Drupal
Page 2 of 12 — Drupal CVEs from a corpus of 1185, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-1556 | Medium | 6.5 | 2026-03-26 | Information disclosure in the file URI processing of File (Field) Paths in Drupal File (Field) Paths 7.x prior to 7.1.3 on Drupal 7.x allows authenticated user… |
CVE-2026-0748 | Medium | 4.3 | 2026-03-26 | In the Drupal 7 Internationalization (i18n) module, the i18n_node submodule allows a user with both "Translate content" and "Administer content translations" p… |
CVE-2026-4933 | High | 7.5 | 2026-03-26 | Incorrect Authorization vulnerability in Drupal Unpublished Node Permissions allows Forceful Browsing.This issue affects Unpublished Node Permissions: from 0.0… |
CVE-2026-4393 | Medium | 4.3 | 2026-03-26 | Cross-Site Request Forgery (CSRF) vulnerability in Drupal Automated Logout allows Cross Site Request Forgery.This issue affects Automated Logout: from 0.0.0 be… |
CVE-2026-3573 | High | 7.5 | 2026-03-26 | Incorrect Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Resource Injection.This issue affects AI (Artificial Intelligence): from 0… |
CVE-2026-3532 | Medium | 4.2 | 2026-03-26 | Improper Handling of Case Sensitivity vulnerability in Drupal OpenID Connect / OAuth client allows Privilege Escalation.This issue affects OpenID Connect / OAu… |
CVE-2026-3531 | Medium | 6.5 | 2026-03-26 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal OpenID Connect / OAuth client allows Authentication Bypass.This issue affects… |
CVE-2026-3530 | Medium | 4.3 | 2026-03-26 | Server-Side Request Forgery (SSRF) vulnerability in Drupal OpenID Connect / OAuth client allows Server Side Request Forgery.This issue affects OpenID Connect /… |
CVE-2026-3529 | Medium | 6.1 | 2026-03-26 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Google Analytics GA4 allows Cross-Site Scripting (… |
CVE-2026-3528 | Medium | 6.1 | 2026-03-26 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Calculation Fields allows Cross-Site Scripting (XS… |
CVE-2026-3527 | Medium | 6.5 | 2026-03-26 | Missing Authentication for Critical Function vulnerability in Drupal AJAX Dashboard allows Exploiting Incorrectly Configured Access Control Security Levels.Thi… |
CVE-2026-3526 | Medium | 5.3 | 2026-03-26 | Incorrect Authorization vulnerability in Drupal File Access Fix (deprecated) allows Forceful Browsing.This issue affects File Access Fix (deprecated): from 0.0… |
CVE-2026-3525 | Medium | 5.3 | 2026-03-26 | Incorrect Authorization vulnerability in Drupal File Access Fix (deprecated) allows Forceful Browsing.This issue affects File Access Fix (deprecated): from 0.0… |
CVE-2026-3218 | Medium | 4.8 | 2026-03-25 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Responsive Favicons allows Cross-Site Scripting (X… |
CVE-2026-3217 | Medium | 6.1 | 2026-03-25 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal SAML SSO - Service Provider allows Cross-Site Scri… |
CVE-2026-3216 | Medium | 5.0 | 2026-03-25 | Server-Side Request Forgery (SSRF) vulnerability in Drupal Drupal Canvas allows Server Side Request Forgery.This issue affects Drupal Canvas: from 0.0.0 before… |
CVE-2026-3215 | Medium | 5.4 | 2026-03-25 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Islandora allows Cross-Site Scripting (XSS).This i… |
CVE-2026-3214 | Medium | 6.5 | 2026-03-25 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal CAPTCHA allows Functionality Bypass.This issue affects CAPTCHA: from 0.0.0 bef… |
CVE-2026-3213 | Medium | 4.7 | 2026-03-25 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Anti-Spam by CleanTalk allows Cross-Site Scripting… |
CVE-2026-3212 | Medium | 5.4 | 2026-03-25 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Tagify allows Cross-Site Scripting (XSS).This issu… |
CVE-2026-3211 | Medium | 4.3 | 2026-03-25 | Cross-Site Request Forgery (CSRF) vulnerability in Drupal Theme Negotiation by Rules allows Cross Site Request Forgery.This issue affects Theme Negotiation by… |
CVE-2026-3210 | Medium | 5.3 | 2026-03-25 | Incorrect Authorization vulnerability in Drupal Material Icons allows Forceful Browsing.This issue affects Material Icons: from 0.0.0 before 2.0.4. |
CVE-2026-2349 | Medium | 6.1 | 2026-03-25 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal UI Icons allows Cross-Site Scripting (XSS).This is… |
