Skip to content
OpenAdvisories

Vendor

Drupal

585 known vulnerabilities.

Products

Drupal core 60 Webform 20 Core 19 AI (Artificial Intelligence) 18 SAML SSO - Service Provider 13 Open Social 8 Commerce Core 7 Enterprise MFA - TFA for Drupal 6 Monster Menus 4 Two-factor Authentication (TFA) 4 COOKiES Consent Management 4 Drupal Canvas 4 Tagify 3 Facets 3 OpenID Connect / OAuth client 3 Disable Login Page 3 Single Content Sync 3 Authenticator Login 3 Login Disable 3 Commerce Stripe 3 Gammu SMS Daemon 3 Drupal 3 UI Icons 3 One Time Password 3 Cloud 2 Access code 2 CivicTheme Design System 2 Webform REST 2 Node Access Rebuild Progressive 2 AI Agents 2 Data-module 2 Frontend Editing 2 Paragraphs 2 Anti-Spam by CleanTalk 2 POST File 2 Unpublished Node Permissions 2 Field Permissions 2 Block Attributes 2 ECA: Event - Condition - Action 2 Acquia DAM 2
All Critical High Medium Low Exploited only Public exploit

389 results · Clear filters · Feed

  • Medium 4.2
    CVE-2026-3532

    OpenID Connect / OAuth client - Less critical - Access bypass - SA-CONTRIB-2026-027

    Improper Handling of Case Sensitivity vulnerability in Drupal OpenID Connect / OAuth client allows Privilege Escalation.This issue affects OpenID Connect / OAuth client: from 0.0.0 before 1.5.0.

    Drupal OpenID Connect / OAuth client drupal/openid_connect Packagist
  • Medium 6.5
    CVE-2026-3531

    OpenID Connect / OAuth client - Moderately critical - Access bypass - SA-CONTRIB-2026-026

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal OpenID Connect / OAuth client allows Authentication Bypass.This issue affects OpenID Connect / OAuth client: from 0.0.0 before 1.5.0.

    Drupal OpenID Connect / OAuth client drupal/openid_connect Packagist
  • Medium 4.3
    CVE-2026-3530

    OpenID Connect / OAuth client - Moderately critical - Server-side request forgery, Information disclosure - SA-CONTRIB-2026-025

    Server-Side Request Forgery (SSRF) vulnerability in Drupal OpenID Connect / OAuth client allows Server Side Request Forgery.This issue affects OpenID Connect / OAuth client: from 0.0.0 before 1.5.0.

    Drupal OpenID Connect / OAuth client drupal/openid_connect Packagist
  • Medium 6.1
    CVE-2026-3529

    Google Analytics GA4 - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-024

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Google Analytics GA4 allows Cross-Site Scripting (XSS).This issue affects Google Analytics GA4: from 0.0.0 before 1.1.14.

    Drupal Google Analytics GA4 drupal/ga4_google_analytics Packagist
  • Medium 6.1
    CVE-2026-3528

    Calculation Fields - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-023

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Calculation Fields allows Cross-Site Scripting (XSS).This issue affects Calculation Fields: from 0.0.0 before 1.0.4.

    Drupal Calculation Fields drupal/calculation_fields Packagist
  • Medium 6.5
    CVE-2026-3527

    AJAX Dashboard - Critical - Access bypass - SA-CONTRIB-2026-022

    Missing Authentication for Critical Function vulnerability in Drupal AJAX Dashboard allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AJAX Dashboard: from 0.0.0 before 3.1.0.

    Drupal AJAX Dashboard drupal/ajax_dashboard Packagist
  • Medium 5.3
    CVE-2026-3526

    File Access Fix (deprecated) - Moderately critical - Access bypass - SA-CONTRIB-2026-021

    Incorrect Authorization vulnerability in Drupal File Access Fix (deprecated) allows Forceful Browsing.This issue affects File Access Fix (deprecated): from 0.0.0 before 1.2.0.

