Search

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

    Related vulnerabilities

    DRUPAL-CONTRIB-2026-191 (CVE-2026-96382)

    Vulnerability from drupal – Published: 2026-09-23 17:24 – Updated: 2026-09-23 17:33 – Source website
    VLAI
    Details

    The Diba Carousel Slider adds a Bootstrap carousel slider block that can be used directly without creating a View or custom integration.

    When the "Allow HTML description" option is enabled, slide descriptions are rendered using the raw stored field value instead of the field's rendered output. This bypasses Drupal's text format filtering and output sanitization mechanisms.

    This vulnerability affects sites that use a formatted text field as the carousel description source and have enabled the "Allow HTML description" option.

    Credits
    Kalle Kipinä (kekkis) www.drupal.org/u/kekkis
    References
    To clipboard 

    {
  "affected": [
    {
      "database_specific": {
        "affected_versions": "\u003c3.0.2"
      },
      "package": {
        "ecosystem": "Packagist:https://packages.drupal.org/8",
        "name": "drupal/diba_carousel"
      },
      "ranges": [
        {
          "database_specific": {
            "constraint": "\u003c3.0.2"
          },
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.0.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "severity": []
    }
  ],
  "aliases": [
    "CVE-2026-96382"
  ],
  "credits": [
    {
      "contact": [
        "https://www.drupal.org/u/kekkis"
      ],
      "name": "Kalle Kipin\u00e4 (kekkis)"
    }
  ],
  "details": "The Diba Carousel Slider adds a Bootstrap carousel slider block that can be used directly without creating a View or custom integration.\n\nWhen the \"Allow HTML description\" option is enabled, slide descriptions are rendered using the raw stored field value instead of the field\u0027s rendered output. This bypasses Drupal\u0027s text format filtering and output sanitization mechanisms.\n\nThis vulnerability affects sites that use a formatted text field as the carousel description source and have enabled the \"Allow HTML description\" option.",
  "id": "DRUPAL-CONTRIB-2026-191",
  "modified": "2026-09-23T17:33:10.000Z",
  "published": "2026-09-23T17:24:33.000Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://www.drupal.org/sa-contrib-2026-191"
    }
  ],
  "schema_version": "1.7.0"
}