Skip to content
OpenAdvisories

Vendor

Drupal

585 known vulnerabilities.

Products

Drupal core 60 Webform 20 Core 19 AI (Artificial Intelligence) 18 SAML SSO - Service Provider 13 Open Social 8 Commerce Core 7 Enterprise MFA - TFA for Drupal 6 Monster Menus 4 Two-factor Authentication (TFA) 4 COOKiES Consent Management 4 Drupal Canvas 4 Tagify 3 Facets 3 OpenID Connect / OAuth client 3 Disable Login Page 3 Single Content Sync 3 Authenticator Login 3 Login Disable 3 Commerce Stripe 3 Gammu SMS Daemon 3 Drupal 3 UI Icons 3 One Time Password 3 Cloud 2 Access code 2 CivicTheme Design System 2 Webform REST 2 Node Access Rebuild Progressive 2 AI Agents 2 Data-module 2 Frontend Editing 2 Paragraphs 2 Anti-Spam by CleanTalk 2 POST File 2 Unpublished Node Permissions 2 Field Permissions 2 Block Attributes 2 ECA: Event - Condition - Action 2 Acquia DAM 2
All Critical High Medium Low Exploited only Public exploit

389 results · Clear filters · Feed

  • Medium 5.4
    CVE-2026-55808

    Drupal core - Moderately critical - Improper validation - SA-CORE-2026-009

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Drupal core versions: from 0.0.0 to 10.5.12, from 10.6.0 to 10.6.11, from 11.2.0 to …

    Drupal Drupal core drupal/core Web / CMS Packagist
  • Medium 5.9
    CVE-2026-55804

    Drupal core - Moderately critical - Gadget chain - SA-CORE-2026-006

    Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection. This issue affects Drupal core versions: from 0.0.0 to 10.5.12, from 10.6.0 to 10.6.11, from 11.2.0 to 11.2.14, from 11…

    Drupal Drupal core drupal/core Web / CMS Packagist
  • Medium 5.9
    CVE-2026-55806

    Drupal core - Less critical - Cache poisoning and open redirect - SA-CORE-2026-007

    URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal Drupal core allows Content Spoofing. This issue affects Drupal core versions: from 0.0.0 to 10.5.12, from 10.6.0 to 10.6.11, from 11.2.0 to 11.2.14, from 11.3.0 to 11.3.12, from 0.0.0…

    Drupal Drupal core drupal/core Web / CMS Packagist
  • Medium 5.9
    CVE-2026-55803

    Drupal core - Critical - PHP object injection - SA-CORE-2026-005

    Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection. This issue affects Drupal core versions: from 0.0.0 to 10.5.12, from 10.6.0 to 10.6.11, from 11.2.0 to 11.2.14, from 11…

    Drupal Drupal core drupal/core Web / CMS Packagist
  • Medium 5.4
    CVE-2026-15085

    AI SEO/GEO Analyzer - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-076

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI SEO/GEO Analyzer allows Stored XSS. This issue affects AI SEO/GEO Analyzer versions: from 0.0.0 to 1.1.3.

    Drupal AI SEO/GEO Analyzer drupal/ai_seo Packagist
  • Medium 5.4
    CVE-2026-15084

    UI Patterns (SDC in Drupal UI) - Moderately critical - Cross site scripting - SA-CONTRIB-2026-075

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal UI Patterns (SDC in Drupal UI) allows Stored XSS. This issue affects UI Patterns (SDC in Drupal UI) versions: from 2.0.0 to 2.0.17.

    Drupal UI Patterns (SDC in Drupal UI) drupal/ui_patterns Web / CMS Packagist
  • Medium 4.2
    CVE-2026-15083

    ECA: Event - Condition - Action - Less critical - Information disclosure - SA-CONTRIB-2026-074

    Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal ECA: Event - Condition - Action allows Object Injection. This issue affects ECA: Event - Condition - Action versions: from 0.0.0 to 2.1.20, from 3.0.0 to 3.…

    Drupal ECA: Event - Condition - Action drupal/eca Packagist
  • Medium 5.4
    CVE-2026-15082

    Siteimprove Analytics - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-073

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Siteimprove Analytics allows Cross-Site Scripting (XSS). This issue affects Siteimprove Analytics versions: from 0.0.0 to 2.0.1.

