[ Vendor · 79 CVEs ]
Drupal
CVEs affecting Drupal published in the last 30 days, plus any Drupal CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-96388 | 22 Oct 2026 | CVSS 5.4 | Drupal Tawk.to - Live chat applicationCross-Site Request Forgery (CSRF) vulnerability in Drupal Tawk.to - Live chat application allows Cross Site Request Forgery. This issue affects… | |
| CVE-2026-96390 | 22 Oct 2026 | CVSS 4.3 | Drupal Editoria11y Accessibility CheckerPrivilege Defined With Unsafe Actions vulnerability in Drupal Editoria11y Accessibility Checker allows Privilege Escalation. This issue affects… | |
| CVE-2026-96391 | 22 Oct 2026 | Not scored yet | Drupal Webform RESTMissing Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. This issue affects Webform REST versions: from 0.0.0 to 4.2.1. | |
| CVE-2026-96392 | 22 Oct 2026 | CVSS 3.5 | Drupal AI CKEditorImproper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal AI CKEditor allows Code Injection. This issue affects… | |
| CVE-2026-96398 | 22 Oct 2026 | CVSS 4.3 | Drupal WebformIncorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from… | |
| CVE-2026-96377 | 22 Oct 2026 | CVSS 5.3 | Drupal Combined image styleAllocation of Resources Without Limits or Throttling vulnerability in Drupal Combined image style allows Excessive Allocation. This issue affects… | |
| CVE-2026-96378 | 22 Oct 2026 | CVSS 4.3 | Drupal Commerce Decoupled CheckoutImproperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Commerce Decoupled Checkout allows Object… | |
| CVE-2026-96379 | 22 Oct 2026 | Not scored yet | Drupal CookieCuttrImproper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal CookieCuttr allows Stored XSS. This… | |
| CVE-2026-96380 | 22 Oct 2026 | CVSS 6.5 | Drupal CSS Usage AnalyzerMissing Authorization vulnerability in Drupal CSS Usage Analyzer allows Forceful Browsing. This issue affects CSS Usage Analyzer versions: from 1.0.0… | |
| CVE-2026-96382 | 22 Oct 2026 | CVSS 4.6 | Drupal Diba carousel sliderImproper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Diba carousel slider allows Stored XSS… | |
| CVE-2026-96384 | 22 Oct 2026 | CVSS 3.5 | Drupal Mermaid Diagram FieldIncorrect Authorization vulnerability in Drupal Mermaid Diagram Field allows Forceful Browsing. This issue affects Mermaid Diagram Field versions… | |
| CVE-2026-96385 | 22 Oct 2026 | CVSS 6.5 | Drupal REST & JSON API Authentication for DrupalAuthentication Bypass Using an Alternate Path or Channel vulnerability in Drupal REST & JSON API Authentication for Drupal allows Authentication… | |
| CVE-2026-96386 | 22 Oct 2026 | CVSS 6.5 | Drupal Smart ContentMissing Authorization vulnerability in Drupal Smart Content allows Forceful Browsing. This issue affects Smart Content versions: from 0.0.0 to 3.2.1. | |
| CVE-2026-96387 | 22 Oct 2026 | CVSS 3.8 | Drupal Stop administrator loginAuthentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Stop administrator login allows Authentication Bypass. This issue… | |
| CVE-2026-96368 | 22 Oct 2026 | CVSS 4.6 | Drupal WebformImproper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Stored XSS. This issue… | |
| CVE-2026-96369 | 22 Oct 2026 | CVSS 3.1 | Drupal WebformUse of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Webform allows Exploiting Incorrectly Configured Access Control… | |
| CVE-2026-96370 | 22 Oct 2026 | CVSS 5.4 | Drupal WebformIncorrect Authorization vulnerability in Drupal Webform allows Server Side Request Forgery. This issue affects Webform versions: from 0.0.0 to… | |
| CVE-2026-96371 | 22 Oct 2026 | CVSS 5.4 | Drupal WebformPrivilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12… | |
| CVE-2026-96372 | 22 Oct 2026 | CVSS 5.4 | Drupal WebformInsufficient Granularity of Access Control vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0… | |
| CVE-2026-96373 | 22 Oct 2026 | CVSS 3.3 | Drupal WebformIncorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from… | |
