Issue #144538 by acbramley, tuutti, Damien Tournoud, alexpott, solideogloria, Xano, TwoD, damiankloip, smustgrave, pameeela, deviantintegral, L_VanDamme, daften, karishmaamin, g.oechsler, larowlan, klausi, sun, Fabianx, andypost, dawehner, kwinters, greggles, Wim Leers, grendzy, pwolanin, alexanderpas, drumm, Chi: User logout is vulnerable to CSRF

Issue #3277003 by mcdruid, catch, poker10, smustgrave, BramDriesen, guedressel, DamienMcKenna, xjm, Heine, greggles, fjgarlin, pwolanin, moshe weitzman: Harden user_pass_rehash() against attack

SA-CORE-2023-006 by ghostccamm, effulgentsia, larowlan, xjm, pwolanin, catch, Wim Leers, mcdruid, benjifisher

(cherry picked from commit 1b96b5ed)

Issue #296693 by tedbow, omkar.podey, sun, ilya.no, JeroenT, tim.plunkett, catch, hooroomoo, ridhimaabrol24, boombatower, paulocs, Damien Tournoud, Xano, pwolanin, chx, webchick, stella, quietone, Bojhan, smustgrave, lauriii, benjifisher, gabesullice: Restrict access to empty top level administration pages

Issue #2823910 by daffie, pwolanin, smustgrave, neclimdul, larowlan, dawehner: DBTNG/EQ condition works inconsistently with arrays

SA-CORE-2023-005 by benjifisher, Heine, cmlara, mlhess, larowlan, David_Rothstein, xjm, Wim Leers, DamienMcKenna, effulgentsia, pwolanin, mcdruid, poker10, jenlampton, longwave, kim.pepper, alexpott, drumm

Issue #1845004 by znerol, claudiu.cristea, Spokje, neclimdul, VladimirAus, slasher13, tvb, pwolanin, NivethaSubramaniyan, pradhumanjainOSL, Ratan Priya, longwave, catch, Crell, andypost, xjm, dawehner, voleger, alexpott, Berdir, klausi, DamienMcKenna, mfb, borisson_, Jalandhar, mohit1604, mcdruid: Replace custom password hashing library with PHP password_hash()

Issue #2823910 by daffie, pwolanin, smustgrave, dawehner, larowlan: DBTNG/EQ condition works inconsistently with arrays

Issue #3265086 by mondrake, alexpott, pwolanin, VladimirAus, daffie, mfb, catch: Implement statement classes using \Iterator to fix memory usage regression and prevent rewinding

Issue #2552837 by smustgrave, pwolanin, alexpott: XSS::filter and filter_xss can create malformed attributes when you would expect them to be stripped

Issue #3325730 by larowlan, alok_singh, ankithashetty, Spokje, pwolanin: Deprecate, remove and replace \Drupal\Tests\book\Functional\BookTestTrait::generateOutlinePattern

Issue #3191389 by anmolgoyal74, greggles, larowlan, mcdruid, pwolanin, brayfe: File Inclusion issue security hardening

Issue #2828724 by Spokje, alexpott, ravi.shankar, Lal_, malcomio, ElusiveMind, smaz, yogeshmpawar, ridhimaabrol24, semiaddict, piggito, f.mazeikis, tvhung, tatarbj, ranjith_kumar_k_u, vijaycs85, baikho, Jelle_S, kleinmp, bbrala, Mike_info, David_Rothstein, pwolanin, cburschka: Username enumeration via one time login route

Issue #2852361 by Xano, smustgrave, pwolanin, mpdonadio, wolffereast, ranjith_kumar_k_u, John Cook, xjm, alexpott: Ignore repeated slashes in the incoming path like Drupal <= 7

SA-CORE-2022-014 by elarlang, pwolanin, xjm, mcdruid, effulgentsia, greggles, jenlampton, larowlan, longwave

(cherry picked from commit 339bd673)

Issue #1884836 by Lendude, cilefen, pwolanin, mgifford, alexpott: replace md5 calls in DiffEngine with crc32b hashes

Issue #3036593 by bbrala, gabesullice, BryanRice, anmolgoyal74, effulgentsia, pwolanin, Wim Leers, mstef, larowlan: Add 'drupal_internal__target_id' to JSON:API representation of entity reference fields, because that can't be retrieved from the target resource for target entity types without corresponding resources

SA-CORE-2021-002 by Jasu_M, effulgentsia, alexpott, mlhess, Wim Leers, Heine, pwolanin, xjm, samuel.mortenson, nwellnhof, larowlan, phenaproxima, mcrdruid

(cherry picked from commit 0d8712d8)

Issue #2238561 by alexpott, dawehner, andypost, bradjones1, ridhimaabrol24, jofitz, eiriksm, Darren Oh, kalyansamanta, znerol, neclimdul, catch, pwolanin: Use the default PHP session ID instead of generating a custom one

