Skip to content
OpenAdvisories

Vendor

Drupal

585 known vulnerabilities.

Products

Drupal core 60 Webform 20 Core 19 AI (Artificial Intelligence) 18 SAML SSO - Service Provider 13 Open Social 8 Commerce Core 7 Enterprise MFA - TFA for Drupal 6 Monster Menus 4 Two-factor Authentication (TFA) 4 COOKiES Consent Management 4 Drupal Canvas 4 Tagify 3 Facets 3 OpenID Connect / OAuth client 3 Disable Login Page 3 Single Content Sync 3 Authenticator Login 3 Login Disable 3 Commerce Stripe 3 Gammu SMS Daemon 3 Drupal 3 UI Icons 3 One Time Password 3 Cloud 2 Access code 2 CivicTheme Design System 2 Webform REST 2 Node Access Rebuild Progressive 2 AI Agents 2 Data-module 2 Frontend Editing 2 Paragraphs 2 Anti-Spam by CleanTalk 2 POST File 2 Unpublished Node Permissions 2 Field Permissions 2 Block Attributes 2 ECA: Event - Condition - Action 2 Acquia DAM 2
All Critical High Medium Low Exploited only Public exploit

585 results · Feed

  • Medium 6.1
    CVE-2026-6095

    Orejime - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-032

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Orejime allows Cross-Site Scripting (XSS). This issue affects Orejime: from 0.0.0 before 2.0.16.

    Drupal Orejime drupal/orejime Packagist
  • Medium 5.3
    CVE-2026-0748

    Access bypass in Drupal 7 i18n_node translation UI

    In the Drupal 7 Internationalization (i18n) module, the i18n_node submodule allows a user with both "Translate content" and "Administer content translations" permissions to view and attach unpublished nodes via the translation UI and its autocomplete widget. …

    Drupal Internationalization (i18n) - i18n_node submodule
  • Medium 6.9
    CVE-2026-1556

    Information disclosure via file URI overwrite in File (Field) Paths

    Information disclosure in the file URI processing of File (Field) Paths in Drupal File (Field) Paths 7.x prior to 7.1.3 on Drupal 7.x allows authenticated users to disclose other users’ private files via filename‑collision uploads. This can cause hook_node_in…

    Drupal Drupal File (Field) Paths drupal7 Web / CMS Ubuntu
  • Medium 4.3
    CVE-2026-4393

    Automated Logout - Moderately critical - Cross-site request forgery - SA-CONTRIB-2026-030

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal Automated Logout allows Cross Site Request Forgery.This issue affects Automated Logout: from 0.0.0 before 1.7.0, from 2.0.0 before 2.0.2.

    Drupal Automated Logout drupal/autologout Packagist
  • High 7.5
    CVE-2026-4933

    Unpublished Node Permissions - Critical - Access bypass - SA-CONTRIB-2026-029

    Incorrect Authorization vulnerability in Drupal Unpublished Node Permissions allows Forceful Browsing.This issue affects Unpublished Node Permissions: from 0.0.0 before 1.7.0.

    Drupal Unpublished Node Permissions drupal/unpublished_node_permissions Packagist
  • High 7.5
    CVE-2026-3573

    AI (Artificial Intelligence) - Moderately critical - Information Disclosure - SA-CONTRIB-2026-028

    Incorrect Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Resource Injection.This issue affects AI (Artificial Intelligence): from 0.0.0 before 1.1.11, from 1.2.0 before 1.2.12.

    Drupal AI (Artificial Intelligence) drupal/ai Packagist
  • Medium 4.2
    CVE-2026-3532

    OpenID Connect / OAuth client - Less critical - Access bypass - SA-CONTRIB-2026-027

    Improper Handling of Case Sensitivity vulnerability in Drupal OpenID Connect / OAuth client allows Privilege Escalation.This issue affects OpenID Connect / OAuth client: from 0.0.0 before 1.5.0.

    Drupal OpenID Connect / OAuth client drupal/openid_connect Packagist
  • Medium 6.5
    CVE-2026-3531

    OpenID Connect / OAuth client - Moderately critical - Access bypass - SA-CONTRIB-2026-026

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal OpenID Connect / OAuth client allows Authentication Bypass.This issue affects OpenID Connect / OAuth client: from 0.0.0 before 1.5.0.

