Skip to content
OpenAdvisories

Vendor

Drupal

576 known vulnerabilities.

Products

Drupal core 52 Webform 20 Core 19 AI (Artificial Intelligence) 18 SAML SSO - Service Provider 13 Open Social 8 Commerce Core 7 Enterprise MFA - TFA for Drupal 6 Monster Menus 4 Two-factor Authentication (TFA) 4 COOKiES Consent Management 4 Drupal Canvas 4 Tagify 3 Facets 3 OpenID Connect / OAuth client 3 Disable Login Page 3 Single Content Sync 3 Authenticator Login 3 Login Disable 3 Commerce Stripe 3 Gammu SMS Daemon 3 UI Icons 3 One Time Password 3 Cloud 2 Access code 2 CivicTheme Design System 2 Webform REST 2 Node Access Rebuild Progressive 2 AI Agents 2 Data-module 2 Frontend Editing 2 Paragraphs 2 Anti-Spam by CleanTalk 2 POST File 2 Unpublished Node Permissions 2 Field Permissions 2 Block Attributes 2 ECA: Event - Condition - Action 2 Acquia DAM 2 Paragraphs table 2
All Critical High Medium Low Exploited only Public exploit

48 results · Clear filters · Feed

  • Low 3.8
    CVE-2026-107306

    Menu Link Attributes - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-209

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Menu Link Attributes allows Stored XSS. This issue affects Menu Link Attributes versions: from 0.0.0 to 1.8.0.

    Drupal Menu Link Attributes drupal/menu_link_attributes Packagist
  • Low 3.1
    CVE-2026-107308

    Country - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-211

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Country allows Cross-Site Scripting (XSS). This issue affects Country versions: from 0.0.0 to 2.1.3, from 2.2.0 to 2.2.1.

    Drupal Country drupal/country Packagist
  • Low 3.7
    CVE-2026-107309

    Easy Breadcrumb - Moderately critical - Information disclosure - SA-CONTRIB-2026-212

    Missing Authorization vulnerability in Drupal Easy Breadcrumb allows Forceful Browsing. This issue affects Easy Breadcrumb versions: from 0.0.0 to 2.0.11.

    Drupal Easy Breadcrumb drupal/easy_breadcrumb Packagist
  • Low 3.7
    CVE-2026-107311

    Permissions by Term - Moderately critical - Information disclosure - SA-CONTRIB-2026-214

    Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal Permissions by Term allows Forceful Browsing. This issue affects Permissions by Term versions: from 0.0.0 to 3.1.41.

    Drupal Permissions by Term drupal/permissions_by_term Packagist
  • Low 3.7
    CVE-2026-114546

    Media Alias Display - Moderately critical - Information disclosure - SA-CONTRIB-2026-245

    Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Media Alias Display allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Media Alias Display versions: from 0.0.0 to 2.1.2, from 3.0.0 to …

    Drupal Media Alias Display drupal/media_alias_display Packagist
  • Low 3.7
    CVE-2026-114547

    TinyPNG - Moderately critical - Information disclosure - SA-CONTRIB-2026-246

    Missing Authorization vulnerability in Drupal TinyPNG allows Forceful Browsing. This issue affects TinyPNG versions: from 0.0.0 to 2.0.2.

    Drupal TinyPNG drupal/tinypng Packagist
  • Low 3.7
    CVE-2026-114548

    ImageAPI Optimize WebP - Moderately critical - Information disclosure - SA-CONTRIB-2026-247

    Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal ImageAPI Optimize WebP allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects ImageAPI Optimize WebP versions: from 0.0.0 to 2.1.2.

    Drupal ImageAPI Optimize WebP drupal/imageapi_optimize_webp Packagist
  • Low 3.5
    CVE-2026-114555

    Data field - Moderately critical - Cross site scripting - SA-CONTRIB-2026-250

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Data field allows Stored XSS. This issue affects Data field versions: from 0.0.0 to 2.0.14.

    Drupal Data field drupal/datafield Packagist
  • Low 2.7
    CVE-2026-118542

    Commerce Core - Moderately critical - Access bypass - SA-CONTRIB-2026-257

    Incorrect Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13.

    Drupal Commerce Core drupal/commerce Packagist
  • Low 3.7
    CVE-2026-118544

    Commerce Core - Moderately critical - Information disclosure - SA-CONTRIB-2026-259

    Exposure of Sensitive Information Through Data Queries vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13.

    Drupal Commerce Core drupal/commerce Packagist
  • Low 2.7
    CVE-2026-118557

    Commerce Shipping - Less critical - Access bypass - SA-CONTRIB-2026-262

    Incorrect Authorization vulnerability in Drupal Commerce Shipping allows Forceful Browsing. This issue affects Commerce Shipping versions: from 0.0.0 to 2.16.0, from 3.0.0 to 3.0.6.

    Drupal Commerce Shipping drupal/commerce_shipping Packagist
  • Low 3.7
    CVE-2026-118548

    AI (Artificial Intelligence) - Moderately critical - Information disclosure - SA-CONTRIB-2026-268

    Incorrect Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Resource Injection. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2.