Issue #2787107 by bc, raman.b, mradcliffe, pwolanin, klausi, dawehner: Menu tree storage does not populate route names for a definition

SA-CORE-2020-012 by ufku, mrf, fgm, samuel.mortenson, dww, Heine, mlhess, David_Rothstein, pwolanin, xjm, fgm, stefan.r, dsnopek, rickmanelius, David Strauss, tedbow, alexpott, dww, larowlan, kim.pepper, Wim Leers, quicksketch, mcdruid, Fabianx, effulgentsia, drumm, pandaski, Mixologic

Issue #1538118 by dww, swentel, dawehner, pwolanin, sanduhrs, alexpott, ayushmishra206, Wim Leers, yogeshmpawar, mgifford, cilefen, David_Rothstein, drumm, larowlan, Heine, colan, tedbow, benjifisher, klausi, borisson_, quietone: Update status does not verify the identity or authenticity of the release history URL

SA-CORE-2020-011 by David_Rothstein, Chi, elarlang, dokumori, kyk, xjm, mlhess, pwolanin, stefan.r, benjy, fgm, samuel.mortenson, larowlan, pandaski

SA-CORE-2020-004 by samuel.mortenson, DorTumarkin, greggles, xjm, larowlan, webchick, pwolanin, dawehner, mcdruid, alexpott, dsnopek

(cherry picked from commit 3999b8f6)

SA-CORE-2020-005 by lorenzo_gre, jazzy2fives, xjm, samuel.mortenson, pwolanin, larowlan, greggles, cashwilliams, Heine, mcdruid, alexpott, Gábor Hojtsy

(cherry picked from commit b34dc3f7)

SA-CORE-2019-012 by samuel.mortenson, larowlan, pwolanin, Sam152, Jasu_M, David_Rothstein, michieltcs, Ayesh, alexpott, xjm, vijaycs85, mcdruid

Issue #2044435 by mondrake, kim.pepper, Mile23, andypost, martin107, daffie, jibran, beejeebus, alexpott, larowlan, dawehner, catch, pwolanin: Convert pager.inc to a service

Issue #3075695 by kim.pepper, andypost, jhodgdon, larowlan, pwolanin, Sam152: Move search_index() and related functions to a service

Issue #2664830 by jhodgdon, alexpott, andypost, Charlie ChX Negyesi, scott_euser, oknate, vijaycs85, larowlan, Amber Himes Matz, pwolanin, Berdir, Wim Leers: Add search capability to help topics

Issue #2313917 by tedbow, pwolanin, jhedstrom, Wim Leers, Mixologic, larowlan, Mile23, Gábor Hojtsy, xjm, Berdir: Core version key in module's .info.yml doesn't respect core semantic versioning

Issue #2825516 by mikelutz, amwhalen, jhedstrom, pwolanin, ragnarkurm: hook_node_access() is called with $op = 'delete' when the create node form is shown

Issue #3067943 by andypost, jhodgdon, Amber Himes Matz, pwolanin: Add capability for search blocks on non-default search

Issue #2966327 by alexpott, mcdruid, dww, dsnopek, catch, pwolanin, larowlan, tim.plunkett, Berdir, Sam152: Limit what can be called by a callback in render arrays to reduce the risk of RCE

Issue #2820611 by YesCT, mkalkbrenner, Darren Oh, pwolanin, David_Rothstein, sidharrell, Sweetchuck: FileStorage generated .htaccess doesn't cover PHP 7

Issue #2843147 by Wim Leers, e0ipso, gabesullice, dagmar, xjm, effulgentsia, webchick, dww, Berdir, dawehner, colan, mgalalm, govind.maloo, das-peter, jludwig, ndobromirov, martin107, abhisekmazumdar, nuez, catch, amateescu, pwolanin, mallezie, borisson_, jibran, voleger, plach, GeduR, Grimreaper, apupiales, Sutharsan, RenatoG, michaellander, sergesemashko, dbt102, hampercm, dremy, rpayanm, chriscalip, tstoeckler, keopx, skyredwang, Spleshka, RajeevK, matthew.perry, kaysenlau, jazzdrive3, dsdeiz, ebeyrent, acbramley, deviantintegral, samuel.mortenson, DamienMcKenna, mohit_aghera, ibustos, dpolant, garphy: Add JSON:API to core as a stable module

(cherry picked from commit eae8a6c1)

SA-CORE-2019-003 by samuel.mortenson, Berdir, pwolanin, dawehner, cashwilliams, Wim Leers, xjm, larowlan, alexpott, plach, damiankloip, tstoeckler, tedbow, DamienMcKenna, effulgentsia, RobLoach, gabesullice, drumm, heshanlk, dsnopek, fago, miro_dietiker, truls1502

Issue #3015110 by pwolanin, mikelutz, YesCT, quietone: migrate source plugin SqlBase::initializeIterator fails to update rows when high water reset to NULL or 0 and mapJoinable() = TRUE