Dave Long (longwave)

Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-011

Drupal AlternativeCommerce (Basket) - Highly critical - Arbitrary PHP code execution - SA-CONTRIB-2026-038

LocalGov Workflows - Moderately critical - Information disclosure - SA-CONTRIB-2026-039

Commerce Core - Moderately critical - Cross site scripting - SA-CONTRIB-2026-041

Tagify - Moderately critical - Cross-site scripting (XSS) - SA-CONTRIB-2026-043

Drupal core - Critical - PHP object injection - SA-CORE-2026-005

Drupal core - Moderately critical - Gadget chain - SA-CORE-2026-006

Drupal core - Less critical - Cache poisoning and open redirect - SA-CORE-2026-007

Drupal core - Moderately critical - Server-side request forgery - SA-CORE-2026-008

Drupal core - Moderately critical - Improper validation - SA-CORE-2026-009