CVE-2026-2348 | Medium | 5.4 | 2026-03-25 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Quick Edit allows Cross-Site Scripting (XSS).This… |
CVE-2026-1917 | Medium | 4.3 | 2026-03-25 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Login Disable allows Functionality Bypass.This issue affects Login Disable: fr… |
CVE-2026-1554 | Medium | 4.2 | 2026-02-04 | XML Injection (aka Blind XPath Injection) vulnerability in Drupal Central Authentication System (CAS) Server allows Privilege Escalation.This issue affects Cen… |
CVE-2026-1553 | Medium | 4.8 | 2026-02-04 | Incorrect Authorization vulnerability in Drupal Drupal Canvas allows Forceful Browsing.This issue affects Drupal Canvas: from 0.0.0 before 1.0.4. |
CVE-2026-0948 | Medium | 6.5 | 2026-02-04 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Microsoft Entra ID SSO Login allows Privilege Escalation.This issue affects Mi… |
CVE-2026-0947 | Medium | 4.8 | 2026-02-04 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AT Internet Piano Analytics allows Cross-Site Scri… |
CVE-2026-0946 | Medium | 6.1 | 2026-02-04 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AT Internet SmartTag allows Cross-Site Scripting (… |
CVE-2026-0945 | High | 8.8 | 2026-02-04 | Privilege Defined With Unsafe Actions vulnerability in Drupal Role Delegation allows Privilege Escalation.This issue affects Role Delegation: from 1.3.0 before… |
CVE-2026-0944 | Medium | 5.3 | 2026-02-04 | Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal Group invite allows Forceful Browsing.This issue affects Group invite: from 0.0.0… |
CVE-2025-14840 | High | 7.5 | 2026-01-28 | Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal HTTP Client Manager allows Forceful Browsing.This issue affects HTTP Client Manage… |
CVE-2025-14472 | High | 8.1 | 2026-01-28 | Cross-Site Request Forgery (CSRF) vulnerability in Drupal Acquia Content Hub allows Cross Site Request Forgery.This issue affects Acquia Content Hub: from 0.0… |
CVE-2025-13986 | Medium | 4.2 | 2026-01-28 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Disable Login Page allows Functionality Bypass.This issue affects Disable Logi… |
CVE-2025-13985 | Medium | 5.3 | 2026-01-28 | Incorrect Authorization vulnerability in Drupal Entity Share allows Forceful Browsing.This issue affects Entity Share: from 0.0.0 before 3.13.0. |
CVE-2025-13984 | Medium | 6.1 | 2026-01-28 | Permissive Cross-domain Security Policy with Untrusted Domains vulnerability in Drupal Next.Js allows Cross-Site Scripting (XSS).This issue affects Next.Js: fr… |
CVE-2025-13983 | Medium | 5.4 | 2026-01-28 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Tagify allows Cross-Site Scripting (XSS).This issu… |
CVE-2025-13982 | High | 8.1 | 2026-01-28 | Cross-Site Request Forgery (CSRF) vulnerability in Drupal Login Time Restriction allows Cross Site Request Forgery.This issue affects Login Time Restriction: f… |
CVE-2025-13981 | Medium | 4.4 | 2026-01-28 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Cross-Site Scr… |
CVE-2025-13980 | Medium | 5.3 | 2026-01-28 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal CKEditor 5 Premium Features allows Functionality Bypass.This issue affects CKE… |
CVE-2025-13979 | Medium | 5.4 | 2026-01-28 | Privilege Defined With Unsafe Actions vulnerability in Drupal Mini site allows Stored XSS.This issue affects Mini site: from 0.0.0 before 3.0.2. |
CVE-2026-0750 | High | 7.5 | 2026-01-28 | Improper Verification of Cryptographic Signature vulnerability in Drupal Drupal Commerce Paybox Commerce Paybox on Drupal 7.X allows Authentication Bypass.This… |
CVE-2026-0749 | Medium | 6.1 | 2026-01-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Form Builder allows Cross-Site Scripting (XSS).Thi… |
CVE-2025-14557 | Medium | 4.8 | 2026-01-14 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Drupal Facebook Pixel facebook_pixel allows Stored… |
CVE-2025-14556 | Medium | 5.4 | 2026-01-14 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Drupal Flag allows Cross-Site Scripting (XSS).This… |
CVE-2025-12848 | Medium | 6.1 | 2025-11-26 | Webform Multiple File Upload module for Drupal 7.x contains a cross-site scripting (XSS) vulnerability in the file name renderer. An unauthenticated attacker c… |
CVE-2025-13083 | Low | 3.7 | 2025-11-18 | Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Drupal core allows Exploiting Incorrectly Configured Access Control Security… |
