Skip to content
OpenAdvisories

Vendor

Drupal

585 known vulnerabilities.

Products

Drupal core 60 Webform 20 Core 19 AI (Artificial Intelligence) 18 SAML SSO - Service Provider 13 Open Social 8 Commerce Core 7 Enterprise MFA - TFA for Drupal 6 Monster Menus 4 Two-factor Authentication (TFA) 4 COOKiES Consent Management 4 Drupal Canvas 4 Tagify 3 Facets 3 OpenID Connect / OAuth client 3 Disable Login Page 3 Single Content Sync 3 Authenticator Login 3 Login Disable 3 Commerce Stripe 3 Gammu SMS Daemon 3 Drupal 3 UI Icons 3 One Time Password 3 Cloud 2 Access code 2 CivicTheme Design System 2 Webform REST 2 Node Access Rebuild Progressive 2 AI Agents 2 Data-module 2 Frontend Editing 2 Paragraphs 2 Anti-Spam by CleanTalk 2 POST File 2 Unpublished Node Permissions 2 Field Permissions 2 Block Attributes 2 ECA: Event - Condition - Action 2 Acquia DAM 2
All Critical High Medium Low Exploited only Public exploit

585 results · Feed

  • Medium 5.4
    CVE-2026-58590

    FlowDrop - Moderately critical - Access bypass - SA-CONTRIB-2026-068

    Missing Authorization vulnerability in Drupal FlowDrop allows Forceful Browsing. This issue affects FlowDrop versions: from 0.0.0 to 1.6.0.

    Drupal FlowDrop drupal/flowdrop Packagist
  • Medium 5.4
    CVE-2026-58589

    FlowDrop - Moderately critical - Access bypass - SA-CONTRIB-2026-067

    Missing Authorization vulnerability in Drupal FlowDrop allows Forceful Browsing. This issue affects FlowDrop versions: from 0.0.0 to 1.6.0.

    Drupal FlowDrop drupal/flowdrop Packagist
  • Medium 6.1
    CVE-2026-58587

    Drupal Canvas - Moderately critical - Improper validation - SA-CONTRIB-2026-065

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal Canvas allows Cross-Site Scripting (XSS). This issue affects Drupal Canvas versions: from 0.0.0 to 1.4.2, from 1.5.0 to 1.5.2, from 1.6.0 to 1.…

    Drupal Drupal Canvas drupal/canvas Web / CMS Packagist
  • Medium 6.1
    CVE-2026-58588

    Drupal Canvas - Moderately critical - Improper validation - SA-CONTRIB-2026-066

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal Canvas allows Cross-Site Scripting (XSS). This issue affects Drupal Canvas versions: from 0.0.0 to 1.4.2, from 1.5.0 to 1.5.2, from 1.6.0 to 1.…

    Drupal Drupal Canvas drupal/canvas Web / CMS Packagist
  • High 8.1
    CVE-2026-13244

    Tealium iQ Tag Management - Critical - PHP object injection - SA-CONTRIB-2026-064

    Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Tealium iQ Tag Management allows Object Injection. This issue affects Tealium iQ Tag Management versions: from 0.0.0 to 2.4.0.

    Drupal Tealium iQ Tag Management drupal/tealiumiq Packagist
  • Medium 4.8
    CVE-2026-13243

    Salesforce Suite - Moderately critical - Cross-site request forgery - SA-CONTRIB-2026-063

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal Salesforce Suite allows Cross Site Request Forgery. This issue affects Salesforce Suite versions: from 0.0.0 to 5.1.3.

    Drupal Salesforce Suite drupal/salesforce Packagist
  • Medium 6.5
    CVE-2026-13242

    Geolocation Field - Critical - SQL Injection - SA-CONTRIB-2026-062

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Geolocation Field allows SQL Injection. This issue affects Geolocation Field versions: from 0.0.0 to 3.15.0.

    Drupal Geolocation Field drupal/geolocation Packagist
  • Medium 6.5
    CVE-2026-13240

    Paragraphs - Less critical - Access bypass - SA-CONTRIB-2026-060

    Missing Authorization vulnerability in Drupal Paragraphs allows Forceful Browsing. This issue affects Paragraphs versions: from 0.0.0 to 1.21.0.

