Skip to content
OpenAdvisories

Vendor

Drupal

576 known vulnerabilities.

Products

Drupal core 52 Webform 20 Core 19 AI (Artificial Intelligence) 18 SAML SSO - Service Provider 13 Open Social 8 Commerce Core 7 Enterprise MFA - TFA for Drupal 6 Monster Menus 4 Two-factor Authentication (TFA) 4 COOKiES Consent Management 4 Drupal Canvas 4 Tagify 3 Facets 3 OpenID Connect / OAuth client 3 Disable Login Page 3 Single Content Sync 3 Authenticator Login 3 Login Disable 3 Commerce Stripe 3 Gammu SMS Daemon 3 UI Icons 3 One Time Password 3 Cloud 2 Access code 2 CivicTheme Design System 2 Webform REST 2 Node Access Rebuild Progressive 2 AI Agents 2 Data-module 2 Frontend Editing 2 Paragraphs 2 Anti-Spam by CleanTalk 2 POST File 2 Unpublished Node Permissions 2 Field Permissions 2 Block Attributes 2 ECA: Event - Condition - Action 2 Acquia DAM 2 Paragraphs table 2
All Critical High Medium Low Exploited only Public exploit

384 results · Clear filters · Feed

  • Medium 4.3
    CVE-2026-96391

    Webform REST - Less critical - Access bypass - SA-CONTRIB-2026-186

    Missing Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. This issue affects Webform REST versions: from 0.0.0 to 4.2.1.

    Drupal Webform REST drupal/webform_rest Packagist
  • Medium 5.3
    CVE-2026-96377

    Combined image style - Moderately critical - Improper access control - SA-CONTRIB-2026-188

    Allocation of Resources Without Limits or Throttling vulnerability in Drupal Combined image style allows Excessive Allocation. This issue affects Combined image style versions: from 0.0.0 to 1.0.7.

    Drupal Combined image style drupal/combined_image_style Packagist
  • Medium 6.5
    CVE-2026-96380

    CSS Usage Analyzer - Moderately critical - Improper access control - SA-CONTRIB-2026-189

    Missing Authorization vulnerability in Drupal CSS Usage Analyzer allows Forceful Browsing. This issue affects CSS Usage Analyzer versions: from 1.0.0 to 1.0.2.

    Drupal CSS Usage Analyzer drupal/css_usage_analyzer Packagist
  • Medium 6.5
    CVE-2026-96386

    Smart Content - Moderately critical - Access bypass - SA-CONTRIB-2026-190

    Missing Authorization vulnerability in Drupal Smart Content allows Forceful Browsing. This issue affects Smart Content versions: from 0.0.0 to 3.2.1.

    Drupal Smart Content drupal/smart_content Packagist
  • Medium 4.6
    CVE-2026-96382

    Diba carousel slider - Moderately critical - Cross Site Scripting (XSS) - SA-CONTRIB-2026-191

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Diba carousel slider allows Stored XSS. This issue affects Diba carousel slider versions: from 0.0.0 to 3.0.2.

    Drupal Diba carousel slider drupal/diba_carousel Packagist
  • Medium 4.1
    CVE-2026-16647

    Disable Login Page - Moderately critical - Access bypass - SA-CONTRIB-2026-111

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Disable Login Page allows Functionality Bypass. This issue affects Disable Login Page versions: from 0.0.0 to 1.1.4.

    Drupal Disable Login Page drupal/disable_login Packagist
  • Medium 4.8
    CVE-2026-18986

    Entity Browser - Moderately critical - Cross site scripting - SA-CONTRIB-2026-094

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Entity Browser allows Stored XSS. This issue affects Entity Browser versions: from 0.0.0 to 2.16.0.

    Drupal Entity Browser drupal/entity_browser Packagist
  • Medium 5.3
    CVE-2026-73478

    Diff - Moderately critical - Access bypass - SA-CONTRIB-2026-096

    Incorrect Authorization vulnerability in Drupal Diff allows Forceful Browsing. This issue affects Diff versions: from 0.0.0 to 2.0.1, from 2.1.0 to 2.1.1.

    Drupal Diff drupal/diff Packagist
  • Medium 5.3
    CVE-2026-73474

    Entity Share Websub - Moderately critical - Server-side request forgery (SSRF) - SA-CONTRIB-2026-097

    Server-Side Request Forgery (SSRF) vulnerability in Drupal Entity Share Websub allows Server Side Request Forgery. This issue affects Entity Share Websub versions: from 0.0.0 to 1.1.2.

    Drupal Entity Share Websub drupal/entity_share_websub Packagist
  • Medium 5.4
    CVE-2026-73476

    External Authentication - Moderately critical - Access bypass - SA-CONTRIB-2026-098

    Improper Handling of Case Sensitivity vulnerability in Drupal External Authentication allows Privilege Escalation. This issue affects External Authentication versions: from 0.0.0 to 2.0.13.

    Drupal External Authentication drupal/externalauth Packagist
  • Medium 5.3
    CVE-2026-73477

    Quick Tabs - Moderately critical - Access bypass - SA-CONTRIB-2026-099

    Incorrect Authorization vulnerability in Drupal Quick Tabs allows Forceful Browsing. This issue affects Quick Tabs versions: from 0.0.0 to 4.3.1.

    Drupal Quick Tabs drupal/quicktabs Packagist
  • Medium 5.9
    CVE-2026-76757

    Gammu SMS Daemon - Critical - Unsupported - SA-CONTRIB-2026-100

    Vulnerability in Drupal Gammu SMS Daemon. This issue affects Gammu SMS Daemon versions: *.*.

    Drupal Gammu SMS Daemon
  • Medium 5.9
    CVE-2026-76756

    Gammu SMS Daemon - Critical - Unsupported - SA-CONTRIB-2026-100

    Vulnerability in Drupal Gammu SMS Daemon. This issue affects Gammu SMS Daemon versions: *.*.

    Drupal Gammu SMS Daemon
  • Medium 5.9
    CVE-2026-76755

    Gammu SMS Daemon - Critical - Unsupported - SA-CONTRIB-2026-100

    Vulnerability in Drupal Gammu SMS Daemon. This issue affects Gammu SMS Daemon versions: *.*.

    Drupal Gammu SMS Daemon drupal/gammu_smsd Packagist
  • Medium 5.9
    CVE-2026-76758

    Link content parser - Critical - Unsupported - SA-CONTRIB-2026-101

    Vulnerability in Drupal Link content parser. This issue affects Link content parser versions: *.*.

    Drupal Link content parser drupal/postlight_parser Packagist
  • Medium 4.8
    CVE-2026-81167

    Address Suggestion - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-103

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Address Suggestion allows Cross-Site Scripting (XSS). This issue affects Address Suggestion versions: from 0.0.0 to 1.0.25.

    Drupal Address Suggestion drupal/address_suggestion Packagist
  • Medium 5.3
    CVE-2026-81165

    Blazy - Less critical - Access bypass - SA-CONTRIB-2026-104

    Incorrect Authorization vulnerability in Drupal Blazy allows Forceful Browsing. This issue affects Blazy versions: from 0.0.0 to 3.0.18.

    Drupal Blazy drupal/blazy Packagist
  • Medium 5.3
    CVE-2026-81269

    Data field - Moderately critical - Information disclosure - SA-CONTRIB-2026-108

    Missing Authorization vulnerability in Drupal Data field allows Forceful Browsing. This issue affects Data field versions: from 0.0.0 to 2.0.13.

    Drupal Data field drupal/datafield Packagist
  • Medium 5.3
    CVE-2026-81166

    Digital Signage Framework - Moderately critical - Access bypass - SA-CONTRIB-2026-109

    Missing Authorization vulnerability in Drupal Digital Signage Framework allows Forceful Browsing. This issue affects Digital Signage Framework versions: from 0.0.0 to 2.6.1.

    Drupal Digital Signage Framework drupal/digital_signage_framework Packagist
  • Medium 5.3
    CVE-2026-81162

    DXPR Builder: The AI Visual Page Builder for Drupal - Moderately critical - Information Disclosure - SA-CONTRIB-2026-112

    Insertion of Sensitive Information Into Sent Data vulnerability in Drupal DXPR Builder: The Best Editing (AI) Experience for Drupal allows Forceful Browsing. This issue affects DXPR Builder: The Best Editing (AI) Experience for Drupal versions: from 0.0.0 to …

    Drupal DXPR Builder: The Best Editing (AI) Experience for Drupal drupal/dxpr_builder Web / CMS Packagist
  • Medium 5.3
    CVE-2026-81158

    Entity API - Moderately critical - Information disclosure - SA-CONTRIB-2026-113

    Incorrect Authorization vulnerability in Drupal Entity API allows Forceful Browsing. This issue affects Entity API versions: from 0.0.0 to 1.8.0.

    Drupal Entity API drupal/entity Packagist
  • Medium 5.4
    CVE-2026-81164

    Entity PDF - Moderately critical - Access bypass - SA-CONTRIB-2026-114

    Missing Authorization vulnerability in Drupal Entity PDF allows Forceful Browsing. This issue affects Entity PDF versions: from 0.0.0 to 2.1.5.

    Drupal Entity PDF drupal/entity_pdf Packagist
  • Medium 5.3
    CVE-2026-81205

    LDAP / Active Directory Integration - Moderately critical - Information Disclosure - SA-CONTRIB-2026-115

    Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in Drupal LDAP / Active Directory Integration allows LDAP Injection. This issue affects LDAP / Active Directory Integration versions: from 0.0.0 to 2.2.1.

    Drupal LDAP / Active Directory Integration drupal/ldap_auth Packagist
  • Medium 6.1
    CVE-2026-81201

    Monster Menus - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-116

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Monster Menus allows Stored XSS. This issue affects Monster Menus versions: from 0.0.0 to 9.5.3.

