Skip to content
OpenAdvisories

Vendor

Drupal

576 known vulnerabilities.

Drupal at a glance

Last 12 months
334
Critical · all time
40
Exploited · all time
4
Public exploit · all time
12

1 of the exploited vulnerabilities are known to be used by ransomware (CISA).

New vulnerabilities per month · last 12 months
0 100 200 December 2025: 0 vulnerabilities Dec 2025 January 2026: 14 vulnerabilities February 2026: 7 vulnerabilities March 2026: 25 vulnerabilities Mar April 2026: 0 vulnerabilities May 2026: 14 vulnerabilities, 2 critical June 2026: 0 vulnerabilities Jun July 2026: 46 vulnerabilities, 5 critical August 2026: 17 vulnerabilities, 4 critical September 2026: 26 vulnerabilities, 1 critical Sep October 2026: 178 vulnerabilities, 3 critical November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 20261783
Sep 2026261
Aug 2026174
Jul 2026465
Jun 202600
May 2026142
Apr 202600
Mar 2026250
Feb 202670
Jan 2026140
Dec 202500
Nov 202570
Oct 2025170
Sep 202500
Aug 202561
Jul 202571
Jun 2025210
May 2025160
Apr 2025180
Mar 2025303
Feb 202500
Jan 20257412
Dec 202483

Products

Drupal core 52 Webform 20 Core 19 AI (Artificial Intelligence) 18 SAML SSO - Service Provider 13 Open Social 8 Commerce Core 7 Enterprise MFA - TFA for Drupal 6 Monster Menus 4 Two-factor Authentication (TFA) 4 COOKiES Consent Management 4 Drupal Canvas 4 Tagify 3 Facets 3 OpenID Connect / OAuth client 3 Disable Login Page 3 Single Content Sync 3 Authenticator Login 3 Login Disable 3 Commerce Stripe 3 Gammu SMS Daemon 3 UI Icons 3 One Time Password 3 Cloud 2 Access code 2 CivicTheme Design System 2 Webform REST 2 Node Access Rebuild Progressive 2 AI Agents 2 Data-module 2 Frontend Editing 2 Paragraphs 2 Anti-Spam by CleanTalk 2 POST File 2 Unpublished Node Permissions 2 Field Permissions 2 Block Attributes 2 ECA: Event - Condition - Action 2 Acquia DAM 2 Paragraphs table 2

Latest advisories

  • High max 8.1
    NCSC-2026-0438 5 CVEs

    Kwetsbaarheden verholpen in Drupal Core en modules door Drupal

    Drupal heeft kwetsbaarheden verholpen in de Drupal core Field UI module, Entity List module, Navigation module, Link module en het Gin administratie thema.

    Drupal
  • High max 9.8
    NCSC-2026-0166 1 CVE 1 exploited

    Kwetsbaarheid verholpen in Drupal core

    Drupal heeft een kwetsbaarheid verholpen in Drupal core (versies vanaf 8.9.0 tot specifieke 10.x en 11.x releases).

    Drupal
  • High max 9.8
    NCSC-2024-0474 6 CVEs

    Kwetsbaarheden verholpen in Drupal Core

    Drupal heeft kwetsbaarheden verholpen in Drupal Core (Specifiek voor versies 7.0 tot 7.102, 8.0.0 tot voor 10.2.11, 10.3.0 tot voor 10.3.9, en 11.0.0 tot voor 11.0.8).

    Drupal open source
All Critical High Medium Low Exploited only Public exploit

576 results · Feed

  • High 8.7
    CVE-2026-110176

    File Force Download for Drupal 7 Access Bypass via Unconditional Download Headers

    The File Force Download module for Drupal 7 implements hook_file_download() to add a Content-Disposition header when a file URL carries the download query parameter. In Drupal 7, returning a non-empty header array from that hook is itself a grant of access to…

    Drupal File Force Download Web / CMS
  • Medium 5.3
    CVE-2026-77152

    Field Collection for Drupal 7 access bypass via missing parent entity access check

    Improper Authorization vulnerability in Drupal Field Collection for Drupal 7 allows a user with the "edit field collections" permission to bypass access control on the parent (host) entity. The access check for field collection items (field_collection_item_ac…

    Drupal Field Collection for Drupal 7 Web / CMS
  • Critical 9.8
    CVE-2026-107249

    Block AJAX - Highly critical - PHP object injection - SA-CONTRIB-2026-192

    Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Block AJAX allows Object Injection. This issue affects Block AJAX versions: from 0.0.0 to 3.0.2.

