Affected: Packagist:https://packages.drupal.org/8: drupal/webform

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. Form submissions may include uploaded files.

The module does not sufficiently force certain uploaded file types to download when served. Under certain site configurations, a file uploaded through a webform could be rendered inline by a browser, resulting in a cross-site scripting vulnerability.

This vulnerability is mitigated by the fact that a user with permission to create or edit webforms must configure the form to allow the affected file extensions, and a user must specifically open the uploaded file.

Affected: Packagist:https://packages.drupal.org/8: drupal/diba_carousel

The Diba Carousel Slider adds a Bootstrap carousel slider block that can be used directly without creating a View or custom integration.

When the "Allow HTML description" option is enabled, slide descriptions are rendered using the raw stored field value instead of the field's rendered output. This bypasses Drupal's text format filtering and output sanitization mechanisms.

This vulnerability affects sites that use a formatted text field as the carousel description source and have enabled the "Allow HTML description" option.

Affected: Packagist:https://packages.drupal.org/8: drupal/ai_ckeditor

This module enables you to use AI to fill in or replace text in CKEditor.

The module doesn't sufficiently mitigate Twig template injections in certain AI CKEditor rules, making it possible to use Twig functions to extract certain confidential system data.

Affected: Packagist:https://packages.drupal.org/8: drupal/combined_image_style

This module enables you to combine multiple image styles into a single image derivative.

The module does not sufficiently validate image style names when generating image derivatives. Under certain circumstances, this allows anonymous users to generate image derivatives without a valid token, potentially leading to a denial of service.

Sites are affected simply by having the module installed, even when no combined image styles are configured or in use.

This vulnerability is mitigated by the fact that only public files can be targeted, and derivatives of private files are still protected by core's token check.

Affected: Packagist:https://packages.drupal.org/8: drupal/css_usage_analyzer

This module lets a frontend scanner post CSS-usage measurements to the site so admin reports can show real-page statistics.

This module doesn't sufficiently protect the `/css-usage-analyzer/save` endpoint against forged or repeated submissions.

Affected: Packagist:https://packages.drupal.org/8: drupal/smart_content

This module enables you to personalize content for anonymous and authenticated users by showing different blocks to visitors based on client-side conditions.

The Smart Content Block submodule doesn't sufficiently check block access when it renders the blocks of a "Display Blocks" reaction through the module's AJAX endpoint.

This vulnerability is mitigated by the fact that a site must have placed a block whose access is restricted to certain users inside a Display Blocks reaction. Sites that only use Views blocks in reactions are not affected, because Views re-checks access when the view is executed.

Affected: Packagist:https://packages.drupal.org/8: drupal/webform_rest

This module enables you to retrieve and submit webforms via REST.

The module doesn't sufficiently check permission to webform and webform submission entities when retrieving webform elements or fields.

Affected: Packagist:https://packages.drupal.org/8: drupal/editoria11y

This module runs a client-side accessibility checker that automatically reports results to dashboard views over an API.

The module incorrectly described a permission as a "view" permission when it grants edit and delete access to module data, resulting in a potential access bypass.

Affected: Packagist:https://packages.drupal.org/8: drupal/tawk_to

This module provides integration of the tawk.to live chat for Drupal sites.

The module does not sufficiently validate certain requests. This may allow an attacker to trick an authenticated user into performing unintended actions through a Cross-Site Request Forgery (CSRF) vulnerability.

Affected: Packagist:https://packages.drupal.org/8: drupal/rest_api_authentication

This module enables you to add an extra authentication layer to the API.

The module does not sufficiently validate authentication requirements for all API requests, which can result in an access bypass vulnerability.