    Drupal AI (Artificial Intelligence) drupal/ai Packagist
  • Low 3.1
    CVE-2026-118551

    AI (Artificial Intelligence) - Less critical - Information Disclosure - SA-CONTRIB-2026-271

    Insecure Storage of Sensitive Information vulnerability in Drupal AI (Artificial Intelligence) allows Retrieve Embedded Sensitive Data. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2.

    Drupal AI (Artificial Intelligence) drupal/ai Packagist
  • Low 3.3
    CVE-2026-118568

    Content Sync (content-sync.io) - Moderately critical - Information disclosure - SA-CONTRIB-2026-291

    Insecure Storage of Sensitive Information vulnerability in Drupal Content Sync (content-sync.io) allows Retrieve Embedded Sensitive Data. This issue affects Content Sync (content-sync.io) versions: from 0.0.0 to 3.2.2.

    Drupal Content Sync (content-sync.io) drupal/cms_content_sync Packagist
  • Low 3.1
    CVE-2026-84911

    AI (Artificial Intelligence) - Moderately critical - Cross site scripting - SA-CONTRIB-2026-119

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Stored XSS. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.3.13, from 1.4.0 to 1.4.8.

    Drupal AI (Artificial Intelligence) drupal/ai Packagist
  • Low 3.7
    CVE-2026-84916

    Islandora - Moderately critical - Access bypass - SA-CONTRIB-2026-126

    Missing Authorization vulnerability in Drupal Islandora allows Forceful Browsing. This issue affects Islandora versions: from 0.0.0 to 2.19.0.

    Drupal Islandora drupal/islandora Packagist
  • Low 3.8
    CVE-2026-16648

    Mailer Plus Log - Moderately critical - Access bypass - SA-CONTRIB-2026-128

    Insertion of Sensitive Information into Log File vulnerability in Drupal Mailer Plus Log allows Remote Services with Stolen Credentials. This issue affects Mailer Plus Log versions: from 0.0.0 to 1.2.7.

    Drupal Mailer Plus Log drupal/symfony_mailer_log Packagist
  • Low 3.7
    CVE-2026-84918

    Monobank payment API - Moderately critical - Access bypass - SA-CONTRIB-2026-130

    Improper Verification of Cryptographic Signature vulnerability in Drupal Monobank payment API allows Signature Spoof. This issue affects Monobank payment API versions: from 0.0.0 to 1.0.3.

    Drupal Monobank payment API drupal/monobank Packagist
  • Low 3.5
    CVE-2026-87948

    SAML SSO - Service Provider - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-146

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal SAML SSO - Service Provider allows Cross-Site Scripting (XSS). This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.

    Drupal SAML SSO - Service Provider drupal/miniorange_saml Packagist
  • Low 3.3
    CVE-2026-87949

    SAML SSO - Service Provider - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-147

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal SAML SSO - Service Provider allows Cross-Site Scripting (XSS). This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.

    Drupal SAML SSO - Service Provider drupal/miniorange_saml Packagist
  • Low 3.1
    CVE-2026-87952

    SAML SSO - Service Provider - Moderately critical - Insufficient replay protection - SA-CONTRIB-2026-150

    Authentication Bypass by Capture-replay vulnerability in Drupal SAML SSO - Service Provider allows Remote Services with Stolen Credentials. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.

    Drupal SAML SSO - Service Provider drupal/miniorange_saml Packagist
  • Low 3.8
    CVE-2026-87951

    SAML SSO - Service Provider - Moderately critical - Information disclosure - SA-CONTRIB-2026-149

    Insecure Storage of Sensitive Information vulnerability in Drupal SAML SSO - Service Provider allows Retrieve Embedded Sensitive Data. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.

    Drupal SAML SSO - Service Provider drupal/miniorange_saml Packagist
  • Low 3.3
    CVE-2026-87953

    SAML SSO - Service Provider - Moderately critical - Server Side Request Forgery - SA-CONTRIB-2026-151

    Server-Side Request Forgery (SSRF) vulnerability in Drupal SAML SSO - Service Provider allows Server Side Request Forgery. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.

    Drupal SAML SSO - Service Provider drupal/miniorange_saml Packagist
  • Low 3.5
    CVE-2026-96360

    Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-154

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Cross-Site Scripting (XSS). This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

    Drupal Webform drupal/webform Packagist
  • Low 3.1
    CVE-2026-96363

    Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-161

    Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

    Drupal Webform drupal/webform Packagist
  • Low 3.1
    CVE-2026-96369

    Webform - Less critical - Access bypass - SA-CONTRIB-2026-165

    Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Webform allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

    Drupal Webform drupal/webform Packagist
  • Low 3.3
    CVE-2026-96373

    Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-168

    Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

    Drupal Webform drupal/webform Packagist
  • Low 3.5
    CVE-2026-96384

    Mermaid Diagram Field - Moderately critical - Access bypass - SA-CONTRIB-2026-180

    Incorrect Authorization vulnerability in Drupal Mermaid Diagram Field allows Forceful Browsing. This issue affects Mermaid Diagram Field versions: from 1.0.4 to 1.0.9.

