Skip to content
OpenAdvisories

Vendor

Drupal

576 known vulnerabilities.

Products

Drupal core 52 Webform 20 Core 19 AI (Artificial Intelligence) 18 SAML SSO - Service Provider 13 Open Social 8 Commerce Core 7 Enterprise MFA - TFA for Drupal 6 Monster Menus 4 Two-factor Authentication (TFA) 4 COOKiES Consent Management 4 Drupal Canvas 4 Tagify 3 Facets 3 OpenID Connect / OAuth client 3 Disable Login Page 3 Single Content Sync 3 Authenticator Login 3 Login Disable 3 Commerce Stripe 3 Gammu SMS Daemon 3 UI Icons 3 One Time Password 3 Cloud 2 Access code 2 CivicTheme Design System 2 Webform REST 2 Node Access Rebuild Progressive 2 AI Agents 2 Data-module 2 Frontend Editing 2 Paragraphs 2 Anti-Spam by CleanTalk 2 POST File 2 Unpublished Node Permissions 2 Field Permissions 2 Block Attributes 2 ECA: Event - Condition - Action 2 Acquia DAM 2 Paragraphs table 2
All Critical High Medium Low Exploited only Public exploit

576 results · Feed

  • Medium 6.5
    CVE-2026-118546

    AI (Artificial Intelligence) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-267

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Cross-Site Scripting (XSS). This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1…

    Drupal AI (Artificial Intelligence) drupal/ai Packagist
  • Low 3.7
    CVE-2026-118548

    AI (Artificial Intelligence) - Moderately critical - Information disclosure - SA-CONTRIB-2026-268

    Incorrect Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Resource Injection. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2.

    Drupal AI (Artificial Intelligence) drupal/ai Packagist
  • High 7.1
    CVE-2026-118549

    AI (Artificial Intelligence) - Critical - Cross-site scripting - SA-CONTRIB-2026-269

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Cross-Site Scripting (XSS). This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1…

    Drupal AI (Artificial Intelligence) drupal/ai Packagist
  • Medium 5.9
    CVE-2026-118550

    AI (Artificial Intelligence) - Moderately critical - Access bypass - SA-CONTRIB-2026-270

    Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal AI (Artificial Intelligence) allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4…

    Drupal AI (Artificial Intelligence) drupal/ai Packagist
  • Low 3.1
    CVE-2026-118551

    AI (Artificial Intelligence) - Less critical - Information Disclosure - SA-CONTRIB-2026-271

    Insecure Storage of Sensitive Information vulnerability in Drupal AI (Artificial Intelligence) allows Retrieve Embedded Sensitive Data. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2.

    Drupal AI (Artificial Intelligence) drupal/ai Packagist
  • Medium 6.5
    CVE-2026-118552

    AI (Artificial Intelligence) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-272

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Cross-Site Scripting (XSS). This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1…

    Drupal AI (Artificial Intelligence) drupal/ai Packagist
  • Medium 5.5
    CVE-2026-118553

    AI (Artificial Intelligence) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-273

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Stored XSS. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2.

    Drupal AI (Artificial Intelligence) drupal/ai Packagist
  • High 7.2
    CVE-2026-118561

    Single Content Sync - Critical - External control of file name or path - SA-CONTRIB-2026-274

    External Control of File Name or Path vulnerability in Drupal Single Content Sync allows Path Traversal. This issue affects Single Content Sync versions: from 0.0.0 to 1.4.19.

    Drupal Single Content Sync drupal/single_content_sync Packagist
  • High 7.2
    CVE-2026-118562

    Single Content Sync - Critical - Remote code execution - SA-CONTRIB-2026-275

    Deserialization of Untrusted Data vulnerability in Drupal Single Content Sync allows Object Injection. This issue affects Single Content Sync versions: from 0.0.0 to 1.4.19.

