Skip to content
OpenAdvisories

Vendor

Drupal

576 known vulnerabilities.

Products

Drupal core 52 Webform 20 Core 19 AI (Artificial Intelligence) 18 SAML SSO - Service Provider 13 Open Social 8 Commerce Core 7 Enterprise MFA - TFA for Drupal 6 Monster Menus 4 Two-factor Authentication (TFA) 4 COOKiES Consent Management 4 Drupal Canvas 4 Tagify 3 Facets 3 OpenID Connect / OAuth client 3 Disable Login Page 3 Single Content Sync 3 Authenticator Login 3 Login Disable 3 Commerce Stripe 3 Gammu SMS Daemon 3 UI Icons 3 One Time Password 3 Cloud 2 Access code 2 CivicTheme Design System 2 Webform REST 2 Node Access Rebuild Progressive 2 AI Agents 2 Data-module 2 Frontend Editing 2 Paragraphs 2 Anti-Spam by CleanTalk 2 POST File 2 Unpublished Node Permissions 2 Field Permissions 2 Block Attributes 2 ECA: Event - Condition - Action 2 Acquia DAM 2 Paragraphs table 2
All Critical High Medium Low Exploited only Public exploit

576 results · Feed

  • Medium 5.3
    CVE-2026-84920

    Unpublished Node Permissions - Critical - Access bypass - SA-CONTRIB-2026-132

    Incorrect Authorization vulnerability in Drupal Unpublished Node Permissions allows Forceful Browsing. This issue affects Unpublished Node Permissions versions: from 0.0.0 to 1.8.0.

    Drupal Unpublished Node Permissions drupal/unpublished_node_permissions Packagist
  • Medium 5.3
    CVE-2026-84921

    Webform Submissions Delete - Moderately critical - Access bypass - SA-CONTRIB-2026-133

    Missing Authorization vulnerability in Drupal Webform Submissions Delete allows Forceful Browsing. This issue affects Webform Submissions Delete versions: from 0.0.0 to 1.2.0.

    Drupal Webform Submissions Delete drupal/webform_submissions_delete Packagist
  • Medium 6.5
    CVE-2026-87936

    amazee.ai Private AI Provider - Critical - SQL injection - SA-CONTRIB-2026-134

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal amazee.ai Private AI Provider allows SQL Injection. This issue affects amazee.ai Private AI Provider versions: from 0.0.0 to 1.3.7, from 1.4.0 to 1.4.…

    Drupal amazee.ai Private AI Provider drupal/ai_provider_amazeeio Packagist
  • Medium 6.5
    CVE-2026-87937

    Central Authentication System (CAS) Server - Moderately critical - Open redirect - SA-CONTRIB-2026-135

    URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal Central Authentication System (CAS) Server allows Fake the Source of Data. This issue affects Central Authentication System (CAS) Server versions: from 0.0.0 to 2.0.4, from 2.1.0 to 2…

    Drupal Central Authentication System (CAS) Server drupal/cas_server Packagist
  • Medium 6.5
    CVE-2026-87938

    CSP log - Critical - SQL Injection - SA-CONTRIB-2026-136

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal CSP log allows SQL Injection. This issue affects CSP log versions: from 0.0.0 to 1.0.2.

    Drupal CSP log drupal/csp_log Packagist
  • Medium 5.4
    CVE-2026-87940

    Key auth - Moderately critical - Access bypass - SA-CONTRIB-2026-138

    Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Key auth allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Key auth versions: from 0.0.0 to 2.2.4.

    Drupal Key auth drupal/key_auth Packagist
  • Medium 4.2
    CVE-2026-87939

    Feed Block - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-137

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Feed Block allows Stored XSS. This issue affects Feed Block versions: from 0.0.0 to 2.0.2, from 3.0.0 to 3.0.2.

    Drupal Feed Block drupal/feed_block Packagist
  • Medium 5.9
    CVE-2026-87941

    Patreon - Critical - Unsupported - SA-CONTRIB-2026-139

    Vulnerability in Drupal Patreon. This issue affects Patreon versions: 7.x.