| CVE-2026-96374 | 22 Oct 2026 | CVSS 4.2 | Drupal Project BrowserCross-Site Request Forgery (CSRF) vulnerability in Drupal Project Browser allows Cross Site Request Forgery. This issue affects Project Browser… | |
| CVE-2026-96375 | 22 Oct 2026 | CVSS 4.8 | Drupal CloudImproper Certificate Validation vulnerability in Drupal Cloud allows Adversary in the Middle (AiTM). This issue affects Cloud versions: from 0.0.0 to… | |
| CVE-2026-96376 | 22 Oct 2026 | CVSS 6.4 | Drupal CloudImproper Neutralization of Special Elements used in an OS Command ("OS Command Injection") vulnerability in Drupal Cloud allows OS Command Injection… | |
| CVE-2026-96360 | 22 Oct 2026 | CVSS 3.5 | Drupal WebformImproper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Cross-Site Scripting… | |
| CVE-2026-96361 | 22 Oct 2026 | CVSS 4.6 | Drupal WebformImproper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Cross-Site Scripting… | |
| CVE-2026-96362 | 22 Oct 2026 | CVSS 4.2 | Drupal WebformImproper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Cross-Site Scripting… | |
| CVE-2026-96363 | 22 Oct 2026 | Not scored yet | Drupal WebformPrivilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12… | |
| CVE-2026-96364 | 22 Oct 2026 | CVSS 5.3 | Drupal WebformImproper Control of Interaction Frequency vulnerability in Drupal Webform allows Functionality Misuse. This issue affects Webform versions: from… | |
| CVE-2026-96365 | 22 Oct 2026 | CVSS 7.5 | Drupal WebformAllocation of Resources Without Limits or Throttling vulnerability in Drupal Webform allows Excessive Allocation. This issue affects Webform… | |
| CVE-2026-96366 | 22 Oct 2026 | CVSS 5.3 | Drupal WebformIncorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from… | |
| CVE-2026-96367 | 22 Oct 2026 | CVSS 4.6 | Drupal WebformPrivilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12… | |
| CVE-2026-87953 | 22 Oct 2026 | CVSS 3.3 | Drupal SAML SSO - Service ProviderServer-Side Request Forgery (SSRF) vulnerability in Drupal SAML SSO - Service Provider allows Server Side Request Forgery. This issue affects SAML… | |
| CVE-2026-87954 | 22 Oct 2026 | CVSS 4.3 | Drupal Taxonomy Term GlossaryMissing Authorization vulnerability in Drupal Taxonomy Term Glossary allows Forceful Browsing. This issue affects Taxonomy Term Glossary versions… | |
| CVE-2026-87955 | 22 Oct 2026 | CVSS 4.3 | Drupal Ultimate Table FieldMissing Authorization vulnerability in Drupal Ultimate Table Field allows Forceful Browsing. This issue affects Ultimate Table Field versions: from… | |
| CVE-2026-96355 | 22 Oct 2026 | CVSS 9.1 | Drupal WebformImproper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Webform allows Code Injection. This issue affects… | |
| CVE-2026-96356 | 22 Oct 2026 | CVSS 5.3 | Drupal WebformIncorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from… | |
| CVE-2026-96357 | 22 Oct 2026 | CVSS 4.6 | Drupal WebformImproper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Stored XSS. This issue… | |
| CVE-2026-96358 | 22 Oct 2026 | CVSS 4.6 | Drupal WebformImproper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Cross-Site Scripting… | |
| CVE-2026-96359 | 22 Oct 2026 | CVSS 4.6 | Drupal WebformImproper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Cross-Site Scripting… | |
| CVE-2026-87945 | 22 Oct 2026 | CVSS 5.4 | Drupal SAML SSO - Service ProviderURL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal SAML SSO - Service Provider allows Fake the Source of Data. This issue… | |
| CVE-2026-87946 | 22 Oct 2026 | CVSS 4.8 | Drupal SAML SSO - Service ProviderObservable Timing Discrepancy vulnerability in Drupal SAML SSO - Service Provider allows Brute Force. This issue affects SAML SSO - Service Provider… | |
