CERT-BUND Flags High-Risk Drupal Vulnerabilities Across 16 Modules, Patches Available

·2 views

Germany's CERT-BUND published advisory WID-SEC-2026-3554 on 23 September 2026, flagging a cluster of 36 vulnerabilities spanning CVE-2026-96355 to CVE-2026-96398 across 16 contributed Drupal modules. The flaws are remotely exploitable over HTTP and can lead to arbitrary code execution, privilege escalation, security bypass, data manipulation, and cross-site scripting. The advisory assigned maximum damage and probability scores of 4 out of 4, with a CVSS v3.1 base score of 9.8 and a temporal score of 8.5, placing the overall risk rating at high. Fixed releases have been identified for all 16 affected modules, including Webform, Project Browser, and Editoria11y, while Drupal core is not affected. A ZoomEye scan conducted on 26 September 2026 indexed over 436,000 Drupal assets globally, though the advisory does not directly link those installations to the vulnerable modules.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

CVSS, EPSS and KEV: A Practical Framework for Prioritizing Security Vulnerabilities

Dependency scanners routinely surface hundreds of vulnerabilities, but fewer than 5% of published CVEs are ever exploited in the wild, making raw CVSS scores an unreliable basis for prioritization. CVSS rates theoretical severity on a 0–10 scale but ignores real-world exploitation likelihood, meaning a high score can reflect a risk that attackers never actually pursue. EPSS, a machine-learning model maintained by FIRST, addresses this gap by producing daily probability scores for exploitation within 30 days, with the top 1% of CVEs by EPSS accounting for roughly 75% of observed attacks. CISA's Known Exploited Vulnerabilities catalog goes further, listing CVEs confirmed as actively exploited in real attacks — these entries represent the highest-priority fixes regardless of their CVSS score. Used together, the three systems allow security teams to dramatically shrink fix lists while concentrating effort on vulnerabilities that pose genuine, immediate risk.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How to Merge PDF Files Locally in a Browser Without Uploading Them

Merging PDF files is a routine task, but most free online tools require uploading documents to a server, which poses a privacy risk for sensitive files such as contracts, medical records, or financial documents. Browser-based PDF merger tools process files entirely on the user's device, meaning no data is transmitted, stored, or exposed to third parties. Users can drag and drop files, arrange them in the desired order, and download the combined result without needing an internet connection after the page loads. However, there are practical considerations: password-protected files must be unlocked beforehand, form fields with identical names may conflict, and mixed page sizes will be preserved as-is in the output. The final merged file size is roughly the sum of all inputs, so compression may be advisable for large documents.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

30-Day Roadmap Teaches System Design as Decision Process, Not Memorization

A structured 30-day High-Level Design (HLD) practice roadmap has been outlined to help engineers build repeatable decision-making skills for system design interviews. The curriculum is divided into four progressive stages: foundational primitives in week one, distributed component integration in week two, and full real-world case studies in the second half. Learners are guided to approach any 45-minute design problem by first clarifying requirements, estimating scale dimensions, selecting a data model, and then identifying bottlenecks that justify each added component. The roadmap emphasizes that a strong design answer lies in the reasoning between components — such as why a write is asynchronous or where consistency is truly needed — rather than in the volume of infrastructure shown. The complete curriculum is available at learn.significanthobbies.com.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Mia's AI Lab publishes open-source local LLM recipes for NVIDIA GPUs on GitHub

Mia's AI Lab, a project maintained by a solo developer named Mia, offers free open-source setup recipes designed to help users run large language models locally on NVIDIA RTX GPUs and DGX Spark hardware. The platform addresses common barriers such as choosing the right quantization level, estimating VRAM requirements, and selecting inference engines like vLLM or SGLang. As of September 26, 2026, the project hosts 16 model recipes plus a tool called sparkDash, collectively accumulating over 5,000 GitHub stars. Each recipe bundles scripts that automatically detect available VRAM, select an appropriate quantization level, download model weights, and launch an OpenAI-compatible API endpoint on both Windows and Linux. The site also publishes benchmark data including decode speed, peak throughput, and context window size, giving prospective local-AI builders a practical reference for hardware planning.

0 comments Read more at DEV Community