    Drupal Patreon
  • Medium 4.6
    CVE-2026-87942

    SafeDelete - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-140

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal SafeDelete allows Stored XSS. This issue affects SafeDelete versions: from 0.0.0 to 1.0.88.

    Drupal SafeDelete drupal/safedelete Packagist
  • Medium 6.5
    CVE-2026-87943

    SAML SSO - Service Provider - Critical - Improper access control - SA-CONTRIB-2026-141

    Missing Authorization vulnerability in Drupal SAML SSO - Service Provider allows Forceful Browsing. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.

    Drupal SAML SSO - Service Provider drupal/miniorange_saml Packagist
  • Medium 4.8
    CVE-2026-87944

    SAML SSO - Service Provider - Critical - Improper certificate validation - SA-CONTRIB-2026-142

    Improper Certificate Validation vulnerability in Drupal SAML SSO - Service Provider allows Adversary in the Middle (AiTM). This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.

    Drupal SAML SSO - Service Provider drupal/miniorange_saml Packagist
  • Medium 4.8
    CVE-2026-87946

    SAML SSO - Service Provider - Critical - Weak cryptographic practices - SA-CONTRIB-2026-144

    Observable Timing Discrepancy vulnerability in Drupal SAML SSO - Service Provider allows Brute Force. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.

    Drupal SAML SSO - Service Provider drupal/miniorange_saml Packagist
  • Medium 5.4
    CVE-2026-87945

    SAML SSO - Service Provider - Critical - Open redirect - SA-CONTRIB-2026-143

    URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal SAML SSO - Service Provider allows Fake the Source of Data. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.

    Drupal SAML SSO - Service Provider drupal/miniorange_saml Packagist
  • Medium 4.8
    CVE-2026-87947

    SAML SSO - Service Provider - Moderately critical - Authentication bypass - SA-CONTRIB-2026-145

    Improper Verification of Cryptographic Signature vulnerability in Drupal SAML SSO - Service Provider allows Signature Spoof. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.

    Drupal SAML SSO - Service Provider drupal/miniorange_saml Packagist
  • Low 3.5
    CVE-2026-87948

    SAML SSO - Service Provider - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-146

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal SAML SSO - Service Provider allows Cross-Site Scripting (XSS). This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.

    Drupal SAML SSO - Service Provider drupal/miniorange_saml Packagist
  • Low 3.3
    CVE-2026-87949

    SAML SSO - Service Provider - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-147

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal SAML SSO - Service Provider allows Cross-Site Scripting (XSS). This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.

    Drupal SAML SSO - Service Provider drupal/miniorange_saml Packagist
  • Medium 5.3
    CVE-2026-87950

    SAML SSO - Service Provider - Moderately critical - Embedded credentials - SA-CONTRIB-2026-148

    Use of Hard-coded Credentials vulnerability in Drupal SAML SSO - Service Provider allows Retrieve Embedded Sensitive Data. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.

    Drupal SAML SSO - Service Provider drupal/miniorange_saml Packagist
  • Low 3.1
    CVE-2026-87952

    SAML SSO - Service Provider - Moderately critical - Insufficient replay protection - SA-CONTRIB-2026-150

    Authentication Bypass by Capture-replay vulnerability in Drupal SAML SSO - Service Provider allows Remote Services with Stolen Credentials. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.

    Drupal SAML SSO - Service Provider drupal/miniorange_saml Packagist
  • Low 3.8
    CVE-2026-87951

    SAML SSO - Service Provider - Moderately critical - Information disclosure - SA-CONTRIB-2026-149

    Insecure Storage of Sensitive Information vulnerability in Drupal SAML SSO - Service Provider allows Retrieve Embedded Sensitive Data. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.

    Drupal SAML SSO - Service Provider drupal/miniorange_saml Packagist
  • Low 3.3
    CVE-2026-87953

    SAML SSO - Service Provider - Moderately critical - Server Side Request Forgery - SA-CONTRIB-2026-151

    Server-Side Request Forgery (SSRF) vulnerability in Drupal SAML SSO - Service Provider allows Server Side Request Forgery. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.

