https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 09:33:45 +0000 https://cve.radiocsirt.org/vuln/drupal-contrib-2026-066 <p><strong>Affected:</strong> Packagist:https://packages.drupal.org/8: drupal/canvas</p> <p>The Canvas module allow you to upload image files via a custom API.</p> <p>The validation rules check the file extension of the uploaded file but not the file MIME type. This may allow a malicious user to upload a file that is not an image.</p> <p>Certain web-server configurations may serve the uploaded file with its actual MIME type rather than an image type. This may lead to cross-site scripting (XSS) or other unexpected behavior.</p> <p><strong>Affected:</strong> Packagist:https://packages.drupal.org/8: drupal/canvas</p> <p>The Canvas module allow you to upload image files via a custom API.</p> <p>The validation rules check the file extension of the uploaded file but not the file MIME type. This may allow a malicious user to upload a file that is not an image.</p> <p>Certain web-server configurations may serve the uploaded file with its actual MIME type rather than an image type. This may lead to cross-site scripting (XSS) or other unexpected behavior.</p> https://cve.radiocsirt.org/vuln/drupal-contrib-2026-066 https://cve.radiocsirt.org/vuln/euvd-2026-336002 EUVD-2026-336002 https://cve.radiocsirt.org/vuln/euvd-2026-336002 https://cve.radiocsirt.org/vuln/fkie_cve-2026-58588 <p>Improper Neutralization of Input During Web Page Generation (&#34;Cross-site Scripting&#34;) vulnerability in Drupal Drupal Canvas allows Cross-Site Scripting (XSS). This issue affects Drupal Canvas versions: from 0.0.0 to 1.4.2, from 1.5.0 to 1.5.2, from 1.6.0 to 1.6.1, from 1.7.0 to 1.7.1.</p> <p>Improper Neutralization of Input During Web Page Generation (&#34;Cross-site Scripting&#34;) vulnerability in Drupal Drupal Canvas allows Cross-Site Scripting (XSS). This issue affects Drupal Canvas versions: from 0.0.0 to 1.4.2, from 1.5.0 to 1.5.2, from 1.6.0 to 1.6.1, from 1.7.0 to 1.7.1.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-58588 https://cve.radiocsirt.org/vuln/ghsa-4jgx-vqf2-p9g9 <p>Improper Neutralization of Input During Web Page Generation (&#34;Cross-site Scripting&#34;) vulnerability in Drupal Drupal Canvas allows Cross-Site Scripting (XSS). This issue affects Drupal Canvas versions: from 0.0.0 to 1.4.2, from 1.5.0 to 1.5.2, from 1.6.0 to 1.6.1, from 1.7.0 to 1.7.1.</p> <p>Improper Neutralization of Input During Web Page Generation (&#34;Cross-site Scripting&#34;) vulnerability in Drupal Drupal Canvas allows Cross-Site Scripting (XSS). This issue affects Drupal Canvas versions: from 0.0.0 to 1.4.2, from 1.5.0 to 1.5.2, from 1.6.0 to 1.6.1, from 1.7.0 to 1.7.1.</p> https://cve.radiocsirt.org/vuln/ghsa-4jgx-vqf2-p9g9 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2181 <p>Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Drupal ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen, Sicherheitsmaßnahmen zu umgehen und Daten zu manipulieren.</p> <p>Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Drupal ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen, Sicherheitsmaßnahmen zu umgehen und Daten zu manipulieren.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2181