1 known vulnerability.
0 direct dependencies
none carry a known advisory
0 packages depend on it
dependents not yet indexed for this ecosystem
Tracked for PyPI packages. HuggingFace models declare Python dependencies, so packagist packages are not covered.
severity out of 10
chance of exploitation in 30 days
CyberXYZ composite out of 10
fig. 01 — CVE-2026-107260, the advisory selected below
Sector is a distribution targeted towards Drupal site builders and site owners who are looking for a fully configured Drupal project out of the box.
A module specific to this distribution doesn't sufficiently sanitize media names, potentially leading to an XSS exploit.
This vulnerability is mitigated by the fact that an attacker must have a role with the ability to create or edit a media entity.
Checked 2026-10-23 at 00:31 UTC. The most recent advisory here was published 2026-10-21. Updated continuously from NVD, GHSA, OSV and CNA feeds.