https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-09T16:20:33.138777+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cnvd-2018-05186 cnvd-2018-05186 2026-10-09T16:20:33.145084+00:00 cnvd-2018-05186 https://cve.radiocsirt.org/vuln/euvd-2026-178875 EUVD-2026-178875 2026-10-09T16:20:33.145121+00:00 EUVD-2026-178875 https://cve.radiocsirt.org/vuln/fkie_cve-2017-6927 fkie_cve-2017-6927 2026-10-09T16:20:33.145135+00:00

Drupal 8.4.x versions before 8.4.5 and Drupal 7.x versions before 7.57 has a Drupal.checkPlain() JavaScript function which is used to escape potentially dangerous text before outputting it to HTML (as JavaScript output does not typically go through Twig autoescaping). This function does not correctly handle all methods of injecting malicious HTML, leading to a cross-site scripting vulnerability under certain circumstances. The PHP functions which Drupal provides for HTML escaping are not affected.

 https://cve.radiocsirt.org/vuln/ghsa-585j-5449-mf5m GHSA-585j-5449-mf5m — Drupal cross-site scripting vulnerability 2026-10-09T16:20:33.145166+00:00

Affected: Packagist: drupal/core, Packagist: drupal/drupal

Drupal 8.4.x versions before 8.4.5 and Drupal 7.x versions before 7.57 has a Drupal.checkPlain() JavaScript function which is used to escape potentially dangerous text before outputting it to HTML (as JavaScript output does not typically go through Twig autoescaping). This function does not correctly handle all methods of injecting malicious HTML, leading to a cross-site scripting vulnerability under certain circumstances. The PHP functions which Drupal provides for HTML escaping are not affected.

 https://cve.radiocsirt.org/vuln/gsd-2017-6927 gsd-2017-6927 2026-10-09T16:20:33.145201+00:00 gsd-2017-6927 https://cve.radiocsirt.org/vuln/ubuntu-cve-2017-6927 UBUNTU-CVE-2017-6927 2026-10-09T16:20:33.145214+00:00

Affected: Ubuntu:Pro:14.04:LTS: drupal7, Ubuntu:Pro:16.04:LTS: drupal7

Drupal 8.4.x versions before 8.4.5 and Drupal 7.x versions before 7.57 has a Drupal.checkPlain() JavaScript function which is used to escape potentially dangerous text before outputting it to HTML (as JavaScript output does not typically go through Twig autoescaping). This function does not correctly handle all methods of injecting malicious HTML, leading to a cross-site scripting vulnerability under certain circumstances. The PHP functions which Drupal provides for HTML escaping are not affected.