https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-10T22:04:10.908418+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2025-00261 bdu:2025-00261 2026-10-10T22:04:10.972922+00:00 bdu:2025-00261 https://cve.radiocsirt.org/vuln/drupal-contrib-2024-071 DRUPAL-CONTRIB-2024-071 2026-10-10T22:04:10.972964+00:00

Affected: Packagist:https://packages.drupal.org/8: drupal/entity_form_steps

This module allows a site builder to create multi-step entity forms leveraging the Field Group field type plugins.

The module doesn't escape plain text administrative configurations. An attacker with admin access could inject arbitrary JavaScript code.

This vulnerability is mitigated by the fact that an attacker must have a role with the 'administer [entity\_type] form display' permission allowing access to configure entity form displays.

 https://cve.radiocsirt.org/vuln/euvd-2026-210002 EUVD-2026-210002 2026-10-10T22:04:10.973018+00:00 EUVD-2026-210002 https://cve.radiocsirt.org/vuln/fkie_cve-2024-13305 fkie_cve-2024-13305 2026-10-10T22:04:10.973038+00:00

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Entity Form Steps allows Cross-Site Scripting (XSS).This issue affects Entity Form Steps: from 0.0.0 before 1.1.4.

 https://cve.radiocsirt.org/vuln/ghsa-9j33-5mgw-847x GHSA-9j33-5mgw-847x 2026-10-10T22:04:10.973075+00:00

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Entity Form Steps allows Cross-Site Scripting (XSS).This issue affects Entity Form Steps: from 0.0.0 before 1.1.4.