Skip to content
OpenAdvisories

Vendor

Drupal

576 known vulnerabilities.

Products

Drupal core 52 Webform 20 Core 19 AI (Artificial Intelligence) 18 SAML SSO - Service Provider 13 Open Social 8 Commerce Core 7 Enterprise MFA - TFA for Drupal 6 Monster Menus 4 Two-factor Authentication (TFA) 4 COOKiES Consent Management 4 Drupal Canvas 4 Tagify 3 Facets 3 OpenID Connect / OAuth client 3 Disable Login Page 3 Single Content Sync 3 Authenticator Login 3 Login Disable 3 Commerce Stripe 3 Gammu SMS Daemon 3 UI Icons 3 One Time Password 3 Cloud 2 Access code 2 CivicTheme Design System 2 Webform REST 2 Node Access Rebuild Progressive 2 AI Agents 2 Data-module 2 Frontend Editing 2 Paragraphs 2 Anti-Spam by CleanTalk 2 POST File 2 Unpublished Node Permissions 2 Field Permissions 2 Block Attributes 2 ECA: Event - Condition - Action 2 Acquia DAM 2 Paragraphs table 2
All Critical High Medium Low Exploited only Public exploit

384 results · Clear filters · Feed

  • Medium 5.3
    CVE-2026-77152

    Field Collection for Drupal 7 access bypass via missing parent entity access check

    Improper Authorization vulnerability in Drupal Field Collection for Drupal 7 allows a user with the "edit field collections" permission to bypass access control on the parent (host) entity. The access check for field collection items (field_collection_item_ac…

    Drupal Field Collection for Drupal 7 Web / CMS
  • Medium 5.9
    CVE-2026-107250

    ECA Helper - Critical - Unsupported - SA-CONTRIB-2026-193

    Vulnerability in Drupal ECA Helper. This issue affects ECA Helper versions: *.*.

    Drupal ECA Helper drupal/eca_helper Packagist
  • Medium 6.5
    CVE-2026-107251

    Entity Reference Manager (Merge entities) - Critical - Access bypass - SA-CONTRIB-2026-194

    Incorrect Authorization vulnerability in Drupal Entity Reference Manager (Merge entities) allows Forceful Browsing. This issue affects Entity Reference Manager (Merge entities) versions: from 0.0.0 to 1.0.3.

    Drupal Entity Reference Manager (Merge entities) drupal/entity_reference_manager Packagist
  • Medium 5.4
    CVE-2026-107252

    MathJax: LaTeX for Drupal - Critical - Cross site scripting - SA-CONTRIB-2026-195

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal MathJax: LaTeX for Drupal allows Cross-Site Scripting (XSS). This issue affects MathJax: LaTeX for Drupal versions: from 0.0.0 to 4.1.2.

    Drupal MathJax: LaTeX for Drupal drupal/mathjax Web / CMS Packagist
  • Medium 5.9
    CVE-2026-107253

    Orphans Media - Critical - Unsupported - SA-CONTRIB-2026-196

    Vulnerability in Drupal Orphans Media. This issue affects Orphans Media versions: *.*.

    Drupal Orphans Media drupal/orphans_media Packagist
  • Medium 4.8
    CVE-2026-107254

    Authenticator Login Plus (2FA) - Critical - Improper authentication - SA-CONTRIB-2026-197

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Authenticator Login Plus (2FA) allows Authentication Bypass. This issue affects Authenticator Login Plus (2FA) versions: from 0.0.0 to 1.0.1.

    Drupal Authenticator Login Plus (2FA) drupal/auth_login_plus Packagist
  • Medium 6.5
    CVE-2026-107257

    Actstream - Critical - Access bypass - SA-CONTRIB-2026-198

    Incorrect Authorization vulnerability in Drupal Actstream allows Forceful Browsing. This issue affects Actstream versions: from 0.0.0 to 2.0.1, from 2.1.0 to 2.1.1.

