Skip to content
OpenAdvisories

Vendor

Drupal

585 known vulnerabilities.

Products

Drupal core 60 Webform 20 Core 19 AI (Artificial Intelligence) 18 SAML SSO - Service Provider 13 Open Social 8 Commerce Core 7 Enterprise MFA - TFA for Drupal 6 Monster Menus 4 Two-factor Authentication (TFA) 4 COOKiES Consent Management 4 Drupal Canvas 4 Tagify 3 Facets 3 OpenID Connect / OAuth client 3 Disable Login Page 3 Single Content Sync 3 Authenticator Login 3 Login Disable 3 Commerce Stripe 3 Gammu SMS Daemon 3 Drupal 3 UI Icons 3 One Time Password 3 Cloud 2 Access code 2 CivicTheme Design System 2 Webform REST 2 Node Access Rebuild Progressive 2 AI Agents 2 Data-module 2 Frontend Editing 2 Paragraphs 2 Anti-Spam by CleanTalk 2 POST File 2 Unpublished Node Permissions 2 Field Permissions 2 Block Attributes 2 ECA: Event - Condition - Action 2 Acquia DAM 2
All Critical High Medium Low Exploited only Public exploit

585 results · Feed

  • Medium 4.4
    CVE-2025-13981

    AI (Artificial Intelligence) - Moderately critical - Cross-Site Scripting - SA-CONTRIB-2025-119

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Cross-Site Scripting (XSS).This issue affects AI (Artificial Intelligence): from 0.0.0 before 1.0.7, from 1.1.0 be…

    Drupal AI (Artificial Intelligence) drupal/ai Packagist
  • Medium 5.3
    CVE-2025-13980

    CKEditor 5 Premium Features - Moderately critical - Access bypass - SA-CONTRIB-2025-118

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal CKEditor 5 Premium Features allows Functionality Bypass.This issue affects CKEditor 5 Premium Features: from 0.0.0 before 1.2.10, from 1.3.0 before 1.3.6, from 1.4.0 before 1.4.3…

    Drupal CKEditor 5 Premium Features drupal/ckeditor5_premium_features Packagist
  • Medium 5.4
    CVE-2025-13979

    Mini site - Moderately critical - Cross-Site Scripting - SA-CONTRIB-2025-117

    Privilege Defined With Unsafe Actions vulnerability in Drupal Mini site allows Stored XSS.This issue affects Mini site: from 0.0.0 before 3.0.2.

    Drupal Mini site drupal/minisite Packagist
  • Medium 4.8
    CVE-2026-0749

    Cross-Site Scripting Vulnerability in Drupal Form Builder Module

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Form Builder allows Cross-Site Scripting (XSS).This issue affects Drupal: from 7.X-1.0 through 7.X-1.22.

    Drupal Drupal Web / CMS
  • High 8.7
    CVE-2026-0750

    Payment bypass in Commerce Paybox

    Improper Verification of Cryptographic Signature vulnerability in Drupal Drupal Commerce Paybox Commerce Paybox on Drupal 7.X allows Authentication Bypass.This issue affects Drupal Commerce Paybox: from 7-x-1.0 through 7.X-1.5.

    Drupal Drupal Commerce Paybox Web / CMS
  • Medium 4.8
    CVE-2025-14557

    XSS in Drupal 7 Facebook Pixel Module

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Drupal Facebook Pixel facebook_pixel allows Stored XSS.This issue affects Facebook Pixel: from 7.X-1.0 through 7.X-1.1.

    Drupal Facebook Pixel
  • Medium 4.8
    CVE-2025-14556

    XSS in Drupal 7 Flag Module

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Drupal Flag allows Cross-Site Scripting (XSS).This issue affects Flag: from 7.X-3.0 through 7.X-3.9.

    Drupal Flag
  • High 7.0
    CVE-2025-12848

    XSS vulnerability when rendering filename in Webform Multiform

    Webform Multiple File Upload module for Drupal 7.x contains a cross-site scripting (XSS) vulnerability in the file name renderer. An unauthenticated attacker can exploit this vulnerability by uploading a file with a malicious filename containing JavaScript co…

    Drupal Drupal Web / CMS
  • Low 3.5
    CVE-2025-12761

    Simple multi step form - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-116

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Simple multi step form allows Cross-Site Scripting (XSS).This issue affects Simple multi step form: from 0.0.0 before 2.0.0.

    Drupal Simple multi step form drupal/simple_multistep Packagist
  • Medium 5.4
    CVE-2025-12760

    Email TFA - Moderately critical - Access bypass - SA-CONTRIB-2025-115

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Email TFA allows Functionality Bypass.This issue affects Email TFA: from 0.0.0 before 2.0.6.

    Drupal Email TFA drupal/email_tfa Packagist
  • Low 3.7
    CVE-2025-13083

    Drupal core - Moderately critical - Information disclosure - SA-CORE-2025-008

    Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Drupal core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Drupal core: from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.…

    Drupal Drupal core drupal/core Web / CMS Packagist
  • Medium 4.3
    CVE-2025-13082

    Drupal core - Moderately critical - Defacement - SA-CORE-2025-007

    User Interface (UI) Misrepresentation of Critical Information vulnerability in Drupal Drupal core allows Content Spoofing.This issue affects Drupal core: from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, from 11.2.0 before 11.2.8.

