Drupal

1185 CVEs across 402 Drupal products. Browse Drupal vulnerabilities, severities, and proof-of-concept exploits.

Drupal products with known CVEs

ProductCVEs
Drupal736
Drupal Core49
Core19
Ai (Artificial Intelligence)8
Open Social8
Enterprise Mfa - Tfa For Drupal6
Project Issue Tracking Module6
Print5
Aggregation Module4
Cookies Consent Management4
Drupal Canvas4
Everyblog4
Project4
Two-Factor Authentication (Tfa)4
Ubercart Module4
Authenticator Login3
Content Construction Kit3
Disable Login Page3
Drupal Project Issue Tracking3
Facets3
Login Disable3
Monster Menus3
One Time Password3
Openid Connect / Oauth Client3
Shindig-Integrator3
Tagify3
Access Code2
Acquia Dam2
Activity2
Advanced Content Feedback (Aka Admin Feedback)2
Ai Agents2
Ajax Checklist2
Anti-Spam By Cleantalk2
Artificial Intelligence2
Bibliography Module2
Brilliant Gallery2
Chatroom Module2
Civictheme Design System2
Colorbox2
Cookies Consent Management2
Custom Search Module2
Data2
Database Administration Module2
Data-Module2
Diff2
Drupal Easylinks Module2
Eca: Event - Condition - Action2
Email Tfa2
File Access Fix (Deprecated)2
File Entity (Fieldable Files)2
Drupal CVEs — newest first (page 1 of 12)
CVESeverityScorePublishedSummary
CVE-2026-81269Medium5.32026-09-02Missing Authorization vulnerability in Drupal Data field allows Forceful Browsing. This issue affects Data field versions: from 0.0.0 to 2.0.13.
CVE-2026-81205Medium5.32026-09-02Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in Drupal LDAP / Active Directory Integration allows LDAP In…
CVE-2026-81201Medium6.12026-09-02Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Monster Menus allows Stored XSS. This issue affect…
CVE-2026-81168Low3.72026-09-02Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal CAPTCHA Protected Page allows Functionality Bypass. This issue affects CAPTCHA…
CVE-2026-81167Medium4.82026-09-02Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Address Suggestion allows Cross-Site Scripting (XS…
CVE-2026-81166Medium5.32026-09-02Missing Authorization vulnerability in Drupal Digital Signage Framework allows Forceful Browsing. This issue affects Digital Signage Framework versions: from 0…
CVE-2026-81165Medium5.32026-09-02Incorrect Authorization vulnerability in Drupal Blazy allows Forceful Browsing. This issue affects Blazy versions: from 0.0.0 to 3.0.18.
CVE-2026-81164Medium5.42026-09-02Missing Authorization vulnerability in Drupal Entity PDF allows Forceful Browsing. This issue affects Entity PDF versions: from 0.0.0 to 2.1.5.
CVE-2026-81162Medium5.32026-09-02Insertion of Sensitive Information Into Sent Data vulnerability in Drupal DXPR Builder: The Best Editing (AI) Experience for Drupal allows Forceful Browsing. T…
CVE-2026-81161Low3.32026-09-02Privilege Defined With Unsafe Actions vulnerability in Drupal Content Moderation Notifications allows Privilege Escalation. This issue affects Content Moderati…
CVE-2026-81160Medium6.12026-09-02Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Slick Carousel allows Stored XSS. This issue affec…
CVE-2026-81159Low3.72026-09-02Observable Timing Discrepancy vulnerability in Drupal Commerce CyberSource allows Brute Force. This issue affects Commerce CyberSource versions: from 0.0.0 to…
CVE-2026-81158Medium5.32026-09-02Incorrect Authorization vulnerability in Drupal Entity API allows Forceful Browsing. This issue affects Entity API versions: from 0.0.0 to 1.8.0.
CVE-2026-76782High7.32026-09-02Vulnerability in Drupal Screenshot. This issue affects Screenshot versions: *.*.
CVE-2026-76758Medium5.92026-09-02Vulnerability in Drupal Link content parser. This issue affects Link content parser versions: *.*.
CVE-2026-76756Medium5.92026-09-02Vulnerability in Drupal Gammu SMS Daemon. This issue affects Gammu SMS Daemon versions: *.*.
