Skip to content
OpenAdvisories

Vendor

Drupal

585 known vulnerabilities.

Products

Drupal core 60 Webform 20 Core 19 AI (Artificial Intelligence) 18 SAML SSO - Service Provider 13 Open Social 8 Commerce Core 7 Enterprise MFA - TFA for Drupal 6 Monster Menus 4 Two-factor Authentication (TFA) 4 COOKiES Consent Management 4 Drupal Canvas 4 Tagify 3 Facets 3 OpenID Connect / OAuth client 3 Disable Login Page 3 Single Content Sync 3 Authenticator Login 3 Login Disable 3 Commerce Stripe 3 Gammu SMS Daemon 3 Drupal 3 UI Icons 3 One Time Password 3 Cloud 2 Access code 2 CivicTheme Design System 2 Webform REST 2 Node Access Rebuild Progressive 2 AI Agents 2 Data-module 2 Frontend Editing 2 Paragraphs 2 Anti-Spam by CleanTalk 2 POST File 2 Unpublished Node Permissions 2 Field Permissions 2 Block Attributes 2 ECA: Event - Condition - Action 2 Acquia DAM 2
All Critical High Medium Low Exploited only Public exploit

585 results · Feed

  • Medium 5.4
    CVE-2026-81164

    Entity PDF - Moderately critical - Access bypass - SA-CONTRIB-2026-114

    Missing Authorization vulnerability in Drupal Entity PDF allows Forceful Browsing. This issue affects Entity PDF versions: from 0.0.0 to 2.1.5.

    Drupal Entity PDF drupal/entity_pdf Packagist
  • Medium 5.3
    CVE-2026-81205

    LDAP / Active Directory Integration - Moderately critical - Information Disclosure - SA-CONTRIB-2026-115

    Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in Drupal LDAP / Active Directory Integration allows LDAP Injection. This issue affects LDAP / Active Directory Integration versions: from 0.0.0 to 2.2.1.

    Drupal LDAP / Active Directory Integration drupal/ldap_auth Packagist
  • Medium 6.1
    CVE-2026-81201

    Monster Menus - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-116

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Monster Menus allows Stored XSS. This issue affects Monster Menus versions: from 0.0.0 to 9.5.3.

    Drupal Monster Menus drupal/monster_menus Packagist
  • Medium 6.1
    CVE-2026-81160

    Slick Carousel - Moderately critical - Cross Site Scripting - SA-CONTRIB-2026-117

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Slick Carousel allows Stored XSS. This issue affects Slick Carousel versions: from 0.0.0 to 2.1.0.

    Drupal Slick Carousel drupal/slick Packagist
  • Medium 4.2
    CVE-2026-15916

    Drupal core - Moderately critical - Information disclosure - SA-CORE-2026-010

    Missing Authorization vulnerability in Drupal Drupal core allows Forceful Browsing. This issue affects Drupal core versions: from 0.0.0 to 10.6.13, from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, from 0.0.0 to 11.0.*, from 0.0.0 to 11.1.*, from 0.0.0 to 11.2.*.

    Drupal Drupal core drupal/core Web / CMS Packagist
  • Medium 4.7
    CVE-2026-15917

    Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-011

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Drupal core versions: from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, from 0.0.0 to 1…

    Drupal Drupal core drupal/core Web / CMS Packagist
  • Medium 5.4
    CVE-2026-55805

    Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-012

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Stored XSS. This issue affects Drupal core versions: from 0.0.0 to 10.6.13, from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, from 0.0…

    Drupal Drupal core drupal/core Web / CMS Packagist
  • Medium 6.1
    CVE-2026-16638

    Media Folders - Moderately critical - Cross site scripting - SA-CONTRIB-2026-080

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Media Folders allows Stored XSS. This issue affects Media Folders versions: from 0.0.0 to 1.0.8.

    Drupal Media Folders drupal/media_folders Packagist
  • Critical 9.8
    CVE-2026-16639

    Internationalization Single Sign-On - Critical - Access bypass - SA-CONTRIB-2026-081

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Internationalization Single Sign-On allows Authentication Bypass. This issue affects Internationalization Single Sign-On versions: from 0.0.0 to 1.8.0.

    Drupal Internationalization Single Sign-On drupal/i18n_sso Packagist
  • Medium 6.1
    CVE-2026-16640

    Search API Autocomplete - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-082

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Search API Autocomplete allows Reflected XSS. This issue affects Search API Autocomplete versions: from 0.0.0 to 1.12.0.

    Drupal Search API Autocomplete drupal/search_api_autocomplete Packagist
  • Medium 5.7
    CVE-2026-16646

    PanKM - Critical - Unsupported - SA-CONTRIB-2026-083

    Vulnerability in Drupal PanKM. This issue affects PanKM versions: *.*.

    Drupal PanKM
  • Critical 9.8
    CVE-2026-16641

    Commerce Elavon - Critical - Unsupported - SA-CONTRIB-2026-084

    Vulnerability in Drupal Commerce Elavon. This issue affects Commerce Elavon versions: *.*.

