Skip to content
OpenAdvisories

Vendor

Drupal

585 known vulnerabilities.

Products

Drupal core 60 Webform 20 Core 19 AI (Artificial Intelligence) 18 SAML SSO - Service Provider 13 Open Social 8 Commerce Core 7 Enterprise MFA - TFA for Drupal 6 Monster Menus 4 Two-factor Authentication (TFA) 4 COOKiES Consent Management 4 Drupal Canvas 4 Tagify 3 Facets 3 OpenID Connect / OAuth client 3 Disable Login Page 3 Single Content Sync 3 Authenticator Login 3 Login Disable 3 Commerce Stripe 3 Gammu SMS Daemon 3 Drupal 3 UI Icons 3 One Time Password 3 Cloud 2 Access code 2 CivicTheme Design System 2 Webform REST 2 Node Access Rebuild Progressive 2 AI Agents 2 Data-module 2 Frontend Editing 2 Paragraphs 2 Anti-Spam by CleanTalk 2 POST File 2 Unpublished Node Permissions 2 Field Permissions 2 Block Attributes 2 ECA: Event - Condition - Action 2 Acquia DAM 2
All Critical High Medium Low Exploited only Public exploit

48 results · Clear filters · Feed

  • Low 3.7
    CVE-2026-8491

    Node View Permissions - Moderately critical - Access bypass - SA-CONTRIB-2026-034

    Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal Node View Permissions allows Forceful Browsing. This issue affects Node View Permissions: from 0.0.0 before 1.7.0, from 2.0.0 before 2.0.1.

    Drupal Node View Permissions drupal/node_view_permissions Packagist
  • Low 3.5
    CVE-2025-12761

    Simple multi step form - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-116

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Simple multi step form allows Cross-Site Scripting (XSS).This issue affects Simple multi step form: from 0.0.0 before 2.0.0.

    Drupal Simple multi step form drupal/simple_multistep Packagist
  • Low 3.7
    CVE-2025-13083

    Drupal core - Moderately critical - Information disclosure - SA-CORE-2025-008

    Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Drupal core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Drupal core: from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.…

    Drupal Drupal core drupal/core Web / CMS Packagist
  • Low 3.8
    CVE-2025-10931

    Umami Analytics - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-109

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Umami Analytics allows Cross-Site Scripting (XSS).This issue affects Umami Analytics: from 0.0.0 before 1.0.1.

    Drupal Umami Analytics drupal/umami_analytics Packagist
  • Low 3.1
    CVE-2025-48009

    Single Content Sync - Moderately critical - Access bypass - SA-CONTRIB-2025-060

    Missing Authorization vulnerability in Drupal Single Content Sync allows Functionality Misuse.This issue affects Single Content Sync: from 0.0.0 before 1.4.12.

    Drupal Single Content Sync drupal/single_content_sync Packagist
  • Low 3.8
    CVE-2024-13308

    Browser Back Button - Moderately critical - Cross site scripting - SA-CONTRIB-2024-072

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Browser Back Button allows Cross-Site Scripting (XSS).This issue affects Browser Back Button: from 1.0.0 before 2.0.2.

    Drupal Browser Back Button drupal/browser_back_button Packagist
  • Low 3.1
    CVE-2024-13293

    POST File - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2024-059

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal POST File allows Cross Site Request Forgery.This issue affects POST File: from 0.0.0 before 1.0.2.

    Drupal POST File drupal/postfile Packagist
  • Low 3.5
    CVE-2024-13261

    Acquia DAM - Moderately critical - Cross Site Request Forgery, Denial of Service - SA-CONTRIB-2024-025

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal Acquia DAM allows Cross Site Request Forgery.This issue affects Acquia DAM: from 0.0.0 before 1.0.13, from 1.1.0 before 1.1.0-beta3.

    Drupal Acquia DAM drupal/acquia_dam Packagist