Skip to content
OpenAdvisories

Vendor

Drupal

576 known vulnerabilities.

Products

Drupal core 52 Webform 20 Core 19 AI (Artificial Intelligence) 18 SAML SSO - Service Provider 13 Open Social 8 Commerce Core 7 Enterprise MFA - TFA for Drupal 6 Monster Menus 4 Two-factor Authentication (TFA) 4 COOKiES Consent Management 4 Drupal Canvas 4 Tagify 3 Facets 3 OpenID Connect / OAuth client 3 Disable Login Page 3 Single Content Sync 3 Authenticator Login 3 Login Disable 3 Commerce Stripe 3 Gammu SMS Daemon 3 UI Icons 3 One Time Password 3 Cloud 2 Access code 2 CivicTheme Design System 2 Webform REST 2 Node Access Rebuild Progressive 2 AI Agents 2 Data-module 2 Frontend Editing 2 Paragraphs 2 Anti-Spam by CleanTalk 2 POST File 2 Unpublished Node Permissions 2 Field Permissions 2 Block Attributes 2 ECA: Event - Condition - Action 2 Acquia DAM 2 Paragraphs table 2
All Critical High Medium Low Exploited only Public exploit

40 results · Clear filters · Feed

  • Critical 9.8
    CVE-2026-107249

    Block AJAX - Highly critical - PHP object injection - SA-CONTRIB-2026-192

    Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Block AJAX allows Object Injection. This issue affects Block AJAX versions: from 0.0.0 to 3.0.2.

    Drupal Block AJAX drupal/block_ajax Packagist
  • Critical 9.8
    CVE-2026-114523

    Ffmpeg Image Toolkit - Highly critical - Remote Code Execution - SA-CONTRIB-2026-220

    Improper Neutralization of Special Elements used in an OS Command ("OS Command Injection") vulnerability in Drupal Ffmpeg Image Toolkit allows OS Command Injection. This issue affects Ffmpeg Image Toolkit versions: from 0.0.0 to 1.0.3.

    Drupal Ffmpeg Image Toolkit drupal/ffmpeg_image_toolkit Packagist
  • Critical 9.1
    CVE-2026-96355

    Webform - Critical - Remote Code Execution - SA-CONTRIB-2026-175

    Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Webform allows Code Injection. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

    Drupal Webform drupal/webform Packagist
  • Critical 9.1
    CVE-2026-73475

    Commerce PayPal - Moderately critical - Access bypass - SA-CONTRIB-2026-095

    Incorrect Authorization vulnerability in Drupal Commerce PayPal allows Forceful Browsing. This issue affects Commerce PayPal versions: from 0.0.0 to 1.12.0, from 2.0.0 to 2.1.3.

    Drupal Commerce PayPal drupal/commerce_paypal Packagist
  • Critical 9.8
    CVE-2026-16639

    Internationalization Single Sign-On - Critical - Access bypass - SA-CONTRIB-2026-081

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Internationalization Single Sign-On allows Authentication Bypass. This issue affects Internationalization Single Sign-On versions: from 0.0.0 to 1.8.0.

    Drupal Internationalization Single Sign-On drupal/i18n_sso Packagist
  • Critical 9.8
    CVE-2026-16641

    Commerce Elavon - Critical - Unsupported - SA-CONTRIB-2026-084

    Vulnerability in Drupal Commerce Elavon. This issue affects Commerce Elavon versions: *.*.

    Drupal Commerce Elavon drupal/commerce_elavon Packagist
  • Critical 9.1
    CVE-2026-16644

    Webform REST - Moderately critical - Access bypass - SA-CONTRIB-2026-087

    Incorrect Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. This issue affects Webform REST versions: from 0.0.0 to 4.1.0.

    Drupal Webform REST drupal/webform_rest Packagist
  • Critical 9.1
    CVE-2026-16645

    PhotoSwipe - Responsive JavaScript Modal Image Gallery - Moderately critical - Access bypass - SA-CONTRIB-2026-088

    Missing Authorization vulnerability in Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery allows Forceful Browsing. This issue affects PhotoSwipe - Responsive JavaScript Modal Image Gallery versions: from 0.0.0 to 3.2.0.

    Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery drupal/photoswipe Packagist
  • Critical 9.8
    CVE-2026-11913

    Mother May I - Critical - Unsupported - SA-CONTRIB-2026-045

    vulnerability in Drupal Mother May I allows . This issue affects Mother May I versions: *.*.

    Drupal Mother May I drupal/mothermayi Packagist
  • Critical 9.1
    CVE-2026-15089

    Commerce guest registration - Critical - Unsupported - SA-CONTRIB-2026-079

    Vulnerability in Drupal Commerce guest registration. This issue affects Commerce guest registration versions: *.*.

    Drupal Commerce guest registration drupal/commerce_guest_registration Packagist
  • Critical 9.8
    CVE-2026-12535

    Formatter Field - Critical - PHP object injection - SA-CONTRIB-2026-048

    Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Formatter Field allows Object Injection. This issue affects Formatter Field versions: from 0.0.0 to 2.0.0.

    Drupal Formatter Field drupal/formatter_field Packagist
  • Critical 9.8
    CVE-2026-10768

    LocalGov Workflows - Moderately critical - Information disclosure - SA-CONTRIB-2026-039

    Missing Authorization vulnerability in Drupal LocalGov Workflows allows Forceful Browsing. This issue affects LocalGov Workflows versions: from 0.0.0 to 1.6.0.

    Drupal LocalGov Workflows drupal/localgov_workflows Packagist
  • Critical 9.8
    CVE-2026-9726

    Drupal AlternativeCommerce (Basket) - Highly critical - Arbitrary PHP code execution - SA-CONTRIB-2026-038

    Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal AlternativeCommerce (Basket) allows Object Injection. This issue affects Drupal AlternativeCommerce (Basket) versions: from 0.0.0 to 2.1.17.

    Drupal Drupal AlternativeCommerce (Basket) drupal/basket Web / CMS Packagist
  • Critical 9.8
    CVE-2026-9082 Exploited Public exploit EPSS 89%

    Drupal core - Highly critical - SQL injection - SA-CORE-2026-004

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Drupal core allows SQL Injection. This issue affects Drupal core: from 8.9.0 before 10.4.10, from 10.5.0 before 10.5.10, from 10.6.0 before 10.6.9, fr…

    Drupal Drupal core drupal/core Web / CMS Packagist
    KEV May 22, 2026
  • Critical 9.8
    CVE-2026-8495

    Date iCal - Critical - Information disclosure - SA-CONTRIB-2026-037

    Missing Authorization vulnerability in Drupal Date iCal allows Forceful Browsing. This issue affects Date iCal: from 0.0.0 before 4.0.15.

    Drupal Date iCal drupal/date_ical Packagist
  • Critical 9.8
    CVE-2025-8995

    Authenticator Login - Highly critical - Access bypass - SA-CONTRIB-2025-096

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Authenticator Login allows Authentication Bypass.This issue affects Authenticator Login: from 0.0.0 before 2.1.4.

    Drupal Authenticator Login drupal/alogin Packagist
  • Critical 9.8
    CVE-2025-7393

    Mail Login - Critical - Access bypass - SA-CONTRIB-2025-088

    Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Mail Login allows Brute Force.This issue affects Mail Login: from 3.0.0 before 3.2.0, from 4.0.0 before 4.2.0.

    Drupal Mail Login drupal/mail_login Packagist
  • Critical 9.8
    CVE-2025-31691

    OAuth2 Server - Moderately critical - Access bypass - SA-CONTRIB-2025-020

    Missing Authorization vulnerability in Drupal OAuth2 Server allows Forceful Browsing.This issue affects OAuth2 Server: from 0.0.0 before 2.1.0.

    Drupal OAuth2 Server drupal/oauth2_server Packagist
  • Critical 9.1
    CVE-2025-31685

    Open Social - Moderately critical - Access bypass - SA-CONTRIB-2025-014

    Missing Authorization vulnerability in Drupal Open Social allows Forceful Browsing.This issue affects Open Social: from 0.0.0 before 12.3.11, from 12.4.0 before 12.4.10.