    Drupal Block AJAX drupal/block_ajax Packagist
  • Medium 5.9
    CVE-2026-107250

    ECA Helper - Critical - Unsupported - SA-CONTRIB-2026-193

    Vulnerability in Drupal ECA Helper. This issue affects ECA Helper versions: *.*.

    Drupal ECA Helper drupal/eca_helper Packagist
  • Medium 6.5
    CVE-2026-107251

    Entity Reference Manager (Merge entities) - Critical - Access bypass - SA-CONTRIB-2026-194

    Incorrect Authorization vulnerability in Drupal Entity Reference Manager (Merge entities) allows Forceful Browsing. This issue affects Entity Reference Manager (Merge entities) versions: from 0.0.0 to 1.0.3.

    Drupal Entity Reference Manager (Merge entities) drupal/entity_reference_manager Packagist
  • Medium 5.4
    CVE-2026-107252

    MathJax: LaTeX for Drupal - Critical - Cross site scripting - SA-CONTRIB-2026-195

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal MathJax: LaTeX for Drupal allows Cross-Site Scripting (XSS). This issue affects MathJax: LaTeX for Drupal versions: from 0.0.0 to 4.1.2.

    Drupal MathJax: LaTeX for Drupal drupal/mathjax Web / CMS Packagist
  • Medium 5.9
    CVE-2026-107253

    Orphans Media - Critical - Unsupported - SA-CONTRIB-2026-196

    Vulnerability in Drupal Orphans Media. This issue affects Orphans Media versions: *.*.

    Drupal Orphans Media drupal/orphans_media Packagist
  • Medium 4.8
    CVE-2026-107254

    Authenticator Login Plus (2FA) - Critical - Improper authentication - SA-CONTRIB-2026-197

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Authenticator Login Plus (2FA) allows Authentication Bypass. This issue affects Authenticator Login Plus (2FA) versions: from 0.0.0 to 1.0.1.

    Drupal Authenticator Login Plus (2FA) drupal/auth_login_plus Packagist
  • Medium 6.5
    CVE-2026-107257

    Actstream - Critical - Access bypass - SA-CONTRIB-2026-198

    Incorrect Authorization vulnerability in Drupal Actstream allows Forceful Browsing. This issue affects Actstream versions: from 0.0.0 to 2.0.1, from 2.1.0 to 2.1.1.

    Drupal Actstream drupal/actstream Packagist
  • Medium 5.4
    CVE-2026-107258

    Inline Entity Form Dialog - Moderately critical - Access bypass - SA-CONTRIB-2026-199

    Incorrect Authorization vulnerability in Drupal Inline Entity Form Dialog allows Forceful Browsing. This issue affects Inline Entity Form Dialog versions: from 0.0.0 to 1.0.6.

    Drupal Inline Entity Form Dialog drupal/inline_entity_form_dialog Packagist
  • Medium 5.4
    CVE-2026-107259

    Linked Field - Moderately critical - Server-side template injection - SA-CONTRIB-2026-200

    Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Linked Field allows Code Injection. This issue affects Linked Field versions: from 0.0.0 to 1.8.0.

    Drupal Linked Field drupal/linked_field Packagist
  • Medium 4.2
    CVE-2026-107261

    Authenticator Login Plus (2FA) - Moderately critical - Improper authentication - SA-CONTRIB-2026-201

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Authenticator Login Plus (2FA) allows Authentication Bypass. This issue affects Authenticator Login Plus (2FA) versions: from 0.0.0 to 1.0.1.

    Drupal Authenticator Login Plus (2FA) drupal/auth_login_plus Packagist
  • Medium 5.4
    CVE-2026-107263

    Gutenberg - Moderately critical - Access bypass - SA-CONTRIB-2026-202

    Incorrect Authorization vulnerability in Drupal Gutenberg allows Forceful Browsing. This issue affects Gutenberg versions: from 0.0.0 to 2.15.0, from 3.0.0 to 3.0.7.

    Drupal Gutenberg drupal/gutenberg Packagist
  • Medium 5.4
    CVE-2026-107264

    Inline Formatter Field - Moderately critical - Server-side template injection - SA-CONTRIB-2026-203

    Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Inline Formatter Field allows Code Injection. This issue affects Inline Formatter Field versions: from 0.0.0 to 4.2.0.

    Drupal Inline Formatter Field drupal/inline_formatter_field Packagist
  • Medium 5.4
    CVE-2026-107265

    Leaflet - Moderately critical - Cross site scripting - SA-CONTRIB-2026-204

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Leaflet allows Stored XSS. This issue affects Leaflet versions: from 0.0.0 to 10.4.13.

    Drupal Leaflet drupal/leaflet Packagist
  • Medium 5.3
    CVE-2026-107266

    Views Share - Moderately critical - Access bypass - SA-CONTRIB-2026-205

    Missing Authorization vulnerability in Drupal Views Share allows Forceful Browsing. This issue affects Views Share versions: from 0.0.0 to 2.0.1.

