Skip to content
OpenAdvisories

Vendor

Drupal

576 known vulnerabilities.

Products

Drupal core 52 Webform 20 Core 19 AI (Artificial Intelligence) 18 SAML SSO - Service Provider 13 Open Social 8 Commerce Core 7 Enterprise MFA - TFA for Drupal 6 Monster Menus 4 Two-factor Authentication (TFA) 4 COOKiES Consent Management 4 Drupal Canvas 4 Tagify 3 Facets 3 OpenID Connect / OAuth client 3 Disable Login Page 3 Single Content Sync 3 Authenticator Login 3 Login Disable 3 Commerce Stripe 3 Gammu SMS Daemon 3 UI Icons 3 One Time Password 3 Cloud 2 Access code 2 CivicTheme Design System 2 Webform REST 2 Node Access Rebuild Progressive 2 AI Agents 2 Data-module 2 Frontend Editing 2 Paragraphs 2 Anti-Spam by CleanTalk 2 POST File 2 Unpublished Node Permissions 2 Field Permissions 2 Block Attributes 2 ECA: Event - Condition - Action 2 Acquia DAM 2 Paragraphs table 2
All Critical High Medium Low Exploited only Public exploit

576 results · Feed

  • Critical 9.1
    CVE-2026-96355

    Webform - Critical - Remote Code Execution - SA-CONTRIB-2026-175

    Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Webform allows Code Injection. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

    Drupal Webform drupal/webform Packagist
  • Medium 5.3
    CVE-2026-96356

    Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-174

    Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

    Drupal Webform drupal/webform Packagist
  • Medium 4.8
    CVE-2026-96375

    Cloud - Critical - Remote code execution - SA-CONTRIB-2026-176

    Improper Certificate Validation vulnerability in Drupal Cloud allows Adversary in the Middle (AiTM). This issue affects Cloud versions: from 0.0.0 to 7.0.1.

    Drupal Cloud drupal/cloud Packagist
  • Medium 6.4
    CVE-2026-96376

    Cloud - Critical - Remote code execution - SA-CONTRIB-2026-177

    Improper Neutralization of Special Elements used in an OS Command ("OS Command Injection") vulnerability in Drupal Cloud allows OS Command Injection. This issue affects Cloud versions: from 0.0.0 to 7.0.1.

    Drupal Cloud drupal/cloud Packagist
  • Medium 4.2
    CVE-2026-96374

    Project Browser - Critical - Cross-site request forgery - SA-CONTRIB-2026-178

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal Project Browser allows Cross Site Request Forgery. This issue affects Project Browser versions: from 0.0.0 to 2.0.3, from 2.1.0 to 2.1.5.

    Drupal Project Browser drupal/project_browser Packagist
  • Medium 4.3
    CVE-2026-96378

    Commerce Decoupled Checkout - Moderately critical - Access bypass - SA-CONTRIB-2026-179

    Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Commerce Decoupled Checkout allows Object Injection. This issue affects Commerce Decoupled Checkout versions: from 1.0.0 to 1.8.0.

    Drupal Commerce Decoupled Checkout drupal/commerce_decoupled_checkout Packagist
  • Low 3.5
    CVE-2026-96384

    Mermaid Diagram Field - Moderately critical - Access bypass - SA-CONTRIB-2026-180

    Incorrect Authorization vulnerability in Drupal Mermaid Diagram Field allows Forceful Browsing. This issue affects Mermaid Diagram Field versions: from 1.0.4 to 1.0.9.

    Drupal Mermaid Diagram Field drupal/mermaid_diagram_field Packagist
  • Medium 6.5
    CVE-2026-96385

    REST & JSON API Authentication for Drupal - Moderately critical - Access bypass - SA-CONTRIB-2026-182

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal REST & JSON API Authentication for Drupal allows Authentication Bypass. This issue affects REST & JSON API Authentication for Drupal versions: from 0.0.0 to 3.2.0.