    Drupal Siteimprove Analytics drupal/siteimprove_analytics Packagist
  • Medium 4.3
    CVE-2026-15080

    Ray Enterprise Translation - Moderately critical - Cross site request forgery - SA-CONTRIB-2026-071

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal Ray Enterprise Translation allows Cross Site Request Forgery. This issue affects Ray Enterprise Translation versions: from 0.0.0 to 4.0.4, from 4.1.0 to 4.1.4, from 11.0.0 to 11.0.4.

    Drupal Ray Enterprise Translation drupal/lingotek Packagist
  • Medium 5.4
    CVE-2026-15079

    Login Disable - Moderately critical - Access bypass - SA-CONTRIB-2026-070

    Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Login Disable allows Brute Force. This issue affects Login Disable versions: from 0.0.0 to 2.1.4.

    Drupal Login Disable drupal/login_disable Packagist
  • Medium 5.4
    CVE-2026-58591

    Colorbox - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-069

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Colorbox allows Cross-Site Scripting (XSS). This issue affects Colorbox versions: from 0.0.0 to 2.1.5, from 0.0.0 to 2.2.0.

    Drupal Colorbox drupal/colorbox Packagist
  • Medium 5.4
    CVE-2026-58590

    FlowDrop - Moderately critical - Access bypass - SA-CONTRIB-2026-068

    Missing Authorization vulnerability in Drupal FlowDrop allows Forceful Browsing. This issue affects FlowDrop versions: from 0.0.0 to 1.6.0.

    Drupal FlowDrop drupal/flowdrop Packagist
  • Medium 5.4
    CVE-2026-58589

    FlowDrop - Moderately critical - Access bypass - SA-CONTRIB-2026-067

    Missing Authorization vulnerability in Drupal FlowDrop allows Forceful Browsing. This issue affects FlowDrop versions: from 0.0.0 to 1.6.0.

    Drupal FlowDrop drupal/flowdrop Packagist
  • Medium 6.1
    CVE-2026-58587

    Drupal Canvas - Moderately critical - Improper validation - SA-CONTRIB-2026-065

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal Canvas allows Cross-Site Scripting (XSS). This issue affects Drupal Canvas versions: from 0.0.0 to 1.4.2, from 1.5.0 to 1.5.2, from 1.6.0 to 1.…

    Drupal Drupal Canvas drupal/canvas Web / CMS Packagist
  • Medium 6.1
    CVE-2026-58588

    Drupal Canvas - Moderately critical - Improper validation - SA-CONTRIB-2026-066

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal Canvas allows Cross-Site Scripting (XSS). This issue affects Drupal Canvas versions: from 0.0.0 to 1.4.2, from 1.5.0 to 1.5.2, from 1.6.0 to 1.…

    Drupal Drupal Canvas drupal/canvas Web / CMS Packagist
  • Medium 4.8
    CVE-2026-13243

    Salesforce Suite - Moderately critical - Cross-site request forgery - SA-CONTRIB-2026-063

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal Salesforce Suite allows Cross Site Request Forgery. This issue affects Salesforce Suite versions: from 0.0.0 to 5.1.3.

    Drupal Salesforce Suite drupal/salesforce Packagist
  • Medium 6.5
    CVE-2026-13242

    Geolocation Field - Critical - SQL Injection - SA-CONTRIB-2026-062

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Geolocation Field allows SQL Injection. This issue affects Geolocation Field versions: from 0.0.0 to 3.15.0.

    Drupal Geolocation Field drupal/geolocation Packagist
  • Medium 6.5
    CVE-2026-13240

    Paragraphs - Less critical - Access bypass - SA-CONTRIB-2026-060

    Missing Authorization vulnerability in Drupal Paragraphs allows Forceful Browsing. This issue affects Paragraphs versions: from 0.0.0 to 1.21.0.

