Drupal

1057 CVEs across 368 Drupal products. Browse Drupal vulnerabilities, severities, and proof-of-concept exploits.

Drupal products with known CVEs

ProductCVEs
Drupal736
Drupal Core46
Core19
Ai (Artificial Intelligence)8
Open Social8
Enterprise Mfa - Tfa For Drupal6
Project Issue Tracking Module6
Print5
Aggregation Module4
Cookies Consent Management4
Drupal Canvas4
Everyblog4
Project4
Two-Factor Authentication (Tfa)4
Ubercart Module4
Authenticator Login3
Content Construction Kit3
Drupal Project Issue Tracking3
Facets3
Login Disable3
One Time Password3
Openid Connect / Oauth Client3
Shindig-Integrator3
Tagify3
Access Code2
Acquia Dam2
Activity2
Advanced Content Feedback (Aka Admin Feedback)2
Ai Agents2
Ajax Checklist2
Anti-Spam By Cleantalk2
Artificial Intelligence2
Bibliography Module2
Brilliant Gallery2
Chatroom Module2
Civictheme Design System2
Colorbox2
Cookies Consent Management2
Custom Search Module2
Data2
Database Administration Module2
Data-Module2
Drupal Easylinks Module2
Eca: Event - Condition - Action2
Email Tfa2
File Access Fix (Deprecated)2
File Entity (Fieldable Files)2
Flowdrop2
Google Tag2
Help Tip Module2
Drupal CVEs — newest first (page 1 of 11)
CVESeverityScorePublishedSummary
CVE-2026-15089Critical9.12026-07-10vulnerability in Drupal Commerce guest registration allows . This issue affects Commerce guest registration versions: *.*.
CVE-2026-15087Medium5.92026-07-10vulnerability in Drupal Clean RESTful allows . This issue affects Clean RESTful versions: *.*.
CVE-2026-15086Medium5.92026-07-10vulnerability in Drupal Raw Formatter [Meta Tag Formatter] allows . This issue affects Raw Formatter [Meta Tag Formatter] versions: *.*.
CVE-2026-11915Medium5.92026-07-10vulnerability in Drupal Brute force attack protection allows . This issue affects Brute force attack protection versions: *.*.
CVE-2026-11914Medium5.92026-07-10vulnerability in Drupal Composer allows . This issue affects Composer versions: *.*.
CVE-2026-11913Critical9.82026-07-10vulnerability in Drupal Mother May I allows . This issue affects Mother May I versions: *.*.
CVE-2026-58591Medium5.42026-07-10Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Colorbox allows Cross-Site Scripting (XSS). This i…
CVE-2026-58590Medium5.42026-07-10Missing Authorization vulnerability in Drupal FlowDrop allows Forceful Browsing. This issue affects FlowDrop versions: from 0.0.0 to 1.6.0.
CVE-2026-58589Medium5.42026-07-10Missing Authorization vulnerability in Drupal FlowDrop allows Forceful Browsing. This issue affects FlowDrop versions: from 0.0.0 to 1.6.0.