    Drupal OpenID Connect / OAuth client drupal/openid_connect Packagist
  • Medium 4.3
    CVE-2026-3530

    OpenID Connect / OAuth client - Moderately critical - Server-side request forgery, Information disclosure - SA-CONTRIB-2026-025

    Server-Side Request Forgery (SSRF) vulnerability in Drupal OpenID Connect / OAuth client allows Server Side Request Forgery.This issue affects OpenID Connect / OAuth client: from 0.0.0 before 1.5.0.

    Drupal OpenID Connect / OAuth client drupal/openid_connect Packagist
  • Medium 6.1
    CVE-2026-3529

    Google Analytics GA4 - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-024

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Google Analytics GA4 allows Cross-Site Scripting (XSS).This issue affects Google Analytics GA4: from 0.0.0 before 1.1.14.

    Drupal Google Analytics GA4 drupal/ga4_google_analytics Packagist
  • Medium 6.1
    CVE-2026-3528

    Calculation Fields - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-023

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Calculation Fields allows Cross-Site Scripting (XSS).This issue affects Calculation Fields: from 0.0.0 before 1.0.4.

    Drupal Calculation Fields drupal/calculation_fields Packagist
  • Medium 6.5
    CVE-2026-3527

    AJAX Dashboard - Critical - Access bypass - SA-CONTRIB-2026-022

    Missing Authentication for Critical Function vulnerability in Drupal AJAX Dashboard allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AJAX Dashboard: from 0.0.0 before 3.1.0.

    Drupal AJAX Dashboard drupal/ajax_dashboard Packagist
  • Medium 5.3
    CVE-2026-3526

    File Access Fix (deprecated) - Moderately critical - Access bypass - SA-CONTRIB-2026-021

    Incorrect Authorization vulnerability in Drupal File Access Fix (deprecated) allows Forceful Browsing.This issue affects File Access Fix (deprecated): from 0.0.0 before 1.2.0.

    Drupal File Access Fix (deprecated) drupal/file_access_fix Packagist
  • Medium 5.3
    CVE-2026-3525

    File Access Fix (deprecated) - Moderately critical - Access bypass - SA-CONTRIB-2026-020

    Incorrect Authorization vulnerability in Drupal File Access Fix (deprecated) allows Forceful Browsing.This issue affects File Access Fix (deprecated): from 0.0.0 before 1.2.0.

    Drupal File Access Fix (deprecated) drupal/file_access_fix Packagist
  • Medium 4.8
    CVE-2026-3218

    Responsive Favicons - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-019

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Responsive Favicons allows Cross-Site Scripting (XSS).This issue affects Responsive Favicons: from 0.0.0 before 2.0.2.

    Drupal Responsive Favicons drupal/responsive_favicons Packagist
  • Medium 6.1
    CVE-2026-3217

    SAML SSO - Service Provider - Critical - Cross-site scripting - SA-CONTRIB-2026-018

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal SAML SSO - Service Provider allows Cross-Site Scripting (XSS).This issue affects SAML SSO - Service Provider: from 0.0.0 before 3.1.3.

    Drupal SAML SSO - Service Provider drupal/miniorange_saml Packagist
  • Medium 5.0
    CVE-2026-3216

    Drupal Canvas - Moderately critical - Server-side request forgery, Information disclosure - SA-CONTRIB-2026-017

    Server-Side Request Forgery (SSRF) vulnerability in Drupal Drupal Canvas allows Server Side Request Forgery.This issue affects Drupal Canvas: from 0.0.0 before 1.1.1.

    Drupal Drupal Canvas drupal/canvas Web / CMS Packagist
  • Medium 5.4
    CVE-2026-3215

    Islandora - Moderately critical - Arbitrary file upload, Cross-site scripting - SA-CONTRIB-2026-016

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Islandora allows Cross-Site Scripting (XSS).This issue affects Islandora: from 0.0.0 before 2.17.5.