| CVE-2026-87947 | 22 Oct 2026 | CVSS 4.8 | Drupal SAML SSO - Service ProviderImproper Verification of Cryptographic Signature vulnerability in Drupal SAML SSO - Service Provider allows Signature Spoof. This issue affects SAML… | |
| CVE-2026-87948 | 22 Oct 2026 | CVSS 3.5 | Drupal SAML SSO - Service ProviderImproper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal SAML SSO - Service Provider allows… | |
| CVE-2026-87949 | 22 Oct 2026 | CVSS 3.3 | Drupal SAML SSO - Service ProviderImproper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal SAML SSO - Service Provider allows… | |
| CVE-2026-87950 | 22 Oct 2026 | CVSS 5.3 | Drupal SAML SSO - Service ProviderUse of Hard-coded Credentials vulnerability in Drupal SAML SSO - Service Provider allows Retrieve Embedded Sensitive Data. This issue affects SAML… | |
| CVE-2026-87951 | 22 Oct 2026 | CVSS 3.8 | Drupal SAML SSO - Service ProviderInsecure Storage of Sensitive Information vulnerability in Drupal SAML SSO - Service Provider allows Retrieve Embedded Sensitive Data. This issue… | |
| CVE-2026-87952 | 22 Oct 2026 | CVSS 3.1 | Drupal SAML SSO - Service ProviderAuthentication Bypass by Capture-replay vulnerability in Drupal SAML SSO - Service Provider allows Remote Services with Stolen Credentials. This… | |
| CVE-2026-87936 | 22 Oct 2026 | CVSS 6.5 | Drupal amazee.ai Private AI ProviderImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal amazee.ai Private AI Provider allows SQL… | |
| CVE-2026-87937 | 22 Oct 2026 | CVSS 6.5 | Drupal Central Authentication System (CAS) ServerURL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal Central Authentication System (CAS) Server allows Fake the Source of… | |
| CVE-2026-87938 | 22 Oct 2026 | Not scored yet | Drupal CSP logImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal CSP log allows SQL Injection. This issue… | |
| CVE-2026-87939 | 22 Oct 2026 | CVSS 4.2 | Drupal Feed BlockImproper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Feed Block allows Stored XSS. This issue… | |
| CVE-2026-87940 | 22 Oct 2026 | CVSS 5.4 | Drupal Key authUse of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Key auth allows Exploiting Incorrectly Configured Access Control… | |
| CVE-2026-87941 | 22 Oct 2026 | Not scored yet | Drupal PatreonVulnerability in Drupal Patreon. This issue affects Patreon versions: 7.x. | |
| CVE-2026-87942 | 22 Oct 2026 | CVSS 4.6 | Drupal SafeDeleteImproper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal SafeDelete allows Stored XSS. This issue… | |
| CVE-2026-87943 | 22 Oct 2026 | CVSS 6.5 | Drupal SAML SSO - Service ProviderMissing Authorization vulnerability in Drupal SAML SSO - Service Provider allows Forceful Browsing. This issue affects SAML SSO - Service Provider… | |
| CVE-2026-87944 | 22 Oct 2026 | CVSS 4.8 | Drupal SAML SSO - Service ProviderImproper Certificate Validation vulnerability in Drupal SAML SSO - Service Provider allows Adversary in the Middle (AiTM). This issue affects SAML… | |
| CVE-2026-84916 | 22 Oct 2026 | CVSS 3.7 | Drupal IslandoraMissing Authorization vulnerability in Drupal Islandora allows Forceful Browsing. This issue affects Islandora versions: from 0.0.0 to 2.19.0. | |
| CVE-2026-84917 | 22 Oct 2026 | CVSS 6.5 | Drupal Jsonapi Role AccessIncorrect Authorization vulnerability in Drupal Jsonapi Role Access allows Forceful Browsing. This issue affects Jsonapi Role Access versions: from… | |
| CVE-2026-84918 | 22 Oct 2026 | CVSS 3.7 | Drupal Monobank payment APIImproper Verification of Cryptographic Signature vulnerability in Drupal Monobank payment API allows Signature Spoof. This issue affects Monobank… | |
| CVE-2026-84919 | 22 Oct 2026 | CVSS 4.6 | Drupal PhotoSwipe - Responsive JavaScript Modal Image GalleryImproper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal PhotoSwipe - Responsive JavaScript Modal… | |
| CVE-2026-84920 | 22 Oct 2026 | CVSS 5.3 | Drupal Unpublished Node PermissionsIncorrect Authorization vulnerability in Drupal Unpublished Node Permissions allows Forceful Browsing. This issue affects Unpublished Node… | |
