- Log in or register to create an issue
- Advanced search
| Title | Status | Priority | Category | Version | Component | Replies |
Last updated |
Assigned to | Created |
|---|---|---|---|---|---|---|---|---|---|
| Ensure core dependencies all have a security contact | Active | Normal | Task | 7.x-1.x-dev | Code | 1 | 5 hours 43 min | prudloff | 5 hours 43 min |
| Policy: Change SA support versions to also list non-stable releases | Active | Normal | Feature request | 7.x-1.x-dev | Security Working Group (policy questions) | 7 | 10 hours 25 min | 13 hours 53 min | |
| Post about welcoming 4 new team members | Closed (fixed) | Normal | Task | 7.x-1.x-dev | Code | 4 | 1 day 12 hours | 2 weeks 1 day | |
| Policy: Change advisory release window day to Tuesday | Needs review | Normal | Plan | 7.x-1.x-dev | Miscellaneous | 29 | 1 day 14 hours | 3 weeks 1 day | |
| Proposed updated requirements for SA release | Active | Normal | Task | 7.x-1.x-dev | Security Working Group (policy questions) | 2 | 2 days 1 hour | 2 weeks 3 days | |
| September 2026 CVEs | Fixed | Normal | Task | 7.x-1.x-dev | Code | 8 | 2 days 1 hour | 1 month 3 weeks | |
| Proposal: Require gitlab setup for SA coverage | Active | Normal | Task | 7.x-1.x-dev | Security Working Group (policy questions) | 1 | 3 days 10 hours | 3 days 10 hours | |
| Publish CVE-2026-110176 CVE for File Force fix | Needs review | Normal | Support request | 7.x-1.x-dev | Code | 7 | 4 days 9 hours | 3 weeks 1 day | |
| Define standard description for marking an existing permission as "restrict access" | Active | Normal | Task | 7.x-1.x-dev | Documentation | 11 | 1 week 2 days | 6 months 1 week | |
| Create script to pull advisory data to csv files | Closed (fixed) | Normal | Task | 7.x-1.x-dev | Code | 8 | 1 week 3 days | 3 months 1 week | |
| DST policy proposals to deal with the 2026 barrage | Active | Normal | Plan | 7.x-1.x-dev | Security Working Group (policy questions) | 4 | 1 week 3 days | 2 weeks 3 days | |
| Script some common needs | Needs review | Normal | Feature request | 7.x-1.x-dev | Code | 5 | 2 weeks 2 days | 3 weeks 4 days | |
| Clearly define policy regarding exploits that require 3rd party code | Active | Normal | Task | 7.x-1.x-dev | Security Working Group (policy questions) | 3 | 2 weeks 4 days | 2 weeks 5 days | |
| Clarify/document our policy about XSS payloads | Needs review | Normal | Task | 7.x-1.x-dev | Security Working Group (policy questions) | 9 | 2 weeks 5 days | 3 months 2 weeks | |
| August 2026 CVEs | Closed (fixed) | Normal | Task | 7.x-1.x-dev | Code | 16 | 2 weeks 6 days | 1 month 4 weeks | |
| Do not create security forks with module name included. | Active | Major | Task | 7.x-1.x-dev | Miscellaneous | 3 | 3 weeks 4 days | 4 weeks 2 hours | |
| Update policy to explicitly state security issues will be handled privately | Active | Normal | Feature request | 7.x-1.x-dev | Security Working Group (policy questions) | 7 | 1 month 4 days | 4 years 1 month | |
| Run a static application security test (SAST) as part of core CI | Active | Normal | Task | 7.x-1.x-dev | Code | 2 | 1 month 1 week | 1 year 6 months | |
| Clarify scope for Open Redirect | Active | Normal | Task | 7.x-1.x-dev | Documentation | 4 | 1 month 1 week | 1 month 3 weeks | |
| July 2026 CVEs | Closed (fixed) | Normal | Task | 7.x-1.x-dev | Code | 9 | 1 month 2 weeks | 3 months 1 week | |
| Publish CVE-2026-19030 for CAPTCHA failure provides login credential validation feedback | Needs review | Normal | Task | 7.x-1.x-dev | Code | 11 | 1 month 2 weeks | 4 months 2 weeks | |
| Publish CVE-2026-16136 for Views Reference Filter (enttityreference_filter) | Needs review | Normal | Task | 7.x-1.x-dev | Code | 4 | 1 month 2 weeks | 3 months 3 weeks | |
| CVE-2026-77152 - Publish Field Collection CVE ID | Needs review | Normal | Support request | 7.x-1.x-dev | Code | 8 | 1 month 2 weeks | 3 months 5 days | |
| Proposed documentation page: Credentials optionally stored in plain text is not considered a vulnerability | Active | Normal | Task | 7.x-1.x-dev | Code | 5 | 1 month 2 weeks | 1 month 3 weeks | |
| Automatically update security release node's short description with SA | Active | Normal | Feature request | 7.x-1.x-dev | Code | 1 | 1 month 3 weeks | 1 month 3 weeks | |