    Drupal Paragraphs drupal/paragraphs Packagist
  • Medium 6.5
    CVE-2026-13241

    Paragraphs - Moderately critical - Access bypass - SA-CONTRIB-2026-061

    Missing Authorization vulnerability in Drupal Paragraphs allows Forceful Browsing. This issue affects Paragraphs versions: from 0.0.0 to 1.21.0.

    Drupal Paragraphs drupal/paragraphs Packagist
  • Medium 6.5
    CVE-2026-13239

    WissKI - Critical - Access bypass - SA-CONTRIB-2026-059

    Missing Authorization vulnerability in Drupal WissKI allows Forceful Browsing. This issue affects WissKI versions: from 0.0.0 to 4.2.0.

    Drupal WissKI drupal/wisski Packagist
  • Medium 4.8
    CVE-2026-13238

    Commerce Realex / Global Payments - Moderately critical - Access Bypass - SA-CONTRIB-2026-058

    Incorrect Authorization vulnerability in Drupal Commerce Realex / Global Payments allows Forceful Browsing. This issue affects Commerce Realex / Global Payments versions: from 0.0.0 to 3.0.2.

    Drupal Commerce Realex / Global Payments drupal/commerce_realex Packagist
  • Medium 4.8
    CVE-2026-13237

    AI Agents - Moderately critical - Information disclosure, Access bypass - SA-CONTRIB-2026-057

    Incorrect Authorization vulnerability in Drupal AI Agents allows Forceful Browsing. This issue affects AI Agents versions: from 0.0.0 to 1.1.4, from 1.2.0 to 1.2.5, from 1.3.0 to 1.3.1.

    Drupal AI Agents drupal/ai_agents Packagist
  • Medium 4.2
    CVE-2026-13236

    AI Agents - Less critical - Access bypass - SA-CONTRIB-2026-056

    Missing Authorization vulnerability in Drupal AI Agents allows Forceful Browsing. This issue affects AI Agents versions: from 0.0.0 to 1.1.4, from 1.2.0 to 1.2.5, from 1.3.0 to 1.3.1.

    Drupal AI Agents drupal/ai_agents Packagist
  • Medium 6.1
    CVE-2026-13234

    AI (Artificial Intelligence) - Moderately critical - Information Disclosure / Cross-site Scripting - SA-CONTRIB-2026-054

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Cross-Site Scripting (XSS). This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.2.17, from 1…

    Drupal AI (Artificial Intelligence) drupal/ai Packagist
  • Medium 6.1
    CVE-2026-13231

    Advanced Content Feedback (aka admin_feedback) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-051

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Advanced Content Feedback (aka admin_feedback) allows Stored XSS. This issue affects Advanced Content Feedback (aka admin_feedback) versions: from 0.0…

    Drupal Advanced Content Feedback (aka admin_feedback) drupal/admin_feedback Packagist
  • Medium 5.4
    CVE-2026-11908

    Tagify - Moderately critical - Cross-site scripting (XSS) - SA-CONTRIB-2026-043

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Tagify allows Stored XSS. This issue affects Tagify versions: from 0.0.0 to 1.2.52.

    Drupal Tagify drupal/tagify Packagist
  • Medium 6.1
    CVE-2026-10770

    Anti-Spam by CleanTalk - Moderately critical - Cross site scripting - SA-CONTRIB-2026-042

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Anti-Spam by CleanTalk allows Reflected XSS. This issue affects Anti-Spam by CleanTalk versions: from 0.0.0 to 9.7.1.

    Drupal Anti-Spam by CleanTalk drupal/cleantalk Packagist
  • Medium 5.4
    CVE-2026-10769

    Commerce Core - Moderately critical - Cross site scripting - SA-CONTRIB-2026-041

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Commerce Core allows Stored XSS. This issue affects Commerce Core versions: from 3.3.0 to 3.3.6.