    Drupal Paragraphs drupal/paragraphs Packagist
  • Medium 6.5
    CVE-2026-13241

    Paragraphs - Moderately critical - Access bypass - SA-CONTRIB-2026-061

    Missing Authorization vulnerability in Drupal Paragraphs allows Forceful Browsing. This issue affects Paragraphs versions: from 0.0.0 to 1.21.0.

    Drupal Paragraphs drupal/paragraphs Packagist
  • Medium 6.5
    CVE-2026-13239

    WissKI - Critical - Access bypass - SA-CONTRIB-2026-059

    Missing Authorization vulnerability in Drupal WissKI allows Forceful Browsing. This issue affects WissKI versions: from 0.0.0 to 4.2.0.

    Drupal WissKI drupal/wisski Packagist
  • Medium 4.8
    CVE-2026-13238

    Commerce Realex / Global Payments - Moderately critical - Access Bypass - SA-CONTRIB-2026-058

    Incorrect Authorization vulnerability in Drupal Commerce Realex / Global Payments allows Forceful Browsing. This issue affects Commerce Realex / Global Payments versions: from 0.0.0 to 3.0.2.

    Drupal Commerce Realex / Global Payments drupal/commerce_realex Packagist
  • Medium 4.8
    CVE-2026-13237

    AI Agents - Moderately critical - Information disclosure, Access bypass - SA-CONTRIB-2026-057

    Incorrect Authorization vulnerability in Drupal AI Agents allows Forceful Browsing. This issue affects AI Agents versions: from 0.0.0 to 1.1.4, from 1.2.0 to 1.2.5, from 1.3.0 to 1.3.1.

    Drupal AI Agents drupal/ai_agents Packagist
  • Medium 4.2
    CVE-2026-13236

    AI Agents - Less critical - Access bypass - SA-CONTRIB-2026-056

    Missing Authorization vulnerability in Drupal AI Agents allows Forceful Browsing. This issue affects AI Agents versions: from 0.0.0 to 1.1.4, from 1.2.0 to 1.2.5, from 1.3.0 to 1.3.1.

    Drupal AI Agents drupal/ai_agents Packagist
  • Low 3.3
    CVE-2026-13235

    AI (Artificial Intelligence) - Moderately critical - Access bypass - SA-CONTRIB-2026-055

    Missing Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Forceful Browsing. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.2.17, from 1.3.0 to 1.3.8, from 1.4.0 to 1.4.3.

    Drupal AI (Artificial Intelligence) drupal/ai Packagist
  • Medium 6.1
    CVE-2026-13234

    AI (Artificial Intelligence) - Moderately critical - Information Disclosure / Cross-site Scripting - SA-CONTRIB-2026-054

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Cross-Site Scripting (XSS). This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.2.17, from 1…

    Drupal AI (Artificial Intelligence) drupal/ai Packagist
  • Low 3.3
    CVE-2026-13233 Public exploit

    OpenAI Provider - Moderately critical - Server-side Request Forgery - SA-CONTRIB-2026-053

    Server-Side Request Forgery (SSRF) vulnerability in Drupal OpenAI Provider allows Server Side Request Forgery. This issue affects OpenAI Provider versions: from 0.0.0 to 1.1.1, from 1.2.0 to 1.2.2.

    Drupal OpenAI Provider drupal/ai_provider_openai Packagist
  • Low 3.1
    CVE-2026-13232

    Advanced Content Feedback (aka admin_feedback) - Moderately critical - Access bypass / Insecure Direct Object Reference (IDOR) - SA-CONTRIB-2026-052

    Incorrect Authorization vulnerability in Drupal Advanced Content Feedback (aka admin_feedback) allows Forceful Browsing. This issue affects Advanced Content Feedback (aka admin_feedback) versions: from 0.0.0 to 2.8.0.