    Drupal File Access Fix (deprecated) drupal/file_access_fix Packagist
  • Medium 5.3
    CVE-2026-3525

    File Access Fix (deprecated) - Moderately critical - Access bypass - SA-CONTRIB-2026-020

    Incorrect Authorization vulnerability in Drupal File Access Fix (deprecated) allows Forceful Browsing.This issue affects File Access Fix (deprecated): from 0.0.0 before 1.2.0.

    Drupal File Access Fix (deprecated) drupal/file_access_fix Packagist
  • Medium 4.8
    CVE-2026-3218

    Responsive Favicons - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-019

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Responsive Favicons allows Cross-Site Scripting (XSS).This issue affects Responsive Favicons: from 0.0.0 before 2.0.2.

    Drupal Responsive Favicons drupal/responsive_favicons Packagist
  • Medium 6.1
    CVE-2026-3217

    SAML SSO - Service Provider - Critical - Cross-site scripting - SA-CONTRIB-2026-018

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal SAML SSO - Service Provider allows Cross-Site Scripting (XSS).This issue affects SAML SSO - Service Provider: from 0.0.0 before 3.1.3.

    Drupal SAML SSO - Service Provider drupal/miniorange_saml Packagist
  • Medium 5.0
    CVE-2026-3216

    Drupal Canvas - Moderately critical - Server-side request forgery, Information disclosure - SA-CONTRIB-2026-017

    Server-Side Request Forgery (SSRF) vulnerability in Drupal Drupal Canvas allows Server Side Request Forgery.This issue affects Drupal Canvas: from 0.0.0 before 1.1.1.

    Drupal Drupal Canvas drupal/canvas Web / CMS Packagist
  • Medium 5.4
    CVE-2026-3215

    Islandora - Moderately critical - Arbitrary file upload, Cross-site scripting - SA-CONTRIB-2026-016

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Islandora allows Cross-Site Scripting (XSS).This issue affects Islandora: from 0.0.0 before 2.17.5.

    Drupal Islandora drupal/islandora Packagist
  • Medium 6.5
    CVE-2026-3214

    CAPTCHA - Moderately critical - Access bypass - SA-CONTRIB-2026-015

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal CAPTCHA allows Functionality Bypass.This issue affects CAPTCHA: from 0.0.0 before 1.17.0, from 2.0.0 before 2.0.10.

    Drupal CAPTCHA drupal/captcha Packagist
  • Medium 4.7
    CVE-2026-3213

    Anti-Spam by CleanTalk - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-014

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Anti-Spam by CleanTalk allows Cross-Site Scripting (XSS).This issue affects Anti-Spam by CleanTalk: from 0.0.0 before 9.7.0.

    Drupal Anti-Spam by CleanTalk drupal/cleantalk Packagist
  • Medium 5.4
    CVE-2026-3212

    Tagify - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-013

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Tagify allows Cross-Site Scripting (XSS).This issue affects Tagify: from 0.0.0 before 1.2.49.

    Drupal Tagify drupal/tagify Packagist
  • Medium 4.3
    CVE-2026-3211

    Theme Negotiation by Rules - Moderately critical - Cross-site request forgery - SA-CONTRIB-2026-012

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal Theme Negotiation by Rules allows Cross Site Request Forgery.This issue affects Theme Negotiation by Rules: from 0.0.0 before 1.2.1.

    Drupal Theme Negotiation by Rules drupal/theme_rule Packagist
  • Medium 5.3
    CVE-2026-3210

    Material Icons - Moderately critical - Access bypass - SA-CONTRIB-2026-011

    Incorrect Authorization vulnerability in Drupal Material Icons allows Forceful Browsing.This issue affects Material Icons: from 0.0.0 before 2.0.4.

    Drupal Material Icons drupal/material_icons Packagist
  • Medium 6.1
    CVE-2026-2349

    UI Icons - Critical - Cross-site Scripting - SA-CONTRIB-2026-010

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal UI Icons allows Cross-Site Scripting (XSS).This issue affects UI Icons: from 0.0.0 before 1.0.1, from 1.1.0 before 1.1.1.

