency by Drupal Recipes or enabled directly via deployment scripts (e.g., Drush). When the submodule is enabled, the following vulnerability is exposed.

The module doesn't sufficiently sanitize user-supplied data via crafted API requests within the messages JSON payload.

It is mitigated by the fact that an attacker must have a role with the permission "use Drupal Canvas AI".

**How the Canvas AI sub-module gets enabled:** As a hidden submodule, `canvas_ai` is not intended for manual activation via the UI. It is designed to be pulled in as a dependency by Drupal Recipes or enabled directly via deployment scripts (e.g., Drush).

 https://cve.radiocsirt.org/vuln/euvd-2026-277790 EUVD-2026-277790 2026-10-03T19:10:49.143035+00:00 EUVD-2026-277790 https://cve.radiocsirt.org/vuln/fkie_cve-2026-3216 fkie_cve-2026-3216 2026-10-03T19:10:49.143052+00:00

Server-Side Request Forgery (SSRF) vulnerability in Drupal Drupal Canvas allows Server Side Request Forgery.This issue affects Drupal Canvas: from 0.0.0 before 1.1.1.

 https://cve.radiocsirt.org/vuln/ghsa-6qhv-qccp-876q GHSA-6qhv-qccp-876q 2026-10-03T19:10:49.143074+00:00

Server-Side Request Forgery (SSRF) vulnerability in Drupal Drupal Canvas allows Server Side Request Forgery.This issue affects Drupal Canvas: from 0.0.0 before 1.1.1.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0530 WID-SEC-W-2026-0530 — Drupal Extensions: Mehrere Schwachstellen 2026-10-03T19:10:49.143088+00:00

Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in verschiedenen Drupal Extensions ausnutzen, um Cross-Site-Scripting-Angriffe zu starten, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren und vertrauliche Informationen offenzulegen.