    Drupal Advanced Content Feedback (aka admin_feedback) drupal/admin_feedback Packagist
  • Medium 6.1
    CVE-2026-13231

    Advanced Content Feedback (aka admin_feedback) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-051

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Advanced Content Feedback (aka admin_feedback) allows Stored XSS. This issue affects Advanced Content Feedback (aka admin_feedback) versions: from 0.0…

    Drupal Advanced Content Feedback (aka admin_feedback) drupal/admin_feedback Packagist
  • High 8.1
    CVE-2026-55810

    Plotly.js Graphing - Critical - PHP object injection - SA-CONTRIB-2026-050

    Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Plotly.js Graphing allows Object Injection. This issue affects Plotly.js Graphing versions: from 0.0.0 to 3.0.2.

    Drupal Plotly.js Graphing drupal/plotly_js Packagist
  • High 8.1
    CVE-2026-55809

    Flag attendance field - Critical - PHP object injection - SA-CONTRIB-2026-049

    Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Flag attendance field allows Object Injection. This issue affects Flag attendance field versions: from 0.0.0 to 1.2.

    Drupal Flag attendance field drupal/flag_attendance_field Packagist
  • Critical 9.8
    CVE-2026-12535

    Formatter Field - Critical - PHP object injection - SA-CONTRIB-2026-048

    Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Formatter Field allows Object Injection. This issue affects Formatter Field versions: from 0.0.0 to 2.0.0.

    Drupal Formatter Field drupal/formatter_field Packagist
  • Low 3.3
    CVE-2026-11909

    Examples for Developers - Moderately critical - Access bypass - SA-CONTRIB-2026-044

    Missing Authorization vulnerability in Drupal Examples for Developers allows Forceful Browsing. This issue affects Examples for Developers versions: from 0.0.0 to 4.0.6.

    Drupal Examples for Developers drupal/examples Packagist
  • Medium 5.4
    CVE-2026-11908

    Tagify - Moderately critical - Cross-site scripting (XSS) - SA-CONTRIB-2026-043

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Tagify allows Stored XSS. This issue affects Tagify versions: from 0.0.0 to 1.2.52.

    Drupal Tagify drupal/tagify Packagist
  • Medium 6.1
    CVE-2026-10770

    Anti-Spam by CleanTalk - Moderately critical - Cross site scripting - SA-CONTRIB-2026-042

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Anti-Spam by CleanTalk allows Reflected XSS. This issue affects Anti-Spam by CleanTalk versions: from 0.0.0 to 9.7.1.

    Drupal Anti-Spam by CleanTalk drupal/cleantalk Packagist
  • Medium 5.4
    CVE-2026-10769

    Commerce Core - Moderately critical - Cross site scripting - SA-CONTRIB-2026-041

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Commerce Core allows Stored XSS. This issue affects Commerce Core versions: from 3.3.0 to 3.3.6.

    Drupal Commerce Core drupal/commerce Packagist
  • Critical 9.8
    CVE-2026-10768 Scanner template

    LocalGov Workflows - Moderately critical - Information disclosure - SA-CONTRIB-2026-039

    Missing Authorization vulnerability in Drupal LocalGov Workflows allows Forceful Browsing. This issue affects LocalGov Workflows versions: from 0.0.0 to 1.6.0.

    Drupal LocalGov Workflows drupal/localgov_workflows Packagist
  • Critical 9.8
    CVE-2026-9726

    Drupal AlternativeCommerce (Basket) - Highly critical - Arbitrary PHP code execution - SA-CONTRIB-2026-038

    Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal AlternativeCommerce (Basket) allows Object Injection. This issue affects Drupal AlternativeCommerce (Basket) versions: from 0.0.0 to 2.1.17.

    Drupal Drupal AlternativeCommerce (Basket) drupal/basket Web / CMS Packagist
  • Medium 5.1
    CVE-2026-6816

    TFA Basic Plugins - Access Bypass

    An access bypass vulnerability in Drupal TFA Basic Plugins allows users with the administer users permission to view or generate recovery codes for other users. This issue affects TFA Basic Plugins: from 7.x-1.0 through 7.x-1.2.

    Drupal TFA Basic Plugins
  • High 7.4
    CVE-2026-5343

    SAML SSO - Service Provider - Critical - Authentication bypass - SA-CONTRIB-2026-031

    Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal SAML SSO - Service Provider allows Privilege Escalation. This issue affects SAML SSO - Service Provider: from 0.0.0 before 3.1.4.

