Drupal vulnerabilities
Published CVEs affecting Drupal products: 180 record(s), with severity, exploitation and fixes.
Drupal 22Drupal core 19AI (Artificial Intelligence) 4Drupal Canvas 4Tagify 3Disable Login Page 3OpenID Connect / OAuth client 3Gammu SMS Daemon 3Anti-Spam by CleanTalk 2CivicTheme Design System 2Facets 2Login Disable 2SAML SSO - Service Provider 2File Access Fix (deprecated) 2Advanced Content Feedback (aka admin feedback) 2AI Agents 2Paragraphs 2FlowDrop 2Screenshot 2UI Icons 1Internationalization (i18n) - i18n node submodule 1Responsive Favicons 1Theme Negotiation by Rules 1Google Analytics GA4 1Access code 1Acquia DAM 1Owl Carousel 2 1HTTP Client Manager 1Drupal Commerce Paybox 1Mini site 1CKEditor 5 Premium Features 1Login Time Restriction 1Next.js 1Entity Share 1Acquia Content Hub 1Quick Edit 1Translate Drupal with GTranslate 1Date iCal 1Node View Permissions 1Colorbox Inline 1
CVE-2026-16647
Medium · 4.1
CWE-288 Sep 2, 2026
Disable Login Page - Moderately critical - Access bypass - SA-CONTRIB-2026-111
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Disable Login Page allows Functionality Bypass. This issue affects Disable Login Page versions: from 0.0.0 to 1.1.4.
CVE-2026-55805
Medium · 5.4
CWE-79 Aug 25, 2026
Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-012
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Stored XSS. This issue affects Drupal core versions: from 0.0.0 to 10.6.13, from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, from 0.0.0 to 11.0.*, from 0.0.0 to 11.1.*, from 0.0.0 to 11.2.*.
CVE-2026-18985
High · 8.1
CWE-863 Aug 25, 2026
Edit in-place field - Moderately critical - Access bypass - SA-CONTRIB-2026-093
Incorrect Authorization vulnerability in Drupal Edit in-place field allows Forceful Browsing. This issue affects Edit in-place field versions: from 0.0.0 to 2.1.1.
CVE-2026-18261
Medium · 5.7
CWE-20 Aug 25, 2026
Powerful Surveys - Critical - Unsupported - SA-CONTRIB-2026-092
Vulnerability in Drupal Powerful Surveys. This issue affects Powerful Surveys versions: *.*.
CVE-2026-18260
Medium · 5.7
CWE-307 Aug 25, 2026
Disable Login Page - Moderately critical - Access bypass - SA-CONTRIB-2026-110
Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Disable Login Page allows Brute Force. This issue affects Disable Login Page versions: from 0.0.0 to 1.1.4.
CVE-2026-18259
High · 7.5
CWE-208 Aug 25, 2026
Token Content Access - Moderately critical - Access bypass - SA-CONTRIB-2026-090
Observable Timing Discrepancy vulnerability in Drupal Token Content Access allows Brute Force. This issue affects Token Content Access versions: from 0.0.0 to 3.1.2.
CVE-2026-16646
Medium · 5.7
CWE-306 Aug 25, 2026
PanKM - Critical - Unsupported - SA-CONTRIB-2026-083
Vulnerability in Drupal PanKM. This issue affects PanKM versions: *.*.
CVE-2026-16645
Critical · 9.1
CWE-862 Aug 25, 2026
PhotoSwipe - Responsive JavaScript Modal Image Gallery - Moderately critical - Access bypass - SA-CONTRIB-2026-088
Missing Authorization vulnerability in Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery allows Forceful Browsing. This issue affects PhotoSwipe - Responsive JavaScript Modal Image Gallery versions: from 0.0.0 to 3.2.0.
CVE-2026-16644
Critical · 9.1
CWE-863 Aug 25, 2026
Webform REST - Moderately critical - Access bypass - SA-CONTRIB-2026-087
Incorrect Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. This issue affects Webform REST versions: from 0.0.0 to 4.1.0.
CVE-2026-16643
Medium · 5.7
CWE-20 Aug 25, 2026
Lunr exposed filters - Critical - Unsupported - SA-CONTRIB-2026-086
Vulnerability in Drupal Lunr exposed filters. This issue affects Lunr exposed filters versions: *.*.