CVE-2025-13082 | Medium | 4.3 | 2025-11-18 | User Interface (UI) Misrepresentation of Critical Information vulnerability in Drupal Drupal core allows Content Spoofing.This issue affects Drupal core: from… |
CVE-2025-13081 | Medium | 5.9 | 2025-11-18 | Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection.This issue affects D… |
CVE-2025-13080 | Medium | 5.3 | 2025-11-18 | Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal Drupal core allows Forceful Browsing.This issue affects Drupal core: from 8.0.0 be… |
CVE-2025-12761 | Low | 3.5 | 2025-11-18 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Simple multi step form allows Cross-Site Scripting… |
CVE-2025-12760 | Medium | 5.4 | 2025-11-18 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Email TFA allows Functionality Bypass.This issue affects Email TFA: from 0.0.0… |
CVE-2025-9954 | High | 7.5 | 2025-10-30 | Missing Authorization vulnerability in Drupal Acquia DAM allows Forceful Browsing.This issue affects Acquia DAM: from 0.0.0 before 1.1.5. |
CVE-2025-12466 | High | 7.5 | 2025-10-30 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Simple OAuth (OAuth2) & OpenID Connect allows Authentication Bypass.This issue… |
CVE-2025-12083 | Medium | 6.1 | 2025-10-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal CivicTheme Design System allows Cross-Site Scripti… |
CVE-2025-12082 | High | 7.5 | 2025-10-30 | Incorrect Authorization vulnerability in Drupal CivicTheme Design System allows Forceful Browsing.This issue affects CivicTheme Design System: from 0.0.0 befor… |
CVE-2025-10931 | Low | 3.8 | 2025-10-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Umami Analytics allows Cross-Site Scripting (XSS)… |
CVE-2025-10930 | Medium | 4.3 | 2025-10-30 | Cross-Site Request Forgery (CSRF) vulnerability in Drupal Currency allows Cross Site Request Forgery.This issue affects Currency: from 0.0.0 before 3.5.0. |
CVE-2025-10929 | Medium | 5.3 | 2025-10-30 | Improper Validation of Consistency within Input vulnerability in Drupal Reverse Proxy Header allows Manipulating User-Controlled Variables.This issue affects R… |
CVE-2025-10928 | Medium | 6.3 | 2025-10-30 | Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Access code allows Brute Force.This issue affects Access code: from 0.0.0 bef… |
CVE-2025-10927 | Medium | 6.1 | 2025-10-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Plausible tracking allows Cross-Site Scripting (XS… |
CVE-2025-10926 | Medium | 6.1 | 2025-10-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal JSON Field allows Cross-Site Scripting (XSS).This… |
CVE-2025-9554 | Medium | 5.3 | 2025-10-10 | Vulnerability in Drupal Owl Carousel 2.This issue affects Owl Carousel 2: *.*. |
CVE-2025-9553 | Medium | 5.3 | 2025-10-10 | Vulnerability in Drupal API Key manager.This issue affects API Key manager: *.*. |
CVE-2025-9552 | Medium | 5.3 | 2025-10-10 | Vulnerability in Drupal Synchronize composer.Json With Contrib Modules.This issue affects Synchronize composer.Json With Contrib Modules: *.*. |
CVE-2025-9551 | Medium | 6.5 | 2025-10-10 | Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Protected Pages allows Brute Force.This issue affects Protected Pages: from 0… |
CVE-2025-9550 | Medium | 6.1 | 2025-10-10 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Facets allows Cross-Site Scripting (XSS).This issu… |
CVE-2025-9549 | Medium | 6.5 | 2025-10-10 | Missing Authorization vulnerability in Drupal Facets allows Forceful Browsing.This issue affects Facets: from 0.0.0 before 2.0.10, from 3.0.0 before 3.0.1. |
CVE-2025-8093 | High | 8.8 | 2025-10-10 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Authenticator Login allows Authentication Bypass.This issue affects Authentica… |
CVE-2025-8996 | Medium | 4.3 | 2025-08-15 | Missing Authorization vulnerability in Drupal Layout Builder Advanced Permissions allows Forceful Browsing.This issue affects Layout Builder Advanced Permissio… |
CVE-2025-8995 | Critical | 9.8 | 2025-08-15 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Authenticator Login allows Authentication Bypass.This issue affects Authentica… |
CVE-2025-8675 | High | 8.8 | 2025-08-15 | Server-Side Request Forgery (SSRF) vulnerability in Drupal AI SEO Link Advisor allows Server Side Request Forgery.This issue affects AI SEO Link Advisor: from… |
