Most recent entries from all

DRUPAL-CONTRIB-2026-010

Affected: Packagist:https://packages.drupal.org/8: drupal/ui_icons

This module enables you to integrate and manage icons with Drupal.

The module doesn't sufficiently sanitize user input leading to a reflected Cross-site Scripting (XSS) vulnerability.

The vulnerability is mitigated by the fact that in order to be vulnerable, the "UI Icons for CKEditor 5" submodule must be enabled.

*Note: this SA was edited after release to correct the risk score; there is no user authentication requirement.*

EUVD-2026-277479

fkie_cve-2026-2349

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal UI Icons allows Cross-Site Scripting (XSS).This issue affects UI Icons: from 0.0.0 before 1.0.1, from 1.1.0 before 1.1.1.

GHSA-7478-wj8x-xfw9

WID-SEC-W-2026-0397 — Drupal Module (UI Icons, Quick Edit): Mehrere Schwachstellen ermöglichen Cross-Site Scripting

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Drupal ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen.