Skip to content
OpenAdvisories

Vendor

Drupal

576 known vulnerabilities.

Products

Drupal core 52 Webform 20 Core 19 AI (Artificial Intelligence) 18 SAML SSO - Service Provider 13 Open Social 8 Commerce Core 7 Enterprise MFA - TFA for Drupal 6 Monster Menus 4 Two-factor Authentication (TFA) 4 COOKiES Consent Management 4 Drupal Canvas 4 Tagify 3 Facets 3 OpenID Connect / OAuth client 3 Disable Login Page 3 Single Content Sync 3 Authenticator Login 3 Login Disable 3 Commerce Stripe 3 Gammu SMS Daemon 3 UI Icons 3 One Time Password 3 Cloud 2 Access code 2 CivicTheme Design System 2 Webform REST 2 Node Access Rebuild Progressive 2 AI Agents 2 Data-module 2 Frontend Editing 2 Paragraphs 2 Anti-Spam by CleanTalk 2 POST File 2 Unpublished Node Permissions 2 Field Permissions 2 Block Attributes 2 ECA: Event - Condition - Action 2 Acquia DAM 2 Paragraphs table 2
All Critical High Medium Low Exploited only Public exploit

384 results · Clear filters · Feed

  • Medium 5.4
    CVE-2026-81163

    Media Library Importer - Moderately critical - Access bypass - SA-CONTRIB-2026-129

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Drupal Media Library Importer allows Path Traversal. This issue affects Media Library Importer versions: from 0.0.0 to 2.1.6.

    Drupal Media Library Importer drupal/media_library_importer Packagist
  • Medium 4.6
    CVE-2026-84919

    PhotoSwipe - Responsive JavaScript Modal Image Gallery - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-131

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery allows Stored XSS. This issue affects PhotoSwipe - Responsive JavaScript Modal Image Gallery ve…

    Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery drupal/photoswipe Packagist
  • Medium 5.3
    CVE-2026-84920

    Unpublished Node Permissions - Critical - Access bypass - SA-CONTRIB-2026-132

    Incorrect Authorization vulnerability in Drupal Unpublished Node Permissions allows Forceful Browsing. This issue affects Unpublished Node Permissions versions: from 0.0.0 to 1.8.0.

    Drupal Unpublished Node Permissions drupal/unpublished_node_permissions Packagist
  • Medium 5.3
    CVE-2026-84921

    Webform Submissions Delete - Moderately critical - Access bypass - SA-CONTRIB-2026-133

    Missing Authorization vulnerability in Drupal Webform Submissions Delete allows Forceful Browsing. This issue affects Webform Submissions Delete versions: from 0.0.0 to 1.2.0.

    Drupal Webform Submissions Delete drupal/webform_submissions_delete Packagist
  • Medium 6.5
    CVE-2026-87936

    amazee.ai Private AI Provider - Critical - SQL injection - SA-CONTRIB-2026-134

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal amazee.ai Private AI Provider allows SQL Injection. This issue affects amazee.ai Private AI Provider versions: from 0.0.0 to 1.3.7, from 1.4.0 to 1.4.…

    Drupal amazee.ai Private AI Provider drupal/ai_provider_amazeeio Packagist
  • Medium 6.5
    CVE-2026-87937

    Central Authentication System (CAS) Server - Moderately critical - Open redirect - SA-CONTRIB-2026-135

    URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal Central Authentication System (CAS) Server allows Fake the Source of Data. This issue affects Central Authentication System (CAS) Server versions: from 0.0.0 to 2.0.4, from 2.1.0 to 2…

    Drupal Central Authentication System (CAS) Server drupal/cas_server Packagist
  • Medium 6.5
    CVE-2026-87938

    CSP log - Critical - SQL Injection - SA-CONTRIB-2026-136

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal CSP log allows SQL Injection. This issue affects CSP log versions: from 0.0.0 to 1.0.2.

    Drupal CSP log drupal/csp_log Packagist
  • Medium 5.4
    CVE-2026-87940

    Key auth - Moderately critical - Access bypass - SA-CONTRIB-2026-138

    Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Key auth allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Key auth versions: from 0.0.0 to 2.2.4.

    Drupal Key auth drupal/key_auth Packagist
  • Medium 4.2
    CVE-2026-87939

    Feed Block - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-137

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Feed Block allows Stored XSS. This issue affects Feed Block versions: from 0.0.0 to 2.0.2, from 3.0.0 to 3.0.2.