    Drupal Drupal core drupal/core Web / CMS Packagist
  • Medium 5.9
    CVE-2025-13081

    Drupal core - Moderately critical - Gadget chain - SA-CORE-2025-006

    Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection.This issue affects Drupal core: from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, from 11.…

    Drupal Drupal core drupal/core Web / CMS Packagist
  • Medium 5.3
    CVE-2025-13080

    Drupal core - Moderately critical - Denial of Service - SA-CORE-2025-005

    Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal Drupal core allows Forceful Browsing.This issue affects Drupal core: from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, from 11.2.0 before 11.2.8.

    Drupal Drupal core drupal/core Web / CMS Packagist
  • High 7.5
    CVE-2025-12466

    Simple OAuth (OAuth2) & OpenID Connect - Critical - Access bypass - SA-CONTRIB-2025-114

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Simple OAuth (OAuth2) & OpenID Connect allows Authentication Bypass.This issue affects Simple OAuth (OAuth2) & OpenID Connect: from 6.0.0 before 6.0.7.

    Drupal Simple OAuth (OAuth2) & OpenID Connect drupal/simple_oauth Packagist
  • Medium 6.1
    CVE-2025-12083

    CivicTheme Design System - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-113

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal CivicTheme Design System allows Cross-Site Scripting (XSS).This issue affects CivicTheme Design System: from 0.0.0 before 1.12.0.

    Drupal CivicTheme Design System drupal/civictheme Packagist
  • High 7.5
    CVE-2025-12082

    CivicTheme Design System - Moderately critical - Information disclosure - SA-CONTRIB-2025-112

    Incorrect Authorization vulnerability in Drupal CivicTheme Design System allows Forceful Browsing.This issue affects CivicTheme Design System: from 0.0.0 before 1.12.0.

    Drupal CivicTheme Design System drupal/civictheme Packagist
  • Medium 5.3
    CVE-2025-10929

    Reverse Proxy Header - Less critical - Access bypass - SA-CONTRIB-2025-111

    Improper Validation of Consistency within Input vulnerability in Drupal Reverse Proxy Header allows Manipulating User-Controlled Variables.This issue affects Reverse Proxy Header: from 0.0.0 before 1.1.2.

    Drupal Reverse Proxy Header drupal/reverse_proxy_header Packagist
  • Medium 6.5
    CVE-2025-10930

    Currency - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-110

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal Currency allows Cross Site Request Forgery.This issue affects Currency: from 0.0.0 before 3.5.0.

    Drupal Currency drupal/currency Packagist
  • Low 3.8
    CVE-2025-10931

    Umami Analytics - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-109

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Umami Analytics allows Cross-Site Scripting (XSS).This issue affects Umami Analytics: from 0.0.0 before 1.0.1.

    Drupal Umami Analytics drupal/umami_analytics Packagist
  • Medium 6.3
    CVE-2025-10928

    Access code - Moderately critical - Access bypass - SA-CONTRIB-2025-108

    Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Access code allows Brute Force.This issue affects Access code: from 0.0.0 before 2.0.5.

    Drupal Access code drupal/access_code Packagist
  • Medium 6.1
    CVE-2025-10927

    Plausible tracking - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-107

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Plausible tracking allows Cross-Site Scripting (XSS).This issue affects Plausible tracking: from 0.0.0 before 1.0.2.

    Drupal Plausible tracking drupal/plausible_tracking Packagist
  • Medium 6.1
    CVE-2025-10926

    JSON Field - Critical - Cross Site Scripting - SA-CONTRIB-2025-106

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal JSON Field allows Cross-Site Scripting (XSS).This issue affects JSON Field: from 0.0.0 before 1.5.

    Drupal JSON Field drupal/json_field Packagist
  • High 7.5
    CVE-2025-9954

    Acquia DAM - Moderately critical - Access bypass, Information Disclosure - SA-CONTRIB-2025-105

    Missing Authorization vulnerability in Drupal Acquia DAM allows Forceful Browsing.This issue affects Acquia DAM: from 0.0.0 before 1.1.5.

    Drupal Acquia DAM drupal/acquia_dam Packagist
  • Medium 5.3
    CVE-2025-9554

    Owl Carousel 2 - Critical - Unsupported - SA-CONTRIB-2025-104

    Vulnerability in Drupal Owl Carousel 2.This issue affects Owl Carousel 2: *.*.

    Drupal Owl Carousel 2 drupal/owlcarousel2 Packagist
  • Medium 5.3
    CVE-2025-9553

    API Key manager - Critical - Unsupported - SA-CONTRIB-2025-103

    Vulnerability in Drupal API Key manager.This issue affects API Key manager: *.*.