| Review test embargo for security issues | Closed (works as designed) | Normal | Plan | 7.x-1.x-dev | Documentation | 14 | 1 month 3 weeks | 2 months 6 days | |
| [policy] Treat CAPTCHA bypasses as non-security bugs | Active | Normal | Plan | 7.x-1.x-dev | Code | 21 | 2 months 2 weeks | 6 months 1 week | |
| Policy: AI tools allow "anyone" to attack sites, so lower-score vulnerabilities should still be given SAs | Active | Normal | Feature request | 7.x-1.x-dev | Security Working Group (policy questions) | 4 | 2 months 2 weeks | 2 months 3 weeks | |
| CVE request for LDAP - CVE-2026-6908 | Needs review | Normal | Task | 7.x-1.x-dev | Code | 10 | 2 months 2 weeks | 6 months 1 week | |
| "My security issues" block's "more" link is redirecting to the wrong url | Closed (outdated) | Normal | Bug report | 7.x-1.x-dev | Code | 10 | 2 months 3 weeks | 1 year 10 months | |
| Publish a blog about the s.d.o to drupalcode migration | Closed (fixed) | Normal | Task | 7.x-1.x-dev | Code | 4 | 2 months 3 weeks | 3 months 1 week | |
| Create CVEs for May, June, and a bit of July 2026 | Closed (fixed) | Normal | Task | 7.x-1.x-dev | Code | 11 | 2 months 3 weeks | 5 months 6 days | |
| Policy about issuing security advisories | Active | Normal | Support request | 7.x-1.x-dev | Security Working Group (policy questions) | 2 | 2 months 3 weeks | 2 months 3 weeks | |
| Change policy regarding timeline for resolution and disclosure of security vulnerabilities to be more strict | Active | Normal | Task | 7.x-1.x-dev | Security Working Group (policy questions) | 21 | 3 months 2 days | 4 years 5 months | |
| Publish CVE-2026-16132 for Icon | Needs review | Normal | Support request | 7.x-1.x-dev | Documentation | 3 | 3 months 5 days | 3 months 3 weeks | |
| Expand the ability of module maintainers to mark a particular release as security. | Active | Major | Task | 7.x-1.x-dev | Code | 6 | 4 months 19 hours | 2 years 3 months | |
| Document the labels on security issues in Drupalcode | Needs review | Normal | Task | 7.x-1.x-dev | Code | 8 | 4 months 3 days | 4 months 6 days | |
| Increase efficiency in ownership transfers related to modules with known vulnerabilities | Closed (won't fix) | Normal | Feature request | 7.x-1.x-dev | Security Working Group (policy questions) | 7 | 4 months 1 week | 4 years 3 months | |
| Publish a new CVE for TFA Basic Plugins - CVE-2026-6816 | Closed (fixed) | Normal | Support request | 7.x-1.x-dev | Code | 17 | 4 months 2 weeks | 7 months 3 weeks | |
| Unsuported Modules: Establish timeline for publishing of vulnerability info to allow for possible CVE creation | Active | Normal | Task | 7.x-1.x-dev | Documentation | 7 | 4 months 2 weeks | 1 year 10 months | |
| Switch to CVSS scoring | Active | Normal | Task | 7.x-1.x-dev | Code | 17 | 4 months 2 weeks | 2 years 6 months | |
| Publish Term Reference Tree CVE - CVE-2026-4093 | Closed (fixed) | Normal | Support request | 7.x-1.x-dev | Code | 8 | 4 months 3 weeks | 7 months 4 weeks | |
| Publish for Simple Hierarchical Select (SHS) CVE-2026-4929 | Closed (fixed) | Normal | Support request | 7.x-1.x-dev | Miscellaneous | 6 | 4 months 3 weeks | 7 months 4 weeks | |
| Create CVEs for April and early May 2026 | Closed (fixed) | Normal | Task | 7.x-1.x-dev | Code | 8 | 4 months 3 weeks | 6 months 3 weeks | |
| OpenID Connect: Request update to CVE-2026-3530 | Needs review | Normal | Task | 7.x-1.x-dev | Code | 3 | 4 months 3 weeks | 5 months 1 day | |
| OpenID Connect: Request update to CVE-2026-3531 | Needs review | Normal | Task | 7.x-1.x-dev | Code | 3 | 4 months 3 weeks | 5 months 1 day | |
| OpenID Connect: Request update to CVE-2026-3532 | Needs review | Normal | Task | 7.x-1.x-dev | Code | 3 | 4 months 3 weeks | 5 months 1 day | |
| CAPTCHA: Request update to CVE-2026-3214 | Needs review | Normal | Task | 7.x-1.x-dev | Code | 2 | 4 months 3 weeks | 4 months 4 weeks | |
| GitLab security issue template should ask for impacted version | Active | Normal | Bug report | 7.x-1.x-dev | User interface | 1 | 4 months 4 weeks | 4 months 4 weeks | |
| Plan for how to meet 72 hour publication obligation (CNAv4.1 section 4.5.1.4) | Active | Normal | Plan | 7.x-1.x-dev | Security Working Group (policy questions) | 3 | 5 months 5 days | 5 months 1 week |
Pages
Subscribe with RSS 