Drupal - vulnerabilities (CVEs)

837 CVEs in 434 products, 72 in the last 30 days, newest from 2026-10-22.

Products

Drupal - 279 CVEs
Drupal Core - 49 CVEs
Webform - 20 CVEs
Core - 19 CVEs
Saml Sso - Service Provider - 13 CVEs
Ai Artificial Intelligence - 10 CVEs
Open Social - 8 CVEs
Enterprise Mfa - Tfa For Drupal - 6 CVEs
Project Issue Tracking Module - 6 CVEs
Print - 5 CVEs
Aggregation Module - 4 CVEs
Cookies Consent Management - 4 CVEs
Drupal Canvas - 4 CVEs
Everyblog - 4 CVEs
Project - 4 CVEs
Two-factor Authentication Tfa - 4 CVEs
Ubercart Module - 4 CVEs
Authenticator Login - 3 CVEs
Content Construction Kit - 3 CVEs
Disable Login Page - 3 CVEs
Drupal Project Issue Tracking - 3 CVEs
Facets - 3 CVEs
Gammu Sms Daemon - 3 CVEs
Login Disable - 3 CVEs
Monster Menus - 3 CVEs
One Time Password - 3 CVEs
Openid Connect Oauth Client - 3 CVEs
Shindig-integrator - 3 CVEs
Tagify - 3 CVEs
Access Code - 2 CVEs
Acquia Dam - 2 CVEs
Activity - 2 CVEs
Advanced Content Feedback Aka Admin Feedback - 2 CVEs
Ai Agents - 2 CVEs
Ajax Checklist - 2 CVEs
Anti-spam By Cleantalk - 2 CVEs
Bibliography Module - 2 CVEs
Brilliant Gallery - 2 CVEs
Central Authentication System Cas Server - 2 CVEs
Chatroom Module - 2 CVEs
Civictheme Design System - 2 CVEs
Cloud - 2 CVEs
Colorbox - 2 CVEs
Custom Search Module - 2 CVEs
Data - 2 CVEs
Data-module - 2 CVEs
Database Administration Module - 2 CVEs
Diff - 2 CVEs
Drupal Easylinks Module - 2 CVEs
Eca Event - Condition - Action - 2 CVEs
Email Tfa - 2 CVEs
Email Verification Sms Verification Otp Verification - 2 CVEs
File Access Fix Deprecated - 2 CVEs
File Entity Fieldable Files - 2 CVEs
Flowdrop - 2 CVEs
Google Tag - 2 CVEs
Help Tip Module - 2 CVEs
Imce Module - 2 CVEs
Islandora - 2 CVEs
Klaro Cookie Consent Management - 2 CVEs
Localization Client - 2 CVEs
Logintoboggan Module - 2 CVEs
Node Access Rebuild Progressive - 2 CVEs
Obfuscate - 2 CVEs
Paragraphs - 2 CVEs
Paragraphs Table - 2 CVEs
Photoswipe - Responsive Javascript Modal Image Gallery - 2 CVEs
Post File - 2 CVEs
Quick Node Block - 2 CVEs
Screenshot - 2 CVEs
Secure Site Module - 2 CVEs
Simple Klaro - 2 CVEs
Talk - 2 CVEs
Taxonomy Autotagger Module - 2 CVEs
Trailscout Module - 2 CVEs
Unpublished Node Permissions - 2 CVEs
User Karma Module - 2 CVEs
Views - 2 CVEs
Webform Rest - 2 CVEs
3rd Party Module - Search Autocomplete - 1 CVEs
Acidfree - 1 CVEs
Acquia Content Hub - 1 CVEs
Address Suggestion - 1 CVEs
Admin Audit Trail - 1 CVEs
Advanced Pwa Inc Push Notifications - 1 CVEs
Advanced Search - 1 CVEs
Advanced Varnish - 1 CVEs
Ai Ckeditor - 1 CVEs
Ai Seo Link Advisor - 1 CVEs
Ai Seogeo Analyzer - 1 CVEs
Ai Translate - 1 CVEs
Ajax Dashboard - 1 CVEs
Allow All File Extensions For File Fields - 1 CVEs