    Drupal Actstream drupal/actstream Packagist
  • Medium 5.4
    CVE-2026-107258

    Inline Entity Form Dialog - Moderately critical - Access bypass - SA-CONTRIB-2026-199

    Incorrect Authorization vulnerability in Drupal Inline Entity Form Dialog allows Forceful Browsing. This issue affects Inline Entity Form Dialog versions: from 0.0.0 to 1.0.6.

    Drupal Inline Entity Form Dialog drupal/inline_entity_form_dialog Packagist
  • Medium 5.4
    CVE-2026-107259

    Linked Field - Moderately critical - Server-side template injection - SA-CONTRIB-2026-200

    Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Linked Field allows Code Injection. This issue affects Linked Field versions: from 0.0.0 to 1.8.0.

    Drupal Linked Field drupal/linked_field Packagist
  • Medium 4.2
    CVE-2026-107261

    Authenticator Login Plus (2FA) - Moderately critical - Improper authentication - SA-CONTRIB-2026-201

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Authenticator Login Plus (2FA) allows Authentication Bypass. This issue affects Authenticator Login Plus (2FA) versions: from 0.0.0 to 1.0.1.

    Drupal Authenticator Login Plus (2FA) drupal/auth_login_plus Packagist
  • Medium 5.4
    CVE-2026-107263

    Gutenberg - Moderately critical - Access bypass - SA-CONTRIB-2026-202

    Incorrect Authorization vulnerability in Drupal Gutenberg allows Forceful Browsing. This issue affects Gutenberg versions: from 0.0.0 to 2.15.0, from 3.0.0 to 3.0.7.

    Drupal Gutenberg drupal/gutenberg Packagist
  • Medium 5.4
    CVE-2026-107264

    Inline Formatter Field - Moderately critical - Server-side template injection - SA-CONTRIB-2026-203

    Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Inline Formatter Field allows Code Injection. This issue affects Inline Formatter Field versions: from 0.0.0 to 4.2.0.

    Drupal Inline Formatter Field drupal/inline_formatter_field Packagist
  • Medium 5.4
    CVE-2026-107265

    Leaflet - Moderately critical - Cross site scripting - SA-CONTRIB-2026-204

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Leaflet allows Stored XSS. This issue affects Leaflet versions: from 0.0.0 to 10.4.13.

    Drupal Leaflet drupal/leaflet Packagist
  • Medium 5.3
    CVE-2026-107266

    Views Share - Moderately critical - Access bypass - SA-CONTRIB-2026-205

    Missing Authorization vulnerability in Drupal Views Share allows Forceful Browsing. This issue affects Views Share versions: from 0.0.0 to 2.0.1.

    Drupal Views Share drupal/views_share Packagist
  • Medium 6.5
    CVE-2026-96389

    Xray Audit - Moderately critical - Access bypass - SA-CONTRIB-2026-206

    Missing Authorization vulnerability in Drupal Xray Audit allows Forceful Browsing. This issue affects Xray Audit versions: from 0.0.0 to 1.6.3, from 2.0.0 to 2.0.4, from 3.0.0 to 3.1.1.

    Drupal Xray Audit drupal/xray_audit Packagist
  • Medium 4.3
    CVE-2026-107268 Public exploit

    Two Factor Authentication - TFA / Passwordless Login - Moderately critical - Information disclosure - SA-CONTRIB-2026-207

    Insertion of Sensitive Information Into Sent Data vulnerability in Drupal Two Factor Authentication - TFA / Passwordless Login allows Forceful Browsing. This issue affects Two Factor Authentication - TFA / Passwordless Login versions: from 0.0.0 to 5.4.1, fro…

    Drupal Two Factor Authentication - TFA / Passwordless Login drupal/miniorange_2fa Packagist
  • Medium 5.3
    CVE-2026-107267

    DKAN - Moderately critical - Access bypass - SA-CONTRIB-2026-208

    Missing Authorization vulnerability in Drupal DKAN allows Forceful Browsing. This issue affects DKAN versions: from 0.0.0 to 4.0.4, from 4.1.0 to 4.1.5.

    Drupal DKAN drupal/dkan Packagist
  • Medium 4.3
    CVE-2026-107307

    SmartLinker AI - Moderately critical - Information disclosure - SA-CONTRIB-2026-210

    Incorrect Authorization vulnerability in Drupal SmartLinker AI allows Forceful Browsing. This issue affects SmartLinker AI versions: from 0.0.0 to 1.0.3.