    Drupal Open Social goalgorilla/open_social Packagist
  • Critical 9.8
    CVE-2025-31681

    Authenticator Login - Critical - Access bypass - SA-CONTRIB-2025-009

    Missing Authorization vulnerability in Drupal Authenticator Login allows Forceful Browsing.This issue affects Authenticator Login: from 0.0.0 before 2.0.6.

    Drupal Authenticator Login drupal/alogin Packagist
  • Critical 9.8
    CVE-2024-13285

    wkhtmltopdf - Highly critical - Unsupported - SA-CONTRIB-2024-049

    Vulnerability in Drupal wkhtmltopdf.This issue affects wkhtmltopdf: *.*.

    Drupal wkhtmltopdf drupal/wkhtmltopdf Packagist
  • Critical 9.1
    CVE-2024-13281

    Monster Menus - Moderately critical - Access bypass, Information Disclosure - SA-CONTRIB-2024-045

    Incorrect Authorization vulnerability in Drupal Monster Menus allows Forceful Browsing.This issue affects Monster Menus: from 0.0.0 before 9.3.2.

    Drupal Monster Menus drupal/monster_menus Packagist
  • Critical 9.8
    CVE-2024-13280

    Persistent Login - Moderately critical - Access bypass - SA-CONTRIB-2024-044

    Insufficient Session Expiration vulnerability in Drupal Persistent Login allows Forceful Browsing.This issue affects Persistent Login: from 0.0.0 before 1.8.0, from 2.0.* before 2.2.2.

    Drupal Persistent Login drupal/persistent_login Packagist
  • Critical 9.8
    CVE-2024-13279

    Two-factor Authentication (TFA) - Critical - Access bypass - SA-CONTRIB-2024-043

    Session Fixation vulnerability in Drupal Two-factor Authentication (TFA) allows Session Fixation.This issue affects Two-factor Authentication (TFA): from 0.0.0 before 1.8.0.

    Drupal Two-factor Authentication (TFA) drupal/tfa Packagist
  • Critical 9.1
    CVE-2024-13278

    Diff - Moderately critical - Access bypass, Information Disclosure - SA-CONTRIB-2024-042

    Incorrect Authorization vulnerability in Drupal Diff allows Functionality Misuse.This issue affects Diff: from 0.0.0 before 1.8.0.

    Drupal Diff drupal/diff Packagist
  • Critical 9.1
    CVE-2024-13277

    Smart IP Ban - Critical - Access bypass - SA-CONTRIB-2024-041

    Incorrect Authorization vulnerability in Drupal Smart IP Ban allows Forceful Browsing.This issue affects Smart IP Ban: from 7.X-1.0 before 7.X-1.1.

    Drupal Smart IP Ban
  • Critical 9.8
    CVE-2024-13264

    Opigno module - Critical - Arbitrary PHP code execution - SA-CONTRIB-2024-028

    Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') vulnerability in Drupal Opigno module allows PHP Local File Inclusion.This issue affects Opigno module: from 0.0.0 before 3.1.2.

    Drupal Opigno module drupal/opigno_module Packagist
  • Critical 9.8
    CVE-2024-13258

    Drupal REST & JSON API Authentication - Moderately critical - Access bypass - SA-CONTRIB-2024-022

    Incorrect Authorization vulnerability in Drupal Drupal REST & JSON API Authentication allows Forceful Browsing.This issue affects Drupal REST & JSON API Authentication: from 0.0.0 before 2.0.13.

    Drupal Drupal REST & JSON API Authentication drupal/rest_api_authentication Web / CMS Packagist
  • Critical 9.1
    CVE-2024-13253

    Advanced PWA - Critical - Access bypass - SA-CONTRIB-2024-017

    Incorrect Authorization vulnerability in Drupal Advanced PWA inc Push Notifications allows Forceful Browsing.This issue affects Advanced PWA inc Push Notifications: from 0.0.0 before 1.5.0.

    Drupal Advanced PWA inc Push Notifications drupal/advanced_pwa Packagist
  • Critical 9.1
    CVE-2024-13242

    Swift Mailer - Moderately critical - Access bypass - SA-CONTRIB-2024-006

    Exposed Dangerous Method or Function vulnerability in Drupal Swift Mailer allows Resource Location Spoofing.This issue affects Swift Mailer: *.*.