Amazee.ai Private Ai Provider - 1 CVEs
Api Key Manager - 1 CVEs
Archive Module - 1 CVEs
Asin Field Module - 1 CVEs
At Internet Piano Analytics - 1 CVEs
At Internet Smarttag - 1 CVEs
Atom Module - 1 CVEs
Audio Module - 1 CVEs
Authenticated User Page Caching - 1 CVEs
Automated Logout - 1 CVEs
Avatar Uploader - 1 CVEs
Baguettebox.js - 1 CVEs
Basic Http Authentication - 1 CVEs
Blazy - 1 CVEs
Block Attributes - 1 CVEs
Block Class - 1 CVEs
Block Permissions - 1 CVEs
Bluemasters - 1 CVEs
Bookable Calendar - 1 CVEs
Bootstrap Site Alert - 1 CVEs
Browser Back Button - 1 CVEs
Brute Force Attack Protection - 1 CVEs
Bueditor - 1 CVEs
Cache Utility - 1 CVEs
Calculate Working Days - 1 CVEs
Calculation Fields - 1 CVEs
Captcha - 1 CVEs
Captcha Protected Page - 1 CVEs
Cck Comment Reference - 1 CVEs
Ckeditor5 Youtube - 1 CVEs
Ckeditor 4 Lts - Wysiwyg Html Editor - 1 CVEs
Ckeditor 5 Premium Features - 1 CVEs
Clean Restful - 1 CVEs
Coffee - 1 CVEs
Colorbox Inline - 1 CVEs
Combined Image Style - 1 CVEs
Comment Mail - 1 CVEs
Comment Upload Module - 1 CVEs
Commerce Alphabank Redirect - 1 CVEs
Commerce Core - 1 CVEs
Commerce Cybersource - 1 CVEs
Commerce Decoupled Checkout - 1 CVEs
Commerce Elavon - 1 CVEs
Commerce Eurobank Redirect - 1 CVEs
Commerce Guest Registration - 1 CVEs
Commerce Paypal - 1 CVEs
Commerce Realex Global Payments - 1 CVEs
Commerce View Receipt - 1 CVEs
Commons - 1 CVEs
Component Blocks - 1 CVEs
Composer - 1 CVEs
Config Pages - 1 CVEs
Config Pages Viewer - 1 CVEs
Configuration Split - 1 CVEs
Content Entity Clone - 1 CVEs
Content Moderation Notifications - 1 CVEs
Context Form Alteration Module - 1 CVEs
Cookiebot Gtm - 1 CVEs
Cookiecuttr - 1 CVEs
Cookies Addons - 1 CVEs
Csp Log - 1 CVEs
Css Usage Analyzer - 1 CVEs
Currency - 1 CVEs
Cvs Management And Tracker - 1 CVEs
Data Field - 1 CVEs
Date Ical - 1 CVEs
Devel Module - 1 CVEs
Development Environment - 1 CVEs
Diba Carousel Slider - 1 CVEs
Digital Signage Framework - 1 CVEs
Doubleclick For Publishers - 1 CVEs
Download All Files - 1 CVEs
Drupal6 - 1 CVEs
Drupal 8 Google Optimize Hide Page - 1 CVEs
Drupal Admin Lte Theme - 1 CVEs
Drupal Alternativecommerce Basket - 1 CVEs
Drupal Commerce Paybox - 1 CVEs
Drupal Docker Images - 1 CVEs
Drupal E-commerce Module - 1 CVEs
Drupal File Field Paths - 1 CVEs
Drupal Mysite - 1 CVEs
Drupal Pathauto Module - 1 CVEs
Drupal Project - 1 CVEs
Drupal Pubcookie Module - 1 CVEs
Drupal Rest Json Api Authentication - 1 CVEs
Drupal Symfony Mailer Lite - 1 CVEs
Drupal Userreview Module - 1 CVEs
Dxpr Builder The Best Editing Ai Experience For Drupal - 1 CVEs
E-commerce Module - 1 CVEs
E-publish - 1 CVEs
Eca\ - 1 CVEs
Edit In-place Field - 1 CVEs
Editoria11y Accessibility Checker - 1 CVEs
Eloqua - 1 CVEs