    Drupal REST & JSON API Authentication for Drupal drupal/rest_api_authentication Web / CMS Packagist
  • Low 3.5
    CVE-2026-96379

    CookieCuttr - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-181

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal CookieCuttr allows Stored XSS. This issue affects CookieCuttr versions: from 2.0.0 to 2.0.3.

    Drupal CookieCuttr drupal/cookiecuttr Packagist
  • Low 3.8
    CVE-2026-96387

    Stop administrator login - Moderately critical - Access bypass - SA-CONTRIB-2026-183

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Stop administrator login allows Authentication Bypass. This issue affects Stop administrator login versions: from 1.0 to 1.6.

    Drupal Stop administrator login drupal/stop_admin Packagist
  • Medium 5.4
    CVE-2026-96388

    Tawk.to - Live chat application - Critical - Cross Site Request Forgery - SA-CONTRIB-2026-184

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal Tawk.to - Live chat application allows Cross Site Request Forgery. This issue affects Tawk.to - Live chat application versions: from 0.0.0 to 3.0.4.

    Drupal Tawk.to - Live chat application drupal/tawk_to Packagist
  • Medium 4.3
    CVE-2026-96390

    Editoria11y Accessibility Checker - Moderately critical - Access bypass - SA-CONTRIB-2026-185

    Privilege Defined With Unsafe Actions vulnerability in Drupal Editoria11y Accessibility Checker allows Privilege Escalation. This issue affects Editoria11y Accessibility Checker versions: from 0.0.0 to 2.2.23, from 3.0.0 to 3.0.9.

    Drupal Editoria11y Accessibility Checker drupal/editoria11y Packagist
  • Medium 4.3
    CVE-2026-96391

    Webform REST - Less critical - Access bypass - SA-CONTRIB-2026-186

    Missing Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. This issue affects Webform REST versions: from 0.0.0 to 4.2.1.

    Drupal Webform REST drupal/webform_rest Packagist
  • Low 3.5
    CVE-2026-96392

    AI CKEditor - Moderately critical - Code execution via Twig templates - SA-CONTRIB-2026-187

    Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal AI CKEditor allows Code Injection. This issue affects AI CKEditor versions: from 0.0.0 to 1.4.3.

    Drupal AI CKEditor drupal/ai_ckeditor Packagist
  • Medium 5.3
    CVE-2026-96377

    Combined image style - Moderately critical - Improper access control - SA-CONTRIB-2026-188

    Allocation of Resources Without Limits or Throttling vulnerability in Drupal Combined image style allows Excessive Allocation. This issue affects Combined image style versions: from 0.0.0 to 1.0.7.

    Drupal Combined image style drupal/combined_image_style Packagist
  • Medium 6.5
    CVE-2026-96380

    CSS Usage Analyzer - Moderately critical - Improper access control - SA-CONTRIB-2026-189

    Missing Authorization vulnerability in Drupal CSS Usage Analyzer allows Forceful Browsing. This issue affects CSS Usage Analyzer versions: from 1.0.0 to 1.0.2.

    Drupal CSS Usage Analyzer drupal/css_usage_analyzer Packagist
  • Medium 6.5
    CVE-2026-96386

    Smart Content - Moderately critical - Access bypass - SA-CONTRIB-2026-190

    Missing Authorization vulnerability in Drupal Smart Content allows Forceful Browsing. This issue affects Smart Content versions: from 0.0.0 to 3.2.1.

    Drupal Smart Content drupal/smart_content Packagist
  • Medium 4.6
    CVE-2026-96382

    Diba carousel slider - Moderately critical - Cross Site Scripting (XSS) - SA-CONTRIB-2026-191

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Diba carousel slider allows Stored XSS. This issue affects Diba carousel slider versions: from 0.0.0 to 3.0.2.

    Drupal Diba carousel slider drupal/diba_carousel Packagist
  • Medium 4.1
    CVE-2026-16647

    Disable Login Page - Moderately critical - Access bypass - SA-CONTRIB-2026-111

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Disable Login Page allows Functionality Bypass. This issue affects Disable Login Page versions: from 0.0.0 to 1.1.4.