    Drupal Views Share drupal/views_share Packagist
  • Medium 6.5
    CVE-2026-96389

    Xray Audit - Moderately critical - Access bypass - SA-CONTRIB-2026-206

    Missing Authorization vulnerability in Drupal Xray Audit allows Forceful Browsing. This issue affects Xray Audit versions: from 0.0.0 to 1.6.3, from 2.0.0 to 2.0.4, from 3.0.0 to 3.1.1.

    Drupal Xray Audit drupal/xray_audit Packagist
  • Medium 4.3
    CVE-2026-107268 Public exploit

    Two Factor Authentication - TFA / Passwordless Login - Moderately critical - Information disclosure - SA-CONTRIB-2026-207

    Insertion of Sensitive Information Into Sent Data vulnerability in Drupal Two Factor Authentication - TFA / Passwordless Login allows Forceful Browsing. This issue affects Two Factor Authentication - TFA / Passwordless Login versions: from 0.0.0 to 5.4.1, fro…

    Drupal Two Factor Authentication - TFA / Passwordless Login drupal/miniorange_2fa Packagist
  • Medium 5.3
    CVE-2026-107267

    DKAN - Moderately critical - Access bypass - SA-CONTRIB-2026-208

    Missing Authorization vulnerability in Drupal DKAN allows Forceful Browsing. This issue affects DKAN versions: from 0.0.0 to 4.0.4, from 4.1.0 to 4.1.5.

    Drupal DKAN drupal/dkan Packagist
  • Low 3.8
    CVE-2026-107306

    Menu Link Attributes - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-209

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Menu Link Attributes allows Stored XSS. This issue affects Menu Link Attributes versions: from 0.0.0 to 1.8.0.

    Drupal Menu Link Attributes drupal/menu_link_attributes Packagist
  • Medium 4.3
    CVE-2026-107307

    SmartLinker AI - Moderately critical - Information disclosure - SA-CONTRIB-2026-210

    Incorrect Authorization vulnerability in Drupal SmartLinker AI allows Forceful Browsing. This issue affects SmartLinker AI versions: from 0.0.0 to 1.0.3.

    Drupal SmartLinker AI drupal/smartlinker_ai Packagist
  • Low 3.1
    CVE-2026-107308

    Country - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-211

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Country allows Cross-Site Scripting (XSS). This issue affects Country versions: from 0.0.0 to 2.1.3, from 2.2.0 to 2.2.1.

    Drupal Country drupal/country Packagist
  • Low 3.7
    CVE-2026-107309

    Easy Breadcrumb - Moderately critical - Information disclosure - SA-CONTRIB-2026-212

    Missing Authorization vulnerability in Drupal Easy Breadcrumb allows Forceful Browsing. This issue affects Easy Breadcrumb versions: from 0.0.0 to 2.0.11.

    Drupal Easy Breadcrumb drupal/easy_breadcrumb Packagist
  • Medium 4.3
    CVE-2026-107310

    Freelinking - Moderately critical - Information Disclosure - SA-CONTRIB-2026-213

    Server-Side Request Forgery (SSRF) vulnerability in Drupal Freelinking allows Server Side Request Forgery. This issue affects Freelinking versions: from 0.0.0 to 4.0.3.

    Drupal Freelinking drupal/freelinking Packagist
  • Low 3.7
    CVE-2026-107311

    Permissions by Term - Moderately critical - Information disclosure - SA-CONTRIB-2026-214

    Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal Permissions by Term allows Forceful Browsing. This issue affects Permissions by Term versions: from 0.0.0 to 3.1.41.

    Drupal Permissions by Term drupal/permissions_by_term Packagist
  • Medium 4.3
    CVE-2026-107312

    Examples for Developers - Less critical - Allocation of resources without limits or throttling - SA-CONTRIB-2026-215

    Allocation of Resources Without Limits or Throttling vulnerability in Drupal Examples for Developers allows Excessive Allocation. This issue affects Examples for Developers versions: from 0.0.0 to 4.0.7.

    Drupal Examples for Developers drupal/examples Packagist
  • High 7.3
    CVE-2026-107255

    Restrict route by IP - Critical - Access bypass - SA-CONTRIB-2026-216

    Incorrect Authorization vulnerability in Drupal Restrict route by IP allows Forceful Browsing. This issue affects Restrict route by IP versions: from 0.0.0 to 1.3.1, from 2.0.0 to 2.0.1.