    Drupal Feed Block drupal/feed_block Packagist
  • Medium 5.9
    CVE-2026-87941

    Patreon - Critical - Unsupported - SA-CONTRIB-2026-139

    Vulnerability in Drupal Patreon. This issue affects Patreon versions: 7.x.

    Drupal Patreon
  • Medium 4.6
    CVE-2026-87942

    SafeDelete - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-140

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal SafeDelete allows Stored XSS. This issue affects SafeDelete versions: from 0.0.0 to 1.0.88.

    Drupal SafeDelete drupal/safedelete Packagist
  • Medium 6.5
    CVE-2026-87943

    SAML SSO - Service Provider - Critical - Improper access control - SA-CONTRIB-2026-141

    Missing Authorization vulnerability in Drupal SAML SSO - Service Provider allows Forceful Browsing. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.

    Drupal SAML SSO - Service Provider drupal/miniorange_saml Packagist
  • Medium 4.8
    CVE-2026-87944

    SAML SSO - Service Provider - Critical - Improper certificate validation - SA-CONTRIB-2026-142

    Improper Certificate Validation vulnerability in Drupal SAML SSO - Service Provider allows Adversary in the Middle (AiTM). This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.

    Drupal SAML SSO - Service Provider drupal/miniorange_saml Packagist
  • Medium 4.8
    CVE-2026-87946

    SAML SSO - Service Provider - Critical - Weak cryptographic practices - SA-CONTRIB-2026-144

    Observable Timing Discrepancy vulnerability in Drupal SAML SSO - Service Provider allows Brute Force. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.

    Drupal SAML SSO - Service Provider drupal/miniorange_saml Packagist
  • Medium 5.4
    CVE-2026-87945

    SAML SSO - Service Provider - Critical - Open redirect - SA-CONTRIB-2026-143

    URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal SAML SSO - Service Provider allows Fake the Source of Data. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.

    Drupal SAML SSO - Service Provider drupal/miniorange_saml Packagist
  • Medium 4.8
    CVE-2026-87947

    SAML SSO - Service Provider - Moderately critical - Authentication bypass - SA-CONTRIB-2026-145

    Improper Verification of Cryptographic Signature vulnerability in Drupal SAML SSO - Service Provider allows Signature Spoof. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.

    Drupal SAML SSO - Service Provider drupal/miniorange_saml Packagist
  • Medium 5.3
    CVE-2026-87950

    SAML SSO - Service Provider - Moderately critical - Embedded credentials - SA-CONTRIB-2026-148

    Use of Hard-coded Credentials vulnerability in Drupal SAML SSO - Service Provider allows Retrieve Embedded Sensitive Data. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.

    Drupal SAML SSO - Service Provider drupal/miniorange_saml Packagist
  • Medium 4.3
    CVE-2026-87954

    Taxonomy Term Glossary - Critical - Access bypass - SA-CONTRIB-2026-152

    Missing Authorization vulnerability in Drupal Taxonomy Term Glossary allows Forceful Browsing. This issue affects Taxonomy Term Glossary versions: from 0.0.0 to 4.6.0.

    Drupal Taxonomy Term Glossary drupal/term_glossary Packagist
  • Medium 4.3
    CVE-2026-87955

    Ultimate Table Field - Critical - Access bypass - SA-CONTRIB-2026-153

    Missing Authorization vulnerability in Drupal Ultimate Table Field allows Forceful Browsing. This issue affects Ultimate Table Field versions: from 0.0.0 to 1.1.1, from 2.0.0 to 2.0.1.

    Drupal Ultimate Table Field drupal/ultimate_table_field Packagist
  • Medium 4.6
    CVE-2026-96361

    Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-155

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Cross-Site Scripting (XSS). This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

    Drupal Webform drupal/webform Packagist
  • Medium 4.6
    CVE-2026-96358

    Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-158

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Cross-Site Scripting (XSS). This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

    Drupal Webform drupal/webform Packagist
  • Medium 4.6
    CVE-2026-96359

    Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-159

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Cross-Site Scripting (XSS). This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

    Drupal Webform drupal/webform Packagist
  • Medium 4.2
    CVE-2026-96362

    Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-160

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Cross-Site Scripting (XSS). This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

