Jess (xjm)

Drupal core - Critical - PHP object injection - SA-CORE-2026-005

Drupal core - Moderately critical - Gadget chain - SA-CORE-2026-006

Drupal core - Less critical - Cache poisoning and open redirect - SA-CORE-2026-007

Drupal core - Moderately critical - Server-side request forgery - SA-CORE-2026-008

Drupal core - Moderately critical - Improper validation - SA-CORE-2026-009

Formatter Field - Critical - PHP object injection - SA-CONTRIB-2026-048

Flag attendance field - Critical - PHP object injection - SA-CONTRIB-2026-049

Plotly.js Graphing - Critical - PHP object injection - SA-CONTRIB-2026-050

Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-003

SAML SSO - Service Provider - Critical - Authentication bypass - SA-CONTRIB-2026-031