CVE-2025-8362 | Medium | 6.1 | 2025-08-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal GoogleTag Manager allows Cross-Site Scripting (XSS… |
CVE-2025-8361 | High | 7.6 | 2025-08-15 | Missing Authorization vulnerability in Drupal Config Pages allows Forceful Browsing. This issue affects Config Pages: from 0.0.0 before 2.18.0. |
CVE-2025-8092 | High | 7.6 | 2025-08-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal COOKiES Consent Management allows Cross-Site Scrip… |
CVE-2025-7717 | High | 7.5 | 2025-07-21 | Missing Authorization vulnerability in Drupal File Download allows Forceful Browsing.This issue affects File Download: from 0.0.0 before 1.9.0, from 2.0.0 befo… |
CVE-2025-7716 | Medium | 6.1 | 2025-07-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Real-time SEO for Drupal allows Cross-Site Scripti… |
CVE-2025-7715 | Medium | 6.1 | 2025-07-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Block Attributes allows Cross-Site Scripting (XSS)… |
CVE-2025-7393 | Critical | 9.8 | 2025-07-21 | Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Mail Login allows Brute Force.This issue affects Mail Login: from 3.0.0 befor… |
CVE-2025-7392 | Medium | 6.1 | 2025-07-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Cookies Addons allows Cross-Site Scripting (XSS).T… |
CVE-2025-7031 | Medium | 5.3 | 2025-07-08 | Missing Authentication for Critical Function vulnerability in Drupal Config Pages Viewer allows Exploiting Incorrectly Configured Access Control Security Level… |
CVE-2025-7030 | Medium | 6.5 | 2025-07-08 | Privilege Defined With Unsafe Actions vulnerability in Drupal Two-factor Authentication (TFA) allows Exploiting Incorrectly Configured Access Control Security… |
CVE-2025-6677 | Medium | 5.4 | 2025-06-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Paragraphs table allows Cross-Site Scripting (XSS)… |
CVE-2025-6676 | Medium | 5.4 | 2025-06-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Simple XML sitemap allows Cross-Site Scripting (XS… |
CVE-2025-6675 | Medium | 4.8 | 2025-06-26 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Enterprise MFA - TFA for Drupal allows Authentication Bypass.This issue affect… |
CVE-2025-6674 | Medium | 6.1 | 2025-06-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal CKEditor5 Youtube allows Cross-Site Scripting (XSS… |
CVE-2025-5682 | Medium | 4.3 | 2025-06-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Klaro Cookie & Consent Management allows Cross-Sit… |
CVE-2025-48923 | Medium | 6.1 | 2025-06-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Toc.Js allows Cross-Site Scripting (XSS).This issu… |
CVE-2025-48922 | Medium | 6.1 | 2025-06-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal GLightbox allows Cross-Site Scripting (XSS).This i… |
CVE-2025-48921 | High | 8.8 | 2025-06-26 | Cross-Site Request Forgery (CSRF) vulnerability in Drupal Open Social allows Cross Site Request Forgery.This issue affects Open Social: from 0.0.0 before 12.3… |
CVE-2025-48920 | High | 7.3 | 2025-06-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal etracker allows Cross-Site Scripting (XSS).This is… |
CVE-2025-48919 | Medium | 5.0 | 2025-06-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Simple Klaro allows Cross-Site Scripting (XSS).Thi… |
CVE-2025-48918 | High | 8.8 | 2025-06-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Simple Klaro allows Cross-Site Scripting (XSS).Thi… |
CVE-2025-48917 | Medium | 5.0 | 2025-06-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal EU Cookie Compliance (GDPR Compliance) allows Cros… |
CVE-2025-48916 | Medium | 6.5 | 2025-06-13 | Missing Authorization vulnerability in Drupal Bookable Calendar allows Forceful Browsing.This issue affects Bookable Calendar: from 0.0.0 before 2.2.13. |
CVE-2025-48915 | High | 8.6 | 2025-06-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal COOKiES Consent Management allows Cross-Site Scrip… |
CVE-2025-48914 | High | 8.6 | 2025-06-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal COOKiES Consent Management allows Cross-Site Scrip… |
CVE-2025-48448 | Medium | 6.5 | 2025-06-11 | Allocation of Resources Without Limits or Throttling vulnerability in Drupal Admin Audit Trail allows Excessive Allocation.This issue affects Admin Audit Trail… |
CVE-2025-48447 | High | 7.1 | 2025-06-11 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Lightgallery allows Cross-Site Scripting (XSS).Thi… |