    Drupal Single Content Sync drupal/single_content_sync Packagist
  • Medium 6.6
    CVE-2026-118563

    CacheFlush - Critical - Unsupported - SA-CONTRIB-2026-276

    Vulnerability in Drupal CacheFlush. This issue affects CacheFlush versions: *.*.

    Drupal CacheFlush drupal/cacheflush Packagist
  • Medium 6.6
    CVE-2026-118564

    PayUmoney for Drupal Commerce - Critical - Unsupported - SA-CONTRIB-2026-277

    Vulnerability in Drupal PayUmoney for Drupal Commerce. This issue affects PayUmoney for Drupal Commerce versions: *.*.

    Drupal PayUmoney for Drupal Commerce drupal/commerce_payumoney Web / CMS Packagist
  • High 7.2
    CVE-2026-118565

    GroupEx PRO ( Daxko ) integration - Critical - Unsupported - SA-CONTRIB-2026-278

    Vulnerability in Drupal GroupEx PRO ( Daxko ) integration. This issue affects GroupEx PRO ( Daxko ) integration versions: *.*.

    Drupal GroupEx PRO ( Daxko ) integration drupal/groupexpro Packagist
  • High 7.3
    CVE-2026-118582

    CAPTCHA - Moderately critical - Session Replay (CAPTCHA bypass) - SA-CONTRIB-2026-281

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal CAPTCHA allows Functionality Bypass. This issue affects CAPTCHA versions: from 0.0.0 to 1.18.0, from 2.0.0 to 2.0.11.

    Drupal CAPTCHA drupal/captcha Packagist
  • Medium 5.4
    CVE-2026-118569 Public exploit

    Fasttoggle - Moderately critical - Access bypass - SA-CONTRIB-2026-282

    Incorrect Authorization vulnerability in Drupal Fasttoggle allows Forceful Browsing. This issue affects Fasttoggle versions: from 0.0.0 to 4.1.1.

    Drupal Fasttoggle drupal/fasttoggle Packagist
  • Medium 6.5
    CVE-2026-118570 Public exploit

    Fasttoggle - Moderately critical - Cross-Site Request Forgery - SA-CONTRIB-2026-283

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal Fasttoggle allows Cross Site Request Forgery. This issue affects Fasttoggle versions: from 0.0.0 to 4.1.1.

    Drupal Fasttoggle drupal/fasttoggle Packagist
  • Medium 5.6
    CVE-2026-118574

    S3 File System - Moderately critical - Access bypass - SA-CONTRIB-2026-279

    Incorrect Permission Assignment for Critical Resource vulnerability in Drupal S3 File System allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects S3 File System versions: from 0.0.0 to 3.12.0.

    Drupal S3 File System drupal/s3fs Packagist
  • Medium 4.7
    CVE-2026-118567

    Bulk Update User Roles - Moderately critical - Incorrect authorization - SA-CONTRIB-2026-280

    Incorrect Authorization vulnerability in Drupal Bulk Update User Roles allows Forceful Browsing. This issue affects Bulk Update User Roles versions: from 0.0.0 to 1.0.5.

    Drupal Bulk Update User Roles drupal/bulk_update_user_roles Packagist
  • Medium 4.8
    CVE-2026-118572

    OAuth Login - OAuth OIDC SSO - Critical - Authentication bypass - SA-CONTRIB-2026-284

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal OAuth Login - OAuth OIDC SSO allows Authentication Bypass. This issue affects OAuth Login - OAuth OIDC SSO versions: from 0.0.0 to 3.1.1.

    Drupal OAuth Login - OAuth OIDC SSO drupal/oauth_login_oauth2 Packagist
  • Medium 6.1
    CVE-2026-118575

    Signature pad widget - Critical - Cross-site scripting - SA-CONTRIB-2026-285

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Signature pad widget allows Stored XSS. This issue affects Signature pad widget versions: from 0.0.0 to 1.15.0.

    Drupal Signature pad widget drupal/sign_widget Packagist
  • Medium 6.5
    CVE-2026-118576

    Stage File Proxy - Critical - Cross-site scripting - SA-CONTRIB-2026-286

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Stage File Proxy allows Cross-Site Scripting (XSS). This issue affects Stage File Proxy versions: from 0.0.0 to 3.1.7, from 4.0.0 to 4.0.1.

    Drupal Stage File Proxy drupal/stage_file_proxy Packagist
  • Medium 5.4
    CVE-2026-118554

    OpenID Connect Client - Moderately critical - Improper authentication - SA-CONTRIB-2026-287

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal OpenID Connect Client allows Authentication Bypass. This issue affects OpenID Connect Client versions: from 0.0.0 to 2.3.1.

    Drupal OpenID Connect Client drupal/oidc Packagist
  • Medium 5.3
    CVE-2026-118583

    Field Permissions - Moderately critical - Access bypass - SA-CONTRIB-2026-288

    Incorrect Authorization vulnerability in Drupal Field Permissions allows Forceful Browsing. This issue affects Field Permissions versions: from 0.0.0 to 1.6.0.

    Drupal Field Permissions drupal/field_permissions Packagist
  • Medium 5.3
    CVE-2026-118584

    Field Permissions - Moderately critical - Access bypass - SA-CONTRIB-2026-289

    Incorrect Authorization vulnerability in Drupal Field Permissions allows Forceful Browsing. This issue affects Field Permissions versions: from 0.0.0 to 1.6.0.

    Drupal Field Permissions drupal/field_permissions Packagist
  • Medium 4.8
    CVE-2026-118573

    OAuth2 Token Manager - Critical - Access bypass - SA-CONTRIB-2026-290

    Missing Authorization vulnerability in Drupal OAuth2 Token Manager allows Forceful Browsing. This issue affects OAuth2 Token Manager versions: from 0.0.0 to 1.2.0.

    Drupal OAuth2 Token Manager drupal/oauth2_token_manager Packagist
  • Low 3.3
    CVE-2026-118568

    Content Sync (content-sync.io) - Moderately critical - Information disclosure - SA-CONTRIB-2026-291

    Insecure Storage of Sensitive Information vulnerability in Drupal Content Sync (content-sync.io) allows Retrieve Embedded Sensitive Data. This issue affects Content Sync (content-sync.io) versions: from 0.0.0 to 3.2.2.

    Drupal Content Sync (content-sync.io) drupal/cms_content_sync Packagist
  • Medium 5.9
    CVE-2026-118571

    Media Alias Display - Moderately critical - Information disclosure - SA-CONTRIB-2026-292

    Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Media Alias Display allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Media Alias Display versions: from 0.0.0 to 2.1.3, from 3.0.0 to …

    Drupal Media Alias Display drupal/media_alias_display Packagist
  • Medium 4.2
    CVE-2026-84910

    Advanced Search - Moderately critical - Access bypass - SA-CONTRIB-2026-118

    Missing Authorization vulnerability in Drupal Advanced Search allows Forceful Browsing. This issue affects Advanced Search versions: from 0.0.0 to 2.4.5.

    Drupal Advanced Search drupal/advanced_search Packagist
  • Low 3.1
    CVE-2026-84911

    AI (Artificial Intelligence) - Moderately critical - Cross site scripting - SA-CONTRIB-2026-119

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Stored XSS. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.3.13, from 1.4.0 to 1.4.8.

    Drupal AI (Artificial Intelligence) drupal/ai Packagist
  • Medium 4.6
    CVE-2026-84913

    AI translate - Moderately critical - Access Bypass - SA-CONTRIB-2026-121

    Missing Authorization vulnerability in Drupal AI Translate allows Forceful Browsing. This issue affects AI Translate versions: from 0.0.0 to 1.3.2, from 1.4.0 to 1.4.1.

    Drupal AI Translate drupal/ai_translate Packagist
  • Medium 4.6
    CVE-2026-84912

    AI (Artificial Intelligence) - Moderately critical - Access Bypass - SA-CONTRIB-2026-120

    Missing Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Forceful Browsing. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.3.13, from 1.4.0 to 1.4.8.