CVE-2026-58588Medium6.12026-07-10Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal Canvas allows Cross-Site Scripting (XSS). T…
CVE-2026-58587Medium6.12026-07-10Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal Canvas allows Cross-Site Scripting (XSS). T…
CVE-2026-55810High8.12026-07-10Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Plotly.js Graphing allows Object Injection. This issue a…
CVE-2026-55809High8.12026-07-10Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Flag attendance field allows Object Injection. This issu…
CVE-2026-55808Medium5.42026-07-10Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). Thi…
CVE-2026-55807Low3.12026-07-10Server-Side Request Forgery (SSRF) vulnerability in Drupal Drupal core allows Server Side Request Forgery. This issue affects Drupal core versions: from 0.0.0…
CVE-2026-55806Medium5.92026-07-10URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal Drupal core allows Content Spoofing. This issue affects Drupal core versions: from…
CVE-2026-55804Medium5.92026-07-10Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection. This issue affects…
CVE-2026-55803Medium5.92026-07-10Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection. This issue affects…
CVE-2026-15085Medium5.42026-07-10Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI SEO/GEO Analyzer allows Stored XSS. This issue…
CVE-2026-15084Medium5.42026-07-10Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal UI Patterns (SDC in Drupal UI) allows Stored XSS…
CVE-2026-15083Medium4.22026-07-10Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal ECA: Event - Condition - Action allows Object Injection…
CVE-2026-15082Medium5.42026-07-10Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Siteimprove Analytics allows Cross-Site Scripting…
CVE-2026-15081High7.42026-07-10Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Location Selector allows SQL Injection. This issue…
CVE-2026-15080Medium4.32026-07-10Cross-Site Request Forgery (CSRF) vulnerability in Drupal Ray Enterprise Translation allows Cross Site Request Forgery. This issue affects Ray Enterprise Trans…
CVE-2026-15079Medium5.42026-07-10Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Login Disable allows Brute Force. This issue affects Login Disable versions…
CVE-2026-13244High8.12026-07-10Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Tealium iQ Tag Management allows Object Injection. This…
CVE-2026-13243Medium4.82026-07-10Cross-Site Request Forgery (CSRF) vulnerability in Drupal Salesforce Suite allows Cross Site Request Forgery. This issue affects Salesforce Suite versions: fro…
CVE-2026-13242Medium6.52026-07-10Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Geolocation Field allows SQL Injection. This issue…
CVE-2026-13241Medium6.52026-07-10Missing Authorization vulnerability in Drupal Paragraphs allows Forceful Browsing. This issue affects Paragraphs versions: from 0.0.0 to 1.21.0.
CVE-2026-13240Medium6.52026-07-10Missing Authorization vulnerability in Drupal Paragraphs allows Forceful Browsing. This issue affects Paragraphs versions: from 0.0.0 to 1.21.0.
CVE-2026-13239Medium6.52026-07-10Missing Authorization vulnerability in Drupal WissKI allows Forceful Browsing. This issue affects WissKI versions: from 0.0.0 to 4.2.0.
CVE-2026-13238Medium4.82026-07-10Incorrect Authorization vulnerability in Drupal Commerce Realex / Global Payments allows Forceful Browsing. This issue affects Commerce Realex / Global Payment…
CVE-2026-13237Medium4.82026-07-10Incorrect Authorization vulnerability in Drupal AI Agents allows Forceful Browsing. This issue affects AI Agents versions: from 0.0.0 to 1.1.4, from 1.2.0 to 1…
CVE-2026-13236Medium4.22026-07-10Missing Authorization vulnerability in Drupal AI Agents allows Forceful Browsing. This issue affects AI Agents versions: from 0.0.0 to 1.1.4, from 1.2.0 to 1.2…
CVE-2026-13235Low3.32026-07-10Missing Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Forceful Browsing. This issue affects AI (Artificial Intelligence) versions…
CVE-2026-13234Medium6.12026-07-10Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Cross-Site Scr…
CVE-2026-13233Low3.32026-07-10Server-Side Request Forgery (SSRF) vulnerability in Drupal OpenAI Provider allows Server Side Request Forgery. This issue affects OpenAI Provider versions: fro…
CVE-2026-13232Low3.12026-07-10Incorrect Authorization vulnerability in Drupal Advanced Content Feedback (aka admin_feedback) allows Forceful Browsing. This issue affects Advanced Content Fe…
CVE-2026-13231Medium6.12026-07-10Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Advanced Content Feedback (aka admin_feedback) all…
CVE-2026-12535Critical9.82026-07-10Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Formatter Field allows Object Injection. This issue affe…
CVE-2026-11909Low3.32026-07-10Missing Authorization vulnerability in Drupal Examples for Developers allows Forceful Browsing. This issue affects Examples for Developers versions: from 0.0.0…
CVE-2026-11908Medium5.42026-07-10Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Tagify allows Stored XSS. This issue affects Tagif…
CVE-2026-10770Medium6.12026-07-10Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Anti-Spam by CleanTalk allows Reflected XSS. This…
CVE-2026-10769Medium5.42026-07-10Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Commerce Core allows Stored XSS. This issue affect…
CVE-2026-10768Critical9.82026-07-10Missing Authorization vulnerability in Drupal LocalGov Workflows allows Forceful Browsing. This issue affects LocalGov Workflows versions: from 0.0.0 to 1.6.0.