    Drupal SAML SSO - Service Provider drupal/miniorange_saml Packagist
  • Medium 4.3
    CVE-2026-87954

    Taxonomy Term Glossary - Critical - Access bypass - SA-CONTRIB-2026-152

    Missing Authorization vulnerability in Drupal Taxonomy Term Glossary allows Forceful Browsing. This issue affects Taxonomy Term Glossary versions: from 0.0.0 to 4.6.0.

    Drupal Taxonomy Term Glossary drupal/term_glossary Packagist
  • Medium 4.3
    CVE-2026-87955

    Ultimate Table Field - Critical - Access bypass - SA-CONTRIB-2026-153

    Missing Authorization vulnerability in Drupal Ultimate Table Field allows Forceful Browsing. This issue affects Ultimate Table Field versions: from 0.0.0 to 1.1.1, from 2.0.0 to 2.0.1.

    Drupal Ultimate Table Field drupal/ultimate_table_field Packagist
  • Medium 4.6
    CVE-2026-96361

    Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-155

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Cross-Site Scripting (XSS). This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

    Drupal Webform drupal/webform Packagist
  • Low 3.5
    CVE-2026-96360

    Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-154

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Cross-Site Scripting (XSS). This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

    Drupal Webform drupal/webform Packagist
  • Medium 4.6
    CVE-2026-96358

    Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-158

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Cross-Site Scripting (XSS). This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

    Drupal Webform drupal/webform Packagist
  • Medium 4.6
    CVE-2026-96359

    Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-159

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Cross-Site Scripting (XSS). This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

    Drupal Webform drupal/webform Packagist
  • Medium 4.2
    CVE-2026-96362

    Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-160

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Cross-Site Scripting (XSS). This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

    Drupal Webform drupal/webform Packagist
  • Low 3.1
    CVE-2026-96363

    Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-161

    Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

    Drupal Webform drupal/webform Packagist
  • Medium 4.6
    CVE-2026-96368

    Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-163

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

    Drupal Webform drupal/webform Packagist
  • Medium 4.6
    CVE-2026-96367

    Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-162

    Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

    Drupal Webform drupal/webform Packagist
  • Medium 5.4
    CVE-2026-96370

    Webform - Moderately critical - Access bypass, Server-side request forgery - SA-CONTRIB-2026-164

    Incorrect Authorization vulnerability in Drupal Webform allows Server Side Request Forgery. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

    Drupal Webform drupal/webform Packagist
  • Low 3.1
    CVE-2026-96369

    Webform - Less critical - Access bypass - SA-CONTRIB-2026-165

    Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Webform allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

    Drupal Webform drupal/webform Packagist
  • Medium 5.4
    CVE-2026-96371

    Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-166

    Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

    Drupal Webform drupal/webform Packagist
  • Medium 5.4
    CVE-2026-96372

    Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-167

    Insufficient Granularity of Access Control vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

    Drupal Webform drupal/webform Packagist
  • Low 3.3
    CVE-2026-96373

    Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-168

    Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

    Drupal Webform drupal/webform Packagist
  • Medium 5.3
    CVE-2026-96366

    Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-169

    Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

    Drupal Webform drupal/webform Packagist
  • High 7.5
    CVE-2026-96365

    Webform - Less critical - Denial of service - SA-CONTRIB-2026-170

    Allocation of Resources Without Limits or Throttling vulnerability in Drupal Webform allows Excessive Allocation. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

    Drupal Webform drupal/webform Packagist
  • Medium 5.3
    CVE-2026-96364

    Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-171

    Improper Control of Interaction Frequency vulnerability in Drupal Webform allows Functionality Misuse. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

    Drupal Webform drupal/webform Packagist
  • Medium 4.6
    CVE-2026-96357

    Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-172

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

    Drupal Webform drupal/webform Packagist
  • Medium 4.3
    CVE-2026-96398

    Webform - Less critical - Access bypass - SA-CONTRIB-2026-173

    Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

    Drupal Webform drupal/webform Packagist