    Drupal Restrict route by IP drupal/restrict_route_by_ip Packagist
  • Medium 5.3
    CVE-2026-107262

    Advanced Filesystem - Moderately critical - Cross-Site Request Forgery - SA-CONTRIB-2026-217

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal Advanced Filesystem allows Cross Site Request Forgery. This issue affects Advanced Filesystem versions: from 0.0.0 to 1.0.28.

    Drupal Advanced Filesystem drupal/advanced_filesystem Packagist
  • High 8.1
    CVE-2026-108097 Public exploit

    Drupal core - Critical - Remote code execution - SA-CORE-2026-014

    Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Drupal Drupal core allows Reflection Injection. This issue affects Drupal core versions: from 8.9.0 to 10.6.19, from 11.0.0 to 11.3.19, from 11.4.0 to 11.4.10,…

    Drupal Drupal core drupal/core Web / CMS Packagist
  • Medium 6.5
    CVE-2026-110738

    Gin Admin Theme - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-219

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Gin Admin Theme allows Cross-Site Scripting (XSS). This issue affects Gin Admin Theme versions: from 0.0.0 to 4.1.4, from 5.0.0 to 5.0.16.

    Drupal Gin Admin Theme drupal/gin Packagist
  • Medium 6.5
    CVE-2026-108515

    Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-015

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Drupal core versions: from 8.9.0 to 10.6.19, from 11.0.0 to 11.3.19, from 11.4.0 to …

    Drupal Drupal core drupal/core Web / CMS Packagist
  • Medium 6.5
    CVE-2026-108514

    Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-016

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Drupal core versions: from 10.3.0 to 10.6.19, from 11.0.0 to 11.3.19, from 11.4.0 to…

    Drupal Drupal core drupal/core Web / CMS Packagist
  • High 8.1
    CVE-2026-108099

    Entity List - Critical - Remote code execution - SA-CONTRIB-2026-218

    Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Drupal Entity List allows Reflection Injection. This issue affects Entity List versions: from 0.0.0 to 3.0.10.

    Drupal Entity List drupal/entity_list Packagist
  • Critical 9.8
    CVE-2026-114523

    Ffmpeg Image Toolkit - Highly critical - Remote Code Execution - SA-CONTRIB-2026-220

    Improper Neutralization of Special Elements used in an OS Command ("OS Command Injection") vulnerability in Drupal Ffmpeg Image Toolkit allows OS Command Injection. This issue affects Ffmpeg Image Toolkit versions: from 0.0.0 to 1.0.3.

    Drupal Ffmpeg Image Toolkit drupal/ffmpeg_image_toolkit Packagist
  • High 7.1
    CVE-2026-114527

    UI Icons - Critical - Cross site scripting - SA-CONTRIB-2026-221

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal UI Icons allows Cross-Site Scripting (XSS). This issue affects UI Icons versions: from 0.0.0 to 1.1.3, from 2.0.0 to 2.0.2.

    Drupal UI Icons drupal/ui_icons Packagist
  • High 7.1
    CVE-2026-114528

    Zero Point - Critical - Cross-site scripting - SA-CONTRIB-2026-222

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Zero Point allows Stored XSS. This issue affects Zero Point versions: from 0.0.0 to 1.30.0, from 2.0.0 to 2.0.1.

    Drupal Zero Point drupal/zeropoint Packagist
  • High 7.1
    CVE-2026-114526

    Black Hole - Critical - Cross-site scripting - SA-CONTRIB-2026-223

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Black Hole allows Stored XSS. This issue affects Black Hole versions: from 0.0.0 to 1.26.0, from 2.0.0 to 2.0.1.

    Drupal Black Hole drupal/black_hole Packagist
  • High 7.1
    CVE-2026-114525

    ABC - Critical - Cross-site scripting - SA-CONTRIB-2026-224

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal ABC allows Stored XSS. This issue affects ABC versions: from 0.0.0 to 1.25.0, from 2.0.0 to 2.0.1.

    Drupal ABC drupal/abc Packagist
  • High 7.2
    CVE-2026-114524

    Custom Formatters - Critical - Remote code execution - SA-CONTRIB-2026-225

    Privilege Defined With Unsafe Actions vulnerability in Drupal Custom Formatters allows Privilege Escalation. This issue affects Custom Formatters versions: from 0.0.0 to 4.2.1.

    Drupal Custom Formatters drupal/custom_formatters Packagist
  • Medium 6.5
    CVE-2026-114529

    CSV Field - Moderately critical - Cross site Scripting - SA-CONTRIB-2026-226

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal CSV Field allows Stored XSS. This issue affects CSV Field versions: from 0.0.0 to 2.0.10, from 3.0.0 to 3.0.7.

    Drupal CSV Field drupal/csv_field Packagist