    Drupal Swift Mailer (abandoned) drupal/swiftmailer Packagist
  • Critical 9.1
    CVE-2024-13241

    Open Social - Moderately critical - Information Disclosure - SA-CONTRIB-2024-005

    Improper Authorization vulnerability in Drupal Open Social allows Collect Data from Common Resource Locations.This issue affects Open Social: from 0.0.0 before 12.0.5.

    Drupal Open Social
  • Critical 9.8
    CVE-2024-13239

    Two-factor Authentication (TFA) - Moderately critical - Access bypass - SA-CONTRIB-2024-003

    Weak Authentication vulnerability in Drupal Two-factor Authentication (TFA) allows Authentication Abuse.This issue affects Two-factor Authentication (TFA): from 0.0.0 before 1.5.0.

    Drupal Two-factor Authentication (TFA) drupal/tfa Packagist
  • Critical 9.8
    CVE-2024-55638

    Drupal core - Moderately critical - Gadget chain - SA-CORE-2024-008

    Deserialization of Untrusted Data vulnerability in Drupal Core allows Object Injection.This issue affects Drupal Core: from 7.0 before 7.102, from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9. Drupal core contains a chain of methods that is exploitable whe…

    Drupal Drupal core drupal/core drupal/drupal Web / CMS Ubuntu Packagist
  • Critical 9.8
    CVE-2024-55637

    Drupal core - Moderately critical - Gadget chain - SA-CORE-2024-007

    Deserialization of Untrusted Data vulnerability in Drupal Core allows Object Injection.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8. Drupal core contains a chain of methods that is exploitable…

    Drupal Drupal core drupal/core drupal/drupal Web / CMS Ubuntu Packagist
  • Critical 9.8
    CVE-2024-55636

    Drupal core - Less critical - Gadget chain - SA-CORE-2024-006

    Deserialization of Untrusted Data vulnerability in Drupal Core allows Object Injection.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8. Drupal core contains a chain of methods that is exploitable…

    Drupal Drupal core drupal/core drupal/drupal Web / CMS Ubuntu Packagist
  • Critical 9.8
    CVE-2020-13675

    Unrestricted Upload of File with Dangerous Type in Drupal core

    Drupal's JSON:API and REST/File modules allow file uploads through their HTTP APIs. The modules do not correctly run all file validation, which causes an access bypass vulnerability. An attacker might be able to upload files that bypass the file validation pr…

    Drupal Core drupal/core drupal/graphql Packagist
  • Critical 9.8
    CVE-2020-13665

    Drupal Core Access bypass vulnerability

    Access bypass vulnerability in Drupal Core allows JSON:API when JSON:API is in read/write mode. Only sites that have the read_only set to FALSE under jsonapi.settings config are vulnerable. This issue affects: Drupal Drupal Core 8.8.x versions prior to 8.8.8;…

    Drupal Drupal core drupal/core drupal/drupal Web / CMS Packagist
  • Critical 9.8
    CVE-2019-6342

    Drupal core - Critical - Access bypass - SA-CORE-2019-008

    An access bypass vulnerability exists when the experimental Workspaces module in Drupal 8 core is enabled. This can be mitigated by disabling the Workspaces module. It does not affect any release other than Drupal 8.7.4.

    Drupal Drupal core drupal/core drupal7 Web / CMS Ubuntu Packagist
  • Critical 9.8
    CVE-2011-2715

    Drupal SQL Injection vulnerability

    An SQL Injection vulnerability exists in Drupal 6.20 with Data 6.x-1.0-alpha14 due to insufficient sanitization of table names or column names.

    Drupal Data-module drupal/core Packagist
  • Critical 9.8
    CVE-2019-6339 Public exploit EPSS 36%

    PHAR stream wrapper Arbitrary PHP code execution

    In Drupal Core versions 7.x prior to 7.62, 8.6.x prior to 8.6.6 and 8.5.x prior to 8.5.9; A remote code execution vulnerability exists in PHP's built-in phar stream wrapper when performing file operations on an untrusted phar:// URI. Some Drupal code (core, c…

    Drupal Drupal core drupal/core drupal/drupal Web / CMS Ubuntu Packagist