    Drupal UI Icons drupal/ui_icons Packagist
  • Medium 5.4
    CVE-2026-2348

    Quick Edit - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-009

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Quick Edit allows Cross-Site Scripting (XSS).This issue affects Quick Edit: from 0.0.0 before 1.0.5, from 2.0.0 before 2.0.1.

    Drupal Quick Edit drupal/quickedit Packagist
  • Medium 4.3
    CVE-2026-1917

    Login Disable - Less critical - Access bypass - SA-CONTRIB-2026-008

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Login Disable allows Functionality Bypass.This issue affects Login Disable: from 0.0.0 before 2.1.3.

    Drupal Login Disable drupal/login_disable Packagist
  • Medium 4.2
    CVE-2026-1554

    Central Authentication System (CAS) Server - Less critical - XML Element Injection - SA-CONTRIB-2026-007

    XML Injection (aka Blind XPath Injection) vulnerability in Drupal Central Authentication System (CAS) Server allows Privilege Escalation.This issue affects Central Authentication System (CAS) Server: from 0.0.0 before 2.0.3, from 2.1.0 before 2.1.2.

    Drupal Central Authentication System (CAS) Server drupal/cas_server Packagist
  • Medium 4.8
    CVE-2026-1553

    Drupal Canvas - Moderately critical - Access bypass - SA-CONTRIB-2026-006

    Incorrect Authorization vulnerability in Drupal Drupal Canvas allows Forceful Browsing.This issue affects Drupal Canvas: from 0.0.0 before 1.0.4.

    Drupal Drupal Canvas drupal/canvas Web / CMS Packagist
  • Medium 6.5
    CVE-2026-0948

    Microsoft Entra ID SSO Login - Critical - Access bypass - SA-CONTRIB-2026-005

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Microsoft Entra ID SSO Login allows Privilege Escalation.This issue affects Microsoft Entra ID SSO Login: from 0.0.0 before 1.0.4.

    Drupal Microsoft Entra ID SSO Login drupal/social_auth_entra_id Packagist
  • Medium 4.8
    CVE-2026-0947

    AT Internet Piano Analytics - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-004

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AT Internet Piano Analytics allows Cross-Site Scripting (XSS).This issue affects AT Internet Piano Analytics: from 0.0.0 before 1.0.1, from 2.0.0 befo…

    Drupal AT Internet Piano Analytics drupal/pianoanalytics Packagist
  • Medium 6.1
    CVE-2026-0946

    AT Internet SmartTag - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-003

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AT Internet SmartTag allows Cross-Site Scripting (XSS).This issue affects AT Internet SmartTag: from 0.0.0 before 1.0.1.

    Drupal AT Internet SmartTag drupal/atsmarttag Packagist
  • Medium 5.4
    CVE-2026-0945

    Role Delegation - Moderately critical - Access bypass - SA-CONTRIB-2026-002

    Privilege Defined With Unsafe Actions vulnerability in Drupal Role Delegation allows Privilege Escalation.This issue affects Role Delegation: from 1.3.0 before 1.5.0.

    Drupal Role Delegation drupal/role_delegation Packagist
  • Medium 5.3
    CVE-2026-0944

    Group invite - Moderately critical - Access bypass - SA-CONTRIB-2026-001

    Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal Group invite allows Forceful Browsing.This issue affects Group invite: from 0.0.0 before 2.3.9, from 3.0.0 before 3.0.4, from 4.0.0 before 4.0.4.

    Drupal Group invite drupal/ginvite Packagist
  • Medium 4.2
    CVE-2025-13986

    Disable Login Page - Critical - Access bypass - SA-CONTRIB-2025-124

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Disable Login Page allows Functionality Bypass.This issue affects Disable Login Page: from 0.0.0 before 1.1.3.

    Drupal Disable Login Page drupal/disable_login Packagist
  • Medium 5.3
    CVE-2025-13985

    Entity Share - Moderately critical - Access bypass, Information Disclosure - SA-CONTRIB-2025-123

    Incorrect Authorization vulnerability in Drupal Entity Share allows Forceful Browsing.This issue affects Entity Share: from 0.0.0 before 3.13.0.

