Displaying 1 - 50 of 71
Title Status Priority Category Version Component Replies Last updatedsort ascending Assigned to Created
Clarify scope for Open Redirect Active Normal Task 7.x-1.x-dev Documentation 4 3 days 8 hours 2 weeks 5 days
September 2026 CVEs Active Normal Task 7.x-1.x-dev Code 2 5 days 5 hours 1 week 6 days
Publish CVE-2026-19030 for CAPTCHA failure provides login credential validation feedback Needs review Normal Task 7.x-1.x-dev Code 11 1 week 18 hours 3 months 1 week
Publish CVE-2026-16136 for Views Reference Filter (enttityreference_filter) Needs review Normal Task 7.x-1.x-dev Code 4 1 week 19 hours 2 months 2 weeks
CVE-2026-77152 - Publish Field Collection CVE ID Needs review Normal Support request 7.x-1.x-dev Code 8 1 week 19 hours 1 month 3 weeks
Update policy to explicitly state security issues will be handled privately Active Normal Feature request 7.x-1.x-dev Security Working Group (policy questions) 6 1 week 1 day 4 years 2 weeks
August 2026 CVEs Needs work Normal Task 7.x-1.x-dev Code 9 1 week 4 days 3 weeks 13 hours
Proposed documentation page: Credentials optionally stored in plain text is not considered a vulnerability Active Normal Task 7.x-1.x-dev Code 5 1 week 5 days 2 weeks 7 hours
Automatically update security release node's short description with SA Active Normal Feature request 7.x-1.x-dev Code 1 1 week 6 days 1 week 6 days
Define standard description for marking an existing permission as "restrict access" Active Normal Task 7.x-1.x-dev Documentation 10 2 weeks 5 days 5 months 4 days
Clarify/document our policy about XSS payloads Needs review Normal Task 7.x-1.x-dev Code 8 2 weeks 6 days 2 months 1 week
[policy] Treat CAPTCHA bypasses as non-security bugs Active Normal Plan 7.x-1.x-dev Code 21 1 month 1 week 5 months 5 days
Policy: AI tools allow "anyone" to attack sites, so lower-score vulnerabilities should still be given SAs Active Normal Feature request 7.x-1.x-dev Security Working Group (policy questions) 4 1 month 1 week 1 month 2 weeks
CVE request for LDAP - CVE-2026-6908 Needs review Normal Task 7.x-1.x-dev Code 10 1 month 1 week 5 months 4 days
Policy about issuing security advisories Active Normal Support request 7.x-1.x-dev Security Working Group (policy questions) 2 1 month 2 weeks 1 month 2 weeks
Change policy regarding timeline for resolution and disclosure of security vulnerabilities to be more strict Active Normal Task 7.x-1.x-dev Security Working Group (policy questions) 21 1 month 3 weeks 4 years 4 months
Publish CVE-2026-16132 for Icon Needs review Normal Support request 7.x-1.x-dev Documentation 3 1 month 3 weeks 2 months 2 weeks
Create script to pull advisory data to csv files Needs review Normal Task 7.x-1.x-dev Code 3 2 months 1 day 2 months 3 days
Expand the ability of module maintainers to mark a particular release as security. Active Major Task 7.x-1.x-dev Code 6 2 months 3 weeks 2 years 2 months
Document the labels on security issues in Drupalcode Needs review Normal Task 7.x-1.x-dev Code 8 2 months 3 weeks 2 months 4 weeks
Unsuported Modules: Establish timeline for publishing of vulnerability info to allow for possible CVE creation Active Normal Task 7.x-1.x-dev Documentation 7 3 months 1 week 1 year 8 months
Switch to CVSS scoring Active Normal Task 7.x-1.x-dev Code 17 3 months 1 week 2 years 4 months
OpenID Connect: Request update to CVE-2026-3530 Needs review Normal Task 7.x-1.x-dev Code 3 3 months 2 weeks 3 months 3 weeks
OpenID Connect: Request update to CVE-2026-3531 Needs review Normal Task 7.x-1.x-dev Code 3 3 months 2 weeks 3 months 3 weeks
OpenID Connect: Request update to CVE-2026-3532 Needs review Normal Task 7.x-1.x-dev Code 3 3 months 2 weeks 3 months 3 weeks