    Drupal AI (Artificial Intelligence) drupal/ai Packagist
  • Medium 5.3
    CVE-2026-84914

    Calculate Working Days - Critical - Access bypass - SA-CONTRIB-2026-122

    Missing Authorization vulnerability in Drupal Calculate Working Days allows Forceful Browsing. This issue affects Calculate Working Days versions: from 0.0.0 to 2.0.3.

    Drupal Calculate Working Days drupal/calculate_working_days Packagist
  • Medium 4.6
    CVE-2026-84915

    Component blocks - Moderately critical - Cross site scripting - SA-CONTRIB-2026-123

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Component blocks allows Stored XSS. This issue affects Component blocks versions: from 0.0.0 to 1.2.7.

    Drupal Component blocks drupal/component_blocks Packagist
  • Medium 6.5
    CVE-2026-84923

    Email Verification / SMS Verification / OTP Verification - Critical - Access Bypass - SA-CONTRIB-2026-124

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Email Verification / SMS Verification / OTP Verification allows Authentication Bypass. This issue affects Email Verification / SMS Verification / OTP Verification versions: from …

    Drupal Email Verification / SMS Verification / OTP Verification drupal/otp_verification Packagist
  • Medium 5.4
    CVE-2026-84924

    Email Verification / SMS Verification / OTP Verification - Critical - Cross Site Scripting - SA-CONTRIB-2026-125

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Email Verification / SMS Verification / OTP Verification allows Reflected XSS. This issue affects Email Verification / SMS Verification / OTP Verifica…

    Drupal Email Verification / SMS Verification / OTP Verification drupal/otp_verification Packagist
  • Medium 6.5
    CVE-2026-84917

    Jsonapi Role Access - Critical - Access bypass - SA-CONTRIB-2026-127

    Incorrect Authorization vulnerability in Drupal Jsonapi Role Access allows Forceful Browsing. This issue affects Jsonapi Role Access versions: from 0.0.0 to 2.0.2.

    Drupal Jsonapi Role Access drupal/jsonapi_role_access Packagist
  • Low 3.7
    CVE-2026-84916

    Islandora - Moderately critical - Access bypass - SA-CONTRIB-2026-126

    Missing Authorization vulnerability in Drupal Islandora allows Forceful Browsing. This issue affects Islandora versions: from 0.0.0 to 2.19.0.

    Drupal Islandora drupal/islandora Packagist
  • Low 3.8
    CVE-2026-16648

    Mailer Plus Log - Moderately critical - Access bypass - SA-CONTRIB-2026-128

    Insertion of Sensitive Information into Log File vulnerability in Drupal Mailer Plus Log allows Remote Services with Stolen Credentials. This issue affects Mailer Plus Log versions: from 0.0.0 to 1.2.7.

    Drupal Mailer Plus Log drupal/symfony_mailer_log Packagist
  • Medium 5.4
    CVE-2026-81163

    Media Library Importer - Moderately critical - Access bypass - SA-CONTRIB-2026-129

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Drupal Media Library Importer allows Path Traversal. This issue affects Media Library Importer versions: from 0.0.0 to 2.1.6.

    Drupal Media Library Importer drupal/media_library_importer Packagist
  • Low 3.7
    CVE-2026-84918

    Monobank payment API - Moderately critical - Access bypass - SA-CONTRIB-2026-130

    Improper Verification of Cryptographic Signature vulnerability in Drupal Monobank payment API allows Signature Spoof. This issue affects Monobank payment API versions: from 0.0.0 to 1.0.3.

    Drupal Monobank payment API drupal/monobank Packagist
  • Medium 4.6
    CVE-2026-84919

    PhotoSwipe - Responsive JavaScript Modal Image Gallery - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-131

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery allows Stored XSS. This issue affects PhotoSwipe - Responsive JavaScript Modal Image Gallery ve…

    Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery drupal/photoswipe Packagist