CVE-2026-73478Medium5.32026-09-02Incorrect Authorization vulnerability in Drupal Diff allows Forceful Browsing. This issue affects Diff versions: from 0.0.0 to 2.0.1, from 2.1.0 to 2.1.1.
CVE-2026-73477Medium5.32026-09-02Incorrect Authorization vulnerability in Drupal Quick Tabs allows Forceful Browsing. This issue affects Quick Tabs versions: from 0.0.0 to 4.3.1.
CVE-2026-73476Medium5.42026-09-02Improper Handling of Case Sensitivity vulnerability in Drupal External Authentication allows Privilege Escalation. This issue affects External Authentication v…
CVE-2026-73475Critical9.12026-09-02Incorrect Authorization vulnerability in Drupal Commerce PayPal allows Forceful Browsing. This issue affects Commerce PayPal versions: from 0.0.0 to 1.12.0, fr…
CVE-2026-73474Medium5.32026-09-02Server-Side Request Forgery (SSRF) vulnerability in Drupal Entity Share Websub allows Server Side Request Forgery. This issue affects Entity Share Websub versi…
CVE-2026-18986Medium4.82026-09-02Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Entity Browser allows Stored XSS. This issue affec…
CVE-2026-16647Medium4.12026-09-02Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Disable Login Page allows Functionality Bypass. This issue affects Disable Log…
CVE-2026-55805Medium5.42026-08-25Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Stored XSS. This issue affects…
CVE-2026-18985High8.12026-08-25Incorrect Authorization vulnerability in Drupal Edit in-place field allows Forceful Browsing. This issue affects Edit in-place field versions: from 0.0.0 to 2…
CVE-2026-18261Medium5.72026-08-25Vulnerability in Drupal Powerful Surveys. This issue affects Powerful Surveys versions: *.*.
CVE-2026-18260Medium5.72026-08-25Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Disable Login Page allows Brute Force. This issue affects Disable Login Page…
CVE-2026-18259High7.52026-08-25Observable Timing Discrepancy vulnerability in Drupal Token Content Access allows Brute Force. This issue affects Token Content Access versions: from 0.0.0 to…
CVE-2026-16646Medium5.72026-08-25Vulnerability in Drupal PanKM. This issue affects PanKM versions: *.*.
CVE-2026-16645Critical9.12026-08-25Missing Authorization vulnerability in Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery allows Forceful Browsing. This issue affects PhotoSwipe -…
CVE-2026-16644Critical9.12026-08-25Incorrect Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. This issue affects Webform REST versions: from 0.0.0 to 4.1.0.
CVE-2026-16643Medium5.72026-08-25Vulnerability in Drupal Lunr exposed filters. This issue affects Lunr exposed filters versions: *.*.
CVE-2026-16642Medium5.72026-08-25Vulnerability in Drupal Email Login OTP. This issue affects Email Login OTP versions: *.*.
CVE-2026-16641Critical9.82026-08-25Vulnerability in Drupal Commerce Elavon. This issue affects Commerce Elavon versions: *.*.
CVE-2026-16640Medium6.12026-08-25Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Search API Autocomplete allows Reflected XSS. This…
CVE-2026-16639Critical9.82026-08-25Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Internationalization Single Sign-On allows Authentication Bypass. This issue a…
CVE-2026-16638Medium6.12026-08-25Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Media Folders allows Stored XSS. This issue affect…
CVE-2026-15917Medium4.72026-08-25Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). Thi…
CVE-2026-15916Medium4.22026-08-25Missing Authorization vulnerability in Drupal Drupal core allows Forceful Browsing. This issue affects Drupal core versions: from 0.0.0 to 10.6.13, from 11.3.0…
CVE-2026-15088Medium5.72026-08-25Vulnerability in Drupal Development Environment. This issue affects Development Environment versions: *.*.
CVE-2026-15089Critical9.12026-07-10Vulnerability in Drupal Commerce guest registration. This issue affects Commerce guest registration versions: *.*.
CVE-2026-15087Medium5.92026-07-10vulnerability in Drupal Clean RESTful allows . This issue affects Clean RESTful versions: *.*.
CVE-2026-15086Medium5.92026-07-10vulnerability in Drupal Raw Formatter [Meta Tag Formatter] allows . This issue affects Raw Formatter [Meta Tag Formatter] versions: *.*.