    Drupal Disable Login Page drupal/disable_login Packagist
  • Medium 4.8
    CVE-2026-18986

    Entity Browser - Moderately critical - Cross site scripting - SA-CONTRIB-2026-094

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Entity Browser allows Stored XSS. This issue affects Entity Browser versions: from 0.0.0 to 2.16.0.

    Drupal Entity Browser drupal/entity_browser Packagist
  • Critical 9.1
    CVE-2026-73475

    Commerce PayPal - Moderately critical - Access bypass - SA-CONTRIB-2026-095

    Incorrect Authorization vulnerability in Drupal Commerce PayPal allows Forceful Browsing. This issue affects Commerce PayPal versions: from 0.0.0 to 1.12.0, from 2.0.0 to 2.1.3.

    Drupal Commerce PayPal drupal/commerce_paypal Packagist
  • Medium 5.3
    CVE-2026-73478

    Diff - Moderately critical - Access bypass - SA-CONTRIB-2026-096

    Incorrect Authorization vulnerability in Drupal Diff allows Forceful Browsing. This issue affects Diff versions: from 0.0.0 to 2.0.1, from 2.1.0 to 2.1.1.

    Drupal Diff drupal/diff Packagist
  • Medium 5.3
    CVE-2026-73474

    Entity Share Websub - Moderately critical - Server-side request forgery (SSRF) - SA-CONTRIB-2026-097

    Server-Side Request Forgery (SSRF) vulnerability in Drupal Entity Share Websub allows Server Side Request Forgery. This issue affects Entity Share Websub versions: from 0.0.0 to 1.1.2.

    Drupal Entity Share Websub drupal/entity_share_websub Packagist
  • Medium 5.4
    CVE-2026-73476

    External Authentication - Moderately critical - Access bypass - SA-CONTRIB-2026-098

    Improper Handling of Case Sensitivity vulnerability in Drupal External Authentication allows Privilege Escalation. This issue affects External Authentication versions: from 0.0.0 to 2.0.13.

    Drupal External Authentication drupal/externalauth Packagist
  • Medium 5.3
    CVE-2026-73477

    Quick Tabs - Moderately critical - Access bypass - SA-CONTRIB-2026-099

    Incorrect Authorization vulnerability in Drupal Quick Tabs allows Forceful Browsing. This issue affects Quick Tabs versions: from 0.0.0 to 4.3.1.

    Drupal Quick Tabs drupal/quicktabs Packagist
  • Medium 5.9
    CVE-2026-76757

    Gammu SMS Daemon - Critical - Unsupported - SA-CONTRIB-2026-100

    Vulnerability in Drupal Gammu SMS Daemon. This issue affects Gammu SMS Daemon versions: *.*.

    Drupal Gammu SMS Daemon
  • Medium 5.9
    CVE-2026-76756

    Gammu SMS Daemon - Critical - Unsupported - SA-CONTRIB-2026-100

    Vulnerability in Drupal Gammu SMS Daemon. This issue affects Gammu SMS Daemon versions: *.*.

    Drupal Gammu SMS Daemon
  • Medium 5.9
    CVE-2026-76755

    Gammu SMS Daemon - Critical - Unsupported - SA-CONTRIB-2026-100

    Vulnerability in Drupal Gammu SMS Daemon. This issue affects Gammu SMS Daemon versions: *.*.

    Drupal Gammu SMS Daemon drupal/gammu_smsd Packagist
  • Medium 5.9
    CVE-2026-76758

    Link content parser - Critical - Unsupported - SA-CONTRIB-2026-101

    Vulnerability in Drupal Link content parser. This issue affects Link content parser versions: *.*.

    Drupal Link content parser drupal/postlight_parser Packagist
  • High 7.3
    CVE-2026-76782

    Screenshot - Critical - Unsupported - SA-CONTRIB-2026-102

    Vulnerability in Drupal Screenshot. This issue affects Screenshot versions: *.*.

