Most recent entries from all

DRUPAL-CONTRIB-2026-094

Affected: Packagist:https://packages.drupal.org/8: drupal/entity_browser

The Entity Browser module allows you to select entities from entity reference fields using a custom entity browser widget.

The module doesn't sufficiently sanitize the the tab titles, resulting in a stored cross-site scripting (XSS) vulnerability.

The vulnerability is mitigated by the fact an attacker must be able to insert HTML with specific attributes on a page that is displaying an entity browser.

fkie_cve-2026-18986

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Entity Browser allows Stored XSS. This issue affects Entity Browser versions: from 0.0.0 to 2.16.0.

Most recent entries from all

DRUPAL-CONTRIB-2026-094

fkie_cve-2026-18986

GHSA-h52g-f94f-r87h