CVE-2026-11915Medium5.92026-07-10vulnerability in Drupal Brute force attack protection allows . This issue affects Brute force attack protection versions: *.*.
CVE-2026-11914Medium5.92026-07-10vulnerability in Drupal Composer allows . This issue affects Composer versions: *.*.
CVE-2026-11913Critical9.82026-07-10vulnerability in Drupal Mother May I allows . This issue affects Mother May I versions: *.*.
CVE-2026-58591Medium5.42026-07-10Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Colorbox allows Cross-Site Scripting (XSS). This i…
CVE-2026-58590Medium5.42026-07-10Missing Authorization vulnerability in Drupal FlowDrop allows Forceful Browsing. This issue affects FlowDrop versions: from 0.0.0 to 1.6.0.
CVE-2026-58589Medium5.42026-07-10Missing Authorization vulnerability in Drupal FlowDrop allows Forceful Browsing. This issue affects FlowDrop versions: from 0.0.0 to 1.6.0.
CVE-2026-58588Medium6.12026-07-10Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal Canvas allows Cross-Site Scripting (XSS). T…
CVE-2026-58587Medium6.12026-07-10Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal Canvas allows Cross-Site Scripting (XSS). T…
CVE-2026-55810High8.12026-07-10Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Plotly.js Graphing allows Object Injection. This issue a…
CVE-2026-55809High8.12026-07-10Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Flag attendance field allows Object Injection. This issu…
CVE-2026-55808Medium5.42026-07-10Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). Thi…
CVE-2026-55807Low3.12026-07-10Server-Side Request Forgery (SSRF) vulnerability in Drupal Drupal core allows Server Side Request Forgery. This issue affects Drupal core versions: from 0.0.0…
CVE-2026-55806Medium5.92026-07-10URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal Drupal core allows Content Spoofing. This issue affects Drupal core versions: from…
CVE-2026-55804Medium5.92026-07-10Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection. This issue affects…
CVE-2026-55803Medium5.92026-07-10Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection. This issue affects…
CVE-2026-15085Medium5.42026-07-10Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI SEO/GEO Analyzer allows Stored XSS. This issue…
CVE-2026-15084Medium5.42026-07-10Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal UI Patterns (SDC in Drupal UI) allows Stored XSS…
CVE-2026-15083Medium4.22026-07-10Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal ECA: Event - Condition - Action allows Object Injection…
CVE-2026-15082Medium5.42026-07-10Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Siteimprove Analytics allows Cross-Site Scripting…
CVE-2026-15081High7.42026-07-10Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Location Selector allows SQL Injection. This issue…
CVE-2026-15080Medium4.32026-07-10Cross-Site Request Forgery (CSRF) vulnerability in Drupal Ray Enterprise Translation allows Cross Site Request Forgery. This issue affects Ray Enterprise Trans…
CVE-2026-15079Medium5.42026-07-10Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Login Disable allows Brute Force. This issue affects Login Disable versions…
CVE-2026-13244High8.12026-07-10Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Tealium iQ Tag Management allows Object Injection. This…
CVE-2026-13243Medium4.82026-07-10Cross-Site Request Forgery (CSRF) vulnerability in Drupal Salesforce Suite allows Cross Site Request Forgery. This issue affects Salesforce Suite versions: fro…
CVE-2026-13242Medium6.52026-07-10Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Geolocation Field allows SQL Injection. This issue…
CVE-2026-13241Medium6.52026-07-10Missing Authorization vulnerability in Drupal Paragraphs allows Forceful Browsing. This issue affects Paragraphs versions: from 0.0.0 to 1.21.0.
CVE-2026-13240Medium6.52026-07-10Missing Authorization vulnerability in Drupal Paragraphs allows Forceful Browsing. This issue affects Paragraphs versions: from 0.0.0 to 1.21.0.
CVE-2026-13239Medium6.52026-07-10Missing Authorization vulnerability in Drupal WissKI allows Forceful Browsing. This issue affects WissKI versions: from 0.0.0 to 4.2.0.