    Drupal SmartLinker AI drupal/smartlinker_ai Packagist
  • Medium 4.3
    CVE-2026-107310

    Freelinking - Moderately critical - Information Disclosure - SA-CONTRIB-2026-213

    Server-Side Request Forgery (SSRF) vulnerability in Drupal Freelinking allows Server Side Request Forgery. This issue affects Freelinking versions: from 0.0.0 to 4.0.3.

    Drupal Freelinking drupal/freelinking Packagist
  • Medium 4.3
    CVE-2026-107312

    Examples for Developers - Less critical - Allocation of resources without limits or throttling - SA-CONTRIB-2026-215

    Allocation of Resources Without Limits or Throttling vulnerability in Drupal Examples for Developers allows Excessive Allocation. This issue affects Examples for Developers versions: from 0.0.0 to 4.0.7.

    Drupal Examples for Developers drupal/examples Packagist
  • Medium 5.3
    CVE-2026-107262

    Advanced Filesystem - Moderately critical - Cross-Site Request Forgery - SA-CONTRIB-2026-217

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal Advanced Filesystem allows Cross Site Request Forgery. This issue affects Advanced Filesystem versions: from 0.0.0 to 1.0.28.

    Drupal Advanced Filesystem drupal/advanced_filesystem Packagist
  • Medium 6.5
    CVE-2026-110738

    Gin Admin Theme - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-219

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Gin Admin Theme allows Cross-Site Scripting (XSS). This issue affects Gin Admin Theme versions: from 0.0.0 to 4.1.4, from 5.0.0 to 5.0.16.

    Drupal Gin Admin Theme drupal/gin Packagist
  • Medium 6.5
    CVE-2026-108515

    Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-015

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Drupal core versions: from 8.9.0 to 10.6.19, from 11.0.0 to 11.3.19, from 11.4.0 to …

    Drupal Drupal core drupal/core Web / CMS Packagist
  • Medium 6.5
    CVE-2026-108514

    Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-016

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Drupal core versions: from 10.3.0 to 10.6.19, from 11.0.0 to 11.3.19, from 11.4.0 to…

    Drupal Drupal core drupal/core Web / CMS Packagist
  • Medium 6.5
    CVE-2026-114529

    CSV Field - Moderately critical - Cross site Scripting - SA-CONTRIB-2026-226

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal CSV Field allows Stored XSS. This issue affects CSV Field versions: from 0.0.0 to 2.0.10, from 3.0.0 to 3.0.7.

    Drupal CSV Field drupal/csv_field Packagist
  • Medium 5.3
    CVE-2026-114530

    Dopup - Critical - Information disclosure - SA-CONTRIB-2026-227

    Incorrect Authorization vulnerability in Drupal Dopup allows Forceful Browsing. This issue affects Dopup versions: from 0.0.0 to 1.0.7.

    Drupal Dopup drupal/dopup Packagist
  • Medium 6.5
    CVE-2026-114531

    Swiper formatter - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-228

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Swiper formatter allows Stored XSS. This issue affects Swiper formatter versions: from 0.0.0 to 2.1.2, from 3.0.1 to 3.1.0.

    Drupal Swiper formatter drupal/swiper_formatter Packagist
  • Medium 6.5
    CVE-2026-107260

    Sector Distribution - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-229

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Sector Distribution allows Stored XSS. This issue affects Sector Distribution versions: from 0.0.0 to 10.3.3, from 10.4.0 to 10.4.2.

    Drupal Sector Distribution drupal/sector Packagist
  • Medium 6.5
    CVE-2026-114532

    UI Icons - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-230

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal UI Icons allows Cross-Site Scripting (XSS). This issue affects UI Icons versions: from 0.0.0 to 1.1.3, from 2.0.0 to 2.0.2.

