Drupal: 34 Security Advisories for Modules and Themes

On Wednesday, October 21, 2026, drupal.org published a batch of 34 security advisories covering 31 contributed modules and themes. One is rated highly critical and seven are critical. The widely used Bootstrap theme is on the list. Drupal core is not affected.

What we know

What shipped and when: 34 advisories, SA-CONTRIB-2026-220 through SA-CONTRIB-2026-253, all dated October 21, 2026, according to drupal.org's list of advisories for contributed projects. They cover 31 projects: UI Icons, Swiper formatter and Frontend Editing get two each.
Severity, on Drupal's own scale: 1 highly critical, 7 critical, 25 moderately critical and 1 less critical.
The most serious one: Ffmpeg Image Toolkit, scored 20 out of 25. Its advisory describes remote code execution and says the attacker must be able to upload images to the site. Version 1.0.3 fixes it.
Another code execution case: Custom Formatters (critical, 17/25). According to its advisory, its PHP formatter engine runs PHP code written by a user, and the permissions screen gives no warning about it. Version 4.2.1 fixes it.
The most widely installed: the Bootstrap theme (more than 91,000 sites report using it), Rabbit Hole (almost 75,000) and View Unpublished (almost 73,000), according to each project's page on drupal.org, read on October 22. All three are moderately critical, and their advisories set conditions.
Bootstrap: the flaw is cross-site scripting and only affects the optional tooltip and popover features, according to its advisory. Version 8.x-3.45 fixes it. The 5.0.x branch is not affected.
Rabbit Hole: according to its advisory, an anonymous visitor could view content the site was set to answer with "access denied" or "not found", or skip a configured redirect. Version 8.x-1.3 fixes it.
View Unpublished: it only affects multilingual sites where one piece of content has both published and unpublished translations, and where another module restricts who can see them, according to its advisory. Version 8.x-1.5 fixes it.
Exploitation: in all 34 advisories, the exploit field of the score reads "Theoretical". On Drupal's scale that is the lowest value: no public exploit code or documentation on developing one exists.

The 31 projects, with the version that fixes each one according to its advisory:

Project	Severity	Fixed version
Ffmpeg Image Toolkit	Highly critical	1.0.3
Custom Formatters	Critical	4.2.1
UI Icons	Critical and moderate (2 advisories)	1.1.3 or 2.0.2
Zero Point	Critical	8.x-1.30 or 2.0.1
Black Hole	Critical	8.x-1.26 or 2.0.1
ABC	Critical	8.x-1.25 or 2.0.1
Monster Menus	Critical	9.5.6
Dopup	Critical	1.0.7
Bootstrap (theme)	Moderate	8.x-3.45 (5.0.x not affected)
Rabbit Hole	Moderate	8.x-1.3
View Unpublished	Moderate	8.x-1.5
Shield	Moderate	8.x-1.9
Simple OAuth (OAuth2) & OpenID Connect	Moderate	6.1.3
Fullcalendar View	Moderate	5.2.6
Media Bulk Upload	Moderate	3.0.6
Domain	Moderate	3.0.2 (2.0.x not affected)
ImageAPI Optimize WebP	Moderate	2.1.2
Media Alias Display	Moderate	2.1.2 or 3.0.2
Block Attributes	Moderate	2.1.0
Swiper formatter	Moderate (2 advisories)	2.1.2 or 3.1.0
TinyPNG	Moderate	2.0.2
Frontend Editing	Moderate and less critical (2 advisories)	1.9.3
Simple User Management	Moderate	8.x-1.11
Data field	Moderate	2.0.14
CSV Field	Moderate	2.0.10 or 3.0.7
Sector (distribution)	Moderate	10.3.3 or 10.4.2
Ágora Transparency Theme	Moderate	1.2.3
USWDS Paragraph Components	Moderate	3.1.3
DocCheck Basic	Moderate	2.2.1
Domain Login Restrict	Moderate	8.x-1.5
AI File to Text	Moderate	1.0.1

Where there are several versions, each one belongs to a different branch of the project.

What changes and what doesn't

What changes: since October 21, 31 projects have publicly described flaws, all with a fixed version. A site that runs one of them and doesn't update keeps a known flaw.

Nothing changes for a Drupal site that runs none of them: this batch includes no core update.

Severity isn't the whole story. Almost every advisory comes with conditions: a permission, a setting that must be on, a submodule, a multilingual site. Being in the table doesn't mean your site is exposed. That reading is this article's: each advisory simply says to install the latest version.

How to tell if you're affected

You're affected if your site runs on Drupal and uses any of the 31 projects. Six steps:

Open the update report. In the admin, "Reports → Available updates" (the path is /admin/reports/updates). Drupal flags affected projects with "Security update required!". The Bootstrap theme shows up there too, in the themes section.
Compare with the table. On a Composer-managed site, `composer show "drupal/*"` lists every project with its version.
Start with the serious ones. First Ffmpeg Image Toolkit and Custom Formatters, if you have them. Then the other critical ones and the most widely installed: Bootstrap, Rabbit Hole and View Unpublished.
Check the cases with an extra step. Bootstrap: if you can't update today, its advisory suggests turning off tooltips and popovers in the theme settings. Rabbit Hole: its advisory lists temporary permission changes for sites that can't update yet. ImageAPI Optimize WebP 2.0.x, UI Icons 1.0.x and CSV Field 1.0.x are no longer supported: move to a maintained branch.
Update with a backup. Back up the files and the database. Then update, run the database updates (with `drush updatedb` or at /update.php) and clear the cache.
If someone else maintains your site, ask: "Do we use any of the 31 projects in Drupal's October 21 advisories? Which version are they on?"

After updating, test the home page, menus, forms and login.

Sources

Updates: this article will be updated if Drupal changes the severity of an advisory or if exploitation of any of them is confirmed.