Email Contact - 1 CVEs
Email Login Otp - 1 CVEs
Entity Api - 1 CVEs
Entity Browser - 1 CVEs
Entity Delete Log - 1 CVEs
Entity Embed - 1 CVEs
Entity Form Steps - 1 CVEs
Entity Pdf - 1 CVEs
Entity Share - 1 CVEs
Entity Share Websub - 1 CVEs
Etracker - 1 CVEs
Eu Cookie Compliance Gdpr Compliance - 1 CVEs
Events Log Track - 1 CVEs
Examples For Developers - 1 CVEs
Extended Tracker - 1 CVEs
External Authentication - 1 CVEs
Facebook Pixel - 1 CVEs
Faq - 1 CVEs
Feature Module - 1 CVEs
Feed Block - 1 CVEs
Feedapi Mapper - 1 CVEs
File Download - 1 CVEs
Fileshare Module - 1 CVEs
Flag - 1 CVEs
Flag Attendance Field - 1 CVEs
Flattern Multipurpose Bootstrap Business Profile - 1 CVEs
Form Mail Module - 1 CVEs
Formatter Field - 1 CVEs
Formatter Suite - 1 CVEs
Forward Module - 1 CVEs
Freelinking - 1 CVEs
Fullname Field For Cck - 1 CVEs
General Data Protection Regulation - 1 CVEs
Geolocation Field - 1 CVEs
Getid3 - 1 CVEs
Git Utilities For Drupal - 1 CVEs
Glightbox - 1 CVEs
Google Analytics Ga4 - 1 CVEs
Google Maps Store Locator - 1 CVEs
Google Optimize - 1 CVEs
Googletag Manager - 1 CVEs
Group Invite - 1 CVEs
Gutenberg - 1 CVEs
Header Image - 1 CVEs
Http Client Manager - 1 CVEs
Iframe Remove Filter - 1 CVEs
Ignition Error Pages - 1 CVEs
Image Sizes - 1 CVEs
Internationalization - 1 CVEs
Internationalization I18n - I18n Node Submodule - 1 CVEs
Internationalization Single Sign-on - 1 CVEs
Invite Module - 1 CVEs
Job Search - 1 CVEs
Jquery Ui Checkboxradio - 1 CVEs
Json Field - 1 CVEs
Jsonapi Role Access - 1 CVEs
Key Auth - 1 CVEs
Layout Builder Advanced Permissions - 1 CVEs
Ldap Active Directory Integration - 1 CVEs
Lightgallery - 1 CVEs
Link - 1 CVEs
Link Content Parser - 1 CVEs
Link Field Display Mode Formatter - 1 CVEs
Link Module - 1 CVEs
Link To Us - 1 CVEs
Localgov Workflows - 1 CVEs
Localization Server - 1 CVEs
Location Selector - 1 CVEs
Login Time Restriction - 1 CVEs
Lunr Exposed Filters - 1 CVEs
Maestro - 1 CVEs
Magic Tabs Module - 1 CVEs
Mail Login - 1 CVEs
Mailer Plus Log - 1 CVEs
Mailhandler - 1 CVEs
Mailjet - 1 CVEs
Mailsave - 1 CVEs
Material Admin - 1 CVEs
Material Icons - 1 CVEs
Matomo Analytics - 1 CVEs
Mayo - 1 CVEs
Media Folders - 1 CVEs
Media Library Importer - 1 CVEs
Mediafield Module - 1 CVEs
Megamenu Framework - 1 CVEs
Mermaid Diagram Field - 1 CVEs
Meta Tags Module - 1 CVEs
Microsoft Entra Id Sso Login - 1 CVEs
Migrate Queue Importer - 1 CVEs
Migrate Tools - 1 CVEs
Mini Site - 1 CVEs
Minify Js - 1 CVEs
Modal Frame - 1 CVEs
Monobank Payment Api - 1 CVEs
Mother May I - 1 CVEs
Mrbs Module - 1 CVEs
News Page - 1 CVEs
Newsflash - 1 CVEs
Next.js - 1 CVEs
Nivo Slider - 1 CVEs
Node Clone - 1 CVEs
Node Export - 1 CVEs
Node Hierarchy Module - 1 CVEs
Node Relativity Module - 1 CVEs