CVE-2026-9726Critical9.82026-07-10Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal AlternativeCommerce (Basket) allows Object Inject…
CVE-2026-6816Low3.82026-05-28An access bypass vulnerability in Drupal TFA Basic Plugins allows users with the administer users permission to view or generate recovery codes for other users…
CVE-2026-5343High7.42026-05-28Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal SAML SSO - Service Provider allows Privilege Escalation. This issue affects SAML…
CVE-2026-4929Medium5.42026-05-21Simple Hierarchical Select (SHS) for Drupal 7 contains cross-site scripting risk due to improper output escaping of term-derived text. Confirmed affected paths…
CVE-2026-4093Medium5.42026-05-21In the Drupal 7 Term Reference Tree module, two stored XSS vectors exist in the widget/formatter rendering pipeline. Vector A (token display templates): When…
CVE-2026-9082Critical9.82026-05-20Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Drupal core allows SQL Injection. This issue affe…
CVE-2026-8495Critical9.82026-05-19Missing Authorization vulnerability in Drupal Date iCal allows Forceful Browsing. This issue affects Date iCal: from 0.0.0 before 4.0.15.
CVE-2026-8493Medium5.42026-05-19Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Colorbox Inline allows Cross-Site Scripting (XSS)…
CVE-2026-8492Low2.72026-05-19Modification of Assumed-Immutable Data (MAID) vulnerability in Drupal Translate Drupal with GTranslate allows Resource Location Spoofing. This issue affects T…
CVE-2026-8491Low3.72026-05-19Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal Node View Permissions allows Forceful Browsing. This issue affects Node View Perm…
CVE-2026-6871Medium6.12026-05-19Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Obfuscate allows Cross-Site Scripting (XSS). This…
CVE-2026-6367Medium6.12026-05-19Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). Th…
CVE-2026-6366Medium6.62026-05-19Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection. This issue affects…
CVE-2026-6365Medium6.12026-05-19Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). Th…
CVE-2026-6095Medium6.12026-05-19Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Orejime allows Cross-Site Scripting (XSS). This i…
CVE-2026-1556Medium6.52026-03-26Information disclosure in the file URI processing of File (Field) Paths in Drupal File (Field) Paths 7.x prior to 7.1.3 on Drupal 7.x allows authenticated user…
CVE-2026-0748Medium4.32026-03-26In the Drupal 7 Internationalization (i18n) module, the i18n_node submodule allows a user with both "Translate content" and "Administer content translations" p…
CVE-2026-4933High7.52026-03-26Incorrect Authorization vulnerability in Drupal Unpublished Node Permissions allows Forceful Browsing.This issue affects Unpublished Node Permissions: from 0.0…
CVE-2026-4393Medium4.32026-03-26Cross-Site Request Forgery (CSRF) vulnerability in Drupal Automated Logout allows Cross Site Request Forgery.This issue affects Automated Logout: from 0.0.0 be…
CVE-2026-3573High7.52026-03-26Incorrect Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Resource Injection.This issue affects AI (Artificial Intelligence): from 0…
CVE-2026-3532Medium4.22026-03-26Improper Handling of Case Sensitivity vulnerability in Drupal OpenID Connect / OAuth client allows Privilege Escalation.This issue affects OpenID Connect / OAu…
CVE-2026-3531Medium6.52026-03-26Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal OpenID Connect / OAuth client allows Authentication Bypass.This issue affects…
CVE-2026-3530Medium4.32026-03-26Server-Side Request Forgery (SSRF) vulnerability in Drupal OpenID Connect / OAuth client allows Server Side Request Forgery.This issue affects OpenID Connect /…
CVE-2026-3529Medium6.12026-03-26Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Google Analytics GA4 allows Cross-Site Scripting (…
CVE-2026-3528Medium6.12026-03-26Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Calculation Fields allows Cross-Site Scripting (XS…
CVE-2026-3527Medium6.52026-03-26Missing Authentication for Critical Function vulnerability in Drupal AJAX Dashboard allows Exploiting Incorrectly Configured Access Control Security Levels.Thi…
CVE-2026-3526Medium5.32026-03-26Incorrect Authorization vulnerability in Drupal File Access Fix (deprecated) allows Forceful Browsing.This issue affects File Access Fix (deprecated): from 0.0…