    Drupal Screenshot
  • High 7.3
    CVE-2026-76759

    Screenshot - Critical - Unsupported - SA-CONTRIB-2026-102

    Vulnerability in Drupal Screenshot. This issue affects Screenshot versions: *.*.

    Drupal Screenshot drupal/screenshot Packagist
  • Medium 4.8
    CVE-2026-81167

    Address Suggestion - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-103

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Address Suggestion allows Cross-Site Scripting (XSS). This issue affects Address Suggestion versions: from 0.0.0 to 1.0.25.

    Drupal Address Suggestion drupal/address_suggestion Packagist
  • Medium 5.3
    CVE-2026-81165

    Blazy - Less critical - Access bypass - SA-CONTRIB-2026-104

    Incorrect Authorization vulnerability in Drupal Blazy allows Forceful Browsing. This issue affects Blazy versions: from 0.0.0 to 3.0.18.

    Drupal Blazy drupal/blazy Packagist
  • Low 3.7
    CVE-2026-81168

    CAPTCHA Protected Page - Moderately critical - Cookie Forgery - SA-CONTRIB-2026-105

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal CAPTCHA Protected Page allows Functionality Bypass. This issue affects CAPTCHA Protected Page versions: from 0.0.0 to 1.0.2.

    Drupal CAPTCHA Protected Page drupal/captcha_protected_page Packagist
  • Low 3.7
    CVE-2026-81159

    Commerce CyberSource - Moderately critical - Insufficient input validation - SA-CONTRIB-2026-106

    Observable Timing Discrepancy vulnerability in Drupal Commerce CyberSource allows Brute Force. This issue affects Commerce CyberSource versions: from 0.0.0 to 1.10.0.

    Drupal Commerce CyberSource drupal/commerce_cybersource Packagist
  • Low 3.3
    CVE-2026-81161

    Content Moderation Notifications - Moderately critical - Access bypass - SA-CONTRIB-2026-107

    Privilege Defined With Unsafe Actions vulnerability in Drupal Content Moderation Notifications allows Privilege Escalation. This issue affects Content Moderation Notifications versions: from 0.0.0 to 3.9.0.

    Drupal Content Moderation Notifications drupal/content_moderation_notifications Packagist
  • Medium 5.3
    CVE-2026-81269

    Data field - Moderately critical - Information disclosure - SA-CONTRIB-2026-108

    Missing Authorization vulnerability in Drupal Data field allows Forceful Browsing. This issue affects Data field versions: from 0.0.0 to 2.0.13.

    Drupal Data field drupal/datafield Packagist
  • Medium 5.3
    CVE-2026-81166

    Digital Signage Framework - Moderately critical - Access bypass - SA-CONTRIB-2026-109

    Missing Authorization vulnerability in Drupal Digital Signage Framework allows Forceful Browsing. This issue affects Digital Signage Framework versions: from 0.0.0 to 2.6.1.

    Drupal Digital Signage Framework drupal/digital_signage_framework Packagist
  • Medium 5.3
    CVE-2026-81162

    DXPR Builder: The AI Visual Page Builder for Drupal - Moderately critical - Information Disclosure - SA-CONTRIB-2026-112

    Insertion of Sensitive Information Into Sent Data vulnerability in Drupal DXPR Builder: The Best Editing (AI) Experience for Drupal allows Forceful Browsing. This issue affects DXPR Builder: The Best Editing (AI) Experience for Drupal versions: from 0.0.0 to …

    Drupal DXPR Builder: The Best Editing (AI) Experience for Drupal drupal/dxpr_builder Web / CMS Packagist
  • Medium 5.3
    CVE-2026-81158

    Entity API - Moderately critical - Information disclosure - SA-CONTRIB-2026-113

    Incorrect Authorization vulnerability in Drupal Entity API allows Forceful Browsing. This issue affects Entity API versions: from 0.0.0 to 1.8.0.

    Drupal Entity API drupal/entity Packagist