    Drupal Islandora drupal/islandora Packagist
  • Medium 6.5
    CVE-2026-3214

    CAPTCHA - Moderately critical - Access bypass - SA-CONTRIB-2026-015

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal CAPTCHA allows Functionality Bypass.This issue affects CAPTCHA: from 0.0.0 before 1.17.0, from 2.0.0 before 2.0.10.

    Drupal CAPTCHA drupal/captcha Packagist
  • Medium 4.7
    CVE-2026-3213

    Anti-Spam by CleanTalk - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-014

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Anti-Spam by CleanTalk allows Cross-Site Scripting (XSS).This issue affects Anti-Spam by CleanTalk: from 0.0.0 before 9.7.0.

    Drupal Anti-Spam by CleanTalk drupal/cleantalk Packagist
  • Medium 5.4
    CVE-2026-3212

    Tagify - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-013

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Tagify allows Cross-Site Scripting (XSS).This issue affects Tagify: from 0.0.0 before 1.2.49.

    Drupal Tagify drupal/tagify Packagist
  • Medium 4.3
    CVE-2026-3211

    Theme Negotiation by Rules - Moderately critical - Cross-site request forgery - SA-CONTRIB-2026-012

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal Theme Negotiation by Rules allows Cross Site Request Forgery.This issue affects Theme Negotiation by Rules: from 0.0.0 before 1.2.1.

    Drupal Theme Negotiation by Rules drupal/theme_rule Packagist
  • Medium 5.3
    CVE-2026-3210

    Material Icons - Moderately critical - Access bypass - SA-CONTRIB-2026-011

    Incorrect Authorization vulnerability in Drupal Material Icons allows Forceful Browsing.This issue affects Material Icons: from 0.0.0 before 2.0.4.

    Drupal Material Icons drupal/material_icons Packagist
  • Medium 6.1
    CVE-2026-2349

    UI Icons - Critical - Cross-site Scripting - SA-CONTRIB-2026-010

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal UI Icons allows Cross-Site Scripting (XSS).This issue affects UI Icons: from 0.0.0 before 1.0.1, from 1.1.0 before 1.1.1.

    Drupal UI Icons drupal/ui_icons Packagist
  • Medium 5.4
    CVE-2026-2348

    Quick Edit - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-009

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Quick Edit allows Cross-Site Scripting (XSS).This issue affects Quick Edit: from 0.0.0 before 1.0.5, from 2.0.0 before 2.0.1.

    Drupal Quick Edit drupal/quickedit Packagist
  • Medium 4.3
    CVE-2026-1917

    Login Disable - Less critical - Access bypass - SA-CONTRIB-2026-008

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Login Disable allows Functionality Bypass.This issue affects Login Disable: from 0.0.0 before 2.1.3.

    Drupal Login Disable drupal/login_disable Packagist
  • Medium 4.2
    CVE-2026-1554

    Central Authentication System (CAS) Server - Less critical - XML Element Injection - SA-CONTRIB-2026-007

    XML Injection (aka Blind XPath Injection) vulnerability in Drupal Central Authentication System (CAS) Server allows Privilege Escalation.This issue affects Central Authentication System (CAS) Server: from 0.0.0 before 2.0.3, from 2.1.0 before 2.1.2.

    Drupal Central Authentication System (CAS) Server drupal/cas_server Packagist
  • Medium 4.8
    CVE-2026-1553

    Drupal Canvas - Moderately critical - Access bypass - SA-CONTRIB-2026-006

    Incorrect Authorization vulnerability in Drupal Drupal Canvas allows Forceful Browsing.This issue affects Drupal Canvas: from 0.0.0 before 1.0.4.

    Drupal Drupal Canvas drupal/canvas Web / CMS Packagist
  • Medium 6.5
    CVE-2026-0948

    Microsoft Entra ID SSO Login - Critical - Access bypass - SA-CONTRIB-2026-005

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Microsoft Entra ID SSO Login allows Privilege Escalation.This issue affects Microsoft Entra ID SSO Login: from 0.0.0 before 1.0.4.