    Drupal Webform drupal/webform Packagist
  • Medium 4.6
    CVE-2026-96368

    Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-163

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

    Drupal Webform drupal/webform Packagist
  • Medium 4.6
    CVE-2026-96367

    Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-162

    Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

    Drupal Webform drupal/webform Packagist
  • Medium 5.4
    CVE-2026-96370

    Webform - Moderately critical - Access bypass, Server-side request forgery - SA-CONTRIB-2026-164

    Incorrect Authorization vulnerability in Drupal Webform allows Server Side Request Forgery. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

    Drupal Webform drupal/webform Packagist
  • Medium 5.4
    CVE-2026-96371

    Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-166

    Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

    Drupal Webform drupal/webform Packagist
  • Medium 5.4
    CVE-2026-96372

    Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-167

    Insufficient Granularity of Access Control vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

    Drupal Webform drupal/webform Packagist
  • Medium 5.3
    CVE-2026-96366

    Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-169

    Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

    Drupal Webform drupal/webform Packagist
  • Medium 5.3
    CVE-2026-96364

    Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-171

    Improper Control of Interaction Frequency vulnerability in Drupal Webform allows Functionality Misuse. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

    Drupal Webform drupal/webform Packagist
  • Medium 4.6
    CVE-2026-96357

    Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-172

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

    Drupal Webform drupal/webform Packagist
  • Medium 4.3
    CVE-2026-96398

    Webform - Less critical - Access bypass - SA-CONTRIB-2026-173

    Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

    Drupal Webform drupal/webform Packagist
  • Medium 5.3
    CVE-2026-96356

    Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-174

    Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

    Drupal Webform drupal/webform Packagist
  • Medium 4.8
    CVE-2026-96375

    Cloud - Critical - Remote code execution - SA-CONTRIB-2026-176

    Improper Certificate Validation vulnerability in Drupal Cloud allows Adversary in the Middle (AiTM). This issue affects Cloud versions: from 0.0.0 to 7.0.1.

    Drupal Cloud drupal/cloud Packagist
  • Medium 6.4
    CVE-2026-96376

    Cloud - Critical - Remote code execution - SA-CONTRIB-2026-177

    Improper Neutralization of Special Elements used in an OS Command ("OS Command Injection") vulnerability in Drupal Cloud allows OS Command Injection. This issue affects Cloud versions: from 0.0.0 to 7.0.1.

    Drupal Cloud drupal/cloud Packagist
  • Medium 4.2
    CVE-2026-96374

    Project Browser - Critical - Cross-site request forgery - SA-CONTRIB-2026-178

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal Project Browser allows Cross Site Request Forgery. This issue affects Project Browser versions: from 0.0.0 to 2.0.3, from 2.1.0 to 2.1.5.

    Drupal Project Browser drupal/project_browser Packagist
  • Medium 4.3
    CVE-2026-96378

    Commerce Decoupled Checkout - Moderately critical - Access bypass - SA-CONTRIB-2026-179

    Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Commerce Decoupled Checkout allows Object Injection. This issue affects Commerce Decoupled Checkout versions: from 1.0.0 to 1.8.0.

    Drupal Commerce Decoupled Checkout drupal/commerce_decoupled_checkout Packagist
  • Medium 6.5
    CVE-2026-96385

    REST & JSON API Authentication for Drupal - Moderately critical - Access bypass - SA-CONTRIB-2026-182

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal REST & JSON API Authentication for Drupal allows Authentication Bypass. This issue affects REST & JSON API Authentication for Drupal versions: from 0.0.0 to 3.2.0.

    Drupal REST & JSON API Authentication for Drupal drupal/rest_api_authentication Web / CMS Packagist
  • Medium 5.4
    CVE-2026-96388

    Tawk.to - Live chat application - Critical - Cross Site Request Forgery - SA-CONTRIB-2026-184

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal Tawk.to - Live chat application allows Cross Site Request Forgery. This issue affects Tawk.to - Live chat application versions: from 0.0.0 to 3.0.4.

    Drupal Tawk.to - Live chat application drupal/tawk_to Packagist
  • Medium 4.3
    CVE-2026-96390

    Editoria11y Accessibility Checker - Moderately critical - Access bypass - SA-CONTRIB-2026-185

    Privilege Defined With Unsafe Actions vulnerability in Drupal Editoria11y Accessibility Checker allows Privilege Escalation. This issue affects Editoria11y Accessibility Checker versions: from 0.0.0 to 2.2.23, from 3.0.0 to 3.0.9.

    Drupal Editoria11y Accessibility Checker drupal/editoria11y Packagist