CAPTCHA: Request update to CVE-2026-3214 Needs review Normal Task 7.x-1.x-dev Code 2 3 months 2 weeks 3 months 2 weeks
GitLab security issue template should ask for impacted version Active Normal Bug report 7.x-1.x-dev User interface 1 3 months 3 weeks 3 months 3 weeks
Plan for how to meet 72 hour publication obligation (CNAv4.1 section 4.5.1.4) Active Normal Plan 7.x-1.x-dev Security Working Group (policy questions) 3 3 months 3 weeks 4 months 5 days
Documenting the Security/CVE process for D7ES providers Active Normal Task 7.x-1.x-dev Documentation 5 4 months 2 weeks aangel 1 year 1 month
Review and adopt CWE assignments from NIST Active Normal Task 7.x-1.x-dev Code 1 7 months 4 days 7 months 4 days
Align DST vulnerability determination criteria to CVE standards Active Critical Support request 7.x-1.x-dev Security Working Group (policy questions) 11 1 year 3 weeks 2 years 2 weeks
Incorrect affected versions on advisories Active Normal Bug report 7.x-1.x-dev Miscellaneous 2 1 year 1 month 1 year 1 month
Create CVEs for 2016 (especially for highly critical issues) Active Normal Task 7.x-1.x-dev Code 1 1 year 1 month 1 year 1 month
More flexible language for git vetted status for co-maintainers of existing projects Active Normal Plan 7.x-1.x-dev Code 42 1 year 2 months 3 years 7 months
Allow filtering the All Issues view by version Needs review Normal Feature request 7.x-1.x-dev User interface 3 1 year 2 months 1 year 2 months
Get an Open Source Security Foundation badge for Drupal (core? contrib?) Needs review Normal Task 7.x-1.x-dev Miscellaneous 11 1 year 2 months 4 years 7 months
Clarify the Drupal Security Team Disclosure Policy Active Normal Task 7.x-1.x-dev Code 2 1 year 3 months 1 year 3 months
Policy: Post CVE number / link on private issue Active Normal Feature request 7.x-1.x-dev Documentation 3 1 year 3 months 1 year 3 months
Run a static application security test (SAST) as part of core CI Active Normal Task 7.x-1.x-dev Code 1 1 year 5 months 1 year 5 months
Create a survey for the community prior to Drupalcon Needs work Normal Task 7.x-1.x-dev Code 11 1 year 6 months 1 year 6 months
issues_by_followup_date view should default to Open status Active Normal Bug report 7.x-1.x-dev Code 3 1 year 6 months 1 year 6 months
Prohibit the ability to adopt a project Active Normal Feature request 7.x-1.x-dev Code 16 1 year 7 months 2 years 3 months
Require in-person identity confirmation to receive "Git vetted user" role. Active Normal Feature request 7.x-1.x-dev Code 8 1 year 8 months 2 years 3 months
[META|POLICY] Think of a way to make adding a (co-) maintainer more trustworthy Active Major Task 7.x-1.x-dev Security Working Group (policy questions) 11 1 year 8 months 1 year 8 months
Develop and publish policy regarding missed SA notices Active Normal Task 7.x-1.x-dev Security Working Group (policy questions) 6 1 year 9 months 4 years 5 months
Improve Security Risk Levels Defined docs page Active Normal Task 7.x-1.x-dev Documentation 2 1 year 9 months 3 years 3 weeks
Collect CVE related details as part of Security Issue Active Normal Task 7.x-1.x-dev Code 5 1 year 9 months 1 year 11 months
Automate publishing of CVE's Active Normal Task 7.x-1.x-dev Code 3 1 year 11 months 1 year 11 months
[META] Increase Security of Project Ownership Transfer Process Active Normal Plan 7.x-1.x-dev Code 7 2 years 3 months 2 years 3 months
Document the process for updating an "unsupported" SA due to new adoption Active Normal Task 7.x-1.x-dev Documentation 7 2 years 5 months 3 years 1 month

Pages

Subscribe with RSS Subscribe to Issues for Drupal Security Team