    Drupal Microsoft Entra ID SSO Login drupal/social_auth_entra_id Packagist
  • Medium 4.8
    CVE-2026-0947

    AT Internet Piano Analytics - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-004

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AT Internet Piano Analytics allows Cross-Site Scripting (XSS).This issue affects AT Internet Piano Analytics: from 0.0.0 before 1.0.1, from 2.0.0 befo…

    Drupal AT Internet Piano Analytics drupal/pianoanalytics Packagist
  • Medium 6.1
    CVE-2026-0946

    AT Internet SmartTag - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-003

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AT Internet SmartTag allows Cross-Site Scripting (XSS).This issue affects AT Internet SmartTag: from 0.0.0 before 1.0.1.

    Drupal AT Internet SmartTag drupal/atsmarttag Packagist
  • Medium 5.4
    CVE-2026-0945

    Role Delegation - Moderately critical - Access bypass - SA-CONTRIB-2026-002

    Privilege Defined With Unsafe Actions vulnerability in Drupal Role Delegation allows Privilege Escalation.This issue affects Role Delegation: from 1.3.0 before 1.5.0.

    Drupal Role Delegation drupal/role_delegation Packagist
  • Medium 5.3
    CVE-2026-0944

    Group invite - Moderately critical - Access bypass - SA-CONTRIB-2026-001

    Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal Group invite allows Forceful Browsing.This issue affects Group invite: from 0.0.0 before 2.3.9, from 3.0.0 before 3.0.4, from 4.0.0 before 4.0.4.

    Drupal Group invite drupal/ginvite Packagist
  • High 7.5
    CVE-2025-14840

    HTTP Client Manager - Less critical - Information disclosure - SA-CONTRIB-2025-126

    Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal HTTP Client Manager allows Forceful Browsing.This issue affects HTTP Client Manager: from 0.0.0 before 9.3.13, from 10.0.0 before 10.0.2, from 11.0.0 before 11.0.1.

    Drupal HTTP Client Manager drupal/http_client_manager Packagist
  • High 8.1
    CVE-2025-14472

    Acquia Content Hub - Moderately critical - Cross-Site Request Forgery - SA-CONTRIB-2025-125

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal Acquia Content Hub allows Cross Site Request Forgery.This issue affects Acquia Content Hub: from 0.0.0 before 3.6.4, from 3.7.0 before 3.7.3.

    Drupal Acquia Content Hub drupal/acquia_contenthub Packagist
  • Medium 4.2
    CVE-2025-13986

    Disable Login Page - Critical - Access bypass - SA-CONTRIB-2025-124

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Disable Login Page allows Functionality Bypass.This issue affects Disable Login Page: from 0.0.0 before 1.1.3.

    Drupal Disable Login Page drupal/disable_login Packagist
  • Medium 5.3
    CVE-2025-13985

    Entity Share - Moderately critical - Access bypass, Information Disclosure - SA-CONTRIB-2025-123

    Incorrect Authorization vulnerability in Drupal Entity Share allows Forceful Browsing.This issue affects Entity Share: from 0.0.0 before 3.13.0.

    Drupal Entity Share drupal/entity_share Packagist
  • Medium 6.1
    CVE-2025-13984

    Next.js - Critical - Access bypass - SA-CONTRIB-2025-122

    Permissive Cross-domain Security Policy with Untrusted Domains vulnerability in Drupal Next.Js allows Cross-Site Scripting (XSS).This issue affects Next.Js: from 0.0.0 before 1.6.4, from 2.0.0 before 2.0.1.

    Drupal Next.js drupal/next Packagist
  • Medium 5.4
    CVE-2025-13983

    Tagify - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-121

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Tagify allows Cross-Site Scripting (XSS).This issue affects Tagify: from 0.0.0 before 1.2.44.

    Drupal Tagify drupal/tagify Packagist
  • High 8.1
    CVE-2025-13982

    Login Time Restriction - Moderately critical - Cross-Site Request Forgery - SA-CONTRIB-2025-120

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal Login Time Restriction allows Cross Site Request Forgery.This issue affects Login Time Restriction: from 0.0.0 before 1.0.3.

    Drupal Login Time Restriction drupal/login_time_restriction Packagist