    Drupal Monster Menus drupal/monster_menus Packagist
  • Medium 6.1
    CVE-2026-81160

    Slick Carousel - Moderately critical - Cross Site Scripting - SA-CONTRIB-2026-117

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Slick Carousel allows Stored XSS. This issue affects Slick Carousel versions: from 0.0.0 to 2.1.0.

    Drupal Slick Carousel drupal/slick Packagist
  • Medium 4.2
    CVE-2026-15916

    Drupal core - Moderately critical - Information disclosure - SA-CORE-2026-010

    Missing Authorization vulnerability in Drupal Drupal core allows Forceful Browsing. This issue affects Drupal core versions: from 0.0.0 to 10.6.13, from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, from 0.0.0 to 11.0.*, from 0.0.0 to 11.1.*, from 0.0.0 to 11.2.*.

    Drupal Drupal core drupal/core Web / CMS Packagist
  • Medium 4.7
    CVE-2026-15917

    Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-011

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Drupal core versions: from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, from 0.0.0 to 1…

    Drupal Drupal core drupal/core Web / CMS Packagist
  • Medium 5.4
    CVE-2026-55805

    Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-012

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Stored XSS. This issue affects Drupal core versions: from 0.0.0 to 10.6.13, from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, from 0.0…

    Drupal Drupal core drupal/core Web / CMS Packagist
  • Medium 6.1
    CVE-2026-16638

    Media Folders - Moderately critical - Cross site scripting - SA-CONTRIB-2026-080

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Media Folders allows Stored XSS. This issue affects Media Folders versions: from 0.0.0 to 1.0.8.

    Drupal Media Folders drupal/media_folders Packagist
  • Medium 6.1
    CVE-2026-16640

    Search API Autocomplete - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-082

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Search API Autocomplete allows Reflected XSS. This issue affects Search API Autocomplete versions: from 0.0.0 to 1.12.0.

    Drupal Search API Autocomplete drupal/search_api_autocomplete Packagist
  • Medium 5.7
    CVE-2026-16646

    PanKM - Critical - Unsupported - SA-CONTRIB-2026-083

    Vulnerability in Drupal PanKM. This issue affects PanKM versions: *.*.

    Drupal PanKM
  • Medium 5.7
    CVE-2026-16642

    Email Login OTP - Critical - Unsupported - SA-CONTRIB-2026-085

    Vulnerability in Drupal Email Login OTP. This issue affects Email Login OTP versions: *.*.

    Drupal Email Login OTP drupal/email_login_otp Packagist
  • Medium 5.7
    CVE-2026-16643

    Lunr exposed filters - Critical - Unsupported - SA-CONTRIB-2026-086

    Vulnerability in Drupal Lunr exposed filters. This issue affects Lunr exposed filters versions: *.*.

    Drupal Lunr exposed filters drupal/lunr_filters Packagist
  • Medium 5.7
    CVE-2026-15088

    Development Environment - Critical - Unsupported - SA-CONTRIB-2026-089

    Vulnerability in Drupal Development Environment. This issue affects Development Environment versions: *.*.

    Drupal Development Environment drupal/development_environment Packagist
  • Medium 5.7
    CVE-2026-18260

    Disable Login Page - Moderately critical - Access bypass - SA-CONTRIB-2026-110

    Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Disable Login Page allows Brute Force. This issue affects Disable Login Page versions: from 0.0.0 to 1.1.4.

    Drupal Disable Login Page drupal/disable_login Packagist
  • Medium 5.7
    CVE-2026-18261

    Powerful Surveys - Critical - Unsupported - SA-CONTRIB-2026-092

    Vulnerability in Drupal Powerful Surveys. This issue affects Powerful Surveys versions: *.*.

    Drupal Powerful Surveys
  • Medium 5.9
    CVE-2026-11914

    Composer - Critical - Unsupported - SA-CONTRIB-2026-046

    vulnerability in Drupal Composer allows . This issue affects Composer versions: *.*.

    Drupal Composer drupal/composer Packagist
  • Medium 5.9
    CVE-2026-11915

    Brute force attack protection - Critical - Unsupported - SA-CONTRIB-2026-047

    vulnerability in Drupal Brute force attack protection allows . This issue affects Brute force attack protection versions: *.*.

    Drupal Brute force attack protection drupal/bfap_sb Packagist
  • Medium 5.9
    CVE-2026-15087

    Clean RESTful - Critical - Unsupported - SA-CONTRIB-2026-078

    vulnerability in Drupal Clean RESTful allows . This issue affects Clean RESTful versions: *.*.

    Drupal Clean RESTful drupal/clean_node_api Packagist
  • Medium 5.9
    CVE-2026-15086

    Raw Formatter [Meta Tag Formatter] - Critical - Unsupported - SA-CONTRIB-2026-077

    vulnerability in Drupal Raw Formatter [Meta Tag Formatter] allows . This issue affects Raw Formatter [Meta Tag Formatter] versions: *.*.

    Drupal Raw Formatter [Meta Tag Formatter] drupal/raw_formatter Packagist