CVE-2026-16642
Medium · 5.7
CWE-20 Aug 25, 2026
Email Login OTP - Critical - Unsupported - SA-CONTRIB-2026-085
Vulnerability in Drupal Email Login OTP. This issue affects Email Login OTP versions: *.*.
CVE-2026-16641
Critical · 9.8
CWE-20 Aug 25, 2026
Commerce Elavon - Critical - Unsupported - SA-CONTRIB-2026-084
Vulnerability in Drupal Commerce Elavon. This issue affects Commerce Elavon versions: *.*.
CVE-2026-16640
Medium · 6.1
CWE-79 Aug 25, 2026
Search API Autocomplete - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-082
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Search API Autocomplete allows Reflected XSS. This issue affects Search API Autocomplete versions: from 0.0.0 to 1.12.0.
CVE-2026-16639
Critical · 9.8
CWE-288 Aug 25, 2026
Internationalization Single Sign-On - Critical - Access bypass - SA-CONTRIB-2026-081
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Internationalization Single Sign-On allows Authentication Bypass. This issue affects Internationalization Single Sign-On versions: from 0.0.0 to 1.8.0.
CVE-2026-16638
Medium · 6.1
CWE-79 Aug 25, 2026
Media Folders - Moderately critical - Cross site scripting - SA-CONTRIB-2026-080
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Media Folders allows Stored XSS. This issue affects Media Folders versions: from 0.0.0 to 1.0.8.
CVE-2026-15917
Medium · 4.7
CWE-79 Aug 25, 2026
Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-011
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Drupal core versions: from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, from 0.0.0 to 11.2.*.
CVE-2026-15916
Medium · 4.2
CWE-862 Aug 25, 2026
Drupal core - Moderately critical - Information disclosure - SA-CORE-2026-010
Missing Authorization vulnerability in Drupal Drupal core allows Forceful Browsing. This issue affects Drupal core versions: from 0.0.0 to 10.6.13, from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, from 0.0.0 to 11.0.*, from 0.0.0 to 11.1.*, from 0.0.0 to 11.2.*.
CVE-2026-15088
Medium · 5.7
CWE-20 Aug 25, 2026
Development Environment - Critical - Unsupported - SA-CONTRIB-2026-089
Vulnerability in Drupal Development Environment. This issue affects Development Environment versions: *.*.
CVE-2026-15089
Critical · 9.1
CWE-287 Jul 10, 2026
Commerce guest registration - Critical - Unsupported - SA-CONTRIB-2026-079
Vulnerability in Drupal Commerce guest registration. This issue affects Commerce guest registration versions: *.*.
CVE-2026-15087
Medium · 5.9
CWE-287 Jul 10, 2026
Clean RESTful - Critical - Unsupported - SA-CONTRIB-2026-078
vulnerability in Drupal Clean RESTful allows . This issue affects Clean RESTful versions: *.*.
CVE-2026-15086
Medium · 5.9
Jul 10, 2026
Raw Formatter [Meta Tag Formatter] - Critical - Unsupported - SA-CONTRIB-2026-077
vulnerability in Drupal Raw Formatter [Meta Tag Formatter] allows . This issue affects Raw Formatter [Meta Tag Formatter] versions: *.*.
CVE-2026-11915
Medium · 5.9
CWE-307 Jul 10, 2026
Brute force attack protection - Critical - Unsupported - SA-CONTRIB-2026-047
vulnerability in Drupal Brute force attack protection allows . This issue affects Brute force attack protection versions: *.*.
CVE-2026-11914
Medium · 5.9
CWE-20 Jul 10, 2026
Composer - Critical - Unsupported - SA-CONTRIB-2026-046
vulnerability in Drupal Composer allows . This issue affects Composer versions: *.*.
CVE-2026-11913
Critical · 9.8
CWE-79 Jul 10, 2026
Mother May I - Critical - Unsupported - SA-CONTRIB-2026-045
vulnerability in Drupal Mother May I allows . This issue affects Mother May I versions: *.*.
CVE-2026-58591
Medium · 5.4
CWE-79 Jul 10, 2026
Colorbox - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-069
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Colorbox allows Cross-Site Scripting (XSS). This issue affects Colorbox versions: from 0.0.0 to 2.1.5, from 0.0.0 to 2.2.0.