CVE-2026-13238Medium4.82026-07-10Incorrect Authorization vulnerability in Drupal Commerce Realex / Global Payments allows Forceful Browsing. This issue affects Commerce Realex / Global Payment…
CVE-2026-13237Medium4.82026-07-10Incorrect Authorization vulnerability in Drupal AI Agents allows Forceful Browsing. This issue affects AI Agents versions: from 0.0.0 to 1.1.4, from 1.2.0 to 1…
CVE-2026-13236Medium4.22026-07-10Missing Authorization vulnerability in Drupal AI Agents allows Forceful Browsing. This issue affects AI Agents versions: from 0.0.0 to 1.1.4, from 1.2.0 to 1.2…
CVE-2026-13235Low3.32026-07-10Missing Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Forceful Browsing. This issue affects AI (Artificial Intelligence) versions…
CVE-2026-13234Medium6.12026-07-10Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Cross-Site Scr…
CVE-2026-13233Low3.32026-07-10Server-Side Request Forgery (SSRF) vulnerability in Drupal OpenAI Provider allows Server Side Request Forgery. This issue affects OpenAI Provider versions: fro…
CVE-2026-13232Low3.12026-07-10Incorrect Authorization vulnerability in Drupal Advanced Content Feedback (aka admin_feedback) allows Forceful Browsing. This issue affects Advanced Content Fe…
CVE-2026-13231Medium6.12026-07-10Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Advanced Content Feedback (aka admin_feedback) all…
CVE-2026-12535Critical9.82026-07-10Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Formatter Field allows Object Injection. This issue affe…
CVE-2026-11909Low3.32026-07-10Missing Authorization vulnerability in Drupal Examples for Developers allows Forceful Browsing. This issue affects Examples for Developers versions: from 0.0.0…
CVE-2026-11908Medium5.42026-07-10Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Tagify allows Stored XSS. This issue affects Tagif…
CVE-2026-10770Medium6.12026-07-10Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Anti-Spam by CleanTalk allows Reflected XSS. This…
CVE-2026-10769Medium5.42026-07-10Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Commerce Core allows Stored XSS. This issue affect…
CVE-2026-10768Critical9.82026-07-10Missing Authorization vulnerability in Drupal LocalGov Workflows allows Forceful Browsing. This issue affects LocalGov Workflows versions: from 0.0.0 to 1.6.0.
CVE-2026-9726Critical9.82026-07-10Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal AlternativeCommerce (Basket) allows Object Inject…
CVE-2026-6816Low3.82026-05-28An access bypass vulnerability in Drupal TFA Basic Plugins allows users with the administer users permission to view or generate recovery codes for other users…
CVE-2026-5343High7.42026-05-28Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal SAML SSO - Service Provider allows Privilege Escalation. This issue affects SAML…
CVE-2026-4929Medium5.42026-05-21Simple Hierarchical Select (SHS) for Drupal 7 contains cross-site scripting risk due to improper output escaping of term-derived text. Confirmed affected paths…
CVE-2026-4093Medium5.42026-05-21In the Drupal 7 Term Reference Tree module, two stored XSS vectors exist in the widget/formatter rendering pipeline. Vector A (token display templates): When…
CVE-2026-9082Critical9.82026-05-20Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Drupal core allows SQL Injection. This issue affe…
CVE-2026-8495Critical9.82026-05-19Missing Authorization vulnerability in Drupal Date iCal allows Forceful Browsing. This issue affects Date iCal: from 0.0.0 before 4.0.15.
CVE-2026-8493Medium5.42026-05-19Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Colorbox Inline allows Cross-Site Scripting (XSS)…
CVE-2026-8492Low2.72026-05-19Modification of Assumed-Immutable Data (MAID) vulnerability in Drupal Translate Drupal with GTranslate allows Resource Location Spoofing. This issue affects T…
CVE-2026-8491Low3.72026-05-19Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal Node View Permissions allows Forceful Browsing. This issue affects Node View Perm…
CVE-2026-6871Medium6.12026-05-19Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Obfuscate allows Cross-Site Scripting (XSS). This…
CVE-2026-6367Medium6.12026-05-19Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). Th…
CVE-2026-6366Medium6.62026-05-19Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection. This issue affects…
CVE-2026-6365Medium6.12026-05-19Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). Th…
CVE-2026-6095Medium6.12026-05-19Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Orejime allows Cross-Site Scripting (XSS). This i…