- Log in or register to create an issue
- Advanced search
| Title | Status | Priority | Category | Version | Component | Replies |
Last updated |
Assigned to | Created |
|---|---|---|---|---|---|---|---|---|---|
| Create script to pull advisory data to csv files | Fixed | Normal | Task | 7.x-1.x-dev | Code | 7 | 1 hour 18 min | 2 months 2 weeks | |
| Script some common needs | Needs review | Normal | Feature request | 7.x-1.x-dev | Code | 4 | 1 day 5 hours | 1 day 10 hours | |
| Do not create security forks with module name included. | Active | Major | Task | 7.x-1.x-dev | Miscellaneous | 3 | 1 day 11 hours | 4 days 26 min | |
| Update policy to explicitly state security issues will be handled privately | Active | Normal | Feature request | 7.x-1.x-dev | Security Working Group (policy questions) | 7 | 1 week 3 days | 4 years 4 weeks | |
| August 2026 CVEs | Fixed | Normal | Task | 7.x-1.x-dev | Code | 15 | 1 week 3 days | 1 month 5 days | |
| Run a static application security test (SAST) as part of core CI | Active | Normal | Task | 7.x-1.x-dev | Code | 2 | 1 week 6 days | 1 year 6 months | |
| Clarify scope for Open Redirect | Active | Normal | Task | 7.x-1.x-dev | Documentation | 4 | 2 weeks 2 days | 1 month 2 days | |
| September 2026 CVEs | Active | Normal | Task | 7.x-1.x-dev | Code | 2 | 2 weeks 4 days | 3 weeks 6 days | |
| Publish CVE-2026-19030 for CAPTCHA failure provides login credential validation feedback | Needs review | Normal | Task | 7.x-1.x-dev | Code | 11 | 3 weeks 8 hours | 3 months 3 weeks | |
| Publish CVE-2026-16136 for Views Reference Filter (enttityreference_filter) | Needs review | Normal | Task | 7.x-1.x-dev | Code | 4 | 3 weeks 8 hours | 2 months 4 weeks | |
| CVE-2026-77152 - Publish Field Collection CVE ID | Needs review | Normal | Support request | 7.x-1.x-dev | Code | 8 | 3 weeks 8 hours | 2 months 1 week | |
| Proposed documentation page: Credentials optionally stored in plain text is not considered a vulnerability | Active | Normal | Task | 7.x-1.x-dev | Code | 5 | 3 weeks 4 days | 3 weeks 6 days | |
| Automatically update security release node's short description with SA | Active | Normal | Feature request | 7.x-1.x-dev | Code | 1 | 3 weeks 6 days | 3 weeks 6 days | |
| Define standard description for marking an existing permission as "restrict access" | Active | Normal | Task | 7.x-1.x-dev | Documentation | 10 | 1 month 3 days | 5 months 2 weeks | |
| Clarify/document our policy about XSS payloads | Needs review | Normal | Task | 7.x-1.x-dev | Code | 8 | 1 month 4 days | 2 months 3 weeks | |
| [policy] Treat CAPTCHA bypasses as non-security bugs | Active | Normal | Plan | 7.x-1.x-dev | Code | 21 | 1 month 3 weeks | 5 months 2 weeks | |
| Policy: AI tools allow "anyone" to attack sites, so lower-score vulnerabilities should still be given SAs | Active | Normal | Feature request | 7.x-1.x-dev | Security Working Group (policy questions) | 4 | 1 month 3 weeks | 2 months 3 days | |
| CVE request for LDAP - CVE-2026-6908 | Needs review | Normal | Task | 7.x-1.x-dev | Code | 10 | 1 month 3 weeks | 5 months 2 weeks | |
| Policy about issuing security advisories | Active | Normal | Support request | 7.x-1.x-dev | Security Working Group (policy questions) | 2 | 2 months 2 days | 2 months 2 days | |
| Change policy regarding timeline for resolution and disclosure of security vulnerabilities to be more strict | Active | Normal | Task | 7.x-1.x-dev | Security Working Group (policy questions) | 21 | 2 months 1 week | 4 years 4 months | |
| Publish CVE-2026-16132 for Icon | Needs review | Normal | Support request | 7.x-1.x-dev | Documentation | 3 | 2 months 1 week | 3 months 3 days | |
| Expand the ability of module maintainers to mark a particular release as security. | Active | Major | Task | 7.x-1.x-dev | Code | 6 | 3 months 6 days | 2 years 3 months | |
| Document the labels on security issues in Drupalcode | Needs review | Normal | Task | 7.x-1.x-dev | Code | 8 | 3 months 1 week | 3 months 1 week | |
| Unsuported Modules: Establish timeline for publishing of vulnerability info to allow for possible CVE creation | Active | Normal | Task | 7.x-1.x-dev | Documentation | 7 | 3 months 3 weeks | 1 year 9 months | |
