https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-19T10:49:32.666633+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2025-01029 bdu:2025-01029 2026-10-19T10:49:32.689052+00:00 bdu:2025-01029 https://cve.radiocsirt.org/vuln/drupal-contrib-2024-060 DRUPAL-CONTRIB-2024-060 2026-10-19T10:49:32.689091+00:00

Affected: Packagist:https://packages.drupal.org/8: drupal/postfile

The module creates an endpoint on the site at /postfile/upload that accepts a POST request for uploading a single file into a specified file system (public, private, etc).

This module accepts any uploaded file extension, including dangerous file formats so it can be used to bypass the allow\_insecure\_uploads config.

This vulnerability is mitigated by the fact that an attacker must have a role with the permission "postfile upload".

 https://cve.radiocsirt.org/vuln/euvd-2026-210078 EUVD-2026-210078 2026-10-19T10:49:32.689129+00:00 EUVD-2026-210078 https://cve.radiocsirt.org/vuln/fkie_cve-2024-13294 fkie_cve-2024-13294 2026-10-19T10:49:32.689142+00:00

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal POST File allows Cross-Site Scripting (XSS).This issue affects POST File: from 0.0.0 before 1.0.2.

 https://cve.radiocsirt.org/vuln/ghsa-9838-cxcw-r6rf GHSA-9838-cxcw-r6rf 2026-10-19T10:49:32.689164+00:00

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal POST File allows Cross-Site Scripting (XSS).This issue affects POST File: from 0.0.0 before 1.0.2.