| CVE-2026-84921 | 22 Oct 2026 | CVSS 5.3 | Drupal Webform Submissions DeleteMissing Authorization vulnerability in Drupal Webform Submissions Delete allows Forceful Browsing. This issue affects Webform Submissions Delete… | |
| CVE-2026-84923 | 22 Oct 2026 | CVSS 6.5 | Drupal Email Verification / SMS Verification / OTP VerificationAuthentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Email Verification / SMS Verification / OTP Verification allows… | |
| CVE-2026-84924 | 22 Oct 2026 | CVSS 5.4 | Drupal Email Verification / SMS Verification / OTP VerificationImproper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Email Verification / SMS Verification /… | |
| CVE-2026-16648 | 22 Oct 2026 | CVSS 3.8 | Drupal Mailer Plus LogInsertion of Sensitive Information into Log File vulnerability in Drupal Mailer Plus Log allows Remote Services with Stolen Credentials. This issue… | |
| CVE-2026-81163 | 22 Oct 2026 | CVSS 5.4 | Drupal Media Library ImporterImproper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Drupal Media Library Importer allows Path Traversal… | |
| CVE-2026-84910 | 22 Oct 2026 | CVSS 4.2 | Drupal Advanced SearchMissing Authorization vulnerability in Drupal Advanced Search allows Forceful Browsing. This issue affects Advanced Search versions: from 0.0.0 to… | |
| CVE-2026-84911 | 22 Oct 2026 | CVSS 3.1 | Drupal AI (Artificial Intelligence)Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows… | |
| CVE-2026-84912 | 22 Oct 2026 | CVSS 4.6 | Drupal AI (Artificial Intelligence)Missing Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Forceful Browsing. This issue affects AI (Artificial Intelligence)… | |
| CVE-2026-84913 | 22 Oct 2026 | CVSS 4.6 | Drupal AI TranslateMissing Authorization vulnerability in Drupal AI Translate allows Forceful Browsing. This issue affects AI Translate versions: from 0.0.0 to 1.3.2… | |
| CVE-2026-84914 | 22 Oct 2026 | CVSS 5.3 | Drupal Calculate Working DaysMissing Authorization vulnerability in Drupal Calculate Working Days allows Forceful Browsing. This issue affects Calculate Working Days versions… | |
| CVE-2026-84915 | 22 Oct 2026 | CVSS 4.6 | Drupal Component blocksImproper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Component blocks allows Stored XSS. This… | |
| CVE-2026-9082 | 20 May 2026 | CVSS 9.8 | Drupal Core SQL InjectionImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Drupal core allows SQL Injection. This… | ExploitedFix |
| CVE-2020-36193 | 18 Jan 2021 | CVSS 7.5 | PEAR Archive_Tar Improper Link ResolutionTar.php in Archive_Tar through 1.4.11 allows write operations with Directory Traversal due to inadequate checking of symbolic links, a related issue… | ExploitedFix |
| CVE-2020-13671 | 20 Nov 2020 | CVSS 8.8 | Drupal core Un-restricted Upload of FileDrupal core does not properly sanitize certain filenames on uploaded files, which can lead to files being interpreted as the incorrect extension and… | Exploited |
| CVE-2020-28949 | 19 Nov 2020 | CVSS 7.8 | PEAR Archive_Tar Deserialization of Untrusted DataArchive_Tar through 1.4.10 has :// filename sanitization only to address phar attacks, and thus any other stream-wrapper attack (such as file:// to… | Exploited |
| CVE-2019-6340 | 21 Feb 2019 | CVSS 8.1 | Drupal Core Remote Code ExecutionSome field types do not properly sanitize data from non-form sources in Drupal 8.5.x before 8.5.11 and Drupal 8.6.x before 8.6.10. This can lead to… | ExploitedFix |
| CVE-2018-7602 | 19 Jul 2018 | CVSS 9.8 | Drupal Core Remote Code ExecutionA remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple… | ExploitedFix |
| CVE-2018-7600 | 29 Mar 2018 | CVSS 9.8 | Drupal Core Remote Code ExecutionDrupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because of an… | ExploitedFix |