Node View Permissions - 1 CVEs
Nodeaccess Userreference - 1 CVEs
Nodefamily - 1 CVEs
Nodequeue - 1 CVEs
Oauth2 Client - 1 CVEs
Oauth2 Server - 1 CVEs
Oauth Openid Connect Single Sign On Sso Oauthoidc Client - 1 CVEs
Oembed Providers - 1 CVEs
Ohdear Integration - 1 CVEs
Openai Provider - 1 CVEs
Openid - 1 CVEs
Opigno - 1 CVEs
Opigno Group Manager - 1 CVEs
Opigno Learning Path - 1 CVEs
Opigno Module - 1 CVEs
Opigno Tincan Question Type - 1 CVEs
Orejime - 1 CVEs
Organic Groups Menu - 1 CVEs
Organic Groups Module - 1 CVEs
Outline Designer Module - 1 CVEs
Owl Carousel 2 - 1 CVEs
Pages Restriction Access - 1 CVEs
Panelizer Obsolete - 1 CVEs
Panels - 1 CVEs
Pankm - 1 CVEs
Pathauto Module - 1 CVEs
Patreon - 1 CVEs
Paypal Node Module - 1 CVEs
Persistent Login - 1 CVEs
Petition Node Module - 1 CVEs
Piwik Pro - 1 CVEs
Plausible Tracking - 1 CVEs
Plotly.js Graphing - 1 CVEs
Plus1 - 1 CVEs
Powerful Surveys - 1 CVEs
Print Anything - 1 CVEs
Print Module - 1 CVEs
Private Content - 1 CVEs
Professional Theme - 1 CVEs
Profile Private - 1 CVEs
Project Browser - 1 CVEs
Project Issue File Review - 1 CVEs
Protected Node Module - 1 CVEs
Protected Pages - 1 CVEs
Quick Edit - 1 CVEs
Quick Tabs - 1 CVEs
Quiz - 1 CVEs
Randomizer - 1 CVEs
Rapidoc Oas Field Formatter - 1 CVEs
Raw Formatter Meta Tag Formatter - 1 CVEs
Ray Enterprise Translation - 1 CVEs
Real-time Seo For Drupal - 1 CVEs
Realname - 1 CVEs
Recipe Module - 1 CVEs
Registration Role - 1 CVEs
Responsive And Off-canvas Menu - 1 CVEs
Responsive Favicons - 1 CVEs
Responsive Menus - 1 CVEs
Rest Json Api Authentication For Drupal - 1 CVEs
Rest Views - 1 CVEs
Restful Web Services - 1 CVEs
Restrict Route By Ip - 1 CVEs
Reverse Proxy Header - 1 CVEs
Role Delegation - 1 CVEs
Safedelete - 1 CVEs
Salesforce Suite - 1 CVEs
Saml Sp 2.0 Single Sign On - 1 CVEs
Search Api Autocomplete - 1 CVEs
Search Api Solr - 1 CVEs
Search Keyword Module - 1 CVEs
Security Kit - 1 CVEs
Semantically Interconnected Online Communities - 1 CVEs
Services Module For Drupal - 1 CVEs
Shoutbox - 1 CVEs
Simple Gtm - 1 CVEs
Simple Hierarchical Select Shs - 1 CVEs
Simple Multi Step Form - 1 CVEs
Simple Oauth Oauth2 Openid Connect - 1 CVEs
Simple Xml Sitemap - 1 CVEs
Simplecorp - 1 CVEs
Single Content Sync - 1 CVEs
Site Profile Directory Module - 1 CVEs
Siteimprove Analytics - 1 CVEs
Skeleton Theme - 1 CVEs
Slick Carousel - 1 CVEs
Smart Content - 1 CVEs
Smart Ip Ban - 1 CVEs
Spamspan Filter - 1 CVEs
Sportsleague - 1 CVEs
Stage File Proxy - 1 CVEs
Stock Module - 1 CVEs
Stop Administrator Login - 1 CVEs
Storage Api - 1 CVEs
Storm - 1 CVEs
Suggested Terms Module - 1 CVEs
Svg Embed - 1 CVEs
Svg Sanitizer - 1 CVEs
Swift Mailer Abandoned - 1 CVEs
Synchronize Composer.json With Contrib Modules - 1 CVEs