    Drupal Commerce Elavon drupal/commerce_elavon Packagist
  • Medium 5.7
    CVE-2026-16642

    Email Login OTP - Critical - Unsupported - SA-CONTRIB-2026-085

    Vulnerability in Drupal Email Login OTP. This issue affects Email Login OTP versions: *.*.

    Drupal Email Login OTP drupal/email_login_otp Packagist
  • Medium 5.7
    CVE-2026-16643

    Lunr exposed filters - Critical - Unsupported - SA-CONTRIB-2026-086

    Vulnerability in Drupal Lunr exposed filters. This issue affects Lunr exposed filters versions: *.*.

    Drupal Lunr exposed filters drupal/lunr_filters Packagist
  • Critical 9.1
    CVE-2026-16644

    Webform REST - Moderately critical - Access bypass - SA-CONTRIB-2026-087

    Incorrect Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. This issue affects Webform REST versions: from 0.0.0 to 4.1.0.

    Drupal Webform REST drupal/webform_rest Packagist
  • Critical 9.1
    CVE-2026-16645

    PhotoSwipe - Responsive JavaScript Modal Image Gallery - Moderately critical - Access bypass - SA-CONTRIB-2026-088

    Missing Authorization vulnerability in Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery allows Forceful Browsing. This issue affects PhotoSwipe - Responsive JavaScript Modal Image Gallery versions: from 0.0.0 to 3.2.0.

    Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery drupal/photoswipe Packagist
  • Medium 5.7
    CVE-2026-15088

    Development Environment - Critical - Unsupported - SA-CONTRIB-2026-089

    Vulnerability in Drupal Development Environment. This issue affects Development Environment versions: *.*.

    Drupal Development Environment drupal/development_environment Packagist
  • High 7.5
    CVE-2026-18259

    Token Content Access - Moderately critical - Access bypass - SA-CONTRIB-2026-090

    Observable Timing Discrepancy vulnerability in Drupal Token Content Access allows Brute Force. This issue affects Token Content Access versions: from 0.0.0 to 3.1.2.

    Drupal Token Content Access drupal/tca Packagist
  • Medium 5.7
    CVE-2026-18260

    Disable Login Page - Moderately critical - Access bypass - SA-CONTRIB-2026-110

    Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Disable Login Page allows Brute Force. This issue affects Disable Login Page versions: from 0.0.0 to 1.1.4.

    Drupal Disable Login Page drupal/disable_login Packagist
  • Medium 5.7
    CVE-2026-18261

    Powerful Surveys - Critical - Unsupported - SA-CONTRIB-2026-092

    Vulnerability in Drupal Powerful Surveys. This issue affects Powerful Surveys versions: *.*.

    Drupal Powerful Surveys
  • High 8.1
    CVE-2026-18985

    Edit in-place field - Moderately critical - Access bypass - SA-CONTRIB-2026-093

    Incorrect Authorization vulnerability in Drupal Edit in-place field allows Forceful Browsing. This issue affects Edit in-place field versions: from 0.0.0 to 2.1.1.

    Drupal Edit in-place field drupal/edit_in_place_field Packagist
  • Critical 9.8
    CVE-2026-11913

    Mother May I - Critical - Unsupported - SA-CONTRIB-2026-045

    vulnerability in Drupal Mother May I allows . This issue affects Mother May I versions: *.*.

    Drupal Mother May I drupal/mothermayi Packagist
  • Medium 5.9
    CVE-2026-11914

    Composer - Critical - Unsupported - SA-CONTRIB-2026-046

    vulnerability in Drupal Composer allows . This issue affects Composer versions: *.*.

    Drupal Composer drupal/composer Packagist
  • Medium 5.9
    CVE-2026-11915

    Brute force attack protection - Critical - Unsupported - SA-CONTRIB-2026-047

    vulnerability in Drupal Brute force attack protection allows . This issue affects Brute force attack protection versions: *.*.

    Drupal Brute force attack protection drupal/bfap_sb Packagist
  • Medium 5.9
    CVE-2026-15087

    Clean RESTful - Critical - Unsupported - SA-CONTRIB-2026-078

    vulnerability in Drupal Clean RESTful allows . This issue affects Clean RESTful versions: *.*.

    Drupal Clean RESTful drupal/clean_node_api Packagist
  • Medium 5.9
    CVE-2026-15086

    Raw Formatter [Meta Tag Formatter] - Critical - Unsupported - SA-CONTRIB-2026-077

    vulnerability in Drupal Raw Formatter [Meta Tag Formatter] allows . This issue affects Raw Formatter [Meta Tag Formatter] versions: *.*.

    Drupal Raw Formatter [Meta Tag Formatter] drupal/raw_formatter Packagist
  • Critical 9.1
    CVE-2026-15089

    Commerce guest registration - Critical - Unsupported - SA-CONTRIB-2026-079

    Vulnerability in Drupal Commerce guest registration. This issue affects Commerce guest registration versions: *.*.