    Drupal SAML SSO - Service Provider drupal/miniorange_saml Packagist
  • Medium 5.1
    CVE-2026-4093

    Stored XSS in Drupal 7 Term Reference Tree module (token display templates and term labels)

    In the Drupal 7 Term Reference Tree module, two stored XSS vectors exist in the widget/formatter rendering pipeline. Vector A (token display templates): When the Token module is enabled and token display templates are configured, attacker-controlled token out…

    Drupal Term Reference Tree
  • Medium 5.1
    CVE-2026-4929

    Simple Hierarchical Select (Drupal 7) XSS in term-derived output

    Simple Hierarchical Select (SHS) for Drupal 7 contains cross-site scripting risk due to improper output escaping of term-derived text. Confirmed affected paths include field formatter output (shs_field_formatter_view) and term-tree child-term data generation …

    Drupal Simple Hierarchical Select (shs)
  • Critical 9.8
    CVE-2026-9082 Exploited Public exploit Scanner template EPSS 89%

    Drupal core - Highly critical - SQL injection - SA-CORE-2026-004

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Drupal core allows SQL Injection. This issue affects Drupal core: from 8.9.0 before 10.4.10, from 10.5.0 before 10.5.10, from 10.6.0 before 10.6.9, fr…

    Drupal Drupal core drupal/core Web / CMS Packagist
    KEV May 22, 2026
  • Critical 9.8
    CVE-2026-8495

    Date iCal - Critical - Information disclosure - SA-CONTRIB-2026-037

    Missing Authorization vulnerability in Drupal Date iCal allows Forceful Browsing. This issue affects Date iCal: from 0.0.0 before 4.0.15.

    Drupal Date iCal drupal/date_ical Packagist
  • Medium 5.4
    CVE-2026-8493

    Colorbox Inline - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-036

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Colorbox Inline allows Cross-Site Scripting (XSS). This issue affects Colorbox Inline: from 0.0.0 before 2.1.1.

    Drupal Colorbox Inline drupal/colorbox_inline Packagist
  • Low 2.7
    CVE-2026-8492

    Translate Drupal with GTranslate - Less critical - DOM clobbering / link manipulation - SA-CONTRIB-2026-035

    Modification of Assumed-Immutable Data (MAID) vulnerability in Drupal Translate Drupal with GTranslate allows Resource Location Spoofing. This issue affects Translate Drupal with GTranslate: from 0.0.0 before 3.0.5.

    Drupal Translate Drupal with GTranslate drupal/gtranslate Web / CMS Packagist
  • Low 3.7
    CVE-2026-8491

    Node View Permissions - Moderately critical - Access bypass - SA-CONTRIB-2026-034

    Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal Node View Permissions allows Forceful Browsing. This issue affects Node View Permissions: from 0.0.0 before 1.7.0, from 2.0.0 before 2.0.1.

    Drupal Node View Permissions drupal/node_view_permissions Packagist
  • Medium 6.1
    CVE-2026-6871

    Obfuscate - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-033

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Obfuscate allows Cross-Site Scripting (XSS). This issue affects Obfuscate: from 0.0.0 before 2.0.2.

    Drupal Obfuscate drupal/obfuscate Packagist
  • Medium 6.1
    CVE-2026-6367

    Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-003

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Drupal core: from 11.3.0 before 11.3.7.

    Drupal Drupal core drupal/core Web / CMS Packagist
  • Medium 6.6
    CVE-2026-6366

    Drupal core - Moderately critical - Gadget Chain - SA-CORE-2026-002

    Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection. This issue affects Drupal core: from 8.0.0 before 10.5.9, from 10.6.0 before 10.6.7, from 11.0.0 before 11.2.11, from 1…

    Drupal Drupal core drupal/core Web / CMS Packagist
  • Medium 6.1
    CVE-2026-6365

    Drupal core - Critical - Cross-site scripting - SA-CORE-2026-001

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Drupal core: from 8.0.0 before 10.5.9, from 10.6.0 before 10.6.7, from 11.0.0 before…

    Drupal Drupal core drupal/core Web / CMS Packagist