Tacjs - 1 CVEs
Tarte Au Citron - 1 CVEs
Tasklist - 1 CVEs
Tawk.to - Live Chat Application - 1 CVEs
Taxonomy Image Module - 1 CVEs
Taxonomy Manager - 1 CVEs
Taxonomy Term Glossary - 1 CVEs
Taxonomy Theme Module - 1 CVEs
Tealium Iq Tag Management - 1 CVEs
Term Reference Tree - 1 CVEs
Textimage - 1 CVEs
Tfa Basic Plugins - 1 CVEs
Theme Negotiation By Rules - 1 CVEs
Tinytax Taxonomy Block Module - 1 CVEs
Toc.js - 1 CVEs
Token Content Access - 1 CVEs
Token Module - 1 CVEs
Tooltip - 1 CVEs
Translate Drupal With Gtranslate - 1 CVEs
Tribune - 1 CVEs
Typogrify - 1 CVEs
Ueditor - - 1 CVEs
Ui Icons - 1 CVEs
Ui Patterns Sdc In Drupal Ui - 1 CVEs
Ultimate Table Field - 1 CVEs
Umami Analytics - 1 CVEs
Upload Module - 1 CVEs
Userpoints Module - 1 CVEs
View Password - 1 CVEs
Views Builk Operations - 1 CVEs
Views Bulk Operations - 1 CVEs
Views Dynamic Field - 1 CVEs
Views Svg Animation - 1 CVEs
Web-t - 1 CVEs
Webform Module - 1 CVEs
Webform Submissions Delete - 1 CVEs
Wiki - 1 CVEs
Wisski - 1 CVEs
Wkhtmltopdf - 1 CVEs
Workflow - 1 CVEs
Zen - 1 CVEs
Artificial Intelligence - 0 CVEs
Restful - 0 CVEs
Web Links - 0 CVEs

Newest CVEs of Drupal

CVE-2026-84910 - CVSS 4.2 (medium), 2026-10-22: Missing Authorization vulnerability in Drupal Advanced Search allows Forceful Browsing. This issue affects Advanced Search versions: from 0.0.0 to 2.4.5.
CVE-2026-84911 - CVSS 3.1 (low), 2026-10-22: Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Stored XSS.…
CVE-2026-84913 - CVSS 4.6 (medium), 2026-10-22: Missing Authorization vulnerability in Drupal AI Translate allows Forceful Browsing. This issue affects AI Translate versions: from 0.0.0 to 1.3.2, from 1.4.0…
CVE-2026-84912 - CVSS 4.6 (medium), 2026-10-22: Missing Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Forceful Browsing. This issue affects AI (Artificial Intelligence) versions:…
CVE-2026-84914 - CVSS 5.3 (medium), 2026-10-22: Missing Authorization vulnerability in Drupal Calculate Working Days allows Forceful Browsing. This issue affects Calculate Working Days versions: from 0.0.0…
CVE-2026-84915 - CVSS 4.6 (medium), 2026-10-22: Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Component blocks allows Stored XSS. This issue…
CVE-2026-84923 - CVSS 6.5 (medium), 2026-10-22: Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Email Verification / SMS Verification / OTP Verification allows…
CVE-2026-84924 - CVSS 5.4 (medium), 2026-10-22: Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Email Verification / SMS Verification / OTP…
CVE-2026-84916 - CVSS 3.7 (low), 2026-10-22: Missing Authorization vulnerability in Drupal Islandora allows Forceful Browsing. This issue affects Islandora versions: from 0.0.0 to 2.19.0.