    Drupal Commerce guest registration drupal/commerce_guest_registration Packagist
  • Medium 5.4
    CVE-2026-55808

    Drupal core - Moderately critical - Improper validation - SA-CORE-2026-009

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Drupal core versions: from 0.0.0 to 10.5.12, from 10.6.0 to 10.6.11, from 11.2.0 to …

    Drupal Drupal core drupal/core Web / CMS Packagist
  • Low 3.1
    CVE-2026-55807

    Drupal core - Moderately critical - Server-side request forgery - SA-CORE-2026-008

    Server-Side Request Forgery (SSRF) vulnerability in Drupal Drupal core allows Server Side Request Forgery. This issue affects Drupal core versions: from 0.0.0 to 10.5.12, from 10.6.0 to 10.6.11, from 11.2.0 to 11.2.14, from 11.3.0 to 11.3.12, from 0.0.0 to 11…

    Drupal Drupal core drupal/core Web / CMS Packagist
  • Medium 5.9
    CVE-2026-55804

    Drupal core - Moderately critical - Gadget chain - SA-CORE-2026-006

    Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection. This issue affects Drupal core versions: from 0.0.0 to 10.5.12, from 10.6.0 to 10.6.11, from 11.2.0 to 11.2.14, from 11…

    Drupal Drupal core drupal/core Web / CMS Packagist
  • Medium 5.9
    CVE-2026-55806

    Drupal core - Less critical - Cache poisoning and open redirect - SA-CORE-2026-007

    URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal Drupal core allows Content Spoofing. This issue affects Drupal core versions: from 0.0.0 to 10.5.12, from 10.6.0 to 10.6.11, from 11.2.0 to 11.2.14, from 11.3.0 to 11.3.12, from 0.0.0…

    Drupal Drupal core drupal/core Web / CMS Packagist
  • Medium 5.9
    CVE-2026-55803

    Drupal core - Critical - PHP object injection - SA-CORE-2026-005

    Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection. This issue affects Drupal core versions: from 0.0.0 to 10.5.12, from 10.6.0 to 10.6.11, from 11.2.0 to 11.2.14, from 11…

    Drupal Drupal core drupal/core Web / CMS Packagist
  • Medium 5.4
    CVE-2026-15085

    AI SEO/GEO Analyzer - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-076

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI SEO/GEO Analyzer allows Stored XSS. This issue affects AI SEO/GEO Analyzer versions: from 0.0.0 to 1.1.3.

    Drupal AI SEO/GEO Analyzer drupal/ai_seo Packagist
  • Medium 5.4
    CVE-2026-15084

    UI Patterns (SDC in Drupal UI) - Moderately critical - Cross site scripting - SA-CONTRIB-2026-075

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal UI Patterns (SDC in Drupal UI) allows Stored XSS. This issue affects UI Patterns (SDC in Drupal UI) versions: from 2.0.0 to 2.0.17.

    Drupal UI Patterns (SDC in Drupal UI) drupal/ui_patterns Web / CMS Packagist
  • Medium 4.2
    CVE-2026-15083

    ECA: Event - Condition - Action - Less critical - Information disclosure - SA-CONTRIB-2026-074

    Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal ECA: Event - Condition - Action allows Object Injection. This issue affects ECA: Event - Condition - Action versions: from 0.0.0 to 2.1.20, from 3.0.0 to 3.…

    Drupal ECA: Event - Condition - Action drupal/eca Packagist
  • Medium 5.4
    CVE-2026-15082

    Siteimprove Analytics - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-073

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Siteimprove Analytics allows Cross-Site Scripting (XSS). This issue affects Siteimprove Analytics versions: from 0.0.0 to 2.0.1.

    Drupal Siteimprove Analytics drupal/siteimprove_analytics Packagist
  • High 7.4
    CVE-2026-15081

    Location Selector - Critical - SQL Injection - SA-CONTRIB-2026-072

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Location Selector allows SQL Injection. This issue affects Location Selector versions: from 0.0.0 to 1.3.0.

    Drupal Location Selector drupal/location_selector Packagist
  • Medium 4.3
    CVE-2026-15080

    Ray Enterprise Translation - Moderately critical - Cross site request forgery - SA-CONTRIB-2026-071

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal Ray Enterprise Translation allows Cross Site Request Forgery. This issue affects Ray Enterprise Translation versions: from 0.0.0 to 4.0.4, from 4.1.0 to 4.1.4, from 11.0.0 to 11.0.4.

    Drupal Ray Enterprise Translation drupal/lingotek Packagist
  • Medium 5.4
    CVE-2026-15079

    Login Disable - Moderately critical - Access bypass - SA-CONTRIB-2026-070

    Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Login Disable allows Brute Force. This issue affects Login Disable versions: from 0.0.0 to 2.1.4.

    Drupal Login Disable drupal/login_disable Packagist
  • Medium 5.4
    CVE-2026-58591

    Colorbox - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-069

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Colorbox allows Cross-Site Scripting (XSS). This issue affects Colorbox versions: from 0.0.0 to 2.1.5, from 0.0.0 to 2.2.0.

    Drupal Colorbox drupal/colorbox Packagist