    Drupal Entity Share drupal/entity_share Packagist
  • Medium 6.1
    CVE-2025-13984

    Next.js - Critical - Access bypass - SA-CONTRIB-2025-122

    Permissive Cross-domain Security Policy with Untrusted Domains vulnerability in Drupal Next.Js allows Cross-Site Scripting (XSS).This issue affects Next.Js: from 0.0.0 before 1.6.4, from 2.0.0 before 2.0.1.

    Drupal Next.js drupal/next Packagist
  • Medium 5.4
    CVE-2025-13983

    Tagify - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-121

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Tagify allows Cross-Site Scripting (XSS).This issue affects Tagify: from 0.0.0 before 1.2.44.

    Drupal Tagify drupal/tagify Packagist
  • Medium 4.4
    CVE-2025-13981

    AI (Artificial Intelligence) - Moderately critical - Cross-Site Scripting - SA-CONTRIB-2025-119

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Cross-Site Scripting (XSS).This issue affects AI (Artificial Intelligence): from 0.0.0 before 1.0.7, from 1.1.0 be…

    Drupal AI (Artificial Intelligence) drupal/ai Packagist
  • Medium 5.3
    CVE-2025-13980

    CKEditor 5 Premium Features - Moderately critical - Access bypass - SA-CONTRIB-2025-118

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal CKEditor 5 Premium Features allows Functionality Bypass.This issue affects CKEditor 5 Premium Features: from 0.0.0 before 1.2.10, from 1.3.0 before 1.3.6, from 1.4.0 before 1.4.3…

    Drupal CKEditor 5 Premium Features drupal/ckeditor5_premium_features Packagist
  • Medium 5.4
    CVE-2025-13979

    Mini site - Moderately critical - Cross-Site Scripting - SA-CONTRIB-2025-117

    Privilege Defined With Unsafe Actions vulnerability in Drupal Mini site allows Stored XSS.This issue affects Mini site: from 0.0.0 before 3.0.2.

    Drupal Mini site drupal/minisite Packagist
  • Medium 4.8
    CVE-2026-0749

    Cross-Site Scripting Vulnerability in Drupal Form Builder Module

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Form Builder allows Cross-Site Scripting (XSS).This issue affects Drupal: from 7.X-1.0 through 7.X-1.22.

    Drupal Drupal Web / CMS
  • Medium 4.8
    CVE-2025-14557

    XSS in Drupal 7 Facebook Pixel Module

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Drupal Facebook Pixel facebook_pixel allows Stored XSS.This issue affects Facebook Pixel: from 7.X-1.0 through 7.X-1.1.

    Drupal Facebook Pixel
  • Medium 4.8
    CVE-2025-14556

    XSS in Drupal 7 Flag Module

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Drupal Flag allows Cross-Site Scripting (XSS).This issue affects Flag: from 7.X-3.0 through 7.X-3.9.

    Drupal Flag
  • Medium 5.4
    CVE-2025-12760

    Email TFA - Moderately critical - Access bypass - SA-CONTRIB-2025-115

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Email TFA allows Functionality Bypass.This issue affects Email TFA: from 0.0.0 before 2.0.6.

    Drupal Email TFA drupal/email_tfa Packagist
  • Medium 4.3
    CVE-2025-13082

    Drupal core - Moderately critical - Defacement - SA-CORE-2025-007

    User Interface (UI) Misrepresentation of Critical Information vulnerability in Drupal Drupal core allows Content Spoofing.This issue affects Drupal core: from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, from 11.2.0 before 11.2.8.

    Drupal Drupal core drupal/core Web / CMS Packagist
  • Medium 5.9
    CVE-2025-13081

    Drupal core - Moderately critical - Gadget chain - SA-CORE-2025-006

    Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection.This issue affects Drupal core: from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, from 11.…

    Drupal Drupal core drupal/core Web / CMS Packagist