CVE-2026-84917 - CVSS 6.5 (medium), 2026-10-22: Incorrect Authorization vulnerability in Drupal Jsonapi Role Access allows Forceful Browsing. This issue affects Jsonapi Role Access versions: from 0.0.0 to…
CVE-2026-16648 - CVSS 3.8 (low), 2026-10-22: Insertion of Sensitive Information into Log File vulnerability in Drupal Mailer Plus Log allows Remote Services with Stolen Credentials. This issue affects…
CVE-2026-81163 - CVSS 5.4 (medium), 2026-10-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Drupal Media Library Importer allows Path Traversal. This…
CVE-2026-84918 - CVSS 3.7 (low), 2026-10-22: Improper Verification of Cryptographic Signature vulnerability in Drupal Monobank payment API allows Signature Spoof. This issue affects Monobank payment API…
CVE-2026-84919 - CVSS 4.6 (medium), 2026-10-22: Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal PhotoSwipe - Responsive JavaScript Modal Image…
CVE-2026-84920 - CVSS 5.3 (medium), 2026-10-22: Incorrect Authorization vulnerability in Drupal Unpublished Node Permissions allows Forceful Browsing. This issue affects Unpublished Node Permissions…
CVE-2026-84921 - CVSS 5.3 (medium), 2026-10-22: Missing Authorization vulnerability in Drupal Webform Submissions Delete allows Forceful Browsing. This issue affects Webform Submissions Delete versions:…
CVE-2026-87936 - CVSS 6.5 (medium), 2026-10-22: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal amazee.ai Private AI Provider allows SQL…
CVE-2026-87937 - CVSS 6.5 (medium), 2026-10-22: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal Central Authentication System (CAS) Server allows Fake the Source of Data. This…
CVE-2026-87938, 2026-10-22: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal CSP log allows SQL Injection. This issue affects…
CVE-2026-87939 - CVSS 4.2 (medium), 2026-10-22: Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Feed Block allows Stored XSS. This issue affects…
CVE-2026-87940 - CVSS 5.4 (medium), 2026-10-22: Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Key auth allows Exploiting Incorrectly Configured Access Control Security…
CVE-2026-87941, 2026-10-22: Vulnerability in Drupal Patreon. This issue affects Patreon versions: 7.x.
CVE-2026-87942 - CVSS 4.6 (medium), 2026-10-22: Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal SafeDelete allows Stored XSS. This issue affects…
CVE-2026-87943 - CVSS 6.5 (medium), 2026-10-22: Missing Authorization vulnerability in Drupal SAML SSO - Service Provider allows Forceful Browsing. This issue affects SAML SSO - Service Provider versions:…
CVE-2026-87944 - CVSS 4.8 (medium), 2026-10-22: Improper Certificate Validation vulnerability in Drupal SAML SSO - Service Provider allows Adversary in the Middle (AiTM). This issue affects SAML SSO -…
CVE-2026-87945 - CVSS 5.4 (medium), 2026-10-22: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal SAML SSO - Service Provider allows Fake the Source of Data. This issue affects…
CVE-2026-87946 - CVSS 4.8 (medium), 2026-10-22: Observable Timing Discrepancy vulnerability in Drupal SAML SSO - Service Provider allows Brute Force. This issue affects SAML SSO - Service Provider versions:…
CVE-2026-87947 - CVSS 4.8 (medium), 2026-10-22: Improper Verification of Cryptographic Signature vulnerability in Drupal SAML SSO - Service Provider allows Signature Spoof. This issue affects SAML SSO -…
CVE-2026-87948 - CVSS 3.5 (low), 2026-10-22: Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal SAML SSO - Service Provider allows Cross-Site…
CVE-2026-87949 - CVSS 3.3 (low), 2026-10-22: Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal SAML SSO - Service Provider allows Cross-Site…