| Switch to CVSS scoring | Active | Normal | Task | 7.x-1.x-dev | Code | 17 | 3 months 3 weeks | 2 years 5 months | |
| OpenID Connect: Request update to CVE-2026-3530 | Needs review | Normal | Task | 7.x-1.x-dev | Code | 3 | 4 months 3 days | 4 months 1 week | |
| OpenID Connect: Request update to CVE-2026-3531 | Needs review | Normal | Task | 7.x-1.x-dev | Code | 3 | 4 months 3 days | 4 months 1 week | |
| OpenID Connect: Request update to CVE-2026-3532 | Needs review | Normal | Task | 7.x-1.x-dev | Code | 3 | 4 months 3 days | 4 months 1 week | |
| CAPTCHA: Request update to CVE-2026-3214 | Needs review | Normal | Task | 7.x-1.x-dev | Code | 2 | 4 months 3 days | 4 months 4 days | |
| GitLab security issue template should ask for impacted version | Active | Normal | Bug report | 7.x-1.x-dev | User interface | 1 | 4 months 5 days | 4 months 5 days | |
| Plan for how to meet 72 hour publication obligation (CNAv4.1 section 4.5.1.4) | Active | Normal | Plan | 7.x-1.x-dev | Security Working Group (policy questions) | 3 | 4 months 1 week | 4 months 2 weeks | |
| Documenting the Security/CVE process for D7ES providers | Active | Normal | Task | 7.x-1.x-dev | Documentation | 5 | 5 months 20 hours | aangel | 1 year 1 month |
| Review and adopt CWE assignments from NIST | Active | Normal | Task | 7.x-1.x-dev | Code | 1 | 7 months 2 weeks | 7 months 2 weeks | |
| Align DST vulnerability determination criteria to CVE standards | Active | Critical | Support request | 7.x-1.x-dev | Security Working Group (policy questions) | 11 | 1 year 1 month | 2 years 3 weeks | |
| Incorrect affected versions on advisories | Active | Normal | Bug report | 7.x-1.x-dev | Miscellaneous | 2 | 1 year 1 month | 1 year 1 month | |
| Create CVEs for 2016 (especially for highly critical issues) | Active | Normal | Task | 7.x-1.x-dev | Code | 1 | 1 year 2 months | 1 year 2 months | |
| More flexible language for git vetted status for co-maintainers of existing projects | Active | Normal | Plan | 7.x-1.x-dev | Code | 42 | 1 year 3 months | 3 years 7 months | |
| Allow filtering the All Issues view by version | Needs review | Normal | Feature request | 7.x-1.x-dev | User interface | 3 | 1 year 3 months | 1 year 3 months | |
| Get an Open Source Security Foundation badge for Drupal (core? contrib?) | Needs review | Normal | Task | 7.x-1.x-dev | Miscellaneous | 11 | 1 year 3 months | 4 years 7 months | |
| Clarify the Drupal Security Team Disclosure Policy | Active | Normal | Task | 7.x-1.x-dev | Code | 2 | 1 year 4 months | 1 year 4 months | |
| Policy: Post CVE number / link on private issue | Active | Normal | Feature request | 7.x-1.x-dev | Documentation | 3 | 1 year 4 months | 1 year 4 months | |
| Create a survey for the community prior to Drupalcon | Needs work | Normal | Task | 7.x-1.x-dev | Code | 11 | 1 year 6 months | 1 year 6 months | |
| issues_by_followup_date view should default to Open status | Active | Normal | Bug report | 7.x-1.x-dev | Code | 3 | 1 year 7 months | 1 year 7 months | |
| Prohibit the ability to adopt a project | Active | Normal | Feature request | 7.x-1.x-dev | Code | 16 | 1 year 8 months | 2 years 3 months | |
| Require in-person identity confirmation to receive "Git vetted user" role. | Active | Normal | Feature request | 7.x-1.x-dev | Code | 8 | 1 year 8 months | 2 years 3 months | |
| [META|POLICY] Think of a way to make adding a (co-) maintainer more trustworthy | Active | Major | Task | 7.x-1.x-dev | Security Working Group (policy questions) | 11 | 1 year 8 months | 1 year 8 months | |
| Develop and publish policy regarding missed SA notices | Active | Normal | Task | 7.x-1.x-dev | Security Working Group (policy questions) | 6 | 1 year 9 months | 4 years 6 months | |
| Improve Security Risk Levels Defined docs page | Active | Normal | Task | 7.x-1.x-dev | Documentation | 2 | 1 year 9 months | 3 years 1 month | |
| Collect CVE related details as part of Security Issue | Active | Normal | Task | 7.x-1.x-dev | Code | 5 | 1 year 9 months | 1 year 11 months | |
| Automate publishing of CVE's | Active | Normal | Task | 7.x-1.x-dev | Code | 3 | 1 year 11 months | 1 year 11 months |
Pages
Subscribe with RSS 