    Drupal Mermaid Diagram Field drupal/mermaid_diagram_field Packagist
  • Low 3.5
    CVE-2026-96379

    CookieCuttr - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-181

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal CookieCuttr allows Stored XSS. This issue affects CookieCuttr versions: from 2.0.0 to 2.0.3.

    Drupal CookieCuttr drupal/cookiecuttr Packagist
  • Low 3.8
    CVE-2026-96387

    Stop administrator login - Moderately critical - Access bypass - SA-CONTRIB-2026-183

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Stop administrator login allows Authentication Bypass. This issue affects Stop administrator login versions: from 1.0 to 1.6.

    Drupal Stop administrator login drupal/stop_admin Packagist
  • Low 3.5
    CVE-2026-96392

    AI CKEditor - Moderately critical - Code execution via Twig templates - SA-CONTRIB-2026-187

    Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal AI CKEditor allows Code Injection. This issue affects AI CKEditor versions: from 0.0.0 to 1.4.3.

    Drupal AI CKEditor drupal/ai_ckeditor Packagist
  • Low 3.7
    CVE-2026-81168

    CAPTCHA Protected Page - Moderately critical - Cookie Forgery - SA-CONTRIB-2026-105

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal CAPTCHA Protected Page allows Functionality Bypass. This issue affects CAPTCHA Protected Page versions: from 0.0.0 to 1.0.2.

    Drupal CAPTCHA Protected Page drupal/captcha_protected_page Packagist
  • Low 3.7
    CVE-2026-81159

    Commerce CyberSource - Moderately critical - Insufficient input validation - SA-CONTRIB-2026-106

    Observable Timing Discrepancy vulnerability in Drupal Commerce CyberSource allows Brute Force. This issue affects Commerce CyberSource versions: from 0.0.0 to 1.10.0.

    Drupal Commerce CyberSource drupal/commerce_cybersource Packagist
  • Low 3.3
    CVE-2026-81161

    Content Moderation Notifications - Moderately critical - Access bypass - SA-CONTRIB-2026-107

    Privilege Defined With Unsafe Actions vulnerability in Drupal Content Moderation Notifications allows Privilege Escalation. This issue affects Content Moderation Notifications versions: from 0.0.0 to 3.9.0.

    Drupal Content Moderation Notifications drupal/content_moderation_notifications Packagist
  • Low 3.1
    CVE-2026-55807

    Drupal core - Moderately critical - Server-side request forgery - SA-CORE-2026-008

    Server-Side Request Forgery (SSRF) vulnerability in Drupal Drupal core allows Server Side Request Forgery. This issue affects Drupal core versions: from 0.0.0 to 10.5.12, from 10.6.0 to 10.6.11, from 11.2.0 to 11.2.14, from 11.3.0 to 11.3.12, from 0.0.0 to 11…

    Drupal Drupal core drupal/core Web / CMS Packagist
  • Low 3.3
    CVE-2026-13235

    AI (Artificial Intelligence) - Moderately critical - Access bypass - SA-CONTRIB-2026-055

    Missing Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Forceful Browsing. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.2.17, from 1.3.0 to 1.3.8, from 1.4.0 to 1.4.3.

    Drupal AI (Artificial Intelligence) drupal/ai Packagist
  • Low 3.3
    CVE-2026-13233 Public exploit

    OpenAI Provider - Moderately critical - Server-side Request Forgery - SA-CONTRIB-2026-053

    Server-Side Request Forgery (SSRF) vulnerability in Drupal OpenAI Provider allows Server Side Request Forgery. This issue affects OpenAI Provider versions: from 0.0.0 to 1.1.1, from 1.2.0 to 1.2.2.

    Drupal OpenAI Provider drupal/ai_provider_openai Packagist
  • Low 3.1
    CVE-2026-13232

    Advanced Content Feedback (aka admin_feedback) - Moderately critical - Access bypass / Insecure Direct Object Reference (IDOR) - SA-CONTRIB-2026-052

    Incorrect Authorization vulnerability in Drupal Advanced Content Feedback (aka admin_feedback) allows Forceful Browsing. This issue affects Advanced Content Feedback (aka admin_feedback) versions: from 0.0.0 to 2.8.0.

    Drupal Advanced Content Feedback (aka admin_feedback) drupal/admin_feedback Packagist
  • Low 3.3
    CVE-2026-11909

    Examples for Developers - Moderately critical - Access bypass - SA-CONTRIB-2026-044

    Missing Authorization vulnerability in Drupal Examples for Developers allows Forceful Browsing. This issue affects Examples for Developers versions: from 0.0.0 to 4.0.6.

    Drupal Examples for Developers drupal/examples Packagist
  • Low 2.7
    CVE-2026-8492

    Translate Drupal with GTranslate - Less critical - DOM clobbering / link manipulation - SA-CONTRIB-2026-035

    Modification of Assumed-Immutable Data (MAID) vulnerability in Drupal Translate Drupal with GTranslate allows Resource Location Spoofing. This issue affects Translate Drupal with GTranslate: from 0.0.0 before 3.0.5.

    Drupal Translate Drupal with GTranslate drupal/gtranslate Web / CMS Packagist