    Drupal UI Icons drupal/ui_icons Packagist
  • Medium 5.3
    CVE-2026-114533

    Ágora Transparency Theme - Moderately critical - Information disclosure - SA-CONTRIB-2026-231

    Missing Authorization vulnerability in Drupal Ágora Transparency Theme allows Forceful Browsing. This issue affects Ágora Transparency Theme versions: from 0.0.0 to 1.2.3.

    Drupal Ágora Transparency Theme drupal/agora_theme Packagist
  • Medium 5.9
    CVE-2026-114534

    Block Attributes - Moderately critical - Cross site Scripting - SA-CONTRIB-2026-232

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Block Attributes allows Stored XSS. This issue affects Block Attributes versions: from 0.0.0 to 2.1.0.

    Drupal Block Attributes drupal/block_attributes Packagist
  • Medium 5.3
    CVE-2026-114535

    Swiper formatter - Moderately critical - Information disclosure - SA-CONTRIB-2026-233

    Missing Authorization vulnerability in Drupal Swiper formatter allows Forceful Browsing. This issue affects Swiper formatter versions: from 0.0.0 to 2.1.2, from 3.0.1 to 3.1.0.

    Drupal Swiper formatter drupal/swiper_formatter Packagist
  • Medium 6.5
    CVE-2026-114536

    USWDS Paragraph Components - Moderately critical - Cross site scripting - SA-CONTRIB-2026-234

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal USWDS Paragraph Components allows Stored XSS. This issue affects USWDS Paragraph Components versions: from 0.0.0 to 3.1.3.

    Drupal USWDS Paragraph Components drupal/uswds_paragraph_components Packagist
  • Medium 5.3
    CVE-2026-114537

    View Unpublished - Moderately critical - Access bypass - SA-CONTRIB-2026-235

    Incorrect Authorization vulnerability in Drupal View Unpublished allows Forceful Browsing. This issue affects View Unpublished versions: from 0.0.0 to 1.5.0.

    Drupal View Unpublished drupal/view_unpublished Packagist
  • Medium 6.3
    CVE-2026-114539

    DocCheck Basic - Moderately critical - Access bypass - SA-CONTRIB-2026-237

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal DocCheck Basic allows Authentication Bypass. This issue affects DocCheck Basic versions: 7.x.

    Drupal DocCheck Basic
  • Medium 6.3
    CVE-2026-114540

    Domain - Moderately critical - Access bypass - SA-CONTRIB-2026-238

    Incorrect Authorization vulnerability in Drupal Domain allows Forceful Browsing. This issue affects Domain versions: from 3.0.0 to 3.0.2.

    Drupal Domain drupal/domain Packagist
  • Medium 4.8
    CVE-2026-114541

    Frontend Editing - Moderately critical - Cross-Site Request Forgery (CSRF) - SA-CONTRIB-2026-240

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal Frontend Editing allows Cross Site Request Forgery. This issue affects Frontend Editing versions: from 0.0.0 to 1.9.3.

    Drupal Frontend Editing drupal/frontend_editing Packagist
  • Medium 5.4
    CVE-2026-114553

    Frontend Editing - Less critical - Access bypass - SA-CONTRIB-2026-241

    Incorrect Authorization vulnerability in Drupal Frontend Editing allows Forceful Browsing. This issue affects Frontend Editing versions: from 0.0.0 to 1.9.3.

    Drupal Frontend Editing drupal/frontend_editing Packagist
  • Medium 5.4
    CVE-2026-114542

    Simple OAuth (OAuth2) & OpenID Connect - Moderately critical - Access bypass - SA-CONTRIB-2026-242

    Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Simple OAuth (OAuth2) & OpenID Connect allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Simple OAuth (OAuth2) & OpenID Connect version…

    Drupal Simple OAuth (OAuth2) & OpenID Connect drupal/simple_oauth Packagist
  • Medium 5.4
    CVE-2026-114544

    Media Bulk Upload - Moderately critical - Access bypass - SA-CONTRIB-2026-243

    Incorrect Authorization vulnerability in Drupal Media Bulk Upload allows Forceful Browsing. This issue affects Media Bulk Upload versions: from 0.0.0 to 3.0.6.

    Drupal Media Bulk Upload drupal/media_bulk_upload Packagist