CVE-2026-3525Medium5.32026-03-26Incorrect Authorization vulnerability in Drupal File Access Fix (deprecated) allows Forceful Browsing.This issue affects File Access Fix (deprecated): from 0.0…
CVE-2026-3218Medium4.82026-03-25Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Responsive Favicons allows Cross-Site Scripting (X…
CVE-2026-3217Medium6.12026-03-25Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal SAML SSO - Service Provider allows Cross-Site Scri…
CVE-2026-3216Medium5.02026-03-25Server-Side Request Forgery (SSRF) vulnerability in Drupal Drupal Canvas allows Server Side Request Forgery.This issue affects Drupal Canvas: from 0.0.0 before…
CVE-2026-3215Medium5.42026-03-25Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Islandora allows Cross-Site Scripting (XSS).This i…
CVE-2026-3214Medium6.52026-03-25Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal CAPTCHA allows Functionality Bypass.This issue affects CAPTCHA: from 0.0.0 bef…
CVE-2026-3213Medium4.72026-03-25Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Anti-Spam by CleanTalk allows Cross-Site Scripting…
CVE-2026-3212Medium5.42026-03-25Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Tagify allows Cross-Site Scripting (XSS).This issu…
CVE-2026-3211Medium4.32026-03-25Cross-Site Request Forgery (CSRF) vulnerability in Drupal Theme Negotiation by Rules allows Cross Site Request Forgery.This issue affects Theme Negotiation by…
CVE-2026-3210Medium5.32026-03-25Incorrect Authorization vulnerability in Drupal Material Icons allows Forceful Browsing.This issue affects Material Icons: from 0.0.0 before 2.0.4.
CVE-2026-2349Medium6.12026-03-25Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal UI Icons allows Cross-Site Scripting (XSS).This is…
CVE-2026-2348Medium5.42026-03-25Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Quick Edit allows Cross-Site Scripting (XSS).This…
CVE-2026-1917Medium4.32026-03-25Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Login Disable allows Functionality Bypass.This issue affects Login Disable: fr…
CVE-2026-1554Medium4.22026-02-04XML Injection (aka Blind XPath Injection) vulnerability in Drupal Central Authentication System (CAS) Server allows Privilege Escalation.This issue affects Cen…
CVE-2026-1553Medium4.82026-02-04Incorrect Authorization vulnerability in Drupal Drupal Canvas allows Forceful Browsing.This issue affects Drupal Canvas: from 0.0.0 before 1.0.4.
CVE-2026-0948Medium6.52026-02-04Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Microsoft Entra ID SSO Login allows Privilege Escalation.This issue affects Mi…
CVE-2026-0947Medium4.82026-02-04Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AT Internet Piano Analytics allows Cross-Site Scri…
CVE-2026-0946Medium6.12026-02-04Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AT Internet SmartTag allows Cross-Site Scripting (…
CVE-2026-0945High8.82026-02-04Privilege Defined With Unsafe Actions vulnerability in Drupal Role Delegation allows Privilege Escalation.This issue affects Role Delegation: from 1.3.0 before…
CVE-2026-0944Medium5.32026-02-04Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal Group invite allows Forceful Browsing.This issue affects Group invite: from 0.0.0…
CVE-2025-14840High7.52026-01-28Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal HTTP Client Manager allows Forceful Browsing.This issue affects HTTP Client Manage…
CVE-2025-14472High8.12026-01-28Cross-Site Request Forgery (CSRF) vulnerability in Drupal Acquia Content Hub allows Cross Site Request Forgery.This issue affects Acquia Content Hub: from 0.0…
CVE-2025-13986Medium4.22026-01-28Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Disable Login Page allows Functionality Bypass.This issue affects Disable Logi…
CVE-2025-13985Medium5.32026-01-28Incorrect Authorization vulnerability in Drupal Entity Share allows Forceful Browsing.This issue affects Entity Share: from 0.0.0 before 3.13.0.
CVE-2025-13984Medium6.12026-01-28Permissive Cross-domain Security Policy with Untrusted Domains vulnerability in Drupal Next.Js allows Cross-Site Scripting (XSS).This issue affects Next.Js: fr…
CVE-2025-13983Medium5.42026-01-28Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Tagify allows Cross-Site Scripting (XSS).This issu…
CVE-2025-13982High8.12026-01-28Cross-Site Request Forgery (CSRF) vulnerability in Drupal Login Time Restriction allows Cross Site Request Forgery.This issue affects Login Time Restriction: f…
CVE-2025-13981Medium4.42026-01-28Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Cross-Site Scr…