    Drupal API Key manager drupal/api_key_manager Packagist
  • Medium 5.3
    CVE-2025-9552

    Synchronize composer.json With Contrib Modules - Critical - Unsupported - SA-CONTRIB-2025-102

    Vulnerability in Drupal Synchronize composer.Json With Contrib Modules.This issue affects Synchronize composer.Json With Contrib Modules: *.*.

    Drupal Synchronize composer.json With Contrib Modules drupal/sync_composer_with_contrib Packagist
  • Medium 6.5
    CVE-2025-9551

    Protected Pages - Moderately critical - Access bypass - SA-CONTRIB-2025-101

    Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Protected Pages allows Brute Force.This issue affects Protected Pages: from 0.0.0 before 1.8.0, from 7.X-1.0 before 7.X-2.5.

    Drupal Protected Pages drupal/protected_pages Packagist
  • Medium 6.1
    CVE-2025-9550

    Facets - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-100

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Facets allows Cross-Site Scripting (XSS).This issue affects Facets: from 0.0.0 before 2.0.10, from 3.0.0 before 3.0.1.

    Drupal Facets drupal/facets Packagist
  • Medium 6.5
    CVE-2025-9549

    Facets - Moderately critical - Information Disclosure - SA-CONTRIB-2025-099

    Missing Authorization vulnerability in Drupal Facets allows Forceful Browsing.This issue affects Facets: from 0.0.0 before 2.0.10, from 3.0.0 before 3.0.1.

    Drupal Facets drupal/facets Packagist
  • High 8.8
    CVE-2025-8093

    Authenticator Login - Moderately critical - Access bypass - SA-CONTRIB-2025-098

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Authenticator Login allows Authentication Bypass.This issue affects Authenticator Login: from 0.0.0 before 2.1.8.

    Drupal Authenticator Login drupal/alogin Packagist
  • Medium 4.3
    CVE-2025-8996

    Layout Builder Advanced Permissions - Moderately critical - Access bypass - SA-CONTRIB-2025-097

    Missing Authorization vulnerability in Drupal Layout Builder Advanced Permissions allows Forceful Browsing.This issue affects Layout Builder Advanced Permissions: from 0.0.0 before 2.2.0.

    Drupal Layout Builder Advanced Permissions drupal/layout_builder_perms Packagist
  • Critical 9.8
    CVE-2025-8995

    Authenticator Login - Highly critical - Access bypass - SA-CONTRIB-2025-096

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Authenticator Login allows Authentication Bypass.This issue affects Authenticator Login: from 0.0.0 before 2.1.4.

    Drupal Authenticator Login drupal/alogin Packagist
  • Medium 4.7
    CVE-2025-8675

    AI SEO Link Advisor - Less critical - Server-side Request Forgery - SA-CONTRIB-2025-095

    Server-Side Request Forgery (SSRF) vulnerability in Drupal AI SEO Link Advisor allows Server Side Request Forgery.This issue affects AI SEO Link Advisor: from 0.0.0 before 1.0.6.

    Drupal AI SEO Link Advisor drupal/ai_seo_link_advisor Packagist
  • Medium 4.3
    CVE-2025-8362

    GoogleTag Manager - Moderately critical - Cross-site scripting - SA-CONTRIB-2025-094

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal GoogleTag Manager allows Cross-Site Scripting (XSS).This issue affects GoogleTag Manager: from 0.0.0 before 1.10.0.

    Drupal GoogleTag Manager drupal/gtm Packagist
  • High 7.6
    CVE-2025-8361

    Config Pages - Moderately critical - Access bypass - SA-CONTRIB-2025-093

    Missing Authorization vulnerability in Drupal Config Pages allows Forceful Browsing. This issue affects Config Pages: from 0.0.0 before 2.18.0.

    Drupal Config Pages drupal/config_pages Packagist
  • High 7.6
    CVE-2025-8092

    COOKiES Consent Management - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-092

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal COOKiES Consent Management allows Cross-Site Scripting (XSS).This issue affects COOKiES Consent Management: from 0.0.0 before 1.2.16.

    Drupal COOKiES Consent Management drupal/cookies Packagist
  • High 7.5
    CVE-2025-7717

    File Download - Moderately critical - Access bypass - SA-CONTRIB-2025-089

    Missing Authorization vulnerability in Drupal File Download allows Forceful Browsing.This issue affects File Download: from 0.0.0 before 1.9.0, from 2.0.0 before 2.0.1.

    Drupal File Download drupal/file_download Packagist
  • Medium 6.1
    CVE-2025-7716

    Real-time SEO for Drupal - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-091

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Real-time SEO for Drupal allows Cross-Site Scripting (XSS).This issue affects Real-time SEO for Drupal: from 2.0.0 before 2.2.0.

    Drupal Real-time SEO for Drupal drupal/yoast_seo Web / CMS Packagist
  • Medium 6.1
    CVE-2025-7715

    Block Attributes - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-090

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Block Attributes allows Cross-Site Scripting (XSS).This issue affects Block Attributes: from 0.0.0 before 1.1.0, from 2.0.0 before 2.0.1.

    Drupal Block Attributes drupal/block_attributes Packagist