    Drupal Commerce Core drupal/commerce Packagist
  • Medium 5.1
    CVE-2026-6816

    TFA Basic Plugins - Access Bypass

    An access bypass vulnerability in Drupal TFA Basic Plugins allows users with the administer users permission to view or generate recovery codes for other users. This issue affects TFA Basic Plugins: from 7.x-1.0 through 7.x-1.2.

    Drupal TFA Basic Plugins
  • Medium 5.1
    CVE-2026-4093

    Stored XSS in Drupal 7 Term Reference Tree module (token display templates and term labels)

    In the Drupal 7 Term Reference Tree module, two stored XSS vectors exist in the widget/formatter rendering pipeline. Vector A (token display templates): When the Token module is enabled and token display templates are configured, attacker-controlled token out…

    Drupal Term Reference Tree
  • Medium 5.1
    CVE-2026-4929

    Simple Hierarchical Select (Drupal 7) XSS in term-derived output

    Simple Hierarchical Select (SHS) for Drupal 7 contains cross-site scripting risk due to improper output escaping of term-derived text. Confirmed affected paths include field formatter output (shs_field_formatter_view) and term-tree child-term data generation …

    Drupal Simple Hierarchical Select (shs)
  • Medium 5.4
    CVE-2026-8493

    Colorbox Inline - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-036

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Colorbox Inline allows Cross-Site Scripting (XSS). This issue affects Colorbox Inline: from 0.0.0 before 2.1.1.

    Drupal Colorbox Inline drupal/colorbox_inline Packagist
  • Medium 6.1
    CVE-2026-6871

    Obfuscate - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-033

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Obfuscate allows Cross-Site Scripting (XSS). This issue affects Obfuscate: from 0.0.0 before 2.0.2.

    Drupal Obfuscate drupal/obfuscate Packagist
  • Medium 6.1
    CVE-2026-6367

    Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-003

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Drupal core: from 11.3.0 before 11.3.7.

    Drupal Drupal core drupal/core Web / CMS Packagist
  • Medium 6.6
    CVE-2026-6366

    Drupal core - Moderately critical - Gadget Chain - SA-CORE-2026-002

    Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection. This issue affects Drupal core: from 8.0.0 before 10.5.9, from 10.6.0 before 10.6.7, from 11.0.0 before 11.2.11, from 1…

    Drupal Drupal core drupal/core Web / CMS Packagist
  • Medium 6.1
    CVE-2026-6365

    Drupal core - Critical - Cross-site scripting - SA-CORE-2026-001

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Drupal core: from 8.0.0 before 10.5.9, from 10.6.0 before 10.6.7, from 11.0.0 before…

    Drupal Drupal core drupal/core Web / CMS Packagist
  • Medium 6.1
    CVE-2026-6095

    Orejime - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-032

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Orejime allows Cross-Site Scripting (XSS). This issue affects Orejime: from 0.0.0 before 2.0.16.

    Drupal Orejime drupal/orejime Packagist
  • Medium 5.3
    CVE-2026-0748

    Access bypass in Drupal 7 i18n_node translation UI

    In the Drupal 7 Internationalization (i18n) module, the i18n_node submodule allows a user with both "Translate content" and "Administer content translations" permissions to view and attach unpublished nodes via the translation UI and its autocomplete widget. …

    Drupal Internationalization (i18n) - i18n_node submodule
  • Medium 6.9
    CVE-2026-1556

    Information disclosure via file URI overwrite in File (Field) Paths

    Information disclosure in the file URI processing of File (Field) Paths in Drupal File (Field) Paths 7.x prior to 7.1.3 on Drupal 7.x allows authenticated users to disclose other users’ private files via filename‑collision uploads. This can cause hook_node_in…

    Drupal Drupal File (Field) Paths drupal7 Web / CMS Ubuntu
  • Medium 4.3
    CVE-2026-4393

    Automated Logout - Moderately critical - Cross-site request forgery - SA-CONTRIB-2026-030

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal Automated Logout allows Cross Site Request Forgery.This issue affects Automated Logout: from 0.0.0 before 1.7.0, from 2.0.0 before 